[waleedlatif1]

Summary

• /api/files/serve read every file fully into memory and refused anything over 100 MB (413), while workspace files are admitted up to 5 GB, so large files (e.g. agent-rendered videos) could never be downloaded or previewed
• Every request answered with the stored object byte-for-byte (raw, or not a Sim page / generated document / preview=1, which may be a HEIC transcode) now streams from storage instead; transformed representations stay buffered and bounded exactly as before
• HTTP Range support end to end: resolveByteRange (single range, suffix, clamp, 416, If-Range strong-ETag only), ranged downloadFileStream for S3 / Blob / GCS / local, and createStoredFileStreamResponse (200 / 206 / 304 / 416 with Accept-Ranges, Content-Range, a strong ETag). Seeking works, and Safari can play at all
• Workspace files keep the open-then-recheck delivery guarantee through a shared streamAuthorizedWorkspaceFile helper (access + read receipt + provenance rechecked after storage opens, stream disposed on refusal); the inline-image use case now uses the same helper instead of its own copy
• Legacy contexts (execution outputs, chat/copilot attachments, knowledge docs) stream the same way, sized and versioned by a storage HEAD
• Removed the buffered readWorkspaceFileContentByKey use case (raw reads now stream) and renamed its module to read-workspace-file-record-by-key
• Client: downloads over 100 MB are HEAD-probed then handed to the browser's download manager instead of being read into a tab Blob; smaller downloads are unchanged
• Client: audio/video previews play straight from the serve URL (progressive playback + seeking) on sources that declare servesByteRanges; project and public-share sources keep the blob path. A failed load is diagnosed with a HEAD probe (replaced key → record re-resolved; unplayable format → "can't be played" message), and a load that finishes before hydration is picked up on mount so the spinner never sticks

Type of Change

• Bug fix

Testing

• New lib/uploads/server/byte-range.test.ts (29 cases, written failure-modes-first), stream-authorized-workspace-file.test.ts, streaming cases in app/api/files/serve/[...path]/route.test.ts (200/206/416/304/If-Range, legacy streaming, buffered paths unchanged), large-download cases in lib/uploads/client/download.test.ts; each guard red-checked by reverting it
• Ran the touched suites plus storage-service, provider client, inline/download use case and files-utils tests locally (all green); check:api-validation:strict, check:comment-hygiene, check:source-conventions, check:client-boundary, check:test-patterns, check:file-names, check:utils, check:boundaries, block registry check, lint
• Local E2E against next dev with local storage and a real session: 14/14 HTTP checks on a 151 MB non-faststart MP4 (byte-exact full download by SHA-256, exact 206 slices incl. suffix/tail, 416, 304, stale/matching If-Range, HEAD, immutable v=, unauthenticated 401); WebKit + Chromium: preview plays, seeks to near the end, Download button saves the exact file; a 5 MB clip behaves the same; server RSS flat while a 1 MB/s client streamed the whole file
• Full bun run test, check:audits and type-check left to CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 31, 2026 11:28pm UTC

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no new actionable issues were found.

Summary

Files served without changes now stream from storage with byte-range support. Rendered pages, generated documents, and image previews keep their bounded, buffered paths.

• Stored files stream in full or by the byte range a caller requests.
• Workspace audio and video play directly from range-enabled file URLs.
• Large raw downloads go straight to the browser download manager.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Authorized file request] --> B{Stored bytes unchanged?}
  B -->|Yes| C[Check version and requested range]
  C --> D[Stream full file or byte range]
  B -->|No| E[Read under size limit]
  E --> F[Render or compile]
  F --> G[Return bounded response]

Loading

_{Reviews (3) · Last reviewed commit: "fix(files): probe served bytes before ha..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 23 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 24 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>