fix(merge): repair three regressions the staging merge surfaced

- cloud-review-tools.test.ts: the merge kept the branch's import line (which
  had dropped `symlink` along with the test that used it) while taking
  staging's reinstated test body, so the symlink-escape assertion would have
  thrown ReferenceError on CI. tsconfig excludes *.test.ts, so type-check
  could not catch it. Restored the import and the workflow's ripgrep install
  step, which the branch removed alongside the same test.

- createByteRangeResponse defaulted to `public, max-age=31536000` while its
  sibling createFileResponse defaults to `private, no-cache` and says in a
  comment why. resolveServeCacheControl returns undefined for any unversioned
  non-`workspace` context, so those access-verified media responses landed on
  the public default — storable by a shared cache and re-servable cross-user,
  where staging sent `private, no-cache`. Defaults now match.

- ReadOnlyTextPreview: restored staging's `flex … flex-col` on the rich
  preview wrapper. Every PreviewPanel renderer sizes itself as a flex item, so
  in a block parent HtmlPreview measures a zero-height box, never mounts its
  iframe, and nothing ever grows the container to un-wedge it — shared .html
  and .svg rendered blank.

Author: waleedlatif1

.github/workflows/test-build.yml

@@ -142,6 +142,11 @@ jobs:
       - name: Type-check all workspaces
         run: bunx turbo run type-check
 
+      # cloud-review-tools.test.ts runs the real helper on the runner, which shells
+      # out to rg. Blacksmith's image ships it, GitHub's doesn't.
+      - name: Install ripgrep
+        run: command -v rg || (sudo apt-get update && sudo apt-get install -y ripgrep)
+
       # Runs the setup CLI's Bun tests plus each workspace's Vitest suite,
       # without `--coverage`. See the Codecov note below.
       - name: Run tests

apps/sim/app/api/files/utils.ts

@@ -306,7 +306,11 @@ export async function createByteRangeResponse(options: ByteServeOptions): Promis
   const headers: Record<string, string> = {
     'Content-Type': contentType,
     'Content-Disposition': `${disposition}; ${encodeFilenameForHeader(options.filename)}`,
-    'Cache-Control': options.cacheControl || 'public, max-age=31536000',
+    // Same default as createFileResponse, and for the same reason: a byte-served object
+    // reaches here only after access verification, so an unspecified policy must never
+    // let a shared cache/CDN store it and re-serve it cross-user. Public assets pass an
+    // explicit `cacheControl`.
+    'Cache-Control': options.cacheControl || 'private, no-cache',
     'X-Content-Type-Options': 'nosniff',
     'Accept-Ranges': 'bytes',
   }

apps/sim/components/resources/file-view/file-view.tsx

@@ -394,11 +394,16 @@ const ReadOnlyTextPreview = memo(function ReadOnlyTextPreview({ file }: { file:
 
   const resolvedError = resolvePreviewError((error as Error | null) ?? null, null)
   if (resolvedError) return <PreviewError label='file' error={resolvedError} />
-  if (isLoading || content == null) return <PreviewLoadingFrame className='h-full' tone='surface' />
+  if (isLoading || content == null)
+    return <PreviewLoadingFrame className='min-h-0 flex-1' tone='surface' />
 
   if (resolvePreviewType(file.type, file.name)) {
     return (
-      <div className='h-full min-h-0 w-full overflow-auto'>
+      // `flex flex-col` is load-bearing, not decoration: every PreviewPanel renderer sizes
+      // itself as a flex item (`flex min-h-0 flex-1`). In a block parent that grow is inert,
+      // the renderer collapses to auto height, and HtmlPreview — which gates its iframe on a
+      // measured non-zero box — deadlocks and paints nothing.
+      <div className='flex min-h-0 w-full flex-1 flex-col overflow-auto'>
         <PreviewPanel
           content={content}
           mimeType={file.type}
@@ -411,7 +416,7 @@ const ReadOnlyTextPreview = memo(function ReadOnlyTextPreview({ file }: { file:
   }
 
   return (
-    <div className='h-full min-h-0 w-full overflow-auto bg-[var(--surface-1)] p-4'>
+    <div className='min-h-0 w-full flex-1 overflow-auto bg-[var(--surface-1)] p-4'>
       <pre className='whitespace-pre-wrap break-words font-mono text-[var(--text-body)] text-small'>
         {content}
       </pre>

apps/sim/executor/handlers/pi/cloud-review-tools.test.ts

@@ -2,7 +2,7 @@
  * @vitest-environment node
  */
 import { execFile } from 'node:child_process'
-import { mkdir, mkdtemp, rm, writeFile as writeLocalFile } from 'node:fs/promises'
+import { mkdir, mkdtemp, rm, symlink, writeFile as writeLocalFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { promisify } from 'node:util'