fix(files): move the unrenderable error out of the 'use server' module

file-utils.server.ts carries 'use server', whose exports must all be async
functions, so exporting an error class from it failed the production build with
67 cascading errors. The class now lives in the plain file-utils.ts beside the
other shared file helpers, which also lets the hydration path import it directly
instead of through a dynamic import.

Also bounds how long a failed render is remembered. The isolated-vm engine
cannot tell a bad source from a sandbox outage, so a permanent entry let one
transient failure block re-rendering that source for the life of the process.
Entries now expire after five minutes: long enough to stop a read loop spending
a sandbox run per read, short enough that an outage self-heals without a deploy.

Author: j15z

apps/sim/lib/copilot/tools/server/files/doc-compile.ts

@@ -500,7 +500,16 @@ function compiledCacheSet(key: string, buffer: Buffer): void {
  * {@link compiledDocCache}, so an edit to the file produces a new key and gets a
  * fresh attempt.
  */
-const unrenderableSources = new Set<string>()
+const unrenderableSources = new Map<string, number>()
+
+/**
+ * How long a failed render is remembered. Bounded rather than permanent because the
+ * isolated-vm engine cannot tell a bad source from a sandbox outage, so an infra
+ * blip would otherwise strand a perfectly renderable document for the life of the
+ * process. Long enough to stop a read loop spending a sandbox run per read, short
+ * enough that a transient failure self-heals without a deploy.
+ */
+const UNRENDERABLE_TTL_MS = 5 * 60 * 1000
 
 /**
  * Renders in flight, keyed identically to {@link compiledDocCache}. An artifact
@@ -538,9 +547,17 @@ function coalesceRender(
 
 function markUnrenderable(key: string): void {
   if (unrenderableSources.size >= MAX_COMPILED_DOC_CACHE) {
-    unrenderableSources.delete(unrenderableSources.values().next().value as string)
+    unrenderableSources.delete(unrenderableSources.keys().next().value as string)
   }
-  unrenderableSources.add(key)
+  unrenderableSources.set(key, Date.now() + UNRENDERABLE_TTL_MS)
+}
+
+function isKnownUnrenderable(key: string): boolean {
+  const expiresAt = unrenderableSources.get(key)
+  if (expiresAt === undefined) return false
+  if (expiresAt > Date.now()) return true
+  unrenderableSources.delete(key)
+  return false
 }
 
 /**
@@ -645,7 +662,7 @@ export async function resolveServableDocBytes(args: {
     return passthrough()
   }
 
-  if (unrenderableSources.has(renderKey)) {
+  if (isKnownUnrenderable(renderKey)) {
     return unrendered('previous render attempt for these bytes failed')
   }
 

apps/sim/lib/execution/sandbox/bundles/docx.cjs

@@ -25,6 +25,7 @@ import {
   processSingleFileToUserFile,
   type RawFileInput,
   resolveTrustedFileContext,
+  UnrenderableDocumentError,
 } from '@/lib/uploads/utils/file-utils'
 import { verifyFileAccess } from '@/app/api/files/authorization'
 import type { UserFile } from '@/executor/types'
@@ -356,31 +357,6 @@ export interface ServableFile {
   unrendered?: boolean
 }
 
-/**
- * Thrown when a file's stored bytes are not the format its name claims and could
- * not be rendered into it.
- *
- * Every caller of {@link downloadServableFileFromStorage} hands the bytes to
- * something that expects the real document — an email attachment, a cloud upload,
- * a zip entry, a provider attachment — and none of them can tell a rendered
- * artifact from raw generation source once it is just a Buffer. Returning the
- * bytes with an honest content type would still be wrong, because the filename
- * travels separately and downstream re-infers the type from it. Failing here is
- * the only place that reliably prevents source text going out under a `.pdf`.
- *
- * The file-serve route deliberately does NOT go through this helper: it resolves
- * bytes directly and keeps the graceful passthrough, because a human downloading
- * the file and seeing what it actually is has a use for it.
- */
-export class UnrenderableDocumentError extends Error {
-  constructor(fileName: string) {
-    super(
-      `File ${fileName} could not be rendered; its stored bytes are not the format its name claims.`
-    )
-    this.name = 'UnrenderableDocumentError'
-  }
-}
-
 /**
  * Downloads a workspace file and resolves it to its SERVABLE bytes — the variant
  * every tool that hands a file to an external service (email attachments, chat

apps/sim/lib/uploads/utils/file-utils.server.ts

@@ -1031,3 +1031,32 @@ export function getViewerUrl(fileKey: string, workspaceId?: string): string | nu
 
   return `/workspace/${resolvedWorkspaceId}/files/${fileKey}`
 }
+
+/**
+ * Thrown when a file's stored bytes are not the format its name claims and could
+ * not be rendered into it.
+ *
+ * Every caller of `downloadServableFileFromStorage` hands the bytes to something
+ * that expects the real document — an email attachment, a cloud upload, a zip
+ * entry, a provider attachment — and none of them can tell a rendered artifact
+ * from raw generation source once it is just a Buffer. Returning the bytes under
+ * an honest content type would still be wrong, because the filename travels
+ * separately and downstream re-infers the type from it. Failing at the download
+ * boundary is what reliably keeps source text from going out under a `.pdf`.
+ *
+ * Lives here rather than beside that function because `file-utils.server.ts` is a
+ * `'use server'` module, whose exports must all be async functions — a class
+ * export there fails the build.
+ *
+ * The file-serve route deliberately does NOT go through that helper: it resolves
+ * bytes directly and keeps the graceful passthrough, which is the one place a
+ * human downloading the file has a use for them.
+ */
+export class UnrenderableDocumentError extends Error {
+  constructor(fileName: string) {
+    super(
+      `File ${fileName} could not be rendered; its stored bytes are not the format its name claims.`
+    )
+    this.name = 'UnrenderableDocumentError'
+  }
+}

apps/sim/lib/uploads/utils/file-utils.ts

@@ -47,15 +47,6 @@ const RENDERED_PDF_BUFFER = Buffer.from('%PDF-1.4 rendered', 'utf8')
 
 vi.mock('@/lib/uploads/utils/file-utils.server', () => ({
   downloadFileFromStorage: mockDownloadFile,
-  // Mirrors the real module: resolveBase64 narrows on this class to decide whether a
-  // strict caller sees the failure, so omitting it from the mock would break that
-  // check rather than exercise it.
-  UnrenderableDocumentError: class UnrenderableDocumentError extends Error {
-    constructor(fileName: string) {
-      super(`File ${fileName} could not be rendered`)
-      this.name = 'UnrenderableDocumentError'
-    }
-  },
   downloadServableFileFromStorage: async (
     file: UserFile,
     requestId: string,

apps/sim/lib/uploads/utils/user-file-base64.server.test.ts

@@ -27,6 +27,7 @@ import {
   ExecutionResourceLimitError,
   isExecutionResourceLimitError,
 } from '@/lib/execution/resource-errors'
+import { UnrenderableDocumentError } from '@/lib/uploads/utils/file-utils'
 import type { UserFile } from '@/executor/types'
 
 const INLINE_BASE64_JSON_OVERHEAD_BYTES = 512 * 1024
@@ -453,11 +454,11 @@ async function resolveBase64(
       // graph (remote sandbox, sandbox task runner, execution limits), and a static
       // import here would load all of it for every hydration consumer — mirroring
       // the deliberate dynamic import in file-utils.server.ts.
-      const [{ isDocNotReadyError }, { UnrenderableDocumentError }] = await Promise.all([
-        import('@/lib/uploads/utils/servable-file-response'),
-        import('@/lib/uploads/utils/file-utils.server'),
-      ])
-      if (isDocNotReadyError(error) || error instanceof UnrenderableDocumentError) {
+      if (error instanceof UnrenderableDocumentError) {
+        throw error
+      }
+      const { isDocNotReadyError } = await import('@/lib/uploads/utils/servable-file-response')
+      if (isDocNotReadyError(error)) {
         throw error
       }
     }