feat(files): integrate Project files with the browser and Mothership by mzxchandra · Pull Request #8781 · simstudioai/sim

mzxchandra · 2026-10-08T03:29:44Z

Summary

Add Project Files browser/editor integration on the shared file backend: owner-qualified navigation, folders, history, sharing, copy destinations, previews and collaborative Markdown editing.
Put Projects at the root of organization resource pickers; show environments and shared files beneath each Project. Preserve canonical ownership for search, mentions, clipboard context, embedded panels and chat reloads.
Gate Project roots behind the existing Project release flag and shared-file discovery behind the Project-files gate. With the release flag off, users retain workspace pickers. These surfaces remain unreleased until the Project UI rollout.
Add Sim-side Mothership Project discovery, explicit file-owner context and native CLI dispatch, with current delegated authorization, consumer capability negotiation, recovery and secret provenance. Keep chat ownership and workflow execution files unchanged.
Reconcile live list changes in embedded panels, and keep Project inventories in the query cache instead of duplicated component state.

Stacked on #8610, above #8609 and #8590, with #8762 as the lifecycle prerequisite. Pairs with Mothership #594. Keep the feature disabled until compatible app/realtime/background consumers and the companion worker are deployed. No migrations are added here.

Type of Change

New feature

Testing

Integrated product acceptance: 305 real-Postgres checks and 23 two-browser realtime checks across workspace/Project edits, concurrency, reload/reconnect, navigation, read-only enforcement and live permission changes.
Project picker: canonical root/file selection, nested hierarchy, search deduplication, keyboard/chip behavior, seven database context/authorization checks and six release-on/off browser checks.
Embedded panel: selected-text Add to Chat and archive invalidation without reloading; persisted organization chat restores its owner-qualified file panel.
Actual model run: Project discovery/read/write/copy, explicit-owner denials, clarification-based restricted-source handling, provenance preservation, worker restart/continuation and settled billing. A warm read/set-content/read updated the open browser editor immediately. A separate cold dev-route timeout recovered through the existing durable outbox retry, invoked explicitly because the local harness has no recurring outbox worker.
Final delta: 58 focused tests, app-only type check, formatting, generated artifacts and all 58 audits pass. Earlier handoff regressions have independent negative controls. Full-repository validation runs in exact-head CI.

The worker currently supports full-content replacement for Project files; targeted files edit remains unsupported. Local model verification exercised the supported operation. Remote Python/XLSX generation is not claimed as tested here.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Relevant tests updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-10-08T03:29:51Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 9, 2026 12:26am UTC

mzxchandra · 2026-10-08T03:30:34Z

@greptile

mzxchandra · 2026-10-08T03:30:36Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-08T03:30:40Z

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 209 files

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

Turn on auto-fix | Re-trigger cubic}

greptile-apps · 2026-10-08T03:39:21Z

Confidence Score: 5/5

[High impact] The changes reviewed appear safe to merge; no new blocking issue was established.

Summary

This PR adds owner-qualified Project files to the browser, chat resource pickers, and Mothership file operations.

The latest changes add authenticated sandbox copy callbacks and accept opaque Project pagination cursors.
Project viewers no longer receive workspace-only streaming preview fields.
Earlier findings were checked against the current diff and thread replies. No new actionable issue was established.
mzxchandra accepted retaining denial-before-work assertions, realtime subscription assertions, and the single-dispatch check for malformed successful mutation responses because they protect demonstrated regressions.
Tests and browser checks were not run during this review.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Sandbox copy request] --> B[Check callback key and live lease]
  B --> C[Parse explicit source and destination]
  C --> D[Bind paired copy authority]
  D --> E[Check current chat and both owners]
  E --> F[Stage copied bytes]
  F --> G[Recheck access and commit]
  G --> H[Return copy result]
  G --> I[Record resource updates]

_{Reviews (18) · Last reviewed commit: "fix(project-files): authorize paired san..." · Reviewed by Greptile}

mzxchandra · 2026-10-08T03:49:03Z

@greptile

mzxchandra · 2026-10-08T03:49:05Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-08T03:49:10Z

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 209 files

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

Turn on auto-fix | Re-trigger cubic}

mzxchandra · 2026-10-08T05:04:13Z

@greptile

mzxchandra · 2026-10-08T05:04:15Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-08T05:04:22Z

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

1 issue found across 209 files

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

Turn on auto-fix | Re-trigger cubic}

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/mothership-view.tsx">

<violation number="1" location="apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/mothership-view.tsx:142">
P2: This lookup runs for persisted Project tabs even when `projects` or `project-files` is disabled, bypassing the separate release gates. Gate Project lookups and rendering on both flags.

(Based on your team's feedback about gating Project lookups.)</violation>
</file>

cubic-dev-ai · 2026-10-08T23:13:25Z

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

1 issue found across 227 files

Confidence score: 5/5

The Redis-enabled scenario in project-file-write-transport.integration.ts leaves stale upload_session rows because deleting the fixture file and user does not cascade. Delete the session during teardown.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/sim/lib/mothership/agent-cli/project-file-write-transport.integration.ts">

<violation number="1" location="apps/sim/lib/mothership/agent-cli/project-file-write-transport.integration.ts:691">
P3: The Redis-enabled scenario leaves its completed `upload_session` behind while deleting the fixture file and user; these columns have no cascading foreign keys, so every run leaves stale test data. Delete sessions for `f.userId` during teardown.</violation>
</file>

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.
You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Turn on auto-fix | Re-trigger cubic}

mzxchandra · 2026-10-08T23:23:09Z

Merged the updated backend parent, preserving the Project file fixes. The incoming change is confined to 12 table files; there is no database schema or migration delta.

Validation: nine affected table tests, two Project-tag state regressions (with independent failing guard-removal controls), and the Redis-enabled callback integration test on a fresh database passed. Worker contract sync and the complete 344-command CLI inventory pass against this combined tree. Lint, 58 audits, generators, docs manifest and actual-base block registry checks pass.

For the upload-transport review, the installed embedded Project CLI successfully transferred exact bytes to real same-origin and different-origin HTTP receivers while its identity transport accepted only Project control requests. Byte transfer uses global fetch and does not pass through the Project control scope check. Fixture upload-session cleanup was fixed.

The earlier live archive browser proof remains valid for the unchanged Project file implementation. Physical provider-backed acceptance remains open pending authorized credentials, a compatible template/snapshot and a sandbox-reachable callback. Fresh exact-head CI and both reviews are requested; this PR remains draft.

mzxchandra · 2026-10-08T23:23:11Z

@greptile

mzxchandra · 2026-10-08T23:23:12Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-08T23:23:19Z

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 227 files

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.
You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Turn on auto-fix | Re-trigger cubic}

mzxchandra · 2026-10-08T23:45:11Z

@greptile

mzxchandra · 2026-10-08T23:45:12Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-08T23:45:19Z

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 229 files

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.
You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

View guided diff | Re-trigger cubic}

mzxchandra · 2026-10-08T23:55:59Z

@greptile

mzxchandra · 2026-10-08T23:56:00Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-08T23:56:07Z

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 229 files

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.
You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Turn on auto-fix | Re-trigger cubic}

mzxchandra · 2026-10-09T00:27:20Z

Validation for 10f89e0:

43 focused unit/UI tests passed; both Cubic regressions failed against the original behavior.
Five scoped PostgreSQL integration checks passed after fresh normal migrations, including the authenticated sandbox copy callback, opaque discovery cursor, and existing compound-copy coverage. A final callback rerun also passed with assertions proving feature re-enable and execution of mid-read permission revocation.
The callback accepts all four Project/workspace copy directions and organization/workspace chat contexts. The Project-to-workspace case verifies stored bytes, current actor, durable provenance, and persisted chat/inbox effects. Denial coverage includes current permissions, mid-read revocation, invalid identity/lease, contradictory headers, owner/selection/folder mismatches, disabled feature flags, and cancellation before delegation.
Lint, 58 audits, generated artifacts, documentation checks, and actual-base block registry checks passed. All owned test databases and services were cleaned up.

These are tests of the actual Sim callback with PostgreSQL and Redis. Physical sandbox-provider/worker end-to-end acceptance remains unverified; it requires authorized provider configuration and a reachable callback. The separate earlier live-browser archive/invalidation result remains valid for that unchanged path.

mzxchandra · 2026-10-09T00:27:22Z

@greptile

mzxchandra · 2026-10-09T00:27:23Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-09T00:27:30Z

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 231 files

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.
You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

View guided diff | Re-trigger cubic}

mzxchandra added 5 commits October 7, 2026 15:56

feat(files): extract Project browser and Mothership integration

ab27021

fix(files): integrate successor attribution into product surfaces

1ea5302

fix(files): retain Project handoffs through chat initialization

6508c22

Merge commit '3014cc2427' into codex/project-files-product

f3c81c1

feat(files): add release-gated Project resource discovery

41cb606

This was referenced Oct 8, 2026

feat: establish shared file ownership foundation #8609

Draft

feat(files): add the Project file backend and APIs #8610

Draft

vercel Bot deployed to Preview October 8, 2026 03:31 View deployment

cubic-dev-ai Bot reviewed Oct 8, 2026

View reviewed changes

greptile-apps Bot reviewed Oct 8, 2026

View reviewed changes

Comment thread ...space/[workspaceId]/home/components/user-input/components/prompt-editor/use-prompt-editor.ts Outdated

Comment thread apps/sim/app/workspace/[workspaceId]/files/hooks/use-project-file-upload.ts Outdated

fix(files): reconcile Project browser ownership and upload lifecycle

a43c8a6

vercel Bot temporarily deployed to Preview October 8, 2026 03:48 Inactive

cubic-dev-ai Bot reviewed Oct 8, 2026

View reviewed changes

Comment thread ...ace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/rich-markdown-editor.tsx Outdated

Comment thread ...space/[workspaceId]/home/components/user-input/components/prompt-editor/use-prompt-editor.ts Outdated

greptile-apps Bot reviewed Oct 8, 2026

View reviewed changes

Comment thread ...space/[workspaceId]/home/components/user-input/components/prompt-editor/use-prompt-editor.ts

Comment thread apps/sim/app/workspace/[workspaceId]/files/hooks/use-file-upload-drop.ts Outdated

fix(files): preserve clipboard workspace scope and rollout gates

b72eb80

vercel Bot temporarily deployed to Preview October 8, 2026 04:13 Inactive

cubic-dev-ai Bot reviewed Oct 8, 2026

View reviewed changes

Comment thread apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/mothership-view.tsx

mzxchandra added 2 commits October 8, 2026 00:03

feat(files): add Project sandbox callbacks and scoped grep

f0769a2

fix(files): integrate backend review corrections

0977d6e

cubic-dev-ai Bot reviewed Oct 8, 2026

View reviewed changes

Comment thread apps/sim/lib/mothership/agent-cli/project-file-upload-transport.ts

Comment thread apps/sim/lib/mothership/agent-cli/project-file-write-transport.integration.ts

greptile-apps Bot reviewed Oct 8, 2026

View reviewed changes

Comment thread ...paceId]/home/components/user-input/components/plus-menu-dropdown/plus-menu-dropdown.test.tsx Outdated

Merge current backend parent and address review test cleanup

e5a1288

vercel Bot temporarily deployed to Preview October 8, 2026 23:22 Inactive

cubic-dev-ai Bot reviewed Oct 8, 2026

View reviewed changes

greptile-apps Bot reviewed Oct 8, 2026

View reviewed changes

Comment thread apps/sim/app/o/[organizationId]/home/organization-home.test.tsx Outdated

fix(project-files): protect drafts and align file operations

8dc7054

vercel Bot temporarily deployed to Preview October 8, 2026 23:44 Inactive

cubic-dev-ai Bot reviewed Oct 8, 2026

View reviewed changes

Comment thread ...workspaceId]/home/components/user-input/components/plus-menu-dropdown/plus-menu-dropdown.tsx Outdated

fix(project-files): gate pending mention hydration

64a4652

vercel Bot temporarily deployed to Preview October 8, 2026 23:55 Inactive

cubic-dev-ai Bot reviewed Oct 8, 2026

View reviewed changes

Comment thread ...orkspaceId]/home/components/mothership-view/components/resource-content/resource-content.tsx Outdated

Comment thread apps/sim/lib/api/contracts/mothership-assistant-tools.ts Outdated

fix(project-files): authorize paired sandbox copies and isolate previews

10f89e0

vercel Bot temporarily deployed to Preview October 9, 2026 00:26 Inactive

cubic-dev-ai Bot reviewed Oct 9, 2026

View reviewed changes

Conversation

mzxchandra commented Oct 8, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mzxchandra commented Oct 8, 2026

Uh oh!

mzxchandra commented Oct 8, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 8, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

Uh oh!

mzxchandra commented Oct 8, 2026

Uh oh!

mzxchandra commented Oct 8, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 8, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mzxchandra commented Oct 8, 2026

Uh oh!

mzxchandra commented Oct 8, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 8, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot commented Oct 8, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mzxchandra commented Oct 8, 2026

Uh oh!

mzxchandra commented Oct 8, 2026

Uh oh!

mzxchandra commented Oct 8, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 8, 2026

Uh oh!

vercel Bot commented Oct 8, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

greptile-apps Bot commented Oct 8, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading