fix(security): close glob translation fail-opens and zip guard bypasses

Glob matcher (RE2 translation layer):
- reject picomatch escape passthrough (\A, \z, \p{L}) that RE2 reads as
  anchors and Unicode classes, bypassing the dot:false guarantee
- reject character-class ranges straddling the private-use segment markers
- restore negated (!) glob semantics instead of silently matching nothing
- parse zero-padded repeat bounds numerically

Zip guard:
- scan the whole buffer for EOCD candidates, matching JSZip and SheetJS
  rather than the spec window
- treat a resolvable-but-empty central directory as unverifiable
- keep stray EOCD byte sequences in non-ZIP documents a no-op so the
  OLE2 and plaintext fallbacks still run
- bound central-directory scanning with a shared record budget

Redaction:
- fix quadratic acronym-boundary backtracking (73s to 1ms at 400k chars)

Author: waleedlatif1

apps/sim/app/api/tools/video/route.test.ts

@@ -57,6 +57,17 @@ function videoResponse() {
   }
 }
 
+function errorResponse(status: number) {
+  return {
+    ok: false,
+    status,
+    headers: { get: () => null },
+    body: null,
+    text: async () => 'denied',
+    arrayBuffer: async () => new ArrayBuffer(0),
+  }
+}
+
 const baseBody = {
   provider: 'falai',
   apiKey: 'fal-key',
@@ -134,3 +145,192 @@ describe('POST /api/tools/video (Fal.ai queue)', () => {
     ])
   })
 })
+
+/**
+ * Runway, Veo, Luma and MiniMax all download the finished asset through
+ * `downloadVideoFromUrl` (the SSRF-guarded client), each with its own label and
+ * error prefix. These cover that plumbing per provider.
+ */
+describe('POST /api/tools/video (provider download paths)', () => {
+  const fetchMock = vi.fn()
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.stubGlobal('fetch', fetchMock)
+    hybridAuthMockFns.mockCheckInternalAuth.mockResolvedValue({
+      success: true,
+      userId: 'user-1',
+      authType: 'internal_jwt',
+    })
+    mockValidateUrlWithDNS.mockResolvedValue({ isValid: true, resolvedIP: '8.8.8.8' })
+    mockUploadFile.mockResolvedValue({ path: '/api/files/serve/video.mp4' })
+  })
+
+  function apiResponse(payload: unknown) {
+    return new Response(JSON.stringify(payload), { status: 200 })
+  }
+
+  function veoFetches(uri: string) {
+    fetchMock.mockResolvedValueOnce(apiResponse({ name: 'operations/op-1' })).mockResolvedValueOnce(
+      apiResponse({
+        done: true,
+        response: { generateVideoResponse: { generatedSamples: [{ video: { uri } }] } },
+      })
+    )
+  }
+
+  it('downloads the Runway asset through the guarded client', async () => {
+    fetchMock
+      .mockResolvedValueOnce(apiResponse({ id: 'task-1' }))
+      .mockResolvedValueOnce(
+        apiResponse({ status: 'SUCCEEDED', output: ['https://cdn.runwayml.test/a.mp4'] })
+      )
+    mockSecureFetchWithPinnedIP.mockResolvedValueOnce(videoResponse())
+
+    const response = await POST(
+      createMockRequest('POST', {
+        provider: 'runway',
+        apiKey: 'runway-key',
+        model: 'gen-4',
+        prompt: 'a cat riding a bike',
+      })
+    )
+
+    expect(response.status).toBe(200)
+    expect(mockSecureFetchWithPinnedIP).toHaveBeenCalledTimes(1)
+    expect(mockSecureFetchWithPinnedIP.mock.calls[0][0]).toBe('https://cdn.runwayml.test/a.mp4')
+    expect(mockSecureFetchWithPinnedIP.mock.calls[0][2].headers).toBeUndefined()
+  })
+
+  it('surfaces the default download error prefix when the Runway asset fetch fails', async () => {
+    fetchMock
+      .mockResolvedValueOnce(apiResponse({ id: 'task-1' }))
+      .mockResolvedValueOnce(
+        apiResponse({ status: 'SUCCEEDED', output: ['https://cdn.runwayml.test/a.mp4'] })
+      )
+    mockSecureFetchWithPinnedIP.mockResolvedValueOnce(errorResponse(401))
+
+    const response = await POST(
+      createMockRequest('POST', {
+        provider: 'runway',
+        apiKey: 'runway-key',
+        model: 'gen-4',
+        prompt: 'a cat riding a bike',
+      })
+    )
+
+    expect(response.status).toBe(500)
+    expect((await response.json()).error).toBe('Failed to download video: 401')
+  })
+
+  it('downloads the Luma asset through the guarded client', async () => {
+    fetchMock
+      .mockResolvedValueOnce(apiResponse({ id: 'gen-1' }))
+      .mockResolvedValueOnce(
+        apiResponse({ state: 'completed', assets: { video: 'https://cdn.lumalabs.test/a.mp4' } })
+      )
+    mockSecureFetchWithPinnedIP.mockResolvedValueOnce(videoResponse())
+
+    const response = await POST(
+      createMockRequest('POST', {
+        provider: 'luma',
+        apiKey: 'luma-key',
+        model: 'ray-2',
+        prompt: 'a cat riding a bike',
+      })
+    )
+
+    expect(response.status).toBe(200)
+    expect(mockSecureFetchWithPinnedIP.mock.calls[0][0]).toBe('https://cdn.lumalabs.test/a.mp4')
+    expect(mockSecureFetchWithPinnedIP.mock.calls[0][2].headers).toBeUndefined()
+  })
+
+  it('keeps the MiniMax-specific download error prefix', async () => {
+    fetchMock
+      .mockResolvedValueOnce(apiResponse({ base_resp: { status_code: 0 }, task_id: 'task-1' }))
+      .mockResolvedValueOnce(
+        apiResponse({ base_resp: { status_code: 0 }, status: 'Success', file_id: 'file-1' })
+      )
+      .mockResolvedValueOnce(
+        apiResponse({ file: { download_url: 'https://cdn.minimax.test/a.mp4' } })
+      )
+    mockSecureFetchWithPinnedIP.mockResolvedValueOnce(errorResponse(401))
+
+    const response = await POST(
+      createMockRequest('POST', {
+        provider: 'minimax',
+        apiKey: 'minimax-key',
+        model: 'hailuo-2.3',
+        prompt: 'a cat riding a bike',
+      })
+    )
+
+    expect(response.status).toBe(500)
+    expect((await response.json()).error).toBe('Failed to download video from URL: 401')
+  })
+
+  it('downloads the MiniMax asset through the guarded client', async () => {
+    fetchMock
+      .mockResolvedValueOnce(apiResponse({ base_resp: { status_code: 0 }, task_id: 'task-1' }))
+      .mockResolvedValueOnce(
+        apiResponse({ base_resp: { status_code: 0 }, status: 'Success', file_id: 'file-1' })
+      )
+      .mockResolvedValueOnce(
+        apiResponse({ file: { download_url: 'https://cdn.minimax.test/a.mp4' } })
+      )
+    mockSecureFetchWithPinnedIP.mockResolvedValueOnce(videoResponse())
+
+    const response = await POST(
+      createMockRequest('POST', {
+        provider: 'minimax',
+        apiKey: 'minimax-key',
+        model: 'hailuo-2.3',
+        prompt: 'a cat riding a bike',
+      })
+    )
+
+    expect(response.status).toBe(200)
+    expect(mockSecureFetchWithPinnedIP.mock.calls[0][0]).toBe('https://cdn.minimax.test/a.mp4')
+  })
+
+  it('attaches the Veo API key only for a genuine https Google API host', async () => {
+    veoFetches('https://generativelanguage.googleapis.com/v1beta/files/a:download')
+    mockSecureFetchWithPinnedIP.mockResolvedValueOnce(videoResponse())
+
+    const response = await POST(
+      createMockRequest('POST', {
+        provider: 'veo',
+        apiKey: 'veo-key',
+        model: 'veo-3',
+        prompt: 'a cat riding a bike',
+      })
+    )
+
+    expect(response.status).toBe(200)
+    expect(mockSecureFetchWithPinnedIP.mock.calls[0][2].headers).toEqual({
+      'x-goog-api-key': 'veo-key',
+    })
+  })
+
+  it.each([
+    ['a suffix-spoofed host', 'https://evil.googleapis.com.attacker.test/a.mp4'],
+    ['a prefix-spoofed host', 'https://xgoogleapis.com/a.mp4'],
+    ['plaintext http', 'http://generativelanguage.googleapis.com/a.mp4'],
+  ])('withholds the Veo API key for %s', async (_label, uri) => {
+    veoFetches(uri)
+    mockSecureFetchWithPinnedIP.mockResolvedValueOnce(videoResponse())
+
+    const response = await POST(
+      createMockRequest('POST', {
+        provider: 'veo',
+        apiKey: 'veo-key',
+        model: 'veo-3',
+        prompt: 'a cat riding a bike',
+      })
+    )
+
+    expect(response.status).toBe(200)
+    expect(mockSecureFetchWithPinnedIP.mock.calls[0][0]).toBe(uri)
+    expect(mockSecureFetchWithPinnedIP.mock.calls[0][2].headers).toBeUndefined()
+  })
+})

apps/sim/app/api/tools/video/route.ts

@@ -550,6 +550,15 @@ async function generateWithRunway(
   throw new Error('Runway generation timed out')
 }
 
+/** Host of a provider-supplied URI for logging, without leaking the path or query. */
+function safeHostname(url: string): string {
+  try {
+    return new URL(url).host
+  } catch {
+    return 'unparseable'
+  }
+}
+
 /**
  * True when a provider-supplied URI is served by Google. The Veo download URI comes out of
  * the operation status body, so the `x-goog-api-key` credential is only attached when the
@@ -662,9 +671,17 @@ async function generateWithVeo(
         throw new Error('No video URI in response')
       }
 
+      const isGoogleHosted = isGoogleApiHost(videoUri)
+      if (!isGoogleHosted) {
+        logger.warn(
+          `[${requestId}] Veo download URI is not a Google API host; sending the request unauthenticated. A 401 here means the URI host is wrong, not the API key.`,
+          { host: safeHostname(videoUri) }
+        )
+      }
+
       return {
         buffer: await downloadVideoFromUrl(videoUri, 'Veo video', {
-          headers: isGoogleApiHost(videoUri) ? { 'x-goog-api-key': apiKey } : undefined,
+          headers: isGoogleHosted ? { 'x-goog-api-key': apiKey } : undefined,
         }),
         width: dimensions.width,
         height: dimensions.height,

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/file-viewer.tsx

@@ -37,7 +37,7 @@ const PdfViewerCore = dynamic(() => import('./pdf-viewer').then((m) => m.PdfView
  * `lib/pptx-renderer/renderer/chart-renderer`) stays out of every bundle that
  * statically imports this viewer - the Files page, the Home view and the public
  * share page - instead of only the visitors who open a PowerPoint file. The
- * fallback matches {@link PptxPreview}'s own pre-fetch frame, so the chunk load
+ * fallback matches the frame `./pptx-preview` renders while it fetches, so the chunk load
  * and the binary fetch look like one continuous loading state. Rendered inside a
  * {@link PreviewErrorBoundary} so a rejected chunk load degrades to the preview
  * fallback — which offers a page reload, the only way to refetch a chunk whose

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/preview-shared.test.tsx

@@ -84,6 +84,20 @@ describe('PreviewErrorBoundary', () => {
     expect(actionLabels()).toEqual(['Reload page'])
   })
 
+  it('offers a page reload for a failed CSS chunk, whose message omits "Loading chunk"', async () => {
+    const Broken = lazy(() => Promise.reject(new Error('Loading CSS chunk 4821 failed')))
+
+    await render(
+      <PreviewErrorBoundary label='PowerPoint'>
+        <Suspense fallback={<span>loading</span>}>
+          <Broken />
+        </Suspense>
+      </PreviewErrorBoundary>
+    )
+
+    expect(actionLabels()).toEqual(['Reload page'])
+  })
+
   it('renders children when nothing throws', async () => {
     await render(
       <PreviewErrorBoundary label='PowerPoint'>

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/preview-shared.tsx

@@ -28,14 +28,21 @@ export function PreviewError({ label, error, action }: PreviewErrorProps) {
       </p>
       <p className='text-[13px] text-[var(--text-muted)]'>{error}</p>
       {action ? (
-        <Chip className='mt-[4px]' onClick={action.onClick}>
+        <Chip variant='primary' className='mt-[4px]' onClick={action.onClick}>
           {action.label}
         </Chip>
       ) : null}
     </div>
   )
 }
 
+/**
+ * webpack's chunk-load failure messages. The JS form is `Loading chunk 5 failed`
+ * and the stylesheet form is `Loading CSS chunk 5 failed`, so a plain
+ * `Loading chunk` substring test misses every CSS chunk 404.
+ */
+const CHUNK_LOAD_MESSAGE = /Loading (?:CSS )?chunk/
+
 /**
  * A `next/dynamic` / `React.lazy` chunk fetch that rejected. The module system
  * caches the rejection on the lazy component itself, so re-rendering it throws
@@ -45,7 +52,7 @@ function isChunkLoadError(error: Error | undefined): boolean {
   if (!error) return false
   if (error.name === 'ChunkLoadError') return true
   return (
-    error.message.includes('Loading chunk') || error.message.includes('dynamically imported module')
+    CHUNK_LOAD_MESSAGE.test(error.message) || error.message.includes('dynamically imported module')
   )
 }
 

apps/sim/executor/orchestrators/loop.ts

@@ -732,10 +732,8 @@ export class LoopOrchestrator {
             if (lower === 'true' || lower === 'false') {
               return lower
             }
-            /**
-             * Serialized rather than hand-quoted: the value is a block output, so a `"` or
-             * newline would close the literal early and run as code in the condition VM.
-             */
+            // Serialized rather than hand-quoted: the value is a block output, so a `"` or
+            // newline would close the literal early and run as code in the condition VM.
             return JSON.stringify(resolved)
           }
           return JSON.stringify(resolved)

apps/sim/lib/copilot/vfs/document-style.test.ts

@@ -2,7 +2,7 @@
  * @vitest-environment node
  */
 import JSZip from 'jszip'
-import { describe, expect, it } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { extractDocumentStyle } from '@/lib/copilot/vfs/document-style'
 
 const CENTRAL_DIRECTORY_HEADER_SIGNATURE = 0x02014b50
@@ -37,14 +37,56 @@ function forgeDeclaredUncompressedSize(zipBuffer: Buffer, declaredBytes: number)
 }
 
 describe('extractDocumentStyle zip-bomb guard', () => {
+  /**
+   * `extractDocumentStyle` swallows every failure and returns `null`, and a
+   * forged archive is one JSZip rejects on its own — so asserting `null` passes
+   * with the guard deleted. Spying on the decompressor is what actually proves
+   * the buffer never reached it.
+   */
+  let loadAsync: ReturnType<typeof vi.spyOn<typeof JSZip, 'loadAsync'>>
+
+  beforeEach(() => {
+    loadAsync = vi.spyOn(JSZip, 'loadAsync')
+  })
+
+  afterEach(() => {
+    loadAsync.mockRestore()
+  })
+
   it('refuses an archive whose declared expansion exceeds the limit', async () => {
     const bomb = forgeDeclaredUncompressedSize(await buildDocxArchive(), 0xfffffff0)
+
     await expect(extractDocumentStyle(bomb, 'docx')).resolves.toBeNull()
+    expect(loadAsync).not.toHaveBeenCalled()
+  })
+
+  it('refuses a bomb whose EOCD lies about the entry count behind an empty-EOCD decoy', async () => {
+    const bomb = forgeDeclaredUncompressedSize(await buildDocxArchive(), 0xfffffff0)
+    const eocdOffset = bomb.lastIndexOf(Buffer.from([0x50, 0x4b, 0x05, 0x06]))
+    const cdOffset = bomb.readUInt32LE(eocdOffset + 16)
+    const decoy = Buffer.alloc(22)
+    decoy.writeUInt32LE(0x06054b50, 0)
+
+    const realEocd = Buffer.from(bomb.subarray(eocdOffset))
+    realEocd.writeUInt16LE(bomb.readUInt16LE(eocdOffset + 10) + 1, 8)
+    realEocd.writeUInt16LE(bomb.readUInt16LE(eocdOffset + 10) + 1, 10)
+    realEocd.writeUInt32LE(cdOffset + decoy.length, 16)
+
+    const attack = Buffer.concat([
+      bomb.subarray(0, cdOffset),
+      decoy,
+      bomb.subarray(cdOffset, eocdOffset),
+      realEocd,
+    ])
+
+    await expect(extractDocumentStyle(attack, 'docx')).resolves.toBeNull()
+    expect(loadAsync).not.toHaveBeenCalled()
   })
 
   it('still extracts style from a well-formed archive', async () => {
     const summary = await extractDocumentStyle(await buildDocxArchive(), 'docx')
 
+    expect(loadAsync).toHaveBeenCalledTimes(1)
     expect(summary).not.toBeNull()
     expect(summary?.theme?.fonts.minor).toBe('Calibri')
     expect(summary?.theme?.colors.accent1).toBe('4472C4')