fix(files): resolve v2 file paths only on the v2 surface, through the canonical resolver by waleedlatif1 · Pull Request #9531 · simstudioai/sim

waleedlatif1 · 2026-10-31T18:07:36Z

Summary

Follow-up to #9504, rebuilt on #9527 (authorize the workspace before an unresolved path answers):

resolveActiveWorkspaceFileContext is shared by ~26 callers, so turning files/… strings into ids there widened every internal surface: an internal caller passing a file name that starts with files/ as an id resolved it as a path. It now takes an explicit acceptVfsPath flag, which only the three v2 routes (describe, rename, delete) set. Every other caller keeps id-only semantics.
Paths resolve through the existing resolveFileReference (folder-first, owner-scoped, at most two rows) instead of the bespoke getWorkspaceFileByVfsPath, which is deleted. One resolver now serves workspace and project files. Its ambiguity conflict maps onto fix(files): authorize the workspace before resolving a files/ path #9527's UnresolvedWorkspaceFileVfsPathError, so a member still gets "pass the file id instead" and a non-member the same refusal as for any other path.
A bare files/ names nothing and is no longer treated as a path; the contract rejects it like any other malformed reference.
The three use-case inputs share one WorkspaceFileTargetInput; restore's lifecycle resolver takes only the fields it reads.
Contract text, OpenAPI, CLI client and CLI docs regenerated.

Type of Change

Bug fix

Testing

file-path-references.integration.ts against disposable Postgres via bun run test:integration: 13/13. New cases: a caller that didn't opt in resolves no path; a bare files/; a non-member's personal key on a workspace with personal keys off gets the same answer for an ambiguous, a missing and an existing path
Red proofs: without the opt-in check, "did not opt in" fails; letting the resolver's conflict out pre-authorization fails the member, non-member, delegation and personal-key cases
v2 file route tests and lib/workspace-files/application: 245 pass
check:openapi, check:cli-api, check:api-validation:strict, check:comment-hygiene, check:test-patterns; rest in CI

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-10-31T18:07:38Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 31, 2026 9:24pm UTC

greptile-apps · 2026-10-31T18:09:59Z

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no blocking issues remain.

Summary

Limits file-path lookup to the three opted-in v2 routes and uses resolveFileReference for those lookups.

Three v2 file routes resolve paths while other callers keep id-only lookups.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[File reference] --> B{Path lookup enabled?}
  B -->|No| C[Load by id]
  B -->|Yes| D[Resolve path in asserted workspace]
  D -->|Found| C
  D -->|Workspace-dependent error| E[Check workspace access]
  E -->|Denied| F[Return access refusal]
  E -->|Allowed| G[Return lookup error]
  C --> H[Check file access]
  H --> I[Run file operation]

_{Reviews (8) · Last reviewed commit: "fix(files): every refusal a path lookup ..." · Reviewed by Greptile}

cubic-dev-ai

All reported issues were addressed across 9 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-10-31T18:12:40Z

@greptile

waleedlatif1 · 2026-10-31T18:12:41Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-31T18:12:46Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-10-31T18:17:17Z

@greptile

waleedlatif1 · 2026-10-31T18:17:18Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-31T18:17:23Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 9 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-10-31T18:22:00Z

@greptile

waleedlatif1 · 2026-10-31T18:22:02Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-31T18:22:07Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 9 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-10-31T18:43:17Z

@greptile

waleedlatif1 · 2026-10-31T18:43:18Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-31T18:43:22Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 14 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-10-31T18:59:46Z

@greptile

waleedlatif1 · 2026-10-31T18:59:47Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-31T18:59:53Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 15 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

… canonical resolver

waleedlatif1 · 2026-10-31T19:17:25Z

@greptile

waleedlatif1 · 2026-10-31T19:17:26Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-31T19:17:32Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 15 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

…s for workspace authorization

waleedlatif1 · 2026-10-31T21:24:39Z

@greptile

waleedlatif1 · 2026-10-31T21:24:40Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-31T21:24:45Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 16 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

vercel Bot temporarily deployed to Preview October 31, 2026 18:07 Inactive

cubic-dev-ai Bot reviewed Oct 31, 2026

View reviewed changes

Comment thread apps/sim/app/api/v2/files/[fileId]/metadata/route.ts Resolved

Comment thread apps/sim/lib/workspace-files/application/file-context.ts Resolved

vercel Bot temporarily deployed to Preview October 31, 2026 18:12 Inactive

vercel Bot temporarily deployed to Preview October 31, 2026 18:17 Inactive

cubic-dev-ai Bot reviewed Oct 31, 2026

View reviewed changes

vercel Bot temporarily deployed to Preview October 31, 2026 18:22 Inactive

cubic-dev-ai Bot reviewed Oct 31, 2026

View reviewed changes

vercel Bot deployed to Preview October 31, 2026 18:44

View deployment

cubic-dev-ai Bot reviewed Oct 31, 2026

View reviewed changes

vercel Bot temporarily deployed to Preview October 31, 2026 18:59 Inactive

cubic-dev-ai Bot reviewed Oct 31, 2026

View reviewed changes

fix(files): resolve v2 file paths only on the v2 surface, through the…

1fcf99d

… canonical resolver

waleedlatif1 force-pushed the fix/v2-file-path-optin-bounded branch from a3aa8c6 to 1fcf99d Compare October 31, 2026 19:16

cubic-dev-ai Bot reviewed Oct 31, 2026

View reviewed changes

greptile-apps Bot reviewed Oct 31, 2026

View reviewed changes

Comment thread apps/sim/lib/workspace-files/application/file-context.ts Resolved

vercel Bot deployed to Preview October 31, 2026 19:21

View deployment

fix(files): every refusal a path lookup reads from the workspace wait…

12be2c5

…s for workspace authorization

vercel Bot temporarily deployed to Preview October 31, 2026 21:24 Inactive

cubic-dev-ai Bot reviewed Oct 31, 2026

View reviewed changes

waleedlatif1 merged commit 7ca3f1a into staging Oct 31, 2026
71 checks passed

waleedlatif1 deleted the fix/v2-file-path-optin-bounded branch October 31, 2026 21:38

waleedlatif1 mentioned this pull request Nov 1, 2026

v0.9.39: people page, desktop agent browser sign-in and updates, mothership memory erasure, oauth refresh hardening, v2 file paths, disposable email blocking #9544

Merged

Conversation

waleedlatif1 commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 31, 2026

Uh oh!

waleedlatif1 commented Oct 31, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 31, 2026

Uh oh!

waleedlatif1 commented Oct 31, 2026

Uh oh!

waleedlatif1 commented Oct 31, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 31, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Oct 31, 2026

Uh oh!

waleedlatif1 commented Oct 31, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 31, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Oct 31, 2026

Uh oh!

waleedlatif1 commented Oct 31, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 31, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Oct 31, 2026

Uh oh!

waleedlatif1 commented Oct 31, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 31, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Oct 31, 2026

Uh oh!

waleedlatif1 commented Oct 31, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 31, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Oct 31, 2026

Uh oh!

waleedlatif1 commented Oct 31, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 31, 2026

waleedlatif1 commented Oct 31, 2026 •

edited

Loading

vercel Bot commented Oct 31, 2026 •

edited

Loading

greptile-apps Bot commented Oct 31, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading