fix(file): enforce single-archive decompress at the API boundary

The block already rejects multiple archives, but the manage route is the
real boundary (callable directly and by the LLM tool) and still took the
first of multiple resolved inputs. Add the empty-input and >1-archive guards
in the route so extra archives are rejected with a clear error rather than
silently ignored (cursor).

Author: waleedlatif1

apps/sim/app/api/tools/file/manage/route.ts

@@ -673,6 +673,16 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         const selectedFileIds = fileId ? [fileId] : extractFileIdsFromInput(fileInput)
         const selectedInputFiles = fileId ? [] : extractUserFilesFromInput(fileInput)
 
+        if (selectedFileIds.length === 0 && selectedInputFiles.length === 0) {
+          return NextResponse.json({ success: false, error: 'File is required' }, { status: 400 })
+        }
+        if (selectedFileIds.length + selectedInputFiles.length > 1) {
+          return NextResponse.json(
+            { success: false, error: 'Decompress accepts a single .zip archive at a time' },
+            { status: 400 }
+          )
+        }
+
         const workspaceFiles = await Promise.all(
           selectedFileIds.map((id) => getWorkspaceFile(workspaceId, id))
         )