[waleedlatif1]

Summary

• sim files get / GET /api/v2/files/[fileId] now accept the files/<folder>/<name> VFS path, same as describe/rename/delete (fix(files): accept files/ VFS paths in v2 file describe, rename and delete #9504, fix(files): resolve v2 file paths only on the v2 surface, through the canonical resolver #9531); a path used to fail with a bare "Invalid file id"
• Reuses the existing resolver: contract switches to v2FileIdOrPathParamsSchema, route and the in-process Chat download transport opt in with acceptVfsPath: true, so only the resolver's input-only validation answers before authorization and every other unresolved path goes through admitUnresolvedPath
• The post-stream delivery recheck re-authorizes the resolved file id instead of re-resolving the path, so a rename mid-download can't fail (or retarget) a delivery that was already authorized; id inputs are unchanged
• CLI: arg docs mention the path form; the --output-file result no longer echoes a path as id; regenerated CLI API, OpenAPI audit, and CLI docs

Type of Change

• Bug fix

Testing

• delivery.integration.ts (real Postgres + local storage), new checks:
  • Chat transport downloads the file a path names (not the same-named file in another folder), byte- and header-identical to the id download — red on pre-fix (400)
  • a non-member gets the same refusal for an existing path, a missing path, and a missing id (rendered 404s identical)
  • a path download whose file is renamed mid-stream still delivers — red with the recheck keyed to the raw input
• route.test.ts: GET with a path reaches the use case with acceptVfsPath: true — red without the route opt-in
• Targeted vitest on app/api/v2/files/, file-provenance.test.ts, download-workspace-file.test.ts; bun run lint; check:api-validation:strict, check:cli-api, check:openapi, check:cli-docs

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 3, 2026 8:58pm UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; path downloads retain workspace access checks and final content checks.

Summary

Adds files/<folder>/<name> paths to v2 downloads and sim files get.

• File downloads accept files/ paths and keep the resolved target.
• The CLI downloads files by path without presenting paths as IDs.

No actionable issues were found. Tests were not run during this review.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[CLI or Chat: id or files path] --> B[Resolve within workspace]
  B --> C[Check current access]
  C --> D[Open file bytes]
  D --> E[Recheck resolved id and content receipt]
  E --> F[Deliver bytes]

Loading

_{Reviews (1) · Last reviewed commit: "fix(files): accept files/ VFS paths in v..." · Reviewed by Greptile}

[cubic-dev-ai]

No issues found across 11 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}