fix(copilot): surface document render failures - #6629

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 12, 2026 6:30pm

PR Summary

Low Risk
Copilot tool signaling only; provenance and secret checks run before surfacing dynamic read errors. No auth or data-model changes.

Overview
Document render and validation failures now fail vfs_read instead of returning success with {ok:false} JSON, so the file agent sees the real compiler/renderer message instead of treating the read as successful.

FileReadResult gains an optional error field. Workspace VFS dynamic reads (especially /render) populate it via a shared renderErrorResult helper for size limits, unsupported types, missing sandbox tasks, and caught exceptions—still inside the provenance envelope. executeVfsRead returns { success: false, error } only after secret provenance checks pass; if provenance cannot be verified, the generic safe-sharing error is returned and the underlying render error is not leaked.

Tests cover the VFS handler boundary and WorkspaceVFS render error paths.

^{Reviewed by Cursor Bugbot for commit 3ad89f2. Bugbot is set up for automated code reviews on this repo. Configure here.}

Greptile Summary

The PR changes document-render failures from successful VFS responses containing error JSON into failed tool calls, while retaining workspace-file provenance validation before detailed errors are returned.

• Adds an optional dynamic-read error field to the VFS read-result contract.
• Propagates render exceptions through the workspace VFS and converts them into failed vfs_read calls.
• Adds coverage for render failures and blocked provenance.

Confidence Score: 5/5

The PR appears safe to merge.

The previously reported provenance bypass is fixed: render failures associated with resolved workspace files retain their identity and undergo provenance validation before the detailed error is returned, with a generic safe failure used when validation fails.

sequenceDiagram
  participant Agent as File Agent
  participant Handler as executeVfsRead
  participant VFS as WorkspaceVFS
  participant Renderer as Document Renderer
  participant Provenance as Provenance Gate
  Agent->>Handler: vfs_read(/render)
  Handler->>VFS: readFileContentWithProvenance
  VFS->>Renderer: render document
  Renderer-->>VFS: throw render error
  VFS-->>Handler: bound file identity + error result
  Handler->>Provenance: validate derived model view
  alt provenance accepted
    Provenance-->>Handler: allowed
    Handler-->>Agent: failed tool call with render error
  else provenance unavailable
    Provenance-->>Handler: denied
    Handler-->>Agent: failed tool call with generic safe error
  end

_{Reviews (2): Last reviewed commit: "Address PR review feedback (#6629)" | Re-trigger Greptile}

This PR should not merge until failed render results pass the same workspace-file provenance validation as successful reads.

Addressed in b893927: detailed render errors now pass the existing workspace-file provenance gate before reaching the model, and a regression test covers provenance-blocked error envelopes.

@greptile

@cursor review