@ixo/oracle-runtime-workers 0.13.0 → 0.15.0

package/src/attachments/download.ts

@@ -4,14 +4,15 @@
  * the Node runtime's SSRF guard, manual redirect validation and streaming
  * size cap.
  */
-import { detectMimeFromMagicBytes } from './magic';
+import { containerMatchesClaim, detectMimeFromMagicBytes } from './magic';
 import type { AttachmentInput } from './types';
 
 export const MAX_FILE_SIZE = 25 * 1024 * 1024; // 25 MB per file
 export const MAX_TOTAL_SIZE = 50 * 1024 * 1024; // 50 MB across all attachments
 export const ALLOWED_URI_SCHEMES = /^(mxc|https?):\/\//i;
 const MAX_REDIRECT_COUNT = 5;
-const DOWNLOAD_TIMEOUT_MS = 60_000;
+/** Upper bound on one attachment download, from the request to the last byte. */
+export const DOWNLOAD_TIMEOUT_MS = 60_000;
 
 /** Blocks redirects to internal / cloud-metadata addresses (SSRF). */
 const BLOCKED_HOST_PATTERNS = [
@@ -29,6 +30,60 @@ const BLOCKED_HOST_PATTERNS = [
   /^metadata\.google\.internal$/i,
 ];
 
+/**
+ * The file itself is refused — empty, or larger than the cap it was fetched
+ * under. Another download of the same file cannot succeed, so the pipeline
+ * notes it instead of retrying.
+ */
+export class AttachmentRejectedError extends Error {
+  override readonly name: string = 'AttachmentRejectedError';
+}
+
+/** The file is larger than the cap the download ran under. */
+export class AttachmentTooLargeError extends AttachmentRejectedError {
+  override readonly name: string = 'AttachmentTooLargeError';
+}
+
+function tooLarge(maxBytes: number): AttachmentTooLargeError {
+  return new AttachmentTooLargeError(
+    `File exceeds maximum size (${Math.round(maxBytes / 1024 / 1024)} MB) — download aborted`,
+  );
+}
+
+/** The signal's reason as an Error (an aborter may pass any value). */
+function abortError(signal: AbortSignal): Error {
+  const reason: unknown = signal.reason;
+  if (reason instanceof Error) return reason;
+  return new Error(
+    reason === undefined ? 'Attachment download aborted' : String(reason),
+  );
+}
+
+/**
+ * `work`, or the signal's reason as soon as it aborts — so a transfer that
+ * ignores the signal still cannot hold the caller past it.
+ */
+function untilAborted<T>(work: Promise<T>, signal: AbortSignal): Promise<T> {
+  if (signal.aborted) {
+    work.catch(() => undefined);
+    return Promise.reject(abortError(signal));
+  }
+  return new Promise<T>((resolve, reject) => {
+    const onAbort = (): void => reject(abortError(signal));
+    signal.addEventListener('abort', onAbort, { once: true });
+    work.then(
+      (value) => {
+        signal.removeEventListener('abort', onAbort);
+        resolve(value);
+      },
+      (error: unknown) => {
+        signal.removeEventListener('abort', onAbort);
+        reject(error instanceof Error ? error : new Error(String(error)));
+      },
+    );
+  });
+}
+
 /** Throws when the URL is not http(s) or points at a blocked internal host. */
 export function validateUrlTarget(targetUrl: string): void {
   let parsed: URL;
@@ -50,13 +105,21 @@ export function validateUrlTarget(targetUrl: string): void {
 /**
  * Matrix media access the pipeline needs. Implemented over the gateway
  * Durable Object in the user object; tests pass an in-memory fake.
+ *
+ * `signal` aborts at the download deadline or when the turn is aborted: an
+ * implementation stops the transfer then (`readBytesCapped` with the signal
+ * cancels the stream). The pipeline stops waiting at that moment either way.
  */
 export interface MatrixMediaSource {
   /**
    * Raw bytes behind an `mxc://` URI (authenticated media download), the
    * transfer cut off once it passes `maxBytes`.
    */
-  downloadMxc(mxc: string, maxBytes?: number): Promise<Uint8Array>;
+  downloadMxc(
+    mxc: string,
+    maxBytes?: number,
+    signal?: AbortSignal,
+  ): Promise<Uint8Array>;
   /**
    * Bytes of the media event `eventId` in `roomId`, decrypted when the event
    * carries an encrypted `file`, the transfer cut off once it passes
@@ -66,6 +129,7 @@ export interface MatrixMediaSource {
     roomId: string,
     eventId: string,
     maxBytes?: number,
+    signal?: AbortSignal,
   ): Promise<{
     bytes: Uint8Array;
     mimetype?: string;
@@ -80,16 +144,29 @@ export interface DownloadOptions {
   maxBytes?: number;
 }
 
-/** A controller that aborts on `signal` OR after `timeoutMs`, whichever first. */
+/**
+ * A controller that aborts on `signal` (with its reason) OR after
+ * `timeoutMs` (with a timeout error), whichever comes first.
+ */
 function boundedSignal(
   signal: AbortSignal | undefined,
   timeoutMs: number,
 ): { signal: AbortSignal; release: () => void } {
   const controller = new AbortController();
-  const onAbort = (): void => controller.abort();
-  if (signal?.aborted) controller.abort();
+  const onAbort = (): void => {
+    if (signal) controller.abort(signal.reason);
+  };
+  if (signal?.aborted) controller.abort(signal.reason);
   signal?.addEventListener('abort', onAbort);
-  const timer = setTimeout(onAbort, timeoutMs);
+  const timer = setTimeout(
+    () =>
+      controller.abort(
+        new Error(
+          `Attachment download timed out after ${Math.round(timeoutMs / 1000)} s`,
+        ),
+      ),
+    timeoutMs,
+  );
   return {
     signal: controller.signal,
     release: () => {
@@ -111,27 +188,43 @@ function concat(chunks: Uint8Array[], total: number): Uint8Array {
 
 /**
  * Collect a stream into bytes with a running size check: the moment the
- * total passes `maxBytes` the stream is cancelled and an error thrown, so an
- * oversized file never lands in memory whole.
+ * total passes `maxBytes` the stream is cancelled and an
+ * `AttachmentTooLargeError` thrown, so an oversized file never lands in
+ * memory whole. When `signal` aborts, the stream is cancelled and the
+ * signal's reason thrown — a stalled source cannot hold the reader.
  */
 export async function readBytesCapped(
   stream: ReadableStream<Uint8Array>,
   maxBytes: number,
+  signal?: AbortSignal,
 ): Promise<Uint8Array> {
   const reader = stream.getReader();
+  const cancel = (reason?: unknown): void => {
+    reader.cancel(reason).catch(() => undefined);
+  };
+  if (signal?.aborted) {
+    cancel(signal.reason);
+    throw abortError(signal);
+  }
+  const onAbort = (): void => cancel(signal?.reason);
+  signal?.addEventListener('abort', onAbort, { once: true });
   const chunks: Uint8Array[] = [];
   let total = 0;
-  for (;;) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    total += value.byteLength;
-    if (total > maxBytes) {
-      void reader.cancel();
-      throw new Error(
-        `File exceeds maximum size (${Math.round(maxBytes / 1024 / 1024)} MB) — download aborted`,
-      );
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      // A cancel settles the pending read as `done`: not a complete file.
+      if (signal?.aborted) throw abortError(signal);
+      if (done) break;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        cancel();
+        throw tooLarge(maxBytes);
+      }
+      chunks.push(value);
     }
-    chunks.push(value);
+  } finally {
+    signal?.removeEventListener('abort', onAbort);
   }
   return concat(chunks, total);
 }
@@ -168,8 +261,13 @@ export async function downloadFromUrl(
       }
       break;
     }
-    if (!response || (response.status >= 300 && response.status < 400)) {
-      throw new Error('Too many redirects');
+    if (!response) throw new Error('Too many redirects');
+    if (response.status >= 300 && response.status < 400) {
+      throw new Error(
+        response.headers.get('location')
+          ? 'Too many redirects'
+          : `HTTP ${response.status} redirect without a Location header from ${currentUrl}`,
+      );
     }
     if (!response.ok) {
       throw new Error(`HTTP ${response.status} downloading ${url}`);
@@ -178,13 +276,13 @@ export async function downloadFromUrl(
       response.headers.get('content-type')?.split(';')[0]?.trim() ?? undefined;
     const contentLength = response.headers.get('content-length');
     if (contentLength && parseInt(contentLength, 10) > maxBytes) {
-      throw new Error(
+      throw new AttachmentTooLargeError(
         `File too large: server reports ${Math.round(parseInt(contentLength, 10) / 1024 / 1024)} MB (limit: ${Math.round(maxBytes / 1024 / 1024)} MB)`,
       );
     }
     if (!response.body) throw new Error('Response body is not readable');
     return {
-      data: await readBytesCapped(response.body, maxBytes),
+      data: await readBytesCapped(response.body, maxBytes, bound.signal),
       contentType,
       ...(currentUrl !== url ? { finalUrl: currentUrl } : {}),
     };
@@ -195,16 +293,20 @@ export async function downloadFromUrl(
 
 /**
  * Bytes for one attachment from whichever source it names, with the per-file
- * cap enforced before and after the transfer. `mimetype` is the best-known
- * type: content sniffing, then the HTTP `content-type`, then the client's
- * claim.
+ * cap (`opts.maxBytes`, default `MAX_FILE_SIZE`) enforced before and during
+ * the transfer and the `DOWNLOAD_TIMEOUT_MS` deadline (or `opts.timeoutMs`)
+ * on every source — Matrix media included. `mimetype` is the best-known
+ * type: content sniffing (`sniffed` is then true; a container signature
+ * consistent with the claim, such as a zip for a `.docx`, keeps the claimed
+ * type), then the HTTP `content-type`, then the client's claim. An empty
+ * file is refused.
  */
 export async function loadAttachmentBytes(
   attachment: AttachmentInput,
   roomId: string | undefined,
   source: MatrixMediaSource,
   opts: DownloadOptions = {},
-): Promise<{ bytes: Uint8Array; mimetype: string }> {
+): Promise<{ bytes: Uint8Array; mimetype: string; sniffed: boolean }> {
   if (!attachment.eventId && !attachment.mxcUri) {
     throw new Error('Either mxcUri or eventId must be provided');
   }
@@ -213,26 +315,44 @@ export async function loadAttachmentBytes(
   }
   const maxBytes = opts.maxBytes ?? MAX_FILE_SIZE;
   if (attachment.size && attachment.size > maxBytes) {
-    throw new Error('File exceeds maximum size');
+    throw new AttachmentTooLargeError('File exceeds maximum size');
   }
 
   let bytes: Uint8Array;
   let httpType: string | undefined;
-  if (attachment.eventId) {
-    if (!roomId)
-      throw new Error(
-        `Cannot fetch event ${attachment.eventId}: no Matrix room for this turn`,
-      );
-    const media = await source.downloadEvent(
-      roomId,
-      attachment.eventId,
-      maxBytes,
+  if (attachment.eventId || attachment.mxcUri!.startsWith('mxc://')) {
+    const bound = boundedSignal(
+      opts.signal,
+      opts.timeoutMs ?? DOWNLOAD_TIMEOUT_MS,
     );
-    if (!media) throw new Error(`Matrix event ${attachment.eventId} not found`);
-    bytes = media.bytes;
-    httpType = media.mimetype;
-  } else if (attachment.mxcUri!.startsWith('mxc://')) {
-    bytes = await source.downloadMxc(attachment.mxcUri!, maxBytes);
+    try {
+      if (attachment.eventId) {
+        if (!roomId)
+          throw new Error(
+            `Cannot fetch event ${attachment.eventId}: no Matrix room for this turn`,
+          );
+        const media = await untilAborted(
+          source.downloadEvent(
+            roomId,
+            attachment.eventId,
+            maxBytes,
+            bound.signal,
+          ),
+          bound.signal,
+        );
+        if (!media)
+          throw new Error(`Matrix event ${attachment.eventId} not found`);
+        bytes = media.bytes;
+        httpType = media.mimetype;
+      } else {
+        bytes = await untilAborted(
+          source.downloadMxc(attachment.mxcUri!, maxBytes, bound.signal),
+          bound.signal,
+        );
+      }
+    } finally {
+      bound.release();
+    }
   } else {
     const result = await downloadFromUrl(attachment.mxcUri!, {
       ...opts,
@@ -241,10 +361,12 @@ export async function loadAttachmentBytes(
     bytes = result.data;
     httpType = result.contentType;
   }
-  if (bytes.length > maxBytes) {
-    throw new Error('File exceeds maximum size');
-  }
+  if (bytes.length > maxBytes) throw tooLarge(maxBytes);
+  if (bytes.length === 0) throw new AttachmentRejectedError('File is empty');
   const sniffed = detectMimeFromMagicBytes(bytes);
+  if (sniffed && containerMatchesClaim(sniffed, attachment.mimetype)) {
+    return { bytes, mimetype: attachment.mimetype, sniffed: true };
+  }
   return {
     bytes,
     mimetype:
@@ -252,5 +374,6 @@ export async function loadAttachmentBytes(
       (httpType && httpType !== 'application/octet-stream'
         ? httpType
         : attachment.mimetype),
+    sniffed: sniffed !== null,
   };
 }

package/src/attachments/index.ts

@@ -5,6 +5,9 @@ export {
 } from './content-blocks';
 export {
   ALLOWED_URI_SCHEMES,
+  AttachmentRejectedError,
+  AttachmentTooLargeError,
+  DOWNLOAD_TIMEOUT_MS,
   downloadFromUrl,
   loadAttachmentBytes,
   MAX_FILE_SIZE,
@@ -83,3 +86,9 @@ export {
   type AttachmentViewSurface,
   type ViewAttachmentDeps,
 } from './view';
+export {
+  AttachmentTextCacheStore,
+  LOCAL_TEXT_EXTRACTION,
+  VIEW_CACHE_MAX_CHARS,
+  type AttachmentTextCache,
+} from './view-cache';

package/src/attachments/magic.ts

@@ -56,6 +56,38 @@ const MAGIC_MIME_CATEGORIES: Record<string, FileCategory[]> = {
   'video/mp4': ['video', 'audio'],
 };
 
+/**
+ * Signatures that mark a container rather than one format: the bytes are
+ * consistent with every claim listed here, and the claim is the more precise
+ * type (a `.docx` is a zip archive, a HEIC photo an ISO-BMFF `ftyp` box).
+ */
+const CONTAINER_CLAIMS: Record<string, (claimed: string) => boolean> = {
+  'application/zip': (claimed) =>
+    claimed.startsWith('application/vnd.openxmlformats-officedocument.') ||
+    claimed.startsWith('application/vnd.oasis.opendocument.') ||
+    claimed === 'application/epub+zip',
+  'application/msword': (claimed) =>
+    claimed === 'application/vnd.ms-excel' ||
+    claimed === 'application/vnd.ms-powerpoint',
+  'video/mp4': (claimed) =>
+    /^image\/(heic|heif|avif)(-sequence)?$/.test(claimed) ||
+    /^audio\/(mp4|m4a|x-m4a)$/.test(claimed) ||
+    /^video\/(quicktime|3gpp2?)$/.test(claimed),
+  'image/webp': (claimed) =>
+    /^audio\/(wav|wave|x-wav)$/.test(claimed) ||
+    /^video\/(avi|x-msvideo)$/.test(claimed),
+  'video/webm': (claimed) =>
+    claimed === 'audio/webm' || /^(audio|video)\/x-matroska$/.test(claimed),
+};
+
+/** Whether a sniffed container type is consistent with the client's more precise claim. */
+export function containerMatchesClaim(
+  sniffed: string,
+  claimed: string,
+): boolean {
+  return CONTAINER_CLAIMS[sniffed]?.(claimed.toLowerCase()) ?? false;
+}
+
 /** The MIME a file's magic bytes announce, or null when no signature matches. */
 export function detectMimeFromMagicBytes(bytes: Uint8Array): string | null {
   if (bytes.length < 4) return null;
@@ -124,6 +156,7 @@ export function verifyMagicBytes(
     );
     return;
   }
+  if (containerMatchesClaim(detected, attachment.mimetype)) return;
   const allowed = MAGIC_MIME_CATEGORIES[detected];
   if (!allowed || !allowed.includes(claimedCategory)) {
     throw new Error(

package/src/attachments/pipeline.ts

@@ -6,18 +6,23 @@
  *  1. classify + route each attachment by the selected model's native input
  *     capabilities (`send-native` / `parse-local` / `model-extract`);
  *  2. NATIVE lane: download, sniff, base64 into LangChain content blocks on
- *     the human message (cumulative 50 MB budget; any failure or budget
- *     overflow falls that file back to extraction so a bad download never
- *     drops the whole message); the original is archived to the sandbox in
- *     the background;
- *  3. EXTRACT lane: sequential (so the running download total is enforced
- *     before the next fetch), plain text read locally, everything else
+ *     the human message; the original is archived to the sandbox in the
+ *     background. A failed download falls back to extraction so a bad
+ *     download never drops the whole message; a file that is itself refused
+ *     (empty, over the budget) is noted, and one whose content is not what it
+ *     claims goes to the extract lane with its bytes — never downloaded a
+ *     second time, never sent as a native block;
+ *  3. EXTRACT lane: sequential, plain text read locally, everything else
  *     described / transcribed / extracted by the helper model, then archived
  *     to the sandbox — when the archive succeeds the text handed to the model
  *     is truncated to 500 chars and points at the sandbox copy (the agent's
  *     file tools read the rest), exactly as on Node;
  *  4. every attachment's metadata lands on the human message so transcripts
  *     render file chips regardless of which lane consumed it.
+ *
+ * Both lanes share one `MAX_TOTAL_SIZE` download budget (`DownloadBudget`):
+ * declared sizes are checked against what is left before a download, and
+ * each download is cut off at what is left.
  */
 import type { MessageContent } from '@langchain/core/messages';
 import type { ModelInputCapabilities } from '../core/llm';
@@ -31,6 +36,8 @@ import {
 } from './content-blocks';
 import {
   ALLOWED_URI_SCHEMES,
+  AttachmentRejectedError,
+  AttachmentTooLargeError,
   loadAttachmentBytes,
   MAX_FILE_SIZE,
   MAX_TOTAL_SIZE,
@@ -118,22 +125,67 @@ function errorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
 
-/** One attachment through the extract lane (Node's `processAttachment`). */
+const BUDGET_EXCEEDED = 'Total attachment size budget exceeded';
+
+/**
+ * The turn's download budget: `MAX_TOTAL_SIZE` across every attachment,
+ * both lanes. A file is checked against what is left before its download
+ * (declared size) and fetched under a cap of what is left, so a download
+ * never runs past the budget and an over-budget file is never fetched twice.
+ */
+class DownloadBudget {
+  private used = 0;
+
+  get remaining(): number {
+    return Math.max(0, MAX_TOTAL_SIZE - this.used);
+  }
+
+  /** The bytes of `attachment`, counted against the budget. */
+  async load(
+    attachment: AttachmentInput,
+    params: PrepareAttachmentsParams,
+    deps: AttachmentPipelineDeps,
+  ): Promise<{ bytes: Uint8Array; mimetype: string; sniffed: boolean }> {
+    if (attachment.size && attachment.size > MAX_FILE_SIZE)
+      throw new AttachmentTooLargeError('File exceeds maximum size');
+    const remaining = this.remaining;
+    if (remaining === 0 || (attachment.size && attachment.size > remaining))
+      throw new AttachmentRejectedError(BUDGET_EXCEEDED);
+    const cap = Math.min(MAX_FILE_SIZE, remaining);
+    try {
+      const loaded = await loadAttachmentBytes(
+        attachment,
+        params.roomId,
+        deps.source,
+        { fetchImpl: deps.fetchImpl, signal: deps.signal, maxBytes: cap },
+      );
+      this.used += loaded.bytes.length;
+      return loaded;
+    } catch (error) {
+      // Cut off by the budget rather than by the per-file cap.
+      if (error instanceof AttachmentTooLargeError && cap < MAX_FILE_SIZE)
+        throw new AttachmentRejectedError(BUDGET_EXCEEDED);
+      throw error;
+    }
+  }
+}
+
+/**
+ * One attachment through the extract lane (Node's `processAttachment`).
+ * `preloaded` is the file the native lane already downloaded.
+ */
 async function extractOne(
   attachment: AttachmentInput,
-  currentTotal: number,
+  budget: DownloadBudget,
   params: PrepareAttachmentsParams,
   deps: AttachmentPipelineDeps,
-): Promise<{ text: string; downloaded: number; usage?: ExtractionUsage }> {
+  preloaded?: Uint8Array,
+): Promise<{ text: string; usage?: ExtractionUsage }> {
   const safeName = sanitizeAttachmentFilename(attachment.filename);
   if (!attachment.eventId && !attachment.mxcUri)
     throw new Error('Either mxcUri or eventId must be provided');
   if (attachment.mxcUri && !ALLOWED_URI_SCHEMES.test(attachment.mxcUri))
     throw new Error('Invalid URI scheme');
-  if (attachment.size && attachment.size > MAX_FILE_SIZE)
-    throw new Error('File exceeds maximum size');
-  if (attachment.size && currentTotal + attachment.size > MAX_TOTAL_SIZE)
-    throw new Error('Total attachment size budget exceeded');
 
   const category: FileCategory = categorizeFile(attachment.mimetype);
   if (category === 'unsupported') {
@@ -142,16 +194,11 @@ async function extractOne(
     );
     return {
       text: `[File "${safeName}" (${attachment.mimetype}) is not a supported file type and could not be processed]`,
-      downloaded: 0,
     };
   }
 
-  const { bytes } = await loadAttachmentBytes(
-    attachment,
-    params.roomId,
-    deps.source,
-    { fetchImpl: deps.fetchImpl, signal: deps.signal },
-  );
+  const bytes =
+    preloaded ?? (await budget.load(attachment, params, deps)).bytes;
   verifyMagicBytes(bytes, category, attachment, (m) =>
     deps.logger.warn(`[attachments] ${m}`),
   );
@@ -198,7 +245,7 @@ async function extractOne(
   }
 
   if (!deps.sandbox) {
-    return { text, downloaded: bytes.length, ...(usage ? { usage } : {}) };
+    return { text, ...(usage ? { usage } : {}) };
   }
   const destPath = `${SANDBOX_OUTPUT_PREFIX}/${safeName}`;
   try {
@@ -245,7 +292,6 @@ async function extractOne(
         : `\n\n[Full file saved to sandbox at ${actualPath}]`;
       return {
         text: text.slice(0, SANDBOX_TRUNCATE_LIMIT) + paths,
-        downloaded: bytes.length,
         ...(usage ? { usage } : {}),
       };
     }
@@ -254,7 +300,6 @@ async function extractOne(
       : `\n\n[File also saved to sandbox at ${actualPath}]`;
     return {
       text: text + suffix,
-      downloaded: bytes.length,
       ...(usage ? { usage } : {}),
     };
   } catch (error) {
@@ -263,7 +308,6 @@ async function extractOne(
     );
     return {
       text: `${text}\n\n[Warning: sandbox upload failed — file content is included above]`,
-      downloaded: bytes.length,
       ...(usage ? { usage } : {}),
     };
   }
@@ -290,7 +334,14 @@ export async function prepareAttachments(
   }
 
   const nativeCandidates: AttachmentInput[] = [];
-  const extractQueue: AttachmentInput[] = [];
+  // A file the native lane already refused (empty, over budget) carries the
+  // reason and is noted; one it downloaded but will not send carries its
+  // bytes. Neither is downloaded again.
+  const extractQueue: Array<{
+    attachment: AttachmentInput;
+    refused?: Error;
+    preloaded?: Uint8Array;
+  }> = [];
   for (const attachment of params.attachments) {
     const kind = classifyAttachment(attachment);
     const strategy = routeAttachment(kind, params.caps);
@@ -298,31 +349,33 @@ export async function prepareAttachments(
       `[attachments] "${attachment.filename}" (${attachment.mimetype}) kind=${kind} model=${params.model} → ${strategy}`,
     );
     if (strategy === 'send-native') nativeCandidates.push(attachment);
-    else extractQueue.push(attachment);
+    else extractQueue.push({ attachment });
   }
 
+  const budget = new DownloadBudget();
   const natives: NativeAttachment[] = [];
-  let nativeBytesTotal = 0;
   for (const attachment of nativeCandidates) {
     try {
-      const { bytes, mimetype } = await loadAttachmentBytes(
+      const { bytes, mimetype, sniffed } = await budget.load(
         attachment,
-        params.roomId,
-        deps.source,
-        { fetchImpl: deps.fetchImpl, signal: deps.signal },
+        params,
+        deps,
       );
-      if (nativeBytesTotal + bytes.length > MAX_TOTAL_SIZE) {
+      // Only a file whose bytes are what it claims goes to the model as a
+      // block: a sniffed type is classified on its own (a PDF named `.png`
+      // is a document), and a kind other than the claimed one goes through
+      // the extract lane, whose content check notes the mismatch.
+      const kind = classifyAttachment({
+        mimetype,
+        filename: sniffed ? '' : attachment.filename,
+      });
+      if (kind !== classifyAttachment(attachment)) {
         deps.logger.warn(
-          `[attachments] native budget (${Math.round(MAX_TOTAL_SIZE / 1024 / 1024)} MB) exceeded at "${attachment.filename}" — falling back to extraction`,
+          `[attachments] "${attachment.filename}" claims ${attachment.mimetype} but is ${mimetype} — not sent natively`,
         );
-        extractQueue.push(attachment);
+        extractQueue.push({ attachment, preloaded: bytes });
         continue;
       }
-      nativeBytesTotal += bytes.length;
-      const kind = classifyAttachment({
-        mimetype,
-        filename: attachment.filename,
-      });
       natives.push({
         kind: kind === 'image' ? 'image' : 'file',
         mimeType: mimetype,
@@ -349,10 +402,17 @@ export async function prepareAttachments(
         });
       }
     } catch (error) {
+      if (error instanceof AttachmentRejectedError) {
+        deps.logger.warn(
+          `[attachments] "${attachment.filename}" refused: ${errorMessage(error)}`,
+        );
+        extractQueue.push({ attachment, refused: error });
+        continue;
+      }
       deps.logger.warn(
         `[attachments] native load failed for "${attachment.filename}", falling back to extraction: ${errorMessage(error)}`,
       );
-      extractQueue.push(attachment);
+      extractQueue.push({ attachment });
     }
   }
 
@@ -366,23 +426,19 @@ export async function prepareAttachments(
         '[attachments] sandbox archive unavailable for this turn — originals are not archived',
       );
     }
-    let downloadedTotal = 0;
-    for (const attachment of extractQueue) {
+    for (const { attachment, refused, preloaded } of extractQueue) {
       const meta = metaFor(attachment);
       let text: string;
       try {
+        if (refused) throw refused;
         const result = await extractOne(
           attachment,
-          downloadedTotal,
+          budget,
           params,
           deps,
+          preloaded,
         );
-        downloadedTotal += result.downloaded;
-        if (downloadedTotal > MAX_TOTAL_SIZE) {
-          throw new Error(
-            `Total downloaded size (${Math.round(downloadedTotal / 1024 / 1024)} MB) exceeds budget (${Math.round(MAX_TOTAL_SIZE / 1024 / 1024)} MB)`,
-          );
-        }
+        // Counted as soon as it is paid for, whatever happens next.
         if (result.usage) {
           usage.cost += result.usage.cost ?? 0;
           usage.promptTokens += result.usage.promptTokens ?? 0;