improvement(copilot): align the VFS read caps and share the read placeholders

Follow-up review of the bounded image read. Three consistency defects and one
shared-definition gap, none of which changed what the limits protect against.

- derive the image source cap from the FormData upload ceiling instead of a
  number of its own. That cap exists for the same failure mode — a route holding
  an entire file in worker memory — so anything uploadable stays readable, and
  the tighter value was refusing images that read fine before for no gain
- report a HEIF past the WebAssembly transcoder's own ceiling as a size refusal;
  it was falling through and telling the model the file could not be decoded
- classify an oversized document like an oversized file or image. One of the
  three size refusals was reported to the model as a successful one-line read
- report the observed size, not the recorded one, when the download cap trips —
  the recorded size is the figure that cap exists to distrust
- move the read placeholders into one module that builds and matches them.
  Producers and matchers sat in four files and had already drifted twice
- stop emitting trace outcomes absent from the generated contract, and derive
  the "vision limit" wording from the constant instead of restating it

Author: waleedlatif1

apps/sim/lib/copilot/tools/handlers/vfs.test.ts

@@ -196,6 +196,24 @@ describe('vfs handlers oversize policy', () => {
     expect(result.error).toContain('too large')
   })
 
+  it('returns an undecodable image placeholder as content, not as a size failure', async () => {
+    const vfs = makeVfs()
+    // Not a size problem — the bytes were read fine and the reason is already in the
+    // message, so the model should see it rather than a "too large, use grep" error.
+    vfs.readFileContent.mockResolvedValue({
+      content: '[Image unavailable: bomb.png (90 Bytes). It is too large to decode safely.]',
+      totalLines: 1,
+    })
+    getOrMaterializeVFS.mockResolvedValue(vfs)
+
+    const result = await executeVfsRead(
+      { path: 'files/bomb.png/content' },
+      { userId: 'user-1', workflowId: 'wf-1', workspaceId: 'ws-1' }
+    )
+
+    expect(result.success).toBe(true)
+  })
+
   it('reads canonical file leaf metadata without fetching dynamic content', async () => {
     const vfs = makeVfs()
     vfs.read.mockReturnValue({

apps/sim/lib/copilot/tools/handlers/vfs.ts

@@ -8,6 +8,7 @@ import { getOrMaterializeVFS } from '@/lib/copilot/vfs'
 import type { GrepCountEntry, GrepMatch } from '@/lib/copilot/vfs/operations'
 import { WorkspaceFileGrepError } from '@/lib/copilot/vfs/operations'
 import { encodeVfsSegment } from '@/lib/copilot/vfs/path-utils'
+import { isOversizedReadPlaceholder } from '@/lib/copilot/vfs/read-placeholders'
 import {
   importWorkspaceFileSecretProvenanceForModelView,
   type WorkspaceFileSecretProvenanceIdentity,
@@ -76,14 +77,6 @@ function serializedResultSize(value: unknown): number {
   }
 }
 
-function isOversizedReadPlaceholder(content: string): boolean {
-  return (
-    content.startsWith('[File too large to display inline:') ||
-    content.startsWith('[Image too large to read inline:') ||
-    content.startsWith('[Compiled artifact too large:')
-  )
-}
-
 function hasModelAttachment(result: unknown): boolean {
   if (!result || typeof result !== 'object') {
     return false

apps/sim/lib/copilot/vfs/file-reader.test.ts

@@ -14,11 +14,13 @@ vi.mock('@/lib/uploads/contexts/workspace/workspace-file-manager', () => ({
   fetchWorkspaceFileBuffer,
 }))
 
-import { readFileRecord } from '@/lib/copilot/vfs/file-reader'
+import {
+  MAX_IMAGE_READ_BYTES,
+  MAX_IMAGE_SOURCE_BYTES,
+  readFileRecord,
+} from '@/lib/copilot/vfs/file-reader'
 import { PayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
-
-const MAX_IMAGE_READ_BYTES = 5 * 1024 * 1024
-const MAX_IMAGE_SOURCE_BYTES = 25 * 1024 * 1024
+import { MAX_TRANSCODE_INPUT_BYTES } from '@/lib/uploads/server/heic'
 
 async function makeNoisePng(width: number, height: number): Promise<Buffer> {
   const sharp = (await import('sharp')).default
@@ -89,17 +91,34 @@ describe('readFileRecord', () => {
     SHARP_TEST_TIMEOUT_MS
   )
 
-  it('reports the too-large placeholder when a understated record.size hides an oversized object', async () => {
-    // `record.size` is client-declared, so the download cap is the check that holds —
-    // and breaching it must still read as "too large", not as a failed read.
+  it('reports the too-large placeholder when an understated record.size hides an oversized object', async () => {
     fetchWorkspaceFileBuffer.mockRejectedValue(
-      new PayloadSizeLimitError({ label: 'workspace file', maxBytes: MAX_IMAGE_SOURCE_BYTES })
+      new PayloadSizeLimitError({
+        label: 'workspace file',
+        maxBytes: MAX_IMAGE_SOURCE_BYTES,
+        observedBytes: MAX_IMAGE_SOURCE_BYTES + 5_000,
+      })
     )
 
     const result = await readFileRecord(imageRecord('understated.png', 1024))
 
     expect(result?.attachment).toBeUndefined()
     expect(result?.content).toContain('Image too large to read inline')
+    // The observed size, not the understated 1024 the cap exists to distrust.
+    expect(result?.content).toContain(`${MAX_IMAGE_SOURCE_BYTES + 5_000} bytes`)
+  })
+
+  it('reports an oversized HEIF as a size refusal, not as a corrupt file', async () => {
+    // `ftyp`+`heic` brand, past the WebAssembly transcoder's own tighter ceiling.
+    const heif = Buffer.alloc(MAX_TRANSCODE_INPUT_BYTES + 1)
+    heif.write('ftypheic', 4, 'ascii')
+    fetchWorkspaceFileBuffer.mockResolvedValue(heif)
+
+    const result = await readFileRecord(imageRecord('photo.heic', heif.length, 'image/heic'))
+
+    expect(result?.attachment).toBeUndefined()
+    expect(result?.content).toContain('It is too large to decode safely.')
+    expect(result?.content).not.toContain('It could not be decoded.')
   })
 
   it('rejects an oversized image on its stored size before fetching it', async () => {