fix(files): normalize encoded embedded ids

[waleedlatif1]

Summary

• normalize encoded embedded file IDs before inline image requests
• preserve document spelling for export rewrites while comparing canonical stored IDs
• cover encoded IDs across rendering, public sharing, export, and Copilot validation

Type of Change

• Bug fix

Testing

• bun run lint
• bun run lint:check
• bun run check:audits
• bun run apps/sim/scripts/check-block-registry.ts origin/staging
• 39 focused tests

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 24, 2026 4:45pm

[cursor]

PR Summary

Low Risk
Targeted ID normalization across file rendering and authorization gates; behavior change is limited to encoded-id edge cases with new test coverage.

Overview
Fixes broken inline images, public-share cascades, and export bundling when markdown embeds use percent-encoded file ids (e.g. /api/files/view/wf%5Fabc).

storedFileId moves from the server-only embedded-refs module into the shared embedded-image-ref util so client and server apply the same single decodeURIComponent when resolving ids for storage/API, while parsers still keep document spelling for export rewrites.

The file content source now emits decoded fileId query params for workspace and public inline URLs. The public inline “referenced-by-doc” check compares canonical ids via storedFileId instead of raw string equality. Export and Copilot embed validation pick up the shared helper; tests cover encoded ids end-to-end.

^{Reviewed by Cursor Bugbot for commit 57701b2. Configure here.}

[greptile-apps]

Greptile Summary

The PR centralizes normalization of document-spelled embedded file IDs and applies it consistently when rendering, authorizing public-share images, exporting files, and validating Copilot-written content.

• Moves storedFileId into the pure, isomorphic embedded-reference utility.
• Canonicalizes encoded IDs before inline requests and storage metadata lookups while retaining their original spelling for export rewrites.
• Adds focused coverage for encoded, double-encoded, and malformed references.

Confidence Score: 5/5

The PR appears safe to merge with encoded embedded-ID handling aligned across all affected paths.

The shared helper decodes document spellings exactly once, malformed values remain unchanged, canonical IDs satisfy route and storage contracts, and export rewriting continues to use the original spelling.

Important Files Changed

Filename	Overview
apps/sim/lib/uploads/utils/embedded-image-ref.ts	Adds a pure single-decode helper with fail-closed handling for malformed and double-encoded IDs.
apps/sim/hooks/use-file-content-source.tsx	Canonicalizes document-spelled file IDs before constructing schema-valid workspace and public inline queries.
apps/sim/app/api/files/public/[token]/inline/route.ts	Compares canonical embedded IDs while retaining workspace-scoped resolution and the referenced-by-document authorization gate.
apps/sim/app/api/files/export/[id]/route.ts	Uses canonical IDs for metadata lookup while preserving raw document spellings as rewrite keys.
apps/sim/lib/copilot/tools/server/files/embedded-image-refs.ts	Aligns Copilot reference validation with the same canonical ID handling used by rendering and export.

_{Reviews (1): Last reviewed commit: "fix(files): normalize encoded embedded i..." | Re-trigger Greptile}