The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	May 3, 2026 3:01am

PR Summary

Medium Risk
Adds a new authenticated export endpoint that rewrites and bundles file contents into a generated ZIP, plus broad refactors to file download plumbing; bugs here could impact download correctness/performance and access control. Additional workflow-lock UX tweaks are low risk but touch interactive canvas/notification behavior.

Overview
Adds GET /api/files/export/[id] to export Markdown files as a self-contained ZIP by rewriting /api/files/view/{uuid} image links to local ./assets/* paths and embedding up to 50 accessible images; non-Markdown exports redirect to the existing serve URL. Filenames are sanitized and deduplicated to avoid traversal/header issues and collisions.

Refactors workspace file reads by renaming server-side downloadWorkspaceFile to fetchWorkspaceFileBuffer and updating API routes/tools/tests accordingly. Client-side downloads are moved to a new triggerFileDownload helper which routes Markdown downloads through the export endpoint.

Tweaks workflow lock UX: unlock notifications no longer auto-dismiss and don’t disappear when clicked, locked canvases now surface an info notification on drop attempts, admin unlock controls are disabled while read-only, and locked canvas opacity is adjusted.

^{Reviewed by Cursor Bugbot for commit 76a07aa. Configure here.}

Greptile Summary

This PR adds a GET /api/files/export/[id] endpoint that bundles a markdown file and its embedded workspace images into a self-contained zip, rewriting /api/files/view/{id} references to relative ./assets/{filename} paths. It also renames downloadWorkspaceFile → fetchWorkspaceFileBuffer (server-side buffer download) and replaces the client downloadWorkspaceFile utility with a new triggerFileDownload helper that routes markdown through the export endpoint automatically. Additional changes improve locked-workflow UX and fix the StorageContext cast for mothership files.

Confidence Score: 5/5

Safe to merge — only P2 style/robustness findings; core export logic, auth, and filename sanitisation are sound.

All findings are P2: incomplete control-character stripping in Content-Disposition (functional but non-spec) and missing filename* RFC 5987 encoding for non-ASCII names (browser-tolerated). No P0/P1 issues found. The access-check, deduplication, zip-slip prevention, and rename refactor are all correct.

apps/sim/app/api/files/export/[id]/route.ts — two minor header-encoding improvements suggested.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant C as Client (triggerFileDownload)
    participant E as GET /api/files/export/[id]
    participant S as GET /api/files/serve/…
    participant DB as File Metadata DB
    participant Stor as Storage Service

    C->>C: isMarkdown(record)?
    alt markdown
        C->>E: GET /api/files/export/{id}
        E->>E: checkSessionOrInternalAuth
        E->>DB: getFileMetadataById(id)
        E->>E: verifyFileAccess
        E->>E: isMarkdown(originalName, contentType)?
        alt not markdown on server
            E-->>S: 302 redirect to serve path
        else markdown
            E->>Stor: downloadFile(key, context)
            E->>E: extract imageIds via VIEW_URL_RE (up to 50)
            par fetch all images
                E->>DB: getFileMetadataById(imageId)
                E->>Stor: downloadFile(imgKey, context)
            end
            E->>E: deduplicate filenames, rewrite md refs
            E->>E: zip.file(mdName, content) + assets/
            E-->>C: 200 application/zip
        end
    else non-markdown
        C->>S: GET /api/files/serve/{key}?context=workspace
        S-->>C: raw file
    end
    C->>C: createObjectURL → anchor click → download

_{Reviews (5): Last reviewed commit: "fix(tests): update mocks for fetchWorksp..." | Re-trigger Greptile}

@greptile

@cursor review

@greptile

@cursor review

@greptile

@cursor review

@greptile

@cursor review