fix(csv): neutralize formula-leading exports

[waleedlatif1]

Summary

• neutralize formula-leading values across generated CSV exports
• centralize CSV formatting and remove duplicate serializers and download code
• add regression coverage for formula injection and CSV escaping

Type of Change

• Bug fix

Testing

• bun run lint
• bun run check:audits
• bun run apps/sim/scripts/check-block-registry.ts origin/staging
• bun run type-check in apps/sim
• 98 focused Vitest tests

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 22, 2026 10:26pm

[cursor]

PR Summary

Medium Risk
Touches every CSV export path and changes cell encoding (formula prefixing). Behavior is defensive, but a serializer bug would affect downloads and copilot-mounted table CSVs.

Overview
Closes CSV injection gaps by prefixing formula-leading cells (=, +, -, @, tab, CR) across generated CSV, not just table exports.

Moves formatCsvValue / toCsvRow into @/lib/core/utils/csv and wires that helper into audit, usage, execution-log, copilot file, chat, and terminal-console CSV. Duplicate local serializers and download-link code are removed; chat/console downloads go through saveBlob.

Adds unit coverage for neutralization and escaping, including formula-leading copilot, chat, and console exports.

^{Reviewed by Cursor Bugbot for commit f35abc7. Configure here.}

[greptile-apps]

Greptile Summary

This PR centralizes CSV field formatting and escaping, then applies formula neutralization consistently across API, table, Copilot, chat, and terminal exports.

• Adds shared CSV formatting, formula-neutralization, and row-escaping utilities with regression tests.
• Migrates existing export paths away from duplicate serializers.
• Consolidates browser-side Blob downloads through the existing shared helper.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or independently actionable non-blocking defects identified.

The shared formatter neutralizes reachable formula-leading string cells before applying CSV escaping, and the migrated export paths preserve their existing serialization, provenance, streaming, and browser-download contracts.

Important Files Changed

Filename	Overview
apps/sim/lib/core/utils/csv.ts	Introduces the canonical CSV value formatter and row escaper, including formula neutralization for string values.
apps/sim/app/api/logs/export/route.ts	Replaces the route-local CSV serializer with the shared formatter while preserving streaming behavior.
apps/sim/lib/copilot/request/tools/files.ts	Uses canonical CSV formatting for generated Copilot files while retaining persisted-value provenance bookkeeping.
apps/sim/lib/table/export-format.ts	Removes duplicate generic CSV helpers while retaining table-specific cell and filename formatting.
apps/sim/lib/table/export-stream.ts	Migrates streamed table exports to the shared CSV row serializer.
apps/sim/stores/chat/store.ts	Neutralizes exported chat cells and delegates Blob downloads to the shared browser helper.
apps/sim/stores/terminal/console/store.ts	Applies shared CSV formatting to normalized console entries while preserving the specialized safe object serializer.
apps/sim/lib/core/utils/csv.test.ts	Covers formula triggers, primitive and object serialization, empty serialization, and RFC-style field escaping.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Export source values] --> B[formatCsvValue]
  B --> C[Neutralize formula-leading strings]
  C --> D[toCsvRow]
  D --> E[Escape quotes, commas, CR and LF]
  E --> F{Export target}
  F --> G[API response stream]
  F --> H[Table or Copilot file]
  F --> I[Browser Blob download]

Loading

_{Reviews (1): Last reviewed commit: "fix(csv): neutralize formula-leading exp..." | Re-trigger Greptile}