Cap non-editor unbounded async_fs reads (APP-4801 remainder)

[warp-agent-staging]

Description

APP-4801 documents a jemalloc-symbolized heap profile pattern (async_fs::read_to_string -> std::fs::read_to_string -> String::try_reserve_exact) where reading a pathologically large file reserves its entire on-disk size (tens of GiB) in one shot, tripping the "Excessive memory usage detected" Sentry alert (issue 7259255054).

History: #15052 originally implemented this ticket end-to-end, including the crates/warp_files/FileModel editor-buffer read path. #15052 was closed unmerged: another factory run consolidated the FileModel editor path into #15038 (fix: cap unbounded file reads in FileModel to prevent multi-GB memory spikes, APP-4519, branch oz/app-5343-cap-file-read-size), which is still an open draft. #15038's own closing comment on #15052 noted that #15052 "also caps several unrelated read paths ... that are outside APP-4519's scope and not covered by #15038 ... worth re-proposing separately (APP-4801) if still wanted." This PR is that re-proposal: it carries forward only the sites #15038 does not cover.

crates/warp_files/FileModel (the editor buffer load path) is intentionally NOT included here — that's #15038's territory. Do not re-add it in this PR.

Linked Issue

Linear: APP-4801
Closed predecessor: #15052

• Filed by the Sentry memory-triage bot; no ready-to-spec/ready-to-implement label applicable.
• No UI changes; no screenshots needed.

Changes

• crates/warp_util/src/file.rs: shared read_to_string_capped/read_capped helpers. Each opens the file once and reads at most max_bytes + 1 bytes from that single handle via AsyncReadExt::take, rejecting if that limit is reached; metadata() is still queried but only to pre-size the buffer (itself clamped to the cap), never to decide accept/reject. This avoids the fail-open TOCTOU gap of stat-then-reread-by-path (a file can grow/be atomically replaced between the two calls, or be a FIFO/character device that reports an unrelated stat length).
  • Overlap with fix: cap unbounded file reads in FileModel to prevent multi-GB memory spikes (APP-4519) #15038: fix: cap unbounded file reads in FileModel to prevent multi-GB memory spikes (APP-4519) #15038 also edits this file, adding its own MAX_LOADABLE_FILE_SIZE_BYTES constant and a FileLoadError::TooLarge { size_bytes, limit_bytes } variant (via a check_not_too_large stat-then-reread guard — the same fail-open pattern this PR avoids). This PR's additions are independent (new free functions, no changes to existing types), but the file will conflict textually with fix: cap unbounded file reads in FileModel to prevent multi-GB memory spikes (APP-4519) #15038. Whoever lands second should reconcile by keeping both: this PR's read_to_string_capped/read_capped alongside fix: cap unbounded file reads in FileModel to prevent multi-GB memory spikes (APP-4519) #15038's FileLoadError::TooLarge/MAX_LOADABLE_FILE_SIZE_BYTES.
  • Typed error, considered and deferred: fix: cap unbounded file reads in FileModel to prevent multi-GB memory spikes (APP-4519) #15038 uses a dedicated FileLoadError::TooLarge variant rather than a generic io::Error::other, which lets callers distinguish "too large" from other I/O failures. Adopting that shape for this PR's six sites would require changing read_to_string_capped/read_capped's return type away from io::Result, which ripples into every call site's existing err.kind() == ErrorKind::NotFound branching. Kept the current io::Error-based shape to avoid that churn; noting as a follow-up once fix: cap unbounded file reads in FileModel to prevent multi-GB memory spikes (APP-4519) #15038 lands and the two files reconcile.
• app/src/drive/import/nodes.rs: caps the FileType::Notebook (read_to_string) and FileType::Workflow (read) reads in parse_file at 25 MiB. No server-side Drive upload size limit was found in this repo to align with; picked a cap generous enough for hand-authored markdown/YAML but well below the pathological range.
• app/src/ai/mcp/file_mcp_watcher.rs: caps MCP config reads (.mcp.json, Claude/Codex/Agents configs) at 1 MiB. An oversized file now returns FileMCPConfigParseOutcome::Error(FileMCPConfigDiagnosticKind::Read), not Missing, so a temporarily-huge config file doesn't look like the user removed their MCP servers.
• crates/repo_metadata/src/repositories.rs: caps .git gitfile reads (worktrees/submodules) at 1 MiB (sized for Windows long-path installations, whose gitdir: line can run well beyond a few KiB — a tighter cap would make find_git_repo treat a valid worktree/submodule as "not a gitfile" and silently walk past the real repository). An oversized/unreadable file is treated like any other unreadable gitfile (not a valid gitfile — keep walking up).
• app/src/settings/import/alacritty_parser.rs: caps Alacritty config reads at 1 MiB. An oversized file maps to ConfigError::FileIOError, not FileNotFoundError.
• app/src/ai/metadata_project_rules.rs: caps project rule file reads at 1 MiB (matching REMOTE_CONTEXT_MAX_FILE_BYTES, used for the same kind of content on the remote path). The local-read loop is extracted into read_local_rule_contents for direct unit testing.
• app/src/ai/skills/file_watchers/skill_watcher.rs: read_local_project_skill_contents used a synchronous fs::read_to_string with the same unbounded-reservation bug. Made it async and capped it at REMOTE_CONTEXT_MAX_FILE_BYTES (1 MiB) to match the remote read path's existing cap.

Testing

• Added/carried-over regression tests at every changed call site (warp_util::file, Drive import parse_file, MCP config parsing, find_git_repo, Alacritty config parsing, project rule reading, skill_watcher.rs's local skill read) asserting an oversized file is rejected/skipped rather than read wholesale, and that pre-existing error semantics (e.g. NotFound vs. other IO errors) are preserved.
• warp_util::file's own tests include a /dev/zero case (character device reporting a stat length of 0 while yielding unbounded data) and a FIFO case (also stat length 0, content that grows past the cap while the read is in progress) — both correctly reject rather than hanging/growing unbounded.
• ./script/format — clean.
• cargo clippy --workspace --exclude warp_completer --all-targets --tests -- -D warnings — clean.
• cargo clippy -p warp --all-targets --tests -- -D warnings — clean.
• cargo clippy -p warp_completer --all-targets --tests -- -D warnings — clean.
• cargo nextest run --no-fail-fast -p warp_util -p repo_metadata --features local_fs,test-util — 258/258 pass (2 skipped); targeted regression tests in -p warp — 27/27 pass.
• cargo nextest run --no-fail-fast -p warp --features local_fs (full crate) — 6566/6569 pass; the 3 failures are pre-existing/environment-only and unrelated to this diff (e.g. an unauthorized sandbox nsc namespace CLI call).
• Not a UI change, so no visual proof is needed.

Agent Mode

• Warp Agent Mode - This PR was created via Warp's AI Agent Mode

CHANGELOG-BUG-FIX: Fixed several file-import and config-reading code paths that could reserve gigabytes of memory up front when reading a pathologically large file.

[warp-agent-staging]

This PR was generated with Warp.