fix(uploads): budget every key built from a caller-supplied name

Auditing the rest of the codebase for the shape that broke the
upload-session PUT found five more key builders that put an unbounded
name into a path component local storage writes directly.

Three are on the same route as the original bug: `table_import`,
`profile_picture`, and `workspace_logo` built their key inline with
`sanitizeFileName`, which maps characters and never truncates, while
their sibling purposes went through `buildStorageKeySegment`. A
255-character name broke `table_import` at the metadata sidecar and the
other two at the object write itself.

The other two are local-storage writers reached from elsewhere:
knowledge-base connector sync capped the document title at 200 and then
appended a timestamp, a uuid and `.txt` on top of the cap, landing at
exactly 255 with no room for the sidecar; the Mistral-OCR staging and
chunk keys inlined the sanitizer with no bound at all; and inbound email
attachments went into a key with neither sanitizer nor bound, on a file
name an outside sender chooses.

All now derive their component through `buildStorageKeySegment`, so the
reservation is stated once. The upload-session test asserts it for every
purpose the contract admits, which is what keeps a newly added purpose
from reintroducing the hand-built form.

Author: waleedlatif1

apps/sim/lib/knowledge/connectors/sync-engine.ts

@@ -22,6 +22,7 @@ import type { DocumentData } from '@/lib/knowledge/documents/service'
 import { hardDeleteDocuments, processDocumentsWithQueue } from '@/lib/knowledge/documents/service'
 import { refreshAccessTokenIfNeeded } from '@/lib/oauth/credential-service'
 import { StorageService } from '@/lib/uploads'
+import { buildStorageKeySegment } from '@/lib/uploads/core/storage-key'
 import { deleteFile } from '@/lib/uploads/core/storage-service'
 import { deleteFileMetadata } from '@/lib/uploads/server/metadata'
 import { extractStorageKey } from '@/lib/uploads/utils/file-utils'
@@ -1472,7 +1473,7 @@ async function addDocument(
   const documentId = generateId()
   const contentBuffer = Buffer.from(extDoc.content, 'utf-8')
   const safeTitle = sanitizeStorageTitle(extDoc.title)
-  const customKey = `kb/${Date.now()}-${documentId}-${safeTitle}.txt`
+  const customKey = `kb/${buildStorageKeySegment(`${Date.now()}-${documentId}-`, `${safeTitle}.txt`)}`
 
   const fileInfo = await StorageService.uploadFile({
     file: contentBuffer,
@@ -1561,7 +1562,7 @@ async function updateDocument(
 
   const contentBuffer = Buffer.from(extDoc.content, 'utf-8')
   const safeTitle = sanitizeStorageTitle(extDoc.title)
-  const customKey = `kb/${Date.now()}-${existingDocId}-${safeTitle}.txt`
+  const customKey = `kb/${buildStorageKeySegment(`${Date.now()}-${existingDocId}-`, `${safeTitle}.txt`)}`
 
   const fileInfo = await StorageService.uploadFile({
     file: contentBuffer,

apps/sim/lib/knowledge/documents/document-processor.ts

@@ -25,6 +25,7 @@ import {
   getKnowledgeOpaqueModelInputRegistry,
 } from '@/lib/knowledge/model-input-provenance'
 import { StorageService } from '@/lib/uploads'
+import { buildStorageKeySegment } from '@/lib/uploads/core/storage-key'
 import { isInternalFileUrl } from '@/lib/uploads/utils/file-utils'
 import { downloadFileFromUrl } from '@/lib/uploads/utils/file-utils.server'
 import { MAX_FILE_SIZE } from '@/lib/uploads/utils/validation'
@@ -362,8 +363,7 @@ async function handleFileForOCR(
 
     const timestamp = Date.now()
     const uniqueId = randomBytes(8).toString('hex')
-    const safeFileName = filename.replace(/[^a-zA-Z0-9.-]/g, '_')
-    const customKey = `kb/${timestamp}-${uniqueId}-${safeFileName}`
+    const customKey = `kb/${buildStorageKeySegment(`${timestamp}-${uniqueId}-`, filename)}`
 
     const cloudResult = await StorageService.uploadFile({
       file: buffer,
@@ -659,8 +659,10 @@ async function processChunk(
   try {
     const timestamp = Date.now()
     const uniqueId = randomBytes(8).toString('hex')
-    const safeFileName = filename.replace(/[^a-zA-Z0-9.-]/g, '_')
-    const chunkKey = `kb/${timestamp}-${uniqueId}-chunk${chunkIndex + 1}-${safeFileName}`
+    const chunkKey = `kb/${buildStorageKeySegment(
+      `${timestamp}-${uniqueId}-chunk${chunkIndex + 1}-`,
+      filename
+    )}`
 
     // No metadata: these chunks are ephemeral OCR artifacts (deleted in the
     // finally below) that are fetched via a direct presigned URL, never through

apps/sim/lib/mothership/inbox/executor.ts

@@ -24,6 +24,7 @@ import * as agentmail from '@/lib/mothership/inbox/agentmail-client'
 import { formatEmailAsMessage } from '@/lib/mothership/inbox/format'
 import { sendInboxResponse } from '@/lib/mothership/inbox/response'
 import type { AgentMailAttachment } from '@/lib/mothership/inbox/types'
+import { buildStorageKeySegment } from '@/lib/uploads/core/storage-key'
 import { uploadFile } from '@/lib/uploads/core/storage-service'
 import { createFileContent, type MessageContent } from '@/lib/uploads/utils/file-utils'
 import { checkWorkspaceAccess, getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
@@ -482,7 +483,10 @@ async function downloadAttachmentContents(
       const fileContent = createFileContent(buffer, attachment.content_type)
       if (!fileContent) return null
 
-      const storageKey = `copilot/${Date.now()}-${attachment.attachment_id}-${attachment.filename}`
+      const storageKey = `copilot/${buildStorageKeySegment(
+        `${Date.now()}-${attachment.attachment_id}-`,
+        attachment.filename
+      )}`
       const uploaded = await uploadFile({
         file: buffer,
         fileName: attachment.filename,

apps/sim/lib/uploads/upload-session/service.test.ts

@@ -34,11 +34,15 @@ vi.mock('@/lib/billing/storage', () => ({
   resolveStorageBillingContext: mockResolveBillingContext,
 }))
 
-vi.mock('@/lib/uploads/contexts/workspace', () => ({
-  generateWorkspaceFileKey: vi.fn(
-    (workspaceId: string, fileName: string) => `workspace/${workspaceId}/final-${fileName}`
-  ),
-}))
+vi.mock('@/lib/uploads/contexts/workspace', async () => {
+  const { buildStorageKeySegment } = await import('@/lib/uploads/core/storage-key')
+  return {
+    generateWorkspaceFileKey: vi.fn(
+      (workspaceId: string, fileName: string) =>
+        `workspace/${workspaceId}/${buildStorageKeySegment('final-', fileName)}`
+    ),
+  }
+})
 
 vi.mock('@/lib/uploads/upload-session/cleanup', () => ({
   maybeCleanupLocalUploadArtifacts: vi.fn().mockResolvedValue({ scanned: 0, removed: 0 }),
@@ -56,6 +60,7 @@ vi.mock('@/lib/uploads/upload-session/provider', () => ({
   uploadStorageProvider: vi.fn(() => 's3'),
 }))
 
+import { LOCAL_UPLOAD_METADATA_SUFFIX } from '@/lib/uploads/core/storage-key'
 import {
   abortUploadSession,
   assertUploadSessionAuthBinding,
@@ -137,6 +142,42 @@ describe('upload sessions', () => {
     })
   })
 
+  // Local storage stores an object's metadata sidecar beside it, under the
+  // object's own name, so the whole key + suffix must fit one path component.
+  // Three purposes built their key by hand and admitted a 255-character name
+  // straight into it: the session was created, its transfer URL issued, and
+  // every request against it then failed with an unclassifiable 500.
+  it.each([
+    ['workspace_file', {}],
+    ['knowledge_document', { knowledgeBaseId: 'kb-1' }],
+    ['table_import', {}],
+    ['profile_picture', {}],
+    ['workspace_logo', {}],
+    ['mothership_attachment', {}],
+    ['execution_attachment', { workflowId: 'workflow-1', executionId: 'execution-1' }],
+  ])('bounds the %s key so its local sidecar still fits', async (purpose, extra) => {
+    dbChainMockFns.returning.mockResolvedValue([uploadRow({ purpose })])
+
+    await createUploadSession({
+      id: 'upload-1',
+      workspaceId: WORKSPACE_ID,
+      userId: 'user-1',
+      principal: { kind: 'session', userId: 'user-1', sessionId: 'session-1' },
+      purpose: purpose as Parameters<typeof createUploadSession>[0]['purpose'],
+      fileName: `${'a'.repeat(251)}.txt`,
+      contentType: 'text/plain',
+      fileSize: 4,
+      localOrigin: 'http://localhost:3000',
+      ...extra,
+    } as Parameters<typeof createUploadSession>[0])
+
+    const { finalKey } = dbChainMockFns.values.mock.calls[0][0]
+    const lastComponent = finalKey.slice(finalKey.lastIndexOf('/') + 1)
+    expect(
+      Buffer.byteLength(`${lastComponent}${LOCAL_UPLOAD_METADATA_SUFFIX}`, 'utf-8')
+    ).toBeLessThanOrEqual(255)
+  })
+
   it('allocates distinct keys for same-named execution attachments', async () => {
     dbChainMockFns.returning
       .mockResolvedValueOnce([

apps/sim/lib/uploads/upload-session/service.ts

@@ -15,6 +15,7 @@ import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { generateUniqueExecutionFileKey } from '@/lib/uploads/contexts/execution/utils'
 import { generateKnowledgeBaseFileKey } from '@/lib/uploads/contexts/knowledge-base/knowledge-base-file-manager'
 import { generateWorkspaceFileKey } from '@/lib/uploads/contexts/workspace'
+import { buildStorageKeySegment } from '@/lib/uploads/core/storage-key'
 import {
   MAX_KNOWLEDGE_DOCUMENT_FILE_SIZE,
   MAX_WORKSPACE_FILE_SIZE,
@@ -41,7 +42,6 @@ import type {
   UploadStorageProvider,
   UploadTransferMethod,
 } from '@/lib/uploads/upload-session/types'
-import { sanitizeFileName } from '@/executor/constants'
 
 export const UPLOAD_SESSION_PUT_MAX_BYTES = 50 * 1024 * 1024
 export const UPLOAD_SESSION_PART_SIZE = 8 * 1024 * 1024
@@ -1200,7 +1200,7 @@ function resolveUploadStorage(
     case 'table_import':
       return {
         storageContext: 'table-import',
-        finalKey: `table-import/${params.workspaceId}/${id}/${sanitizeFileName(params.fileName)}`,
+        finalKey: `table-import/${params.workspaceId}/${id}/${buildStorageKeySegment('', params.fileName)}`,
       }
     case 'knowledge_document':
       return {
@@ -1210,12 +1210,12 @@ function resolveUploadStorage(
     case 'profile_picture':
       return {
         storageContext: 'profile-pictures',
-        finalKey: `profile-pictures/${id}-${sanitizeFileName(params.fileName)}`,
+        finalKey: `profile-pictures/${buildStorageKeySegment(`${id}-`, params.fileName)}`,
       }
     case 'workspace_logo':
       return {
         storageContext: 'workspace-logos',
-        finalKey: `workspace-logos/${params.workspaceId}/${id}-${sanitizeFileName(params.fileName)}`,
+        finalKey: `workspace-logos/${params.workspaceId}/${buildStorageKeySegment(`${id}-`, params.fileName)}`,
       }
     case 'mothership_attachment':
       return {