The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		May 21, 2026 6:01pm

PR Summary

Medium Risk
Touches several request/response handling paths (file parsing/uploads, CSV imports, media tools) and execution log persistence, so regressions could affect uploads/downloads and tooling reliability despite being primarily defensive size-limit work.

Overview
Introduces a new stream-limits utility (with tests) and wires it through file parsing, uploads, CSV import routes, and multiple tool proxy endpoints to preflight Content-Length, cap streamed reads, and return 413s instead of materializing oversized payloads.

Updates files/parse to validate file reference shape, cap per-request multi-file parsed output (and per-file remaining download bytes), and enforce download/parsed-output limits across external, cloud, and local sources.

Refactors retention job dispatch to page active workspaces (avoiding loading all into memory), adds per-job concurrencyKey, and scopes log cleanup key-reference checks by workspace.

Adds execution-log compaction to keep stored executionData under ~500KB by summarizing large inputs/outputs and persisting size/truncation metadata.

^{Reviewed by Cursor Bugbot for commit 0b28132. Configure here.}

Greptile Summary

This PR introduces a new stream-limits.ts utility module providing safe stream/response reading with byte-cap enforcement (PayloadSizeLimitError), and applies it broadly across file parsing, tool execution, storage downloads, and HTTP request handling. It also fixes the cleanup-logs workspace scoping (narrowing the large-value reference check to the batch's own workspace IDs) and refactors the cleanup dispatcher to paginate active-workspace queries instead of loading all rows at once.

• Stream size limits: New readStreamToBufferWithLimit, readResponseToBufferWithLimit, and related helpers are wired into tool response reading, DocuSign document downloads, Google Slides exports, file parsing routes, Blob/S3 downloads, and HTTP request tool responses, each with appropriate per-context byte caps.
• Cleanup-logs query scoping: Reference check for large-value storage keys is now scoped to workspace_id = ANY(workspaceIds), avoiding a full-table scan and correctly reflecting that storage keys are workspace-local UUIDs.
• Execution log compaction: ExecutionLogger now summarizes oversized executionData payloads through a three-tier fallback (summarize → minimal → metadata-only) before persisting, preventing large logs from exceeding the 500 KB stored-payload cap.
• Cleanup dispatcher pagination: buildCleanupChunks now uses cursor-based pages (WORKSPACE_SCOPE_PAGE_SIZE = 500) rather than a single unbounded query, and maintains chunkCountByPlan across pages for globally unique chunk labels.

Confidence Score: 4/5

The stream-limiting changes are generally safe to merge; the cleanup dispatcher still carries previously flagged unresolved concerns around execution order and sequential enqueue performance.

The core stream-limit plumbing is well-structured and the cleanup-logs workspace scoping is correct. The previously noted issues in cleanup-dispatcher.ts (inline-runner precedence inversion, sequential chunk enqueue, always-extra housekeeping chunk) remain in the code and affect production cleanup job behavior.

apps/sim/lib/billing/cleanup-dispatcher.ts warrants another pass; apps/sim/lib/core/utils/stream-limits.ts has the body-already-read risk on the arrayBuffer→text fallback path.

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Tool Request] --> B{Internal Route?}
    B -- Yes --> C[fetch internal URL]
    B -- No --> D[secureFetchWithPinnedIP\nwith maxResponseBytes]
    C --> E{nullBody or\nshouldRetryWithout\nReadingBody?}
    D --> F{nullBody or\nshouldRetryWithout\nReadingBody?}
    E -- Yes --> G[cancel body\nResponse null]
    E -- No --> H[readToolResponseBody\nmax 10MB]
    F -- Yes --> I[cancel body\nResponse null]
    F -- No --> J[readToolResponseBody\nmax 10MB]
    G --> K{Retryable & not\nlast attempt?}
    I --> K
    H --> K
    J --> K
    K -- Yes --> L[sleep & retry]
    L --> B
    K -- No --> M{response.ok?}
    M -- No --> N[Parse error body\nfrom buffered response]
    M -- Yes --> O[Build success result]
    H -- PayloadSizeLimitError --> P[handleResponseSizeLimitError\nuser-friendly message]
    J -- PayloadSizeLimitError --> P

_{Reviews (3): Last reviewed commit: "address comments" | Re-trigger Greptile}

@greptile

bugbot run

@greptile

bugbot run