[waleedlatif1]

Summary

• sim-setup binds its managed Redis and Postgres to 127.0.0.1 and writes 127.0.0.1 URLs. Docker's default -p port:port listens on every interface and bypasses host firewalls, and the official Redis image ships with protected mode off and no password, so dev-mode Redis was reachable from the network. Containers an earlier release published on every interface are flagged at the start of dev setup, with the steps to recreate them on loopback (sim-setup down, then re-run; data is kept). They are not replaced automatically: Redis holds live realtime sessions, and a DATABASE_URL may name its own database.
• sim-setup reset tears down before archiving .env. Compose interpolates the required ${VAR:?} secrets even for down -v, so archiving first made a Compose reset fail with the stack still running and the config moved aside. A failed teardown now leaves the env files in place, for dev and Kubernetes too.
• Env values that need it are quoted on write. dotenv (Next's loader) cuts an unquoted value at any # (a#b read as a), and every reader trims edge whitespace and strips a leading quote. Those values are single-quoted, which dotenv, Bun, Compose and our own parser all read literally. Ordinary values (hex secrets, URLs, DSNs) are written byte-for-byte as before. A value with a line break is refused instead of spilling into a second line.
• sim-setup's THIRD_PARTY_LICENSES adds the five bundled MIT packages it was missing: fast-string-truncated-width, fast-string-width, fast-wrap-ansi, ipaddr.js and sisteransi.
• The published sim manifest drops the source-only ./embed export and the #sim-cli/* imports. They point at src/*.ts, which the tarball doesn't ship, so import 'sim/embed' from npm failed. The repo manifest is unchanged because apps/sim consumes sim/embed from source through the workspace. The smoke test now fails if any export target is missing from the tarball.
• Remove the legacy packages/cli (simstudio) and its publish workflow. It hasn't published since 0.1.19. That release starts Postgres as postgres/postgres on all interfaces with a placeholder auth secret, and current realtime images refuse to start with that secret. Nothing in the repo or docs points at it, and sim-setup replaces it. The npm package will be deprecated separately.
• Kept out of scope: moving sim's bundled runtime deps to devDependencies. apps/sim imports the CLI source through sim/embed, so its Docker build resolves them through those dependencies.

Type of Change

• Bug fix

Testing

• New env-files.test.ts cases: round-trips for #, edge whitespace and quotes, and line-break refusal. All 5 fail against the staging source and pass with the fix. Plain values are checked to stay unquoted.
• Wrote the new lines and read them back through @next/env, Bun's loader and docker compose config: every value came back identical.
• Docker Compose 2.39: down -v without .env fails on the required variables, and with it present succeeds.
• Docker: an old-style -p binding was reachable on the LAN address, the new loopback binding was not, and docker port still parses.
• Docker: exposure detection flags legacy containers (including stopped ones) and stays quiet for loopback-bound containers and when no containers exist.
• Ran the new workflow steps against the published sim@2.2.23 tarball: the export check fails on the current manifest and passes after the strip, and sim/runtime still imports.
• sim-setup suite (79 tests), test:scripts (739 tests), sim-setup type-check, check:utils, check:file-names, check:comment-hygiene, check:boundaries, bun run lint, actionlint.
• bun install --frozen-lockfile --lockfile-only confirms the lockfile edit.
• Full type-check, check:audits and the full test suite run in CI.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Nov 10, 2026 7:09am UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; both previous issues are addressed and no new blocking issue was found.

Summary

This PR binds newly created dev containers to loopback, fixes reset ordering and env quoting, checks published export targets, and removes the legacy CLI.

• sim-setup keeps its managed Postgres and Redis ports on the local machine.
• sim-setup reset removes services before archiving environment files.
• sim-setup keeps special environment values intact when it writes them.
• The published sim package points only to files included in its tarball.
• The old simstudio command and its release workflow are removed.
• sim-setup’s license file now lists five more bundled packages.

_{Reviews (3) · Last reviewed commit: "fix(setup): warn about containers an ear..." · Reviewed by Greptile}

[cubic-dev-ai]

1 issue found across 18 files

Confidence score: 3/5

• In packages/sim-setup/src/env-files.ts, values containing $ can be expanded by Compose or Next and silently change secrets or URLs. Quote or escape dollar signs when writing values.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/sim-setup/src/env-files.ts">

<violation number="1" location="packages/sim-setup/src/env-files.ts:100">
P1: Values containing `$` are left unquoted, but Compose and Next env loading expand `$NAME` references. A user-entered secret or URL such as `api$UNSET` can therefore be silently rewritten; treat `$` as requiring literal quoting (or reject the unsupported quote combination).</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 18 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 19 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}