fix(tables): cap aggregate snapshot mounts

Author: TheodoreSpeaks

apps/sim/lib/copilot/tools/handlers/function-execute.test.ts

@@ -650,6 +650,21 @@ describe('executeFunctionExecute table mounts', () => {
     expect(mockGeneratePresignedDownloadUrl).not.toHaveBeenCalled()
   })
 
+  it('throws when cloud snapshots exceed the aggregate URL mount limit', async () => {
+    mockGetTableById.mockImplementation(async (tableId: string) => ({ ...table, id: tableId }))
+    mockGetOrCreateTableSnapshot.mockImplementation(async (mountedTable: typeof table) => ({
+      key: `table-snapshots/ws_1/${mountedTable.id}/v5.csv`,
+      size: 500 * 1024 * 1024,
+      version: 5,
+    }))
+    const tableIds = Array.from({ length: 5 }, (_, index) => `tbl_${index}`)
+
+    await expect(
+      executeFunctionExecute({ inputTables: tableIds }, context as never)
+    ).rejects.toThrow(/total mount limit/)
+    expect(mockGeneratePresignedDownloadUrl).toHaveBeenCalledTimes(4)
+  })
+
   it('throws when a local snapshot exceeds the per-file mount limit', async () => {
     mockHasCloudStorage.mockReturnValue(false)
     mockGetOrCreateTableSnapshot.mockResolvedValue({

apps/sim/lib/copilot/tools/handlers/function-execute.ts

@@ -497,20 +497,23 @@ export async function resolveInputFiles(
       }
 
       if (hasCloudStorage()) {
-        // Mount by reference: the sandbox fetches the snapshot straight from storage via a
-        // presigned URL, so the bytes never pass through the web process — the only ceiling is
-        // sandbox disk (enforced at materialization by SNAPSHOT_MAX_BYTES).
         if (snapshot.size > SNAPSHOT_MAX_BYTES) {
           throw new Error(
             `Input table "${tableId}" is ${Math.round(snapshot.size / 1024 / 1024)}MB, over the ${SNAPSHOT_MAX_BYTES / 1024 / 1024}MB table mount limit.`
           )
         }
+        if (mounted.url + snapshot.size > MAX_TOTAL_URL_BYTES) {
+          throw new Error(
+            `Mounting "${tableId}" would exceed the ${MAX_TOTAL_URL_BYTES / 1024 / 1024 / 1024}GB total mount limit. Mount fewer or smaller files and tables.`
+          )
+        }
         const url = await generatePresignedDownloadUrl(
           snapshot.key,
           'execution',
           MOUNT_URL_TTL_SECONDS
         )
         sandboxFiles.push({ type: 'url', path: mountPath, url })
+        mounted.url += snapshot.size
         continue
       }