fix: cap unbounded file reads in FileModel to prevent multi-GB memory spikes (APP-5343)

FileModel::open and FileModel::read_content_for_file (crates/warp_files)
called async_fs::read_to_string with no size check, so opening a
pathologically large file (e.g. a multi-gigabyte log or binary opened by
mistake) allocated memory proportional to the file's size. A Sentry memory
alert captured a single 8 GB allocation from exactly this call stack.

Add FileLoadError::TooLarge and a MAX_LOADABLE_FILE_SIZE_BYTES (100 MB) cap
enforced via a new FileModel::check_not_too_large helper, applied before
every unbounded read_to_string call site (open, read_content_for_file, and
the file-watcher auto-reload path). Surface a specific, actionable toast
message in the code editor when a file is rejected for being too large.

Co-Authored-By: Warp Agent <agent@warp.dev>
Co-Authored-By: Oz <oz-agent@warp.dev>

Author: 3 people

app/src/ai/blocklist/action_model/execute.rs

@@ -1333,6 +1333,11 @@ async fn read_binary_file_context(
         Ok(content) => content,
         Err(FileLoadError::DoesNotExist) => return Ok(BinaryFileReadResult::NotFound),
         Err(FileLoadError::IOError(e)) => return Err(anyhow::anyhow!(e)),
+        // `read_file_as_binary` never checks against `MAX_LOADABLE_FILE_SIZE_BYTES`
+        // itself (this function already enforces its own `max_bytes` limit
+        // above), so this arm should be unreachable in practice. Handled
+        // explicitly so the match stays exhaustive as `FileLoadError` grows.
+        Err(err @ FileLoadError::TooLarge { .. }) => return Err(anyhow::anyhow!(err)),
     };
 
     let mime_type = from_path(path).first_or_octet_stream().to_string();

app/src/code/view.rs

@@ -127,6 +127,23 @@ pub fn init(app: &mut AppContext) {
 
 const PADDING: f32 = 4.;
 
+/// Renders a byte count in human-readable units (e.g. `8.6 GB`), used for the
+/// "file too large to open" toast message.
+fn format_file_size(bytes: u64) -> String {
+    const UNITS: [&str; 5] = ["B", "KB", "MB", "GB", "TB"];
+    let mut size = bytes as f64;
+    let mut unit_index = 0;
+    while size >= 1024.0 && unit_index < UNITS.len() - 1 {
+        size /= 1024.0;
+        unit_index += 1;
+    }
+    if unit_index == 0 {
+        format!("{bytes} {}", UNITS[unit_index])
+    } else {
+        format!("{size:.1} {}", UNITS[unit_index])
+    }
+}
+
 pub use crate::util::openable_file_type::is_binary_file;
 /// Determines the `SavePosition` ID for a draggable tab based on its index.
 pub fn tab_position_id(index: usize) -> String {
@@ -516,7 +533,7 @@ impl CodeView {
                     return;
                 }
                 log::warn!("Failed to load file. {err:?}");
-                CodeView::display_load_failure(ctx.window_id(), ctx);
+                CodeView::display_load_failure(ctx.window_id(), err, ctx);
             }
             LocalCodeEditorEvent::SelectionAddedAsContext {
                 relative_file_path,
@@ -943,10 +960,26 @@ impl CodeView {
         }
     }
 
-    fn display_load_failure(window_id: WindowId, ctx: &mut ViewContext<Self>) {
+    fn display_load_failure(
+        window_id: WindowId,
+        error: &warp_util::file::FileLoadError,
+        ctx: &mut ViewContext<Self>,
+    ) {
+        let message = match error {
+            warp_util::file::FileLoadError::TooLarge {
+                size_bytes,
+                limit_bytes,
+            } => format!(
+                "File is too large to open ({} > {} limit).",
+                format_file_size(*size_bytes),
+                format_file_size(*limit_bytes)
+            ),
+            warp_util::file::FileLoadError::DoesNotExist
+            | warp_util::file::FileLoadError::IOError(_) => "Failed to load file.".to_string(),
+        };
         ToastStack::handle(ctx).update(ctx, |toast_stack, ctx| {
-            let toast = DismissibleToast::error(String::from("Failed to load file."))
-                .with_object_id("failed_to_load_file".to_string());
+            let toast =
+                DismissibleToast::error(message).with_object_id("failed_to_load_file".to_string());
             toast_stack.add_ephemeral_toast(toast, window_id, ctx);
         });
     }

crates/warp_files/src/lib.rs

@@ -24,7 +24,7 @@ use repo_metadata::repository::{RepositorySubscriber, SubscriberId};
 use repo_metadata::{CanonicalizedPath, Repository, RepositoryUpdate, RepositoryWatchMode};
 use warp_core::HostId;
 use warp_util::content_version::ContentVersion;
-use warp_util::file::{FileId, FileLoadError, FileSaveError};
+use warp_util::file::{FileId, FileLoadError, FileSaveError, MAX_LOADABLE_FILE_SIZE_BYTES};
 use warp_util::standardized_path::StandardizedPath;
 use warpui_core::r#async::SpawnedFutureHandle;
 use warpui_core::{Entity, ModelContext, ModelHandle, SingletonEntity};
@@ -447,9 +447,12 @@ impl FileModel {
         let file_path_buf = file_path.to_owned();
         let future = ctx.spawn(
             async move {
-                let contents = async_fs::read_to_string(&file_path_buf)
-                    .await
-                    .map_err(FileLoadError::from);
+                let contents = match Self::check_not_too_large(&file_path_buf).await {
+                    Ok(()) => async_fs::read_to_string(&file_path_buf)
+                        .await
+                        .map_err(FileLoadError::from),
+                    Err(err) => Err(err),
+                };
                 (file_id, contents)
             },
             move |me, (file_id, load_result), ctx| {
@@ -521,11 +524,37 @@ impl FileModel {
         if !Self::file_exists(file_path).await {
             return Err(FileLoadError::DoesNotExist);
         }
+        Self::check_not_too_large(file_path).await?;
         async_fs::read_to_string(file_path)
             .await
             .map_err(FileLoadError::from)
     }
 
+    /// Returns `Err(FileLoadError::TooLarge)` if `path`'s on-disk size exceeds
+    /// [`MAX_LOADABLE_FILE_SIZE_BYTES`]. Reading a file's full contents into a
+    /// `String` (as `open`/`read_content_for_file` do) can otherwise trigger a
+    /// single allocation as large as the file itself; an unexpectedly huge
+    /// file (a multi-gigabyte log, database, or binary opened by mistake) can
+    /// then spike process memory by that same amount. Checking the size
+    /// up front avoids ever attempting that allocation.
+    ///
+    /// If `metadata` fails (e.g. the file does not exist or was removed
+    /// concurrently), this returns `Ok(())` so the caller's own read attempt
+    /// surfaces the more specific underlying error.
+    async fn check_not_too_large(path: &Path) -> Result<(), FileLoadError> {
+        let Ok(metadata) = async_fs::metadata(path).await else {
+            return Ok(());
+        };
+        let size_bytes = metadata.len();
+        if size_bytes > MAX_LOADABLE_FILE_SIZE_BYTES {
+            return Err(FileLoadError::TooLarge {
+                size_bytes,
+                limit_bytes: MAX_LOADABLE_FILE_SIZE_BYTES,
+            });
+        }
+        Ok(())
+    }
+
     /// Asynchronously reads specific lines from a file using BufReader.
     ///
     /// # Arguments
@@ -1145,6 +1174,10 @@ impl FileModel {
             async move {
                 let mut res = Vec::new();
                 for file_path in matching_files {
+                    if let Err(err) = Self::check_not_too_large(&file_path).await {
+                        log::warn!("Skipping auto-reload of {}: {err}", file_path.display());
+                        continue;
+                    }
                     if let Ok(content) = async_fs::read_to_string(&file_path).await {
                         res.push((file_path, content));
                     }

crates/warp_files/src/lib_tests.rs

@@ -356,4 +356,64 @@ fn test_a_failed_open_registers_no_watcher() {
     });
 }
 
+/// Opening a file whose on-disk size exceeds `MAX_LOADABLE_FILE_SIZE_BYTES`
+/// must fail with `FileLoadError::TooLarge` instead of reading the whole file
+/// into memory. A single pathologically large file (a huge log, a binary
+/// opened by mistake, etc.) could otherwise trigger a multi-gigabyte
+/// allocation. Uses a sparse file (`set_len`) so the test doesn't actually
+/// need to write the oversized content to disk.
+#[test]
+fn test_load_oversized_file_reports_too_large() {
+    App::test((), |mut app| async move {
+        let app = &mut app;
+        let files = app.add_singleton_model(FileModel::new);
+        let receiver = setup_event_channel(app, &files);
+
+        let directory = tempfile::tempdir().expect("temp dir");
+        let path = directory.path().join("huge.log");
+        let file = std::fs::File::create(&path).expect("create file");
+        file.set_len(MAX_LOADABLE_FILE_SIZE_BYTES + 1)
+            .expect("set sparse length");
+        drop(file);
+
+        files.update(app, |model, ctx| {
+            model.open(&path, false, ctx);
+        });
+
+        match receiver.recv().await.expect("Could not receive the result") {
+            TestFileModelEvent::FailedToLoad(err) => {
+                assert!(
+                    err.contains("TooLarge"),
+                    "expected TooLarge error, got {err}"
+                );
+            }
+            event => panic!("Expected oversized file to fail to load, got {event:?}"),
+        }
+    });
+}
+
+/// [`FileModel::read_content_for_file`] is used for reload/discard flows and
+/// must apply the same size guard as `open`.
+#[test]
+fn test_read_content_for_file_reports_too_large() {
+    App::test((), |mut _app| async move {
+        let directory = tempfile::tempdir().expect("temp dir");
+        let path = directory.path().join("huge.log");
+        let file = std::fs::File::create(&path).expect("create file");
+        file.set_len(MAX_LOADABLE_FILE_SIZE_BYTES + 1)
+            .expect("set sparse length");
+        drop(file);
+
+        let result = FileModel::read_content_for_file(&path).await;
+        assert!(
+            matches!(
+                result,
+                Err(FileLoadError::TooLarge { limit_bytes, .. })
+                    if limit_bytes == MAX_LOADABLE_FILE_SIZE_BYTES
+            ),
+            "expected TooLarge error, got {result:?}"
+        );
+    });
+}
+
 static TEST_FILE_CONTENT: &[u8] = include_bytes!("../test_data/test_file.rs");

crates/warp_util/src/file.rs

@@ -32,12 +32,22 @@ impl ErrorExt for FileSaveError {
 }
 register_error!(FileSaveError);
 
+/// Maximum size, in bytes, of a file that can be fully loaded into memory as a
+/// `String` (e.g. to populate an editor buffer). Reading larger files whole
+/// risks multi-gigabyte allocations for pathologically large files (logs,
+/// binaries opened by mistake, etc.); callers should check
+/// [`FileLoadError::TooLarge`] and surface a friendly error instead of
+/// attempting the read.
+pub const MAX_LOADABLE_FILE_SIZE_BYTES: u64 = 100 * 1024 * 1024;
+
 #[derive(thiserror::Error, Debug)]
 pub enum FileLoadError {
     #[error("File does not exist")]
     DoesNotExist,
     #[error("IO error when loading file.")]
     IOError(#[from] io::Error),
+    #[error("File is too large to open ({size_bytes} bytes, limit is {limit_bytes} bytes)")]
+    TooLarge { size_bytes: u64, limit_bytes: u64 },
 }
 
 #[derive(Copy, Clone, Debug, Hash, PartialEq, Eq, PartialOrd, Ord)]