feat(zip): add support for zip files

[Sg312]

Summary

Add support for zip files

Type of Change

• New feature

Testing

Manual

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 21, 2026 12:47am

[greptile-apps]

Greptile Summary

This PR adds ZIP attachment extraction to the mothership copilot flow. The main changes are:

• Allows ZIP uploads in the mothership attachment UI and API.
• Adds archive-aware read and grep guidance.
• Adds an extract operation to materialize_file.
• Adds shared ZIP parsing, size limits, path checks, and rollback handling.

Confidence Score: 4/5

Archive extraction can duplicate files, block retries after failed uploads, and dead-end large mislabeled files.

• Parallel extracts can write into the same destination.
• Failed nested extraction can leave folders that prevent retry.
• Large non-archive files named .zip cycle between read and extract guidance.
• ZIP traversal and expansion limits otherwise appear well contained.

apps/sim/lib/copilot/tools/handlers/materialize-file.ts; apps/sim/lib/copilot/tools/handlers/upload-file-reader.ts; apps/sim/lib/uploads/archive.ts

Important Files Changed

Filename	Overview
apps/sim/lib/copilot/tools/handlers/materialize-file.ts	Adds archive extraction and destination reconciliation, with race and retry bugs around the destination folder.
apps/sim/lib/uploads/archive.ts	Adds a two-pass, bounded ZIP extractor with file rollback, but created folders are not rolled back.
apps/sim/lib/copilot/tools/handlers/upload-file-reader.ts	Adds archive sniffing and guidance, but trusts the extension for large files and can create a read/extract loop.
apps/sim/lib/file-parsers/zip-guard.ts	Adds central-directory statistics used to bound parser allocation before decompression.
apps/sim/app/api/files/upload/route.ts	Allows archive extensions only for mothership uploads.

Comments Outside Diff (3)

1. apps/sim/lib/copilot/tools/handlers/materialize-file.ts, line 926 (link)

   Concurrent Extracts Duplicate Files

   Two parallel extract calls can both pass this existence check before either creates the destination. They then share the folder created by the first call, and the upload layer gives the second archive's files (1) suffixes, so both calls report success with a duplicated or merged tree.

2. apps/sim/lib/copilot/tools/handlers/materialize-file.ts, line 951 (link)

   Orphan Folders Block Retries

   If an upload fails after nested folders were created, archive rollback deletes uploaded files but leaves those folders active. A retry then finds existingSubfolder here and reports the archive as already extracted, even though the first attempt rolled back its files.

3. apps/sim/lib/copilot/tools/handlers/upload-file-reader.ts, line 1219 (link)

   Large Mislabeled Files Dead-End

   A text or CSV upload larger than 5 MB whose name ends in .zip is treated as an archive without checking its bytes. read() therefore requests extraction, extraction rejects it as invalid and points back to read(), leaving the accepted upload inaccessible through either path.

_{Reviews (1): Last reviewed commit: "fix(zip-uploads): detect prior nested-on..." | Re-trigger Greptile}