fix(chat): download generated files without stale storage URLs

[icecrasher321]

Summary

• Download inline generated files directly from their returned bytes, avoiding CSP-blocked data URL fetches and expired storage links.
• Reuse the execution-log serve route for stored files, preserve safe external provider URLs, and show individual or bulk download failures without opening storage error pages.

Type of Change

• Bug fix

Testing

192 focused tests, type-check, repository lint, and all 46 audits passed. Browser verification under restrictive CSP saved inline and served files with exact byte equality and kept denied files blocked. A real generated PNG downloaded byte-for-byte after its delivered signed URL expired. Regression coverage includes revoked and cross-workspace access, unauthenticated serving, arbitrary external provider IDs, unsafe URLs, bulk failure/retry, response-body cancellation, and safe browser navigation for CORS-restricted external downloads.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 15, 2026 8:58pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

Summary

Chat file downloads now use the file's actual bytes instead of stale or blocked URLs. Stored files go through the current serve route, while external links and bulk-download failures get safer fallback behavior.

• Inline generated files are decoded locally instead of fetched as data URLs.
• Stored files use the authorized serve route to get current bytes.
• External downloads and bulk failures now show safer recovery options.

Diagram

sequenceDiagram
  actor User
  participant Chat as Chat download
  participant Serve as /api/files/serve
  participant External as External host
  participant Browser

  User->>Chat: Click download
  alt Inline base64 exists
    Chat->>Chat: Decode bytes and save blob
  else Recognized storage key
    Chat->>Serve: Fetch current file with inferred context
    alt Authorized response
      Serve-->>Chat: Current bytes
      Chat->>Chat: Save blob
    else 401 and safe delivered URL
      Chat->>External: Fetch delivered URL
      External-->>Chat: File bytes or CORS error
    else Denied or missing
      Serve-->>Chat: Error
      Chat-->>User: Show download error
    end
  else Safe external URL
    Chat->>External: Fetch file
    External-->>Chat: File bytes or CORS error
  else Unsafe or missing URL
    Chat-->>User: Show download error
  end
  opt External host blocks CORS
    Chat-->>User: Show direct download link
    User->>Browser: Open safe external URL
  end

Loading

_{Reviews (4) · Last reviewed commit: "chore(chat): annotate binary download fe..."}

[icecrasher321]

Also addressed the bulk-download finding: failed files are counted and shown in an inline alert, successful files continue downloading, and a successful retry clears the alert. Covered partial failure and retry in the component tests and exercised the actual component under the application CSP.

[icecrasher321]

@greptile

[icecrasher321]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@icecrasher321 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 4 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[icecrasher321]

@greptile

[icecrasher321]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@icecrasher321 I have started the AI code review. It will take a few minutes to complete.

[icecrasher321]

@greptile

[icecrasher321]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@icecrasher321 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}