fix(files): allow document compiler to read referenced images

[TheodoreSpeaks]

Summary

• allow Copilot document compilation to read referenced files across the trusted workspace
• keep the destination content update scoped to its canonical file ID
• add regression coverage for the split authorization scope

Type of Change

• Bug fix

Testing

Focused tests, Biome, type-check, and strict API validation passed before shipping. No checks were rerun during ship.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 12, 2026 11:02pm

[cursor]

PR Summary

Medium Risk
Narrows delegation scope for compilation vs writes in Copilot file tools; behavior change is intentional but touches authorization boundaries for document compilation.

Overview
Fixes Copilot edit_content so document compilation can read other workspace files (e.g. images referenced in Python PDF source) while the saved content update stays tied to the intent file ID.

resolveCopilotFilePrincipal is now called with context only (workspace-scoped delegation) for compileDocForWrite, instead of passing intent.fileId (file-scoped). executeCopilotFileUseCase / updateWorkspaceFileContent still use intent.fileId and assertedWorkspaceId, so authorization for the write path is unchanged.

Adds a regression test that asserts compilation receives the workspace principal and the update use case remains file-scoped.

^{Reviewed by Cursor Bugbot for commit 2ea29cd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

The PR fixes document editing so compilation can read referenced images across the trusted workspace while retaining destination-file scoping for the resulting write.

• Resolves a workspace-scoped delegated principal for document compilation.
• Continues to scope the content update to the canonical destination file ID.
• Adds regression coverage verifying the separate compilation and write scopes.

Confidence Score: 5/5

The PR appears safe to merge with workspace boundaries and destination-file write scoping preserved.

The compiler now receives the workspace scope required to resolve referenced images, while existing authorization rejects files outside that workspace and the content update independently remains scoped to the intended destination file.

Important Files Changed

Filename	Overview
apps/sim/lib/copilot/tools/server/files/edit-content.ts	Separates workspace-scoped compilation reads from the existing file-scoped destination update without weakening workspace authorization.
apps/sim/lib/copilot/tools/server/files/edit-content.test.ts	Adds focused orchestration coverage confirming the compiler and destination write receive their intended authorization scopes.

Sequence Diagram

sequenceDiagram
  participant Copilot
  participant Edit as edit_content
  participant Compiler
  participant Files as Workspace Files
  participant Update as Content Update
  Copilot->>Edit: Submit document source
  Edit->>Compiler: Compile with workspace-scoped principal
  Compiler->>Files: Read referenced workspace images
  Files-->>Compiler: Authorized image content
  Compiler-->>Edit: Compiled source MIME
  Edit->>Update: Write using destination file scope
  Update->>Files: Update canonical destination file

Loading

_{Reviews (1): Last reviewed commit: "fix(files): allow document compiler to r..." | Re-trigger Greptile}