improvement(repo): separate realtime into separate app by icecrasher321 · Pull Request #4262 · simstudioai/sim

icecrasher321 · 2026-04-22T16:28:38Z

Summary

Optimize docker image and follow correct monorepo pattern.

Type of Change

Other: Code structure

Testing

Tested manually

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-04-22T16:28:44Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Apr 23, 2026 6:00am

cursor · 2026-04-22T16:28:49Z

PR Summary

Medium Risk
Medium risk because it introduces a new apps/realtime workspace and rewires permission/auth/audit imports across many API routes, which could cause subtle authz regressions or CI/build issues if any paths/env vars are misconfigured.

Overview
Splits the collaborative Socket.IO server into a new apps/realtime Bun workspace with its own env schema (apps/realtime/src/env.ts + .env.example), tests/vitest config, and updated module layout (config/, handlers/, middleware/, rooms/, routes/). Realtime code is refactored to depend on shared @sim/* packages (e.g., @sim/audit, @sim/realtime-protocol, @sim/workflow-authz, @sim/workflow-persistence) instead of importing from the Next.js app, and webhook cleanup is removed from draft block deletions.

Repo tooling/CI is tightened: devcontainer bootstrapping now creates .env files for apps/realtime and packages/db, GitHub Actions adds monorepo-boundary and realtime-prune checks plus realtime type-checking, and docs/testing rules are updated to reference @sim/audit and describe enforced package boundaries. Separately, several endpoints switch from Node crypto helpers to @sim/security utilities (safeCompare, hmacSha256Hex, sha256Hex) and many API routes/tests update audit + workflow authorization imports to the shared packages.

^{Reviewed by Cursor Bugbot for commit 48307c6. Configure here.}

Addresses merge-time issues and gaps from the realtime app split: - Retarget stale vi.mock paths to @sim/workflow-persistence/subblocks - Restore README branding, fix AGENTS.md script reference - Restore TSDoc on workflow-persistence subblocks helpers - Use toError() from @sim/utils/errors in save.ts - Add vitest config + local mocks so @sim/audit tests run standalone - Move socket.io-client to devDependencies in apps/realtime - Add missing package COPY steps to docker/app.Dockerfile - Add check:boundaries/check:realtime-prune scripts and wire into CI Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Move general-purpose crypto primitives out of apps/sim into the @sim/security package so both apps/sim and apps/realtime can share them. @sim/security exports (all pure, dependency-free): ./compare safeCompare (constant-time HMAC-wrapped equality) ./encryption encrypt/decrypt (AES-256-GCM, iv:cipher:tag format) ./hash sha256Hex ./tokens generateSecureToken (base64url) Migrate apps/sim call sites to use these + @sim/utils helpers: crypto.randomUUID() -> generateId() from @sim/utils/id createHash('sha256').digest -> sha256Hex timingSafeEqual on hashed hex -> safeCompare new Promise(setTimeout) -> sleep from @sim/utils/helpers No behavior change: encryption format, digest output, and token length are preserved exactly.

Replace the last two `error instanceof Error ? error : new Error(String(error))` patterns with toError from @sim/utils/errors. Completes the sweep of clean candidates — no behavior change.

…rity Adds hmacSha256Hex and hmacSha256Base64 to @sim/security/hmac and migrates 15 webhook providers plus 5 other hot paths (deployment token signing, outbound webhook requests, workspace notification delivery, notification test route, Shopify OAuth callback) off bare `createHmac` calls. Secret parameter accepts `string | Buffer` to cover base64-decoded Svix-style secrets (Resend) and MS Teams' HMAC scheme. AWS SigV4 signing in S3 and Textract tools intentionally retains direct `createHmac` usage — its multi-step key derivation chain doesn't fit a generic helper. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

- Add safeCompare unit tests (identity, length mismatch, hex-nibble diff). - Add Buffer-secret cases to hmac tests to lock in Svix/MS-Teams contract. - Declare `reactflow` as a peerDependency on @sim/workflow-types — only used for type imports. - Add a barrel export to @sim/workflow-persistence for consumers that prefer package-level imports; subpath exports retained. - Document the data-field invariant in load.ts for loop/parallel subflow patching. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

waleedlatif1 · 2026-04-23T05:47:51Z

@greptile

waleedlatif1 · 2026-04-23T05:47:55Z

@cursor review

greptile-apps · 2026-04-23T05:52:01Z

Greptile Summary

This PR extracts the collaborative realtime/socket server from apps/sim into a first-class monorepo app (apps/realtime), introduces a shared packages/realtime-protocol for protocol constants and Zod schemas, replaces the hand-rolled Docker multi-stage copy with turbo prune, and adds two new CI guards (monorepo boundary checker and prune-graph size limiter). The migration is structurally clean — auth, permissions, room management, and all socket handlers are moved verbatim with correct package imports, and the apps/sim side is updated to import from @sim/realtime-protocol instead of the old internal @/socket/constants path.

Confidence Score: 5/5

Safe to merge — no blocking defects found; remaining findings are style and naming quality concerns.

All P0/P1 concerns from prior review rounds (SOCKET_PORT redundancy, missing type-check gate) are addressed. The two new inline comments are P2 code-quality items (operation-name collision and a shadowed logger parameter) that do not affect runtime correctness or security.

No files require special attention; the only advisory items are packages/realtime-protocol/src/constants.ts (naming collision) and apps/realtime/src/database/operations.ts (logger parameter).

Important Files Changed

Filename	Overview
docker/realtime.Dockerfile	Refactored from a manual file-copy approach to a proper turbo prune workflow; eliminates SOCKET_PORT redundancy and points CMD at the new apps/realtime entry point.
apps/realtime/src/index.ts	New entry point for the standalone realtime service; clean startup/shutdown lifecycle with graceful SIGTERM/SIGINT handling and proper Redis or in-memory room manager selection.
apps/realtime/src/env.ts	Zod-validated env schema for the realtime app; DISABLE_AUTH is correctly gated by isHosted so auth cannot be bypassed on sim.ai. PORT defaults to 3002.
apps/realtime/src/middleware/permissions.ts	Role-based permission checks for socket operations; VARIABLE_OPERATIONS.ADD/REMOVE are allowed for write/admin via a coincidental string collision with EDGE_OPERATIONS (flagged inline).
apps/realtime/src/database/operations.ts	1909-line database layer for realtime operations; creates its own connection pool (max=30). insertAutoConnectEdge has a redundant logger: any parameter shadowing the module-level logger.
apps/realtime/src/rooms/redis-manager.ts	Redis-backed room manager with Lua scripts for atomic user add/remove/activity-update; handles NOSCRIPT cache miss with one retry. Key construction matches the KEYS helper.
packages/realtime-protocol/src/constants.ts	Shared protocol constants extracted into their own package; VARIABLE_OPERATIONS.ADD/REMOVE share string values with EDGE_OPERATIONS.ADD/REMOVE, creating a latent permissions coupling.
packages/realtime-protocol/src/schemas.ts	Zod schemas for all workflow socket operations moved to the shared protocol package; discriminated unions use target + operation literals so Zod can safely differentiate colliding operation names.
scripts/check-monorepo-boundaries.ts	New CI guard that walks all packages/ source files and rejects @/ path aliases or relative imports into apps/, enforcing clean monorepo boundaries.
scripts/check-realtime-prune-graph.ts	CI guard that runs turbo prune @sim/realtime --docker in a temp dir and asserts the pruned package count stays ≤ 25, preventing accidental transitive-dependency bloat in the realtime image.

_{Reviews (2): Last reviewed commit: "chore(realtime): remove unused SOCKET_PO..." | Re-trigger Greptile}

- Remove redundant SOCKET_PORT=3002 env from Dockerfile runner stage (env.PORT already defaults to 3002 via zod schema). - Reorder PORT fallback so an explicitly-set SOCKET_PORT wins over the schema default for PORT; keeps SOCKET_PORT functional as an override instead of dead code. - Add dedicated type-check CI step for @sim/realtime so TS errors surface pre-deploy (the Dockerfile runs source TS via Bun and has no implicit build-time type check). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

SOCKET_PORT has lived in the socket server since the June 2025 refactor but was never actually set in any deploy config — docker-compose.prod, helm values/templates, .env.example, and docs all use PORT or the 3002 default exclusively. No self-hoster was ever pointed at SOCKET_PORT, so removing it is safe. Simplifies realtime port resolution to `env.PORT` (zod-validated with a 3002 default) and drops the orphaned sim-side schema entry. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

waleedlatif1 · 2026-04-23T06:00:48Z

@greptile

waleedlatif1 · 2026-04-23T06:00:52Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 48307c6. Configure here.}

vercel Bot deployed to Preview April 22, 2026 16:29 View deployment

vercel Bot deployed to Preview April 22, 2026 17:50 View deployment

icecrasher321 and others added 3 commits April 22, 2026 20:44

improvement(repo): restructuring to make realtime image narrower scoped

dbdf30b

improvements

3885386

waleedlatif1 force-pushed the improvement/repo-structure branch from a24d633 to a8cc431 Compare April 23, 2026 04:19

waleedlatif1 and others added 4 commits April 22, 2026 21:53

refactor(copilot): use toError in remaining otel/finalize sites

9240561

Replace the last two `error instanceof Error ? error : new Error(String(error))` patterns with toError from @sim/utils/errors. Completes the sweep of clean candidates — no behavior change.

cursor Bot reviewed Apr 23, 2026

View reviewed changes

Comment thread apps/sim/app/api/copilot/checkpoints/revert/route.test.ts

greptile-apps Bot reviewed Apr 23, 2026

View reviewed changes

Comment thread docker/realtime.Dockerfile

Comment thread docker/realtime.Dockerfile

vercel Bot deployed to Preview April 23, 2026 05:58 View deployment

vercel Bot temporarily deployed to Preview April 23, 2026 06:00 Inactive

cursor Bot reviewed Apr 23, 2026

View reviewed changes

waleedlatif1 merged commit 5f0f0ed into staging Apr 23, 2026
14 checks passed

waleedlatif1 deleted the improvement/repo-structure branch April 23, 2026 06:06

waleedlatif1 mentioned this pull request Apr 23, 2026

v0.6.55: standardize monorepo conventions, api key hash, thinking text for mothership #4273

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

improvement(repo): separate realtime into separate app#4262

improvement(repo): separate realtime into separate app#4262
waleedlatif1 merged 9 commits intostagingfrom
improvement/repo-structure

icecrasher321 commented Apr 22, 2026

Uh oh!

vercel Bot commented Apr 22, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Apr 22, 2026 •

edited

Loading

Uh oh!

waleedlatif1 commented Apr 23, 2026

Uh oh!

waleedlatif1 commented Apr 23, 2026

Uh oh!

Uh oh!

greptile-apps Bot commented Apr 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Apr 23, 2026

Uh oh!

waleedlatif1 commented Apr 23, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

icecrasher321 commented Apr 22, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

waleedlatif1 commented Apr 23, 2026

Uh oh!

waleedlatif1 commented Apr 23, 2026

Uh oh!

Uh oh!

greptile-apps Bot commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Apr 23, 2026

Uh oh!

waleedlatif1 commented Apr 23, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel Bot commented Apr 22, 2026 •

edited

Loading

cursor Bot commented Apr 22, 2026 •

edited

Loading

greptile-apps Bot commented Apr 23, 2026 •

edited

Loading