feat: add shared Project files by mzxchandra · Pull Request #8610 · simstudioai/sim

mzxchandra · 2026-10-04T12:50:28Z

Summary

Add shared Project files for architecture notes and reference documentation, with folders, uploads, history, copy, recursive downloads, extraction, public links, document compilation and collaborative Markdown editing.
Use the same authorized operations for sessions, v2/CLI and delegated Mothership callers. Writes require an organization admin, an admin in an active environment, or write access in every active environment. Workspace API keys do not gain Project authority.
Keep execution files workspace scoped and chats personal/organization scoped. Separate creator attribution, authorization and billing from the shared file-owner interface, backed by explicit owner FKs in feat: establish shared file ownership foundation #8609.
Carry ownership through realtime and retention; preserve current authorization during concurrent joins and writes. Workspace and Project folders share atomic child relocation, while file purges commit cleanup intents and billing together.
Preserve file-browser settings and owner-qualified Project file/folder tabs in chat. Handle supported extensionless names, inferred MIME types, image previews, Project document assets, and draft-source copying consistently. Refresh sharing and copy destinations after uncertain responses or realtime changes, and disclose truncated CSV previews without offering workspace-only actions.
Require copy revisions, bound retention queries and sandbox payload allocation, rate-limit CSV previews, authorize HEAD without compilation or download side effects, and allow the collaborative snapshot envelope through the proxy while retaining ordinary JSON limits.

Stacked on #8609, above #8590; #8580 has merged. Retire incompatible consumers before enabling the default-off Project files flag. Companion Mothership #594 uses the same owner protocol and needs no change for these fixes. This PR adds no further migration.

Type of Change

New feature

Testing

Root lint, all 26 workspace type-check tasks, all audits, generated artifacts, docs manifest, block registry and migration checks pass.
Full root tests pass: 373 script tests and all 19 workspace tasks, including 34,849 app tests with 20 existing skips.
Fresh migration, replay and schema generation pass without drift. All 115 targeted PostgreSQL checks pass across ownership, history, sharing, cleanup, billing, search and chat context; all 20 Project Socket.IO checks and both upload/cache UI regressions pass.
The running app and relay pass 80 HTTP acceptance checks across browsing, history, rendering, public/password sharing, embedded sources, copying and realtime. Fifteen distinct Chromium checks verify scoped chat-history cleanup, Project folder navigation, lost sharing responses, cross-client copy destinations, CSV truncation and cancelled file drags.
Independent negative controls demonstrate the authorization, realtime, retention, search, reference-scanning, inline-cache, artifact-HEAD, optional-revision, scoped-resource, folder-dispatch and CSV-warning regressions. The latest owner-search suite passes all 15 checks on fresh migrated PostgreSQL; removing the authority guard fails the unchanged lock-order assertion.

Earlier revisions passed native browser collaboration and navigation checks. This revision adds Chromium file-state verification alongside HTTP, PostgreSQL and Socket.IO testing. Drag, sharing and cross-client copy cases passed with the fixes; supplemental negative runs for those three were blocked by dev-cache runtime crashes. Live-model testing and remote Python/XLSX generation remain unverified locally. CI is manually dispatched for the updated branches; workflow triggers and timeouts are unchanged.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-10-04T12:50:35Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 6, 2026 9:59pm UTC

mzxchandra · 2026-10-06T00:31:12Z

@greptile

mzxchandra · 2026-10-06T00:31:15Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-06T00:31:20Z

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 485 files

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

Re-trigger cubic}

Reuse entity-owned file operations across Project UI, session APIs, v2/CLI, and delegated Mothership callers. Add Project discovery, sharing, history, copy, collaborative editing, and current-access invalidation while preserving workspace execution boundaries and independent creator/payer attribution. Keep activation gated behind the file-ownership compatibility foundation. Run real HTTP suites through disposable fixture orchestration in CI.

greptile-apps · 2026-10-06T00:39:34Z

Confidence Score: 5/5

[Critical risk] Adds new public API routes for project file operations.

The changes reviewed since the previous review appear safe to merge, with no outstanding findings identified.

Summary

The PR adds shared Project files across the application, APIs, CLI, realtime collaboration, and file browser. Since the previous review, it also adds an embedded Project folder view and refreshes drag, sharing, copy-destination, and CSV-preview behavior.

_{Reviews (5) · Last reviewed commit: "fix(files): refresh scoped file views an..."}

mzxchandra · 2026-10-06T00:46:17Z

@greptile

mzxchandra · 2026-10-06T00:46:19Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-06T00:46:23Z

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 485 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

Re-trigger cubic}

mzxchandra · 2026-10-06T19:59:23Z

@greptile

mzxchandra · 2026-10-06T19:59:25Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-06T19:59:31Z

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

greptile-apps · 2026-10-06T20:04:00Z

Comments Outside Diff

These findings could not be posted inline.

Project admins can be denied apps/sim/lib/projects/application/authorization.ts:95 ▶

When a user belongs to multiple organizations, this query loads just one membership without filtering for the Project’s organization. If it selects a different organization’s row, the later check treats the user as a non-admin. An administrator can then be denied Project administration or shared-file access despite having the required role.

mzxchandra · 2026-10-06T20:11:44Z

Regarding the outside-diff finding “Project admins can be denied”: the premise of simultaneous memberships in multiple organizations is excluded by the current database invariant. packages/db/schema.ts declares member_user_id_unique on member.userId, installed by migration 0136_pretty_jack_flag.sql. A real PostgreSQL attempt to construct the proposed multi-organization fixture is rejected by that unique constraint before authorization runs. The membership lookup also compares the returned organization to the canonical Project organization. No authorization change is appropriate while this single-organization invariant remains in force.

cubic-dev-ai

All reported issues were addressed across 492 files

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

Turn on auto-fix | Re-trigger cubic}

mzxchandra · 2026-10-06T21:13:32Z

@greptile

mzxchandra · 2026-10-06T21:13:33Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-06T21:13:39Z

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 495 files

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

Turn on auto-fix | Re-trigger cubic}

mzxchandra · 2026-10-06T21:59:57Z

@greptile

mzxchandra · 2026-10-06T21:59:59Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-06T22:00:07Z

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 498 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.
You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Turn on auto-fix | Re-trigger cubic}

mzxchandra mentioned this pull request Oct 4, 2026

feat: establish shared file ownership foundation #8609

Draft

6 tasks done

vercel Bot deployed to Preview October 4, 2026 12:52 View deployment

mzxchandra mentioned this pull request Oct 5, 2026

feat(projects): backfill and enforce membership in SQL #8590

Open

7 tasks done

mzxchandra added this pull request to stack #8630 October 5, 2026 18:24

mzxchandra force-pushed the codex/project-files branch from 9dae237 to 3db7e57 Compare October 5, 2026 21:02

vercel Bot deployed to Preview October 5, 2026 21:04 View deployment

vercel Bot deployed to Preview October 5, 2026 22:14 View deployment

vercel Bot temporarily deployed to Preview October 5, 2026 22:42 Inactive

vercel Bot temporarily deployed to Preview October 5, 2026 23:29 Inactive

vercel Bot deployed to Preview October 6, 2026 00:33 View deployment

cubic-dev-ai Bot reviewed Oct 6, 2026

View reviewed changes

mzxchandra added 6 commits October 5, 2026 17:39

refactor: use explicit Project file ownership storage

0985191

refactor: carry file owners through collaborative documents

4f45fa6

refactor: consolidate background file retention by owner

8de6b11

fix(files): close retention races and preserve browser navigation

845b9c5

fix(files): require explicit owners in live documents

a9fd086

greptile-apps Bot reviewed Oct 6, 2026

View reviewed changes

Comment thread apps/sim/lib/projects/files/application/authorization.ts Outdated

Comment thread apps/sim/app/workspace/[workspaceId]/files/project-files.tsx

mzxchandra force-pushed the codex/project-files branch from 547eb7b to a9fd086 Compare October 6, 2026 00:44

vercel Bot deployed to Preview October 6, 2026 00:46 View deployment

cubic-dev-ai Bot reviewed Oct 6, 2026

View reviewed changes

mzxchandra added 3 commits October 5, 2026 23:56

chore(files): sync Project files with ownership foundation

c274a0a

fix(files): address Project file review findings

ef1a434

chore(files): sync CI fixture corrections from foundation

1a846f2

vercel Bot deployed to Preview October 6, 2026 18:44 View deployment

fix(files): initialize cleanup database only when cleanup runs

5da2222

cubic-dev-ai Bot reviewed Oct 6, 2026

View reviewed changes

mzxchandra added 3 commits October 6, 2026 13:48

fix(files): preserve scoped resources and delivery semantics

90dac8c

chore(files): carry foundation review fixes into project files

98739df

chore(files): sync owner-qualified realtime regression coverage

9115b91

vercel Bot deployed to Preview October 6, 2026 21:15 View deployment

cubic-dev-ai Bot reviewed Oct 6, 2026

View reviewed changes

fix(files): refresh scoped file views and sharing state

587b892

vercel Bot temporarily deployed to Preview October 6, 2026 21:59 Inactive

cubic-dev-ai Bot reviewed Oct 6, 2026

View reviewed changes

Conversation

mzxchandra commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mzxchandra commented Oct 6, 2026

Uh oh!

mzxchandra commented Oct 6, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 6, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

Uh oh!

Uh oh!

mzxchandra commented Oct 6, 2026

Uh oh!

mzxchandra commented Oct 6, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 6, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

mzxchandra commented Oct 6, 2026

Uh oh!

mzxchandra commented Oct 6, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 6, 2026

Uh oh!

greptile-apps Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Comments Outside Diff

Uh oh!

mzxchandra commented Oct 6, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mzxchandra commented Oct 6, 2026

Uh oh!

mzxchandra commented Oct 6, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 6, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

mzxchandra commented Oct 4, 2026 •

edited

Loading

vercel Bot commented Oct 4, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

greptile-apps Bot commented Oct 6, 2026 •

edited

Loading

greptile-apps Bot commented Oct 6, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading