@@ -81,3 +81,37 @@ describe('getCsvPreviewSlice', () => {
     expect(destroySpy).toHaveBeenCalled()
   })
 })
+
+it('rejects an oversized streamed record before consuming the entire file', async () => {
+  let chunksRead = 0
+  const source = Readable.from(
+    (async function* () {
+      yield Buffer.from('header\n"')
+      for (let i = 0; i < 1000; i++) {
+        chunksRead++
+        yield Buffer.alloc(16 * 1024, 'x')
+      }
+    })()
+  )
+  mockDownloadFileStream.mockResolvedValue(source)
+  await expect(getCsvPreviewSlice(args)).rejects.toMatchObject({ code: 'CSV_MAX_RECORD_SIZE' })
+  expect(chunksRead).toBeLessThan(30)
+  expect(source.destroyed).toBe(true)
+})
+
+it('bounds bytes consumed even when blank records produce no preview rows', async () => {
+  let chunksRead = 0
+  const source = Readable.from(
+    (async function* () {
+      yield Buffer.from('header\n')
+      for (let i = 0; i < 1000; i++) {
+        chunksRead++
+        yield Buffer.alloc(64 * 1024, '\n')
+      }
+    })()
+  )
+  mockDownloadFileStream.mockResolvedValue(source)
+  await expect(getCsvPreviewSlice(args)).rejects.toThrow('CSV preview')
+  expect(chunksRead).toBeLessThan(140)
+  expect(source.destroyed).toBe(true)
+})
@@ -2,11 +2,14 @@ import { Readable } from 'node:stream'
 import { truncate } from '@sim/utils/string'
 import { parse as parseCsvStream } from 'csv-parse'
 import { CSV_PREVIEW_MAX_ROWS } from '@/lib/api/contracts/workspace-file-table'
+import { assertKnownSizeWithinLimit } from '@/lib/core/utils/stream-limits'
 import type { StorageContext } from '@/lib/uploads/config'
 import { downloadFileStream } from '@/lib/uploads/core/storage-service'
 
 /** Cap a single cell so one pathological field can't bloat the preview payload. */
 const MAX_CELL_LENGTH = 2_000
+const MAX_RECORD_SIZE = 256 * 1024
+const MAX_PREVIEW_BYTES = 8 * 1024 * 1024
 
 /** Read at most this many bytes while sniffing the first line for the delimiter. */
 const DELIMITER_SNIFF_MAX_BYTES = 256 * 1024
@@ -44,7 +47,7 @@ function cell(value: unknown): string {
 /**
  * Streams the first {@link CSV_PREVIEW_MAX_ROWS} rows of a CSV/TSV from storage without
  * ever buffering the whole file. The source stream is destroyed as soon as enough rows are
- * read (one past the cap, to detect truncation), so a multi-GB file costs O(rows) of memory.
+ * read (one past the cap, to detect truncation), with record and total-byte limits bounding parser memory and work.
  */
 export async function getCsvPreviewSlice({
   key,
@@ -60,6 +63,17 @@ export async function getCsvPreviewSlice({
   signal?.addEventListener('abort', onAbort, { once: true })
 
   const reader = source[Symbol.asyncIterator]()
+  let bytesRead = 0
+  let piped: Readable | undefined
+  let parser: ReturnType<typeof parseCsvStream> | undefined
+  async function nextChunk() {
+    const next = await reader.next()
+    if (!next.done) {
+      bytesRead += Buffer.byteLength(next.value)
+      assertKnownSizeWithinLimit(bytesRead, MAX_PREVIEW_BYTES, 'CSV preview')
+    }
+    return next
+  }
 
   try {
     // Pull chunks until the first newline so the delimiter can be sniffed before parsing.
@@ -71,12 +85,14 @@ export async function getCsvPreviewSlice({
     let firstLine = ''
     let sniffedBytes = 0
     while (true) {
-      const { value, done } = await reader.next()
+      const { value, done } = await nextChunk()
       if (done) break
       const chunk = Buffer.isBuffer(value) ? value : Buffer.from(value)
       sniffed.push(chunk)
       sniffedBytes += chunk.length
-      const text = chunk.toString('utf-8')
+      const text = chunk
+        .subarray(0, Math.max(0, DELIMITER_SNIFF_MAX_BYTES - sniffedBytes + chunk.length))
+        .toString('utf-8')
       const nl = text.indexOf('\n')
       if (nl !== -1) {
         firstLine += text.slice(0, nl)
@@ -91,13 +107,13 @@ export async function getCsvPreviewSlice({
     }
 
     const delimiter = detectDelimiter(firstLine)
-    const parser = parseCsvStream({
+    parser = parseCsvStream({
       columns: false,
       skip_empty_lines: true,
       trim: true,
       relax_column_count: true,
       relax_quotes: true,
-      skip_records_with_error: true,
+      max_record_size: MAX_RECORD_SIZE,
       cast: false,
       bom: true,
       delimiter,
@@ -107,13 +123,13 @@ export async function getCsvPreviewSlice({
     async function* rejoin() {
       for (const chunk of sniffed) yield chunk
       while (true) {
-        const { value, done } = await reader.next()
+        const { value, done } = await nextChunk()
         if (done) return
         yield value
       }
     }
-    const piped = Readable.from(rejoin())
-    piped.on('error', (err) => parser.destroy(err))
+    piped = Readable.from(rejoin())
+    piped.on('error', (err) => parser?.destroy(err))
     piped.pipe(parser)
 
     let headers: string[] = []
@@ -141,6 +157,8 @@ export async function getCsvPreviewSlice({
     if (signal?.aborted) signal.throwIfAborted()
     throw error
   } finally {
+    piped?.destroy()
+    parser?.destroy()
     signal?.removeEventListener('abort', onAbort)
     source.destroy()
   }
 
@@ -132,6 +132,7 @@ import {
 } from '@/lib/mothership/__integration__/content-delivery-fixture'
 import { observePrivateFile } from '@/lib/mothership/agent-cli/engines/observe-private-file'
 import { createAgentCliTransport } from '@/lib/mothership/agent-cli/transport'
+import { createWorkbenchFileProvenance } from '@/lib/mothership/agent-cli/workbench-file-provenance'
 import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
 import { createRegistryContentGate } from '@/lib/mothership/content-delivery/registry-gate'
 import { proxySandboxResourceRequest } from '@/lib/mothership/tools/sandbox-resource-transport'
@@ -251,6 +252,12 @@ describe('content reaching Chat is admitted per item', () => {
         chatId: generateId(),
       },
       registry,
+      files: createWorkbenchFileProvenance({
+        userId: fixture.ids.aliceId,
+        workspaceId: fixture.ids.workspaceId,
+        sessionKey: generateId(),
+        resolvedSecretTraceRegistry: registry,
+      }),
       resources: [],
       observeReads: true,
     })
 
@@ -59,6 +59,7 @@ vi.mock('@/lib/mothership/agent-cli/scoped-transport', () => ({
 
 import { createFileReadTransport } from '@/lib/mothership/agent-cli/file-read-transport'
 import { createAgentCliTransport } from '@/lib/mothership/agent-cli/transport'
+import { createWorkbenchFileProvenance } from '@/lib/mothership/agent-cli/workbench-file-provenance'
 import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
 import { createRegistryContentGate } from '@/lib/mothership/content-delivery'
 import { inspectToolResultForCopilot } from '@/lib/mothership/request/tools/resolved-secret-result'
@@ -204,11 +205,19 @@ function runCli(invocation: CliInvocation, trace = registry()) {
 const invocation = { userId: 'reader', workspaceId: 'workspace', chatId: 'chat' }
 
 /** Chat's CLI transport as every invocation composes it: the registry gate around the routes. */
-function readTransport(trace = registry()): typeof fetch {
+function readTransport(trace = registry(), tracked = true): typeof fetch {
   const transport = createAgentCliTransport({
     endpoint: 'https://sim.test',
     invocation,
     registry: trace,
+    files: tracked
+      ? createWorkbenchFileProvenance({
+          userId: 'reader',
+          workspaceId: 'workspace',
+          sessionKey: 'chat',
+          resolvedSecretTraceRegistry: trace,
+        })
+      : undefined,
     resources: [],
     observeReads: true,
   })
@@ -429,6 +438,16 @@ describe('file provenance at the actual CLI and model-result boundary', () => {
     ).not.toContain(content)
   })
 
+  it('refuses opaque protected downloads without workbench provenance tracking', async () => {
+    classify('exact', revision, [
+      { name: 'FILE_SECRET', encryptedValue: 'fixture-ciphertext', sourceUserId: 'reader' },
+    ])
+    const response = await readTransport(registry(), false)(fileRequest())
+    expect(response.status).toBe(403)
+    expect(await response.text()).not.toContain(content)
+    expect(mocks.stream).not.toHaveBeenCalled()
+  })
+
   it('imports encrypted file provenance into a fresh registry before model projection', async () => {
     classify('exact', revision, [
       { name: 'FILE_SECRET', encryptedValue: 'fixture-ciphertext', sourceUserId: 'reader' },
 
@@ -38,6 +38,7 @@ export function createFileReadTransport(context: {
   transport: typeof fetch
   invocation: CopilotChatDelegationContext & { workspaceId: string }
   registry?: ResolvedSecretTraceRegistry
+  tracksWorkbenchDownloads?: boolean
 }): typeof fetch {
   const base = new URL(context.endpoint)
   const basePath = base.pathname.replace(/\/$/, '')
@@ -105,7 +106,7 @@ export function createFileReadTransport(context: {
           workspaceId: parsed.data.query.workspaceId,
           actorUserId: context.invocation.userId,
           unknown: 'taint',
-          destination: 'workbench',
+          destination: context.tracksWorkbenchDownloads ? 'workbench' : 'model',
         }),
         () =>
           downloadWorkspaceFileStream.execute({
 
@@ -40,6 +40,7 @@ export function createAgentCliTransport(context: {
     transport: createTracedCliTransport(endpoint, createScopedCliTransport(endpoint, invocation)),
     invocation,
     registry,
+    tracksWorkbenchDownloads: Boolean(files),
   })
   const reads: typeof fetch = async (input, init) => {
     const { response, admitted } = await dispatchUnderContentGate(gate, () => routes(input, init))
 
@@ -277,6 +277,7 @@ export const readProjectFileArtifact = defineAuthorizedProjectFileUseCase<
           const inputIdentity = fileDocumentInputIdentity(context.owner, manifest.dependencies)
           const compiled = await compileFileDocument({
             owner: context.owner,
+            sourceMime: file.contentType,
             source: content.toString('utf-8'),
             fileName: file.originalName,
             inputs,
 
@@ -40,7 +40,11 @@ vi.mock('@/lib/uploads/documents/compiled-store', async (importOriginal) => ({
 
 import { type ContentDeliveryGate, observeContentDelivery } from '@/lib/core/application'
 import { createCopilotChatFilePrincipal } from '@/lib/mothership/auth/file-delegation'
-import { collectReferencedFileIds, compileDoc } from '@/lib/uploads/documents/compile'
+import {
+  collectReferencedFileIds,
+  compileDoc,
+  compileFileDocument,
+} from '@/lib/uploads/documents/compile'
 import { DocCompileUserError } from '@/lib/uploads/documents/compile-error'
 
 const executeInSandboxMock = remoteSandboxMockFns.mockExecuteInSandbox
@@ -391,3 +395,29 @@ describe('isolated-VM compile for Chat', () => {
     expect(runSandboxTaskMock).toHaveBeenCalledTimes(2)
   })
 })
+
+describe('compileFileDocument source engine', () => {
+  it('uses the JavaScript PDF task even with the document sandbox enabled', async () => {
+    setEnvFlags({ isDocSandboxEnabled: true })
+    loadCompiledDocMock.mockResolvedValue(null)
+    runSandboxTaskMock.mockResolvedValue(Buffer.from('%PDF-1.7'))
+    runSandboxTaskMock.mockClear()
+    executeInSandboxMock.mockClear()
+    const source = 'const doc = await PDFDocument.create()'
+    const result = await compileFileDocument({
+      owner: { entityType: 'project', entityId: ID },
+      source,
+      sourceMime: 'text/x-pdflibjs',
+      fileName: 'report.pdf',
+      inputs: [],
+      maxBytes: 1024,
+    })
+    expect(result.buffer.toString()).toBe('%PDF-1.7')
+    expect(runSandboxTaskMock).toHaveBeenCalledWith(
+      'pdf-generate',
+      { code: source },
+      expect.any(Object)
+    )
+    expect(executeInSandboxMock).not.toHaveBeenCalled()
+  })
+})
@@ -623,6 +623,7 @@ async function renderPreparedDocument(source: string, fmt: E2BDocFormat, inputs:
 /** Compiles a document against a fixed, authorized input manifest and canonical owner cache. */
 export async function compileFileDocument(args: {
   owner: EditableFileOwner
+  sourceMime: string
   source: string
   fileName: string
   inputs: readonly { fileId: string; contentType: string; content: Buffer }[]
@@ -651,7 +652,7 @@ export async function compileFileDocument(args: {
       dependsOnReferencedFiles: args.inputs.length > 0,
     }
   let buffer: Buffer
-  if (isDocSandboxEnabled) {
+  if (isDocSandboxEnabled && args.sourceMime !== 'text/x-pdflibjs') {
     buffer = await renderPreparedDocument(
       args.source,
       fmt,
 
@@ -40,6 +40,7 @@ import {
 import { runCli } from '@/lib/mothership/agent-cli/run-cli'
 import { createScopedCliTransport } from '@/lib/mothership/agent-cli/scoped-transport'
 import { createAgentCliTransport } from '@/lib/mothership/agent-cli/transport'
+import { createWorkbenchFileProvenance } from '@/lib/mothership/agent-cli/workbench-file-provenance'
 import { createCopilotChatPrincipal } from '@/lib/mothership/auth/application-delegation'
 import {
   updateWorkspaceFileContent,
@@ -145,6 +146,12 @@ describe('chat-delegated file version history', () => {
             endpoint: ORIGIN,
             invocation,
             ...(registry ? { registry } : {}),
+            files: createWorkbenchFileProvenance({
+              userId,
+              workspaceId: fixture.workspaceId,
+              sessionKey: invocation.chatId,
+              resolvedSecretTraceRegistry: registry,
+            }),
             resources: [],
             observeReads: true,
           })