fix(files): finish the render cancellation and failure-surfacing edges

- Race the E2B render against the caller's signal too. Only the isolated-vm
  branch did, so an aborted request on the E2B path waited for the sandbox to
  finish and could return a success the caller no longer wanted.
- Attach a terminal handler to the shared render. Every caller races it against
  its own signal, so all of them can walk away; a later rejection with no waiters
  left would otherwise surface as an unhandled rejection.
- Stop narrowing what throwOnDocNotReady rethrows. readUserFileContent now runs
  document compiles and can fail in ways this module has no business
  enumerating; narrowing produced three consecutive review rounds of "this
  particular failure is still swallowed". The flag means "do not degrade".
- Do not mark an unrendered response immutable. The serve route caches versioned
  responses for a year, which would pin a one-off render failure to that URL long
  after a later compile succeeds on the same version.

Author: j15z

apps/sim/app/api/files/serve/[...path]/route.ts

@@ -37,7 +37,7 @@ async function compileDocumentIfNeeded(
   raw: boolean,
   ownerKey: string | undefined,
   signal: AbortSignal | undefined
-): Promise<{ buffer: Buffer; contentType: string }> {
+): Promise<{ buffer: Buffer; contentType: string; unrendered?: boolean }> {
   if (raw) return { buffer, contentType: getContentType(filename) }
   return resolveServableDocBytes({
     rawBuffer: buffer,
@@ -67,6 +67,10 @@ const WORKSPACE_REVALIDATE_CACHE_CONTROL = 'private, no-cache, must-revalidate'
  * bumps on every edit — so the browser may cache it indefinitely; re-opens and
  * focus refetches then resolve from cache with no round trip. Unversioned workspace
  * reads stay revalidated because the same storage key is edited in place.
+ *
+ * Callers pass `versioned && !unrendered`: a render that failed returns the stored
+ * bytes as opaque data, and marking that immutable for a year would pin the failure
+ * to the URL long after a later compile succeeds on the same version.
  */
 function resolveServeCacheControl(
   versioned: boolean,
@@ -195,22 +199,19 @@ async function handleLocalFile(
     const segment = filename.split('/').pop() || filename
     const displayName = stripStorageKeyPrefix(segment)
     const workspaceId = getWorkspaceIdForCompile(filename)
-    const { buffer: fileBuffer, contentType } = await compileDocumentIfNeeded(
-      rawBuffer,
-      displayName,
-      workspaceId,
-      raw,
-      ownerKey,
-      signal
-    )
+    const {
+      buffer: fileBuffer,
+      contentType,
+      unrendered,
+    } = await compileDocumentIfNeeded(rawBuffer, displayName, workspaceId, raw, ownerKey, signal)
 
     logger.info('Local file served', { userId, filename, size: fileBuffer.length })
 
     return createFileResponse({
       buffer: fileBuffer,
       contentType,
       filename: displayName,
-      cacheControl: resolveServeCacheControl(versioned, contextParam),
+      cacheControl: resolveServeCacheControl(versioned && !unrendered, contextParam),
     })
   } catch (error) {
     logger.error('Error reading local file:', error)
@@ -257,14 +258,11 @@ async function handleCloudProxy(
     const segment = cloudKey.split('/').pop() || 'download'
     const displayName = stripStorageKeyPrefix(segment)
     const workspaceId = getWorkspaceIdForCompile(cloudKey)
-    const { buffer: fileBuffer, contentType } = await compileDocumentIfNeeded(
-      rawBuffer,
-      displayName,
-      workspaceId,
-      raw,
-      ownerKey,
-      signal
-    )
+    const {
+      buffer: fileBuffer,
+      contentType,
+      unrendered,
+    } = await compileDocumentIfNeeded(rawBuffer, displayName, workspaceId, raw, ownerKey, signal)
 
     logger.info('Cloud file served', {
       userId,
@@ -277,7 +275,7 @@ async function handleCloudProxy(
       buffer: fileBuffer,
       contentType,
       filename: displayName,
-      cacheControl: resolveServeCacheControl(versioned, context),
+      cacheControl: resolveServeCacheControl(versioned && !unrendered, context),
     })
   } catch (error) {
     logger.error('Error downloading from cloud storage:', error)

apps/sim/lib/copilot/tools/server/files/doc-compile.ts

@@ -541,6 +541,11 @@ function coalesceRender(
   const existing = inFlightRenders.get(key)
   if (existing) return existing
   const started = run().finally(() => inFlightRenders.delete(key))
+  // Every caller races this against its own signal, so all of them can walk away
+  // before it settles. Attach a terminal handler so a later rejection with no
+  // waiters left is not reported as an unhandled rejection — callers still observe
+  // it through their own reference.
+  started.catch(() => {})
   inFlightRenders.set(key, started)
   return started
 }
@@ -675,7 +680,11 @@ export async function resolveServableDocBytes(args: {
     // (content-addressed), so racing a still-running write-time compile is wasteful
     // but correct.
     try {
-      return await coalesceRender(renderKey, () => compileDoc({ source, fileName, workspaceId }))
+      // Same shape as the isolated-vm branch below: the shared run carries no
+      // caller's signal, and each caller races its own so an aborting reader gives
+      // up promptly without cancelling the render for everyone else.
+      const shared = coalesceRender(renderKey, () => compileDoc({ source, fileName, workspaceId }))
+      return await (signal ? Promise.race([shared, rejectOnAbort(signal)]) : shared)
     } catch (error) {
       // Only a script error is deterministic — the same bytes will never render, so
       // remembering that is safe. Infra failures (sandbox create/timeout, S3, an

apps/sim/lib/uploads/utils/user-file-base64.server.ts

@@ -27,7 +27,6 @@ import {
   ExecutionResourceLimitError,
   isExecutionResourceLimitError,
 } from '@/lib/execution/resource-errors'
-import { UnrenderableDocumentError } from '@/lib/uploads/utils/file-utils'
 import type { UserFile } from '@/executor/types'
 
 const INLINE_BASE64_JSON_OVERHEAD_BYTES = 512 * 1024
@@ -444,23 +443,15 @@ async function resolveBase64(
     // already-finished result opt out, so a late compile cannot retroactively
     // fail completed work.
     if (options.throwOnDocNotReady) {
-      // This caller cannot use a file without content, so any reason the bytes are
-      // missing must reach it verbatim. Degrading to null here is what produced the
-      // misleading "may exceed size limit or no longer accessible" message for a
-      // document that was actually still compiling, or one whose stored bytes are
-      // not the format its name claims.
+      // This caller cannot use a file without content, so every failure reaches it
+      // verbatim — still compiling, unrenderable, a sandbox outage, a storage error.
       //
-      // Imported lazily: `servable-file-response` pulls in the doc-compile module
-      // graph (remote sandbox, sandbox task runner, execution limits), and a static
-      // import here would load all of it for every hydration consumer — mirroring
-      // the deliberate dynamic import in file-utils.server.ts.
-      if (error instanceof UnrenderableDocumentError) {
-        throw error
-      }
-      const { isDocNotReadyError } = await import('@/lib/uploads/utils/servable-file-response')
-      if (isDocNotReadyError(error)) {
-        throw error
-      }
+      // Deliberately not narrowed to specific error classes. Doing that produced
+      // three consecutive rounds of "this particular failure is still swallowed",
+      // because `readUserFileContent` now runs document compiles and can fail in
+      // ways this module has no business enumerating. The flag means "do not
+      // degrade", not "do not degrade for the failures we thought of".
+      throw error
     }
     logger.warn(`[${requestId}] Failed to hydrate base64 for ${file.name}`, error)
     return null