fix(agent): authorize workspace attachments through execution delegation

[icecrasher321]

Summary

• Let Agent blocks read remembered workspace files in deployed chats through the same trusted executor delegation used by File blocks.
• Carry trusted execution context into large-file preflight and uploads, preserving provider formats and existing file authorization policies.

Type of Change

• Bug fix

Testing

428 tests across 14 files passed, including 12 PostgreSQL/storage/Agent/provider-SDK harness scenarios. The harness verifies persisted references and next-turn byte replay for OpenAI and Anthropic with streaming on/off; provider HTTP responses are synthetic. Negative controls cover missing delegation, wrong workspace, completed executions, mismatched deployments, and deleted files before provider HTTP. Registry-wide attachment strategies and OpenAI/Gemini large uploads are covered. An additional 15 real-authorization cases confirm unprefixed keys remain denied for standalone, session, and system callers. App/auth type-check, full lint, strict API validation, and all 46 audits passed.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 15, 2026 8:59pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no outstanding correctness, security, or repository-rule violation was identified.

Summary

This PR authorizes workspace attachments in actorless deployed-chat executions through the existing trusted executor delegation path.

• Resolves delegated materialization context only for system-principal workspace files.
• Applies the trusted execution context during inline hydration, large-file preflight, and provider uploads.
• Preserves existing authorization for ordinary callers and fails closed for invalid, expired, mismatched, or absent delegation.
• Adds unit and PostgreSQL-backed coverage for replayed attachments, provider strategies, and negative authorization cases.

Diagram

sequenceDiagram
  participant Agent as Agent handler
  participant Provider as Provider pipeline
  participant Delegation as Executor delegation
  participant Auth as File authorization
  participant Storage as File storage
  participant SDK as Provider SDK

  Agent->>Provider: Request with attachment and trusted execution context
  Provider->>Delegation: Resolve executor principal for system workspace file
  Delegation-->>Provider: Deployment-bound delegated principal
  Provider->>Auth: Assert current file-content access
  Auth-->>Provider: Authorized
  Provider->>Storage: Hydrate, presign, or download bytes
  Storage-->>Provider: Authorized file content
  Provider->>SDK: Inline attachment or Files API upload

Loading

_{Reviews (2) · Last reviewed commit: "test(agent): preserve rejection of unpre..."}

[cubic-dev-ai]

All reported issues were addressed across 9 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[icecrasher321]

@greptile

[icecrasher321]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@icecrasher321 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 10 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}