Merge remote-tracking branch 'origin/staging' into codex/shared-resource-lifecycle

Author: mzxchandra

.claude/rules/sim-testing.md

@@ -48,8 +48,8 @@ contracts, and demonstrated regressions.
   those checks. Isolate with a unique schema or generated IDs, and clean up in `afterAll`.
 - Integration files run one at a time against one shared database. A new `*.integration.ts` is
   picked up by CI with no workflow change, and the run writes the JSON report configured in
-  `vitest.shared.ts`, which CI uploads. Never add a passing suite to the quarantine list in
-  `apps/sim/vitest.config.ts`.
+  `vitest.shared.ts`, which CI uploads. Never exclude a failing suite from the run in
+  `apps/sim/vitest.config.ts`: fix it or delete it.
 - `bun run test:integration` starts disposable Postgres and Redis containers, provisions the schema,
   and runs both workspaces; pass filenames to narrow the `apps/sim` run.
 
@@ -169,6 +169,7 @@ The suite's wall time is bound by the single Vite server thread that serves ever
 3. Mock heavy graphs a test does not need and the setup does not already mock: `@/blocks`,
    `@/triggers/registry`, `@/tools/generated/*`.
 4. No real timers: `vi.useFakeTimers()`, `flushMicrotasks()`, or `flushMacrotask()`.
+   `check:test-patterns` (`real-wait`) fails on a new wall-clock wait in a unit test.
 5. Absolute imports only.
 
 ### Running

.cursor/rules/sim-testing.mdc

@@ -46,8 +46,8 @@ contracts, and demonstrated regressions.
   those checks. Isolate with a unique schema or generated IDs, and clean up in `afterAll`.
 - Integration files run one at a time against one shared database. A new `*.integration.ts` is
   picked up by CI with no workflow change, and the run writes the JSON report configured in
-  `vitest.shared.ts`, which CI uploads. Never add a passing suite to the quarantine list in
-  `apps/sim/vitest.config.ts`.
+  `vitest.shared.ts`, which CI uploads. Never exclude a failing suite from the run in
+  `apps/sim/vitest.config.ts`: fix it or delete it.
 - `bun run test:integration` starts disposable Postgres and Redis containers, provisions the schema,
   and runs both workspaces; pass filenames to narrow the `apps/sim` run.
 
@@ -167,6 +167,7 @@ The suite's wall time is bound by the single Vite server thread that serves ever
 3. Mock heavy graphs a test does not need and the setup does not already mock: `@/blocks`,
    `@/triggers/registry`, `@/tools/generated/*`.
 4. No real timers: `vi.useFakeTimers()`, `flushMicrotasks()`, or `flushMacrotask()`.
+   `check:test-patterns` (`real-wait`) fails on a new wall-clock wait in a unit test.
 5. Absolute imports only.
 
 ### Running

.github/scripts/check-project-rollout.py

@@ -6,7 +6,8 @@
 # diff sets all of them.
 #
 #   full          integration, e2e, e2e-build, e2e-mobile: any file not allowlisted below
-#   test          the Vitest shards: content, docs app, and desktop changes, plus `full`
+#   test          the Vitest shards and test-types: content, docs app, and desktop changes,
+#                 plus `full`
 #   build         the app's `next build`: content changes, plus `full`
 #   desktop_live  the live Electron suite: any file outside its own skip list
 #

.github/scripts/ci-changes.sh

@@ -6,7 +6,7 @@
 # A skip passes only for a gated job whose `changes` flag is exactly `false`:
 #
 #   integration, e2e, e2e-build, e2e-mobile  full
-#   test                                     test
+#   test, test-types                         test
 #   build                                    build
 #   desktop-live                             desktop_live
 #
@@ -25,7 +25,7 @@ fi
 
 failed="$(jq -r '
   {"integration": "full", "e2e": "full", "e2e-build": "full", "e2e-mobile": "full", "test": "test",
-   "build": "build", "desktop-live": "desktop_live"} as $gate
+   "test-types": "test", "build": "build", "desktop-live": "desktop_live"} as $gate
   | (.changes.outputs // {}) as $flags
   | to_entries[]
   | select(.value.result != "success")

.github/scripts/ci-gate.sh

@@ -653,9 +653,9 @@ jobs:
       # Every workspace, not just realtime. packages/emcn, packages/utils,
       # apps/desktop and apps/docs had no type check in CI at all; apps/sim's
       # source was covered only as a side effect of `next build` in the separate
-      # `build` job. Note this does NOT cover apps/sim's tests — its tsconfig
-      # excludes *.test.ts(x), and including them today surfaces ~2.2k errors,
-      # so that is its own cleanup rather than a gate to switch on here.
+      # `build` job. This does NOT cover apps/sim's tests — its tsconfig
+      # excludes *.test.ts(x), which carry ~2.2k errors; the `test-types` job
+      # ratchets those per file instead.
       - name: Type-check all workspaces
         run: bunx turbo run type-check
 
@@ -672,6 +672,41 @@ jobs:
           fi
           echo "✅ Schema and migrations are in sync"
 
+  # Type errors in apps/sim's unit tests, ratcheted per file and TS code against a committed
+  # baseline (scripts/check-test-types.ts). It type-checks the whole app with its ~3.4k test files:
+  # lint's uncached apps/sim type-check alone takes ~35 s on this runner, so it gets its own job
+  # beside lint rather than a place in check:audits, which also runs on laptops. Gated like `test`.
+  # On failure the compiler output and its exit status are uploaded, so a fix can shrink the
+  # existing baseline from them (`--diagnostics <file> --update`) without a local compile; nothing
+  # ever raises the baseline.
+  test-types:
+    name: test-types
+    needs: changes
+    if: needs.changes.outputs.test == 'true'
+    runs-on: *runner-4vcpu
+    timeout-minutes: 10
+
+    steps:
+      - *checkout-mirror
+      - *checkout-plain
+
+      - name: Setup workspace
+        uses: ./.github/actions/setup
+        with:
+          provider: ${{ vars.CI_PROVIDER }}
+
+      - name: Ratchet type errors in apps/sim tests
+        run: bun run scripts/check-test-types.ts --report "$RUNNER_TEMP/test-types"
+
+      - name: Upload compiler output and counts
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: test-types
+          path: ${{ runner.temp }}/test-types/
+          if-no-files-found: ignore
+          retention-days: 14
+
   # The root scripts and every workspace's Vitest suite (`bun run test`), split in two. apps/sim is
   # about 98% of the time, so only its files are sharded; shard 1 also runs the root scripts and
   # the other workspaces. Each shard keeps its own Turbo cache: pass-through args are part of the
@@ -876,7 +911,8 @@ jobs:
   # on a cancelled run would report a cancelled head commit as passing.
   ci:
     name: ci
-    needs: [changes, integration, e2e, e2e-mobile, desktop-live, lint, test, build, e2e-build]
+    needs:
+      [changes, integration, e2e, e2e-mobile, desktop-live, lint, test-types, test, build, e2e-build]
     if: ${{ always() }}
     runs-on: *runner-2vcpu
     timeout-minutes: 5

.github/workflows/checks.yml

@@ -114,7 +114,6 @@ jobs:
   migrate:
     permissions:
       contents: read
-      id-token: write
     name: migrate
     needs: [checks]
     # Explicit need results instead of the implicit success(): a skipped job
@@ -134,10 +133,6 @@ jobs:
       STAGING_DATABASE_URL: ${{ secrets.STAGING_DATABASE_URL }}
       MIGRATION_DATABASE_URL: ${{ secrets.MIGRATION_DATABASE_URL }}
       STAGING_MIGRATION_DATABASE_URL: ${{ secrets.STAGING_MIGRATION_DATABASE_URL }}
-      AWS_ROLE_TO_ASSUME: ${{ secrets.AWS_ROLE_TO_ASSUME }}
-      STAGING_AWS_ROLE_TO_ASSUME: ${{ secrets.STAGING_AWS_ROLE_TO_ASSUME }}
-      AWS_REGION: ${{ secrets.AWS_REGION }}
-      STAGING_AWS_REGION: ${{ secrets.STAGING_AWS_REGION }}
 
   # Same ordering for dev (schema push before the dev image lands in ECR)
   migrate-dev:

.github/workflows/ci.yml

@@ -18,14 +18,6 @@ on:
         required: false
       STAGING_MIGRATION_DATABASE_URL:
         required: false
-      AWS_ROLE_TO_ASSUME:
-        required: false
-      STAGING_AWS_ROLE_TO_ASSUME:
-        required: false
-      AWS_REGION:
-        required: false
-      STAGING_AWS_REGION:
-        required: false
   workflow_dispatch:
     inputs:
       environment:
@@ -39,7 +31,6 @@ on:
 
 permissions:
   contents: read
-  id-token: write
 
 jobs:
   migrate:
@@ -60,32 +51,13 @@ jobs:
           provider: ${{ vars.CI_PROVIDER }}
           node-version: ''
 
-      - name: Check Project column expansion and whether enforcement needs rollout evidence
-        id: project-contract
+      - name: Validate Project migration database prerequisites
         if: inputs.environment != 'dev'
         working-directory: ./packages/db
         env:
           DATABASE_URL: ${{ inputs.environment == 'production' && secrets.DATABASE_URL || inputs.environment == 'staging' && secrets.STAGING_DATABASE_URL || '' }}
           MIGRATION_DATABASE_URL: ${{ inputs.environment == 'production' && secrets.MIGRATION_DATABASE_URL || inputs.environment == 'staging' && secrets.STAGING_MIGRATION_DATABASE_URL || '' }}
-        run: bun --no-env-file scripts/project-contract-required.ts >> "$GITHUB_OUTPUT"
-
-      - name: Configure AWS for Project connector retirement verification
-        if: steps.project-contract.outputs.required == 'true'
-        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b
-        with:
-          role-to-assume: ${{ inputs.environment == 'production' && secrets.AWS_ROLE_TO_ASSUME || secrets.STAGING_AWS_ROLE_TO_ASSUME }}
-          aws-region: ${{ inputs.environment == 'production' && secrets.AWS_REGION || secrets.STAGING_AWS_REGION }}
-
-      # Acknowledge #8830 only after authority-aware readers/writers deploy and all incompatible
-      # servers and relevant old Trigger.dev runs drain. The runner commits the column-authority
-      # switch before backfill, validation, and connector retirement; retries never revert it.
-      # The preflight independently checks ECS retirement; it does not inspect worker runs.
-      - name: Require completed authority-aware rollout before Project cutover
-        if: steps.project-contract.outputs.required == 'true'
-        env:
-          ENVIRONMENT: ${{ inputs.environment }}
-          EXPECTED_IMAGE_DIGEST: ${{ inputs.environment == 'production' && vars.PROJECT_COLUMN_ENFORCEMENT_READY_IMAGE_DIGEST_PRODUCTION || inputs.environment == 'staging' && vars.PROJECT_COLUMN_ENFORCEMENT_READY_IMAGE_DIGEST_STAGING || '' }}
-        run: python3 .github/scripts/check-project-rollout.py --environment "$ENVIRONMENT" --region "$AWS_REGION" --expected-image-digest "$EXPECTED_IMAGE_DIGEST"
+        run: bun --no-env-file scripts/project-contract-required.ts
 
       # The expression maps the explicit environment input to exactly one repo
       # secret, so the job never holds another environment's database URL. An

.github/workflows/migrate.yml

@@ -22,7 +22,7 @@ This file (also `AGENTS.md`) holds the repo-wide rules. Area detail lives in `.c
   - `compareStrings(left, right)` from `@sim/utils/string` — code-unit ordering for hashes, fingerprints, and cross-process comparisons; never `localeCompare` there
   - `backoffWithJitter(attempt, retryAfterMs, options?)` / `parseRetryAfter(header)` from `@sim/utils/retry` — never reimplement exponential backoff inline
 - **Deployment flags in the browser**: client code inside a workspace, organization, or standalone settings surface reads `hosted`, `billingEnabled`, `chatEnabled`, and the enterprise feature set through `useDeploymentShape()` (components) or `getDeploymentShape()` (block conditions, stores, helpers) from `@/lib/core/config/deployment-shape`, never `isHosted`/`isBillingEnabled`/... from `env-flags`. Those constants freeze at module init from the root layout's `NEXT_PUBLIC_*` transport, which Next's bare 404 shell and `global-error` never emit, so a recovered tab would render Sim Cloud as self-hosted; the reader is seeded from the server-resolved workspace host context, organization layout, or standalone settings layout instead. Server code keeps reading `env-flags`.
-- **Type-checking**: `bun run type-check` at the root checks every workspace (`bun run type-check` inside a workspace checks just that one). `apps/sim`'s tsconfig excludes `*.test.ts(x)`, so its tests are not type-checked. Never remove the `@typescript/native` alias from the root `devDependencies`: nothing imports it, but without it a bare `tsc` resolves to the ~10x slower TypeScript 6 compiler. `bun run check:native-typecheck` enforces this; its header explains the bin-resolution trap.
+- **Type-checking**: `bun run type-check` at the root checks every workspace (`bun run type-check` inside a workspace checks just that one). `apps/sim`'s tsconfig excludes `*.test.ts(x)`, so `type-check` skips its tests; CI's `test-types` job ratchets their errors per file and TS code instead (`check:test-types`, whose header says how to fix a finding): a test file may not gain one. Never remove the `@typescript/native` alias from the root `devDependencies`: nothing imports it, but without it a bare `tsc` resolves to the ~10x slower TypeScript 6 compiler. `bun run check:native-typecheck` enforces this; its header explains the bin-resolution trap.
 
 ## Architecture
 

CLAUDE.md

@@ -289,22 +289,20 @@ test('chat panel sizes survive navigation, chat switches, collapse, and layout c
     }
 
     await check('a viewport change during a drag clamps the committed display width', async () => {
-      await page.getByRole('button', { name: 'Resize container' }).click()
-      await expectWidth(520)
+      await expectWidth(698)
       const rect = await beginDrag()
       await page.mouse.move(rect.x + 20, rect.y + 100, { steps: 12 })
-      await expectWidth(500)
+      await expectWidth(678)
       await shell.evaluate(({ BrowserWindow }) =>
-        BrowserWindow.getAllWindows()[0].setContentSize(300, 400)
+        BrowserWindow.getAllWindows()[0].setContentSize(500, 400)
       )
-      await expect.poll(() => page.evaluate(() => window.innerWidth)).toBe(600)
+      await expect.poll(() => page.evaluate(() => window.innerWidth)).toBe(1000)
       await page.mouse.up()
-      await expectWidth(480)
+      await expectWidth(520)
       await shell.evaluate(({ BrowserWindow }) =>
         BrowserWindow.getAllWindows()[0].setContentSize(720, 400)
       )
-      await expectWidth(500)
-      await page.getByRole('button', { name: 'Resize container' }).click()
+      await expectWidth(678)
       await dragTo(698)
     })