fix(files): render image previews inline

[waleedlatif1]

fix(files): render image previews inline

Summary

• Render browser-supported workspace images through the authenticated inline endpoint
• Preserve HEIC derivatives and public share image previews

Type of Change

• Bug fix

Testing

• Focused Vitest coverage (101 tests)
• App type-check
• Lint, block registry, and 33 CI audits

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 24, 2026 2:04am

[cursor]

PR Summary

Medium Risk
Touches authenticated file delivery and Content-Type headers for inline images. MIME inference and URL routing are security-adjacent but reuse existing header sanitization and workspace-scoped routes.

Overview
Workspace file previews now load browser-renderable images from the authenticated inline endpoint instead of the generic serve URL, so they can use content-addressed caching. HEIC/HEIF still go through the derivative preview=1 serve path; public shares keep using the token content URL.

FileContentSource gains buildImageUrl for that split. The inline route infers a real MIME type from the filename when storage stored application/octet-stream, so PNG (and similar) responses are image/png with inline disposition.

^{Reviewed by Cursor Bugbot for commit a40d4de. Configure here.}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[greptile-apps]

Greptile Summary

The PR routes browser-renderable workspace images through the authenticated inline endpoint while retaining derivative-backed preview URLs for HEIC/HEIF and public shares.

• Derives effective response MIME types when storage recorded generic bytes.
• Adds format-aware image URL construction to each file-content source.
• Updates focused route and component coverage for inline PNG rendering.

Confidence Score: 5/5

The PR appears safe to merge with no concrete correctness or security regressions identified.

The changed URL paths preserve HEIC derivatives and public-share behavior, workspace keys provide correct cache identity, current callers maintain workspace scoping, and inferred MIME types continue through the existing secure response-header policy.

Important Files Changed

Filename	Overview
apps/sim/app/api/workspaces/[id]/files/inline/route.ts	Resolves generic stored MIME types before applying the existing secure inline-header policy.
apps/sim/hooks/use-file-content-source.tsx	Adds context-specific image URL generation, routing ordinary workspace images inline while preserving HEIC and public preview behavior.
apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/image-preview.tsx	Delegates image URL selection to the active file-content source without changing preview fallback behavior.
apps/sim/app/api/workspaces/[id]/files/inline/route.test.ts	Covers MIME derivation and inline disposition for generically typed PNG storage.
apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/image-preview.test.tsx	Adds provider-backed coverage confirming browser-renderable images use the workspace inline endpoint.

_{Reviews (2): Last reviewed commit: "fix(files): preserve generic image previ..." | Re-trigger Greptile}

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a40d4de. Configure here.}