feat(files): add the Project file backend and APIs by mzxchandra · Pull Request #8610 · simstudioai/sim

mzxchandra · 2026-10-04T12:50:28Z

Summary

Add the complete Project-file backend: folders, uploads, edits, history, copy, recursive listing/downloads, extraction, search, compiled documents, sharing and realtime persistence callbacks.
Reuse authorized application operations across sessions, v2/CLI and delegated callers. Writes require an organization admin, an admin in an active environment, or write access in every active environment; workspace API keys do not acquire Project authority.
Preserve canonical ownership and revision checks through storage, history, billing, retention, cross-owner copies and content delivery. Public/password/email/SSO sharing rechecks current policy and dependencies.
Keep Project operations behind the existing release gates. Execution files remain workspace scoped; chat ownership remains personal/organization scoped.

Stacked on #8609 above #8590, with #8762 as the lifecycle prerequisite. This PR contains the backend, HTTP API, CLI, documentation and the public-share viewer required for content delivery. Stacked #8781 adds authenticated Project Files UI, picker/mentions and Sim-side Mothership integration; Mothership #594 is its separate worker companion. No additional migration is introduced here.

Type of Change

New feature

Testing

Hosted CI and standalone desktop-e2e passed on 44afd159b40eb485bb49d26b96faa779d1a0f3b1, including all eight integration shards and Project Files/mobile/desktop HTTP suites. Greptile and Cubic completed on the production-equivalent 7c68116cdf; the final commit only removes mocked logger assertions requested by review. All review threads are answered and resolved.

Current membership-alignment validation:

Focused local route/cleanup tests: 32 passed; CLI transfer tests: 10 passed; CLI operation declarations: 3 passed; CLI package type check passed after correcting the Project upload part-URL operation name.
Real PostgreSQL runs passed 124 and 54 test cases. Fixture cleanup failures were corrected; authorization (28 cases) and browser (5 cases) reruns pass including cleanup.
CLI/MCP generated artifacts were regenerated and are consistent; the tool dependency graph baseline was reconciled with the merged parent.
Follow-up fixes include current-schema HTTP fixtures, owned-file accounting, and updated context/error mocks. Focused reruns passed the dimensions case, 3 changelog database cases, and all 10 file-serving route cases.
Latest delivery/retention review fixes pass 90 focused PostgreSQL cases and 10 unit cases, including retryable Project search contention, terminal live-document reconciliation reporting, public source ownership, and bulk folder re-rooting. Follow-up validation passes all 15 retention database cases and 7 reconciliation unit cases; postcommit failures retain the successful write result, and root conflict reads are restricted to each child batch.
Foundation review fixes are merged. The subsequent delivery/retention changes are separately reviewed and validated.
Full repository tests, type checks, audits and HTTP matrices run in hosted CI for the published head. Earlier full-suite and live HTTP reports are historical evidence, not validation of this head.

Membership alignment

Uses required workspace.project_id for canonical membership and authorization; no connector or marker is retained or reintroduced.
Preserves upstream named CLI operations and test/changelog file lifecycle handling while adding Project scope.
Contains no additional database migration. Rollout and rollback gates remain those of feat(projects): enforce Project membership and retire the connector #8590 and feat: establish shared file ownership foundation #8609; merge status does not establish deployment or worker drain.
Keeps existing release gates and the current stack. No merge or deployment is included in this update.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Relevant tests updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-10-04T12:50:35Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 10, 2026 10:24pm UTC

mzxchandra · 2026-10-06T00:31:12Z

@greptile

mzxchandra · 2026-10-06T00:31:15Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-06T00:31:20Z

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 485 files

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

Re-trigger cubic}

Reuse entity-owned file operations across Project UI, session APIs, v2/CLI, and delegated Mothership callers. Add Project discovery, sharing, history, copy, collaborative editing, and current-access invalidation while preserving workspace execution boundaries and independent creator/payer attribution. Keep activation gated behind the file-ownership compatibility foundation. Run real HTTP suites through disposable fixture orchestration in CI.

greptile-apps · 2026-10-06T00:39:34Z

Confidence Score: 4/5

[Critical impact] Adds new backend APIs and realtime handlers for project file management.

The behavioral fixes appear safe, but the new reconciliation tests must satisfy the repository’s explicit testing requirement before merging.

Findings

Tests assert mocked logger calls ▶

Summary

The PR adds Project-owned file operations across the application, realtime service, HTTP and v2 APIs, CLI, sharing, and retention. Since the previous review, it narrows folder-cleanup conflict reads and changes post-commit live-document reconciliation failures to be logged without failing the completed write.

_{Reviews (28) · Last reviewed commit: "fix: preserve committed write results an..." · Reviewed by Greptile}

mzxchandra · 2026-10-06T00:46:17Z

@greptile

mzxchandra · 2026-10-06T00:46:19Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-06T00:46:23Z

@cubic-dev-ai review this PR

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 485 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

Re-trigger cubic}

cubic-dev-ai · 2026-10-10T21:54:11Z

@cubic-dev-ai review — 2c6bf86 fixes the default file-serving error mock signature; all 10 route cases pass.

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

mzxchandra · 2026-10-10T21:54:57Z

@greptileai review — 401f60e carries the foundation array-compatibility correction; the branch remains aligned with current #8609.

mzxchandra · 2026-10-10T21:54:59Z

@cubic-dev-ai review — 401f60e carries the foundation array-compatibility correction; the branch remains aligned with current #8609.

cubic-dev-ai · 2026-10-10T21:55:09Z

@cubic-dev-ai review — 401f60e carries the foundation array-compatibility correction; the branch remains aligned with current #8609.

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

…nting

cubic-dev-ai

Review completed against the latest diff

_{Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.

Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.
You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Turn on auto-fix | Re-trigger cubic}

mzxchandra · 2026-10-10T22:11:38Z

@greptileai review — 89ab6e1 addresses the latest verified delivery/retention findings. Focused validation: 90 PostgreSQL cases and 10 unit cases pass.

mzxchandra · 2026-10-10T22:11:40Z

@cubic-dev-ai review — 89ab6e1 addresses five findings; all seven threads have individual replies with fixes or current-code evidence. 90 PostgreSQL cases and 10 unit cases pass.

cubic-dev-ai · 2026-10-10T22:11:56Z

@cubic-dev-ai review — 89ab6e1 addresses five findings; all seven threads have individual replies with fixes or current-code evidence. 90 PostgreSQL cases and 10 unit cases pass.

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

mzxchandra · 2026-10-10T22:14:15Z

@greptileai review

mzxchandra · 2026-10-10T22:14:16Z

@cubic-dev-ai review

cubic-dev-ai · 2026-10-10T22:14:23Z

@cubic-dev-ai review

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

mzxchandra · 2026-10-10T22:19:43Z

@greptileai review

mzxchandra · 2026-10-10T22:19:45Z

@cubic-dev-ai review

cubic-dev-ai · 2026-10-10T22:19:52Z

@cubic-dev-ai review

@mzxchandra I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 390 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.

Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.
You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Turn on auto-fix | Re-trigger cubic}

mzxchandra mentioned this pull request Oct 4, 2026

feat: establish shared file ownership foundation #8609

Draft

6 tasks done

vercel Bot deployed to Preview October 4, 2026 12:52 View deployment

mzxchandra mentioned this pull request Oct 5, 2026

feat(projects): enforce Project membership and retire the connector #8590

Draft

mzxchandra added this pull request to stack #8630 October 5, 2026 18:24

mzxchandra force-pushed the codex/project-files branch from 9dae237 to 3db7e57 Compare October 5, 2026 21:02

vercel Bot deployed to Preview October 5, 2026 21:04 View deployment

vercel Bot deployed to Preview October 5, 2026 22:14 View deployment

vercel Bot temporarily deployed to Preview October 5, 2026 22:42 Inactive

vercel Bot temporarily deployed to Preview October 5, 2026 23:29 Inactive

vercel Bot deployed to Preview October 6, 2026 00:33 View deployment

cubic-dev-ai Bot reviewed Oct 6, 2026

View reviewed changes

mzxchandra added 6 commits October 5, 2026 17:39

refactor: use explicit Project file ownership storage

0985191

refactor: carry file owners through collaborative documents

4f45fa6

refactor: consolidate background file retention by owner

8de6b11

fix(files): close retention races and preserve browser navigation

845b9c5

fix(files): require explicit owners in live documents

a9fd086

greptile-apps Bot reviewed Oct 6, 2026

View reviewed changes

Comment thread apps/sim/lib/projects/files/application/authorization.ts Outdated

Comment thread apps/sim/app/workspace/[workspaceId]/files/project-files.tsx Outdated

mzxchandra force-pushed the codex/project-files branch from 547eb7b to a9fd086 Compare October 6, 2026 00:44

vercel Bot deployed to Preview October 6, 2026 00:46 View deployment

cubic-dev-ai Bot reviewed Oct 6, 2026

View reviewed changes

Merge branch 'codex/file-ownership-foundation' into HEAD

401f60e

vercel Bot temporarily deployed to Preview October 10, 2026 21:54 Inactive

Merge foundation billing boundary correction and retain backend accou…

bd0294b

…nting

vercel Bot temporarily deployed to Preview October 10, 2026 21:58 Inactive

cubic-dev-ai Bot reviewed Oct 10, 2026

View reviewed changes

Address Project file delivery and retention review findings

89ab6e1

vercel Bot temporarily deployed to Preview October 10, 2026 22:11 Inactive

test: use shared mock cleanup for content effects

dded5e8

vercel Bot temporarily deployed to Preview October 10, 2026 22:14 Inactive

greptile-apps Bot reviewed Oct 10, 2026

View reviewed changes

Comment thread apps/sim/lib/uploads/server/content-effects.ts Outdated

Comment thread apps/sim/lib/file-retention/folders.ts Outdated

greptile-apps Bot reviewed Oct 10, 2026

View reviewed changes

Comment thread apps/sim/lib/uploads/server/content-effects.ts Outdated

Comment thread apps/sim/lib/file-retention/folders.ts Outdated

fix: preserve committed write results and bound retention reads

7c68116

vercel Bot temporarily deployed to Preview October 10, 2026 22:17 Inactive

cubic-dev-ai Bot reviewed Oct 10, 2026

View reviewed changes

greptile-apps Bot reviewed Oct 10, 2026

View reviewed changes

Comment thread apps/sim/lib/uploads/server/content-effects.test.ts Outdated

test: assert committed outcomes without logger call checks

44afd15

vercel Bot temporarily deployed to Preview October 10, 2026 22:24 Inactive

Conversation

mzxchandra commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Membership alignment

Checklist

Uh oh!

vercel Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mzxchandra commented Oct 6, 2026

Uh oh!

mzxchandra commented Oct 6, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 6, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 4/5

Findings

Summary

Uh oh!

Uh oh!

Uh oh!

mzxchandra commented Oct 6, 2026

Uh oh!

mzxchandra commented Oct 6, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 6, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot commented Oct 10, 2026

Uh oh!

mzxchandra commented Oct 10, 2026

Uh oh!

mzxchandra commented Oct 10, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 10, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mzxchandra commented Oct 10, 2026

Uh oh!

mzxchandra commented Oct 10, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 10, 2026

Uh oh!

mzxchandra commented Oct 10, 2026

Uh oh!

mzxchandra commented Oct 10, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 10, 2026

Uh oh!

mzxchandra commented Oct 4, 2026 •

edited

Loading

vercel Bot commented Oct 4, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

greptile-apps Bot commented Oct 6, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading