Q125: imports stream through a bounded window and refuse files over 1 GiB

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/unit/private-attachments.test.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { mkdirSync, writeFileSync } from "node:fs";
+import { mkdirSync, readdirSync, rmSync, truncateSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { describe, expect, test, vi } from "vitest";
@@ -13,7 +13,7 @@ const { FileService } = await import("../../src/main/services/file-service");
 const { dispatchAgentTool } = await import("../../src/main/services/agent-tools");
 
 describe("files shared in a private conversation", () => {
-  test("a file imported into a direct conversation is readable by its members only", () => {
+  test("a file imported into a direct conversation is readable by its members only", async () => {
     const connection = new DatabaseConnection(join(tmpdir(), `ac-private-${randomUUID()}.db`));
     const organization = new OrganizationService(connection.db);
     const chat = new ChatService(connection.db);
@@ -33,7 +33,7 @@ describe("files shared in a private conversation", () => {
     mkdirSync(source, { recursive: true });
     writeFileSync(join(source, "salary.md"), "Dana's raise: 10%");
     const artifacts = join(tmpdir(), `ac-private-art-${randomUUID()}`);
-    const fileId = new FileService(connection.db, artifacts).importPath(orgId, join(source, "salary.md"), dm);
+    const fileId = await new FileService(connection.db, artifacts).importPath(orgId, join(source, "salary.md"), dm);
 
     const deps = { db: connection.db, organization, chat };
     const as = (agentId: string) => ({ orgId, agent: { id: agentId, modelProviderId: null, modelId: null }, taskProjectId: null, taskGoalId: null, taskId: null, sourceThreadId: null, workspace: null });
@@ -50,4 +50,20 @@ describe("files shared in a private conversation", () => {
       .toEqual([{ type: "agent" }, { type: "employee" }]);
     connection.close();
   });
+
+  test("a file over the import limit is refused before anything is copied", async () => {
+    const connection = new DatabaseConnection(join(tmpdir(), `ac-import-limit-${randomUUID()}.db`));
+    let orgId = "";
+    connection.transaction(() => {
+      orgId = new OrganizationService(connection.db).createOrganization({ organizationName: "Acme", employeeName: "Yang", mission: "m", goal: "g" });
+    });
+    const huge = join(tmpdir(), `ac-huge-${randomUUID()}.bin`);
+    writeFileSync(huge, "");
+    truncateSync(huge, 1024 * 1024 * 1024 + 1);
+    const artifacts = join(tmpdir(), `ac-import-limit-art-${randomUUID()}`);
+    await expect(new FileService(connection.db, artifacts).importPath(orgId, huge, null)).rejects.toThrow("files over 1024.0 MiB cannot be imported");
+    expect(readdirSync(artifacts, { recursive: true })).toEqual([]);
+    rmSync(huge);
+    connection.close();
+  });
 });