feat(files): embed sim files and render mermaid diagrams in markdown preview by waleedlatif1 · Pull Request #4402 · simstudioai/sim

waleedlatif1 · 2026-05-02T07:19:23Z

Summary

Add `/api/files/view/[id]` route that resolves a file ID to its serve URL via 302 redirect (auth + access-checked)
Detect relative workspace file page URLs in markdown `img` tags and rewrite them to the view API so embedded Sim files render correctly; only relative paths are rewritten to avoid SSR hydration mismatches and cross-origin URL hijacking
Fix mermaid diagrams in markdown previews — add a `remarkMermaid` remark plugin that intercepts mermaid code blocks at the MDAST stage and routes them through our `MermaidDiagram` component with correct design tokens (Streamdown's built-in renderer uses mismatched Tailwind semantic classes)
Reduce default trace view tree pane width from 360 → 240

Type of Change

New feature
Bug fix

Testing

Tested manually

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-05-02T07:19:27Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		May 2, 2026 8:49am

cursor · 2026-05-02T07:19:31Z

PR Summary

Medium Risk
Adds a new authenticated /api/files/view/[id] endpoint that redirects to underlying storage serve URLs and changes markdown rendering behavior (mermaid + image URL rewriting), which could affect access control and content rendering if misconfigured.

Overview
Adds a new authenticatedGET /api/files/view/[id] route that looks up file metadata by UUID, verifies the requesting user’s access, then 302 redirects to the appropriate /api/files/serve/{s3|blob}/... URL.

Updates the markdown preview to render Mermaid code blocks via a new remarkMermaid plugin/component (instead of relying on generic code rendering), allows the custom mermaid-diagram tag through Streamdown, and rewrites relative workspace file page URLs in markdown img tags to /api/files/view/{id} so embedded Sim files load correctly.

Also adds getFileMetadataById to the uploads metadata layer, extends the storage-transfer API contracts with fileViewContract, and narrows the default trace-view tree pane width (360 → 240).

^{Reviewed by Cursor Bugbot for commit 380388c. Configure here.}

greptile-apps · 2026-05-02T07:22:22Z

Greptile Summary

This PR adds a new /api/files/view/[id] redirect endpoint that resolves a workspace file by UUID (with auth + access checks) and 302s to the serve path, then wires it into the markdown preview's img component via resolveSimFileUrl (which now correctly limits rewriting to same-origin relative URLs). It also replaces Streamdown's built-in mermaid renderer with a custom remarkMermaid remark plugin that routes diagrams through the existing MermaidDiagram component, and narrows the trace-view tree pane default width from 360 to 240 px.

Confidence Score: 5/5

Safe to merge — no P0/P1 findings; auth and access-control paths are solid and the cross-origin URL rewrite guard is correctly implemented.

All findings are P2 (a contract response-mode label mismatch). Auth, access checking, UUID validation, and the same-origin guard in resolveSimFileUrl are all correctly implemented. The remarkMermaid plugin correctly mutates the MDAST in-place following standard remark conventions.

apps/sim/lib/api/contracts/storage-transfer.ts — the fileViewContract response mode label is inaccurate but non-blocking.

Important Files Changed

Filename	Overview
apps/sim/app/api/files/view/[id]/route.ts	New authenticated redirect endpoint that resolves a file ID to its serve URL via 302; auth + access checks are correctly applied before redirecting
apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/preview-panel.tsx	Adds remarkMermaid remark plugin, resolveSimFileUrl for relative file URL rewriting, and integrates them into markdown rendering; origin check for URL rewriting is correctly in place
apps/sim/lib/api/contracts/storage-transfer.ts	Adds fileViewParamsSchema (UUID-validated) and fileViewContract; response mode is declared as 'binary' but the endpoint always returns 302 redirects or JSON errors
apps/sim/lib/uploads/server/metadata.ts	Adds getFileMetadataById helper with correct use of drizzle ORM conditions and optional includeDeleted flag
apps/sim/app/workspace/[workspaceId]/logs/components/log-details/components/trace-view/trace-view.tsx	Simple constant change reducing default tree pane width from 360 to 240px

Sequence Diagram

sequenceDiagram
participant Browser
participant MarkdownRenderer as Markdown Renderer
participant ViewAPI as /api/files/view/[id]
participant ServeAPI as /api/files/serve/[storage]/[key]
participant DB as Database
Browser->>MarkdownRenderer: Render markdown with img src
MarkdownRenderer->>MarkdownRenderer: resolveSimFileUrl() rewrites relative /workspace/.../files/[id] URLs
MarkdownRenderer-->>Browser: img src rewritten to /api/files/view/[id]
Browser->>ViewAPI: GET /api/files/view/[id]
ViewAPI->>ViewAPI: checkSessionOrInternalAuth()
ViewAPI->>DB: getFileMetadataById(id)
DB-->>ViewAPI: FileMetadataRecord
ViewAPI->>ViewAPI: verifyFileAccess(record.key, userId)
ViewAPI-->>Browser: 302 to /api/files/serve/[storage]/[key]
Browser->>ServeAPI: GET /api/files/serve/[storage]/[key]
ServeAPI-->>Browser: Binary file content
Note over MarkdownRenderer: remarkMermaid plugin intercepts mermaid fenced code blocks at MDAST stage and converts them to mermaid-diagram elements

_{Reviews (7): Last reviewed commit: "fix(files): match mmd skeleton to actual..." | Re-trigger Greptile}

waleedlatif1 · 2026-05-02T07:29:02Z

@greptile

waleedlatif1 · 2026-05-02T07:29:05Z

@cursor review

waleedlatif1 · 2026-05-02T07:35:07Z

@greptile

waleedlatif1 · 2026-05-02T07:35:10Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 85e5f3d. Configure here.}

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 989b683. Configure here.}

waleedlatif1 · 2026-05-02T07:45:32Z

@greptile

waleedlatif1 · 2026-05-02T07:45:42Z

@cursor review

…own preview

…esolveSimFileUrl

…tokens Streamdown intercepts fenced code blocks before components.code is called, so the previous mermaid branch in the code renderer was dead code. Add a remarkMermaid plugin that transforms mermaid code nodes at the MDAST stage via data.hName/hProperties so remark-rehype emits a <mermaid-diagram> element that our MermaidDiagram component handles. This avoids Streamdown's built-in mermaid renderer which uses mismatched Tailwind semantic classes.

…igin

… narrowing

… Streamdown Components type

… hydration mismatch

…review

waleedlatif1 · 2026-05-02T08:16:45Z

@greptile

waleedlatif1 · 2026-05-02T08:16:51Z

@cursor review

…ion mismatch

waleedlatif1 · 2026-05-02T08:28:56Z

@greptile

waleedlatif1 · 2026-05-02T08:29:03Z

@cursor review

…route

…t zoomable area

waleedlatif1 · 2026-05-02T08:42:06Z

@greptile

waleedlatif1 · 2026-05-02T08:42:10Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 380388c. Configure here.}

waleedlatif1 mentioned this pull request May 2, 2026
v0.6.62: firecrawl parse, new gmail tools, trace improvements, tool fixes, db query optimizations, contract boundaries code hygiene, CORS, toast improvements, tables infinite query, executor robustness, reranker support #4390
Merged

greptile-appsBot reviewed May 2, 2026
View reviewed changes

Comment threadapps/sim/app/workspace/[workspaceId]/files/components/file-viewer/preview-panel.tsx

vercelBottemporarily deployed to Preview May 2, 2026 07:26 Inactive

vercelBottemporarily deployed to Preview May 2, 2026 07:27 Inactive

vercelBottemporarily deployed to Preview May 2, 2026 07:28 Inactive

vercelBottemporarily deployed to Preview May 2, 2026 07:33 Inactive

vercelBottemporarily deployed to Preview May 2, 2026 07:34 Inactive

cursorBot reviewed May 2, 2026
View reviewed changes

vercelBottemporarily deployed to Preview May 2, 2026 07:40 Inactive

cursorBot reviewed May 2, 2026
View reviewed changes

Comment threadapps/sim/app/workspace/[workspaceId]/files/components/file-viewer/preview-panel.tsx Outdated

vercelBottemporarily deployed to Preview May 2, 2026 07:56 Inactive

waleedlatif1 added 9 commits May 2, 2026 01:03

feat(files): resolve workspace file page URLs to raw content in markd…
31850ae
…own preview

refactor(files): replace regex URL matching with URL constructor in r…
46f0326
…esolveSimFileUrl

fix(trace): reduce default tree pane width from 360 to 280
ea7817c

fix(files): guard resolveSimFileUrl against cross-origin URL hijacking
9e5dbef

refactor(files): use getBrowserOrigin() instead of window.location.or…
134e30d
…igin

fix(trace): reduce default tree pane width to 240
a1f7037

fix(files): narrow img src type before passing to resolveSimFileUrl
701ad2b

fix(files): use narrow props type for img renderer instead of runtime…
9fc1a4f
… narrowing

waleedlatif1 added 2 commits May 2, 2026 01:04

fix(files): accept full ImgHTMLAttributes for img renderer to satisfy…
7915211
… Streamdown Components type

fix(files): treat null getBrowserOrigin as same-origin to prevent SSR…
d8ce2c9
… hydration mismatch

waleedlatif1 force-pushed the fix/csp branch from d19739e to d8ce2c9Compare May 2, 2026 08:04

vercelBottemporarily deployed to Preview May 2, 2026 08:04 Inactive

improvement(files): use centered aspect-ratio skeleton for mmd file p…
95b186d
…review

vercelBottemporarily deployed to Preview May 2, 2026 08:09 Inactive

improvement(files): diagram-shaped skeleton card for mmd file preview
2d3993f

vercelBottemporarily deployed to Preview May 2, 2026 08:13 Inactive

cursorBot reviewed May 2, 2026
View reviewed changes

Comment threadapps/sim/app/workspace/[workspaceId]/files/components/file-viewer/preview-panel.tsx Outdated

fix(files): only rewrite relative workspace file URLs to avoid hydrat…
446d9e3
…ion mismatch

vercelBottemporarily deployed to Preview May 2, 2026 08:28 Inactive

cursorBot reviewed May 2, 2026
View reviewed changes

Comment threadapps/sim/app/api/files/view/[id]/route.ts Outdated

fix(files): pass context not resolved params to parseRequest in view …
9cb28da
…route

vercelBottemporarily deployed to Preview May 2, 2026 08:37 Inactive

fix(files): simplify mmd file skeleton to match pptx card pattern
6642893

vercelBottemporarily deployed to Preview May 2, 2026 08:38 Inactive

fix(files): match mmd skeleton to actual rendered layout — full-heigh…
380388c
…t zoomable area

vercelBottemporarily deployed to Preview May 2, 2026 08:40 Inactive

fix(sidebar): left-align folder lock icon next to name
66207c4

vercelBottemporarily deployed to Preview May 2, 2026 08:49 Inactive

cursorBot reviewed May 2, 2026
View reviewed changes

waleedlatif1 merged commit db05297 into stagingMay 2, 2026
9 checks passed

waleedlatif1 deleted the fix/csp branch May 2, 2026 08:50

waleedlatif1 restored the fix/csp branch May 2, 2026 19:08

Uh oh!

Conversation

waleedlatif1 commented May 2, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercelBot commented May 2, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursorBot commented May 2, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-appsBot commented May 2, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

waleedlatif1 commented May 2, 2026

Uh oh!

waleedlatif1 commented May 2, 2026

Uh oh!

waleedlatif1 commented May 2, 2026

Uh oh!

waleedlatif1 commented May 2, 2026

Uh oh!

cursorBot left a comment

Choose a reason for hiding this comment

Uh oh!

cursorBot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented May 2, 2026

Uh oh!

waleedlatif1 commented May 2, 2026

Uh oh!

Uh oh!

waleedlatif1 commented May 2, 2026

Uh oh!

waleedlatif1 commented May 2, 2026

Uh oh!

Uh oh!

waleedlatif1 commented May 2, 2026

Uh oh!

waleedlatif1 commented May 2, 2026

Uh oh!

Uh oh!

waleedlatif1 commented May 2, 2026

Uh oh!

waleedlatif1 commented May 2, 2026

Uh oh!

cursorBot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

waleedlatif1 commented May 2, 2026•
edited
Loading

vercelBot commented May 2, 2026•
edited
Loading

cursorBot commented May 2, 2026•
edited
Loading

greptile-appsBot commented May 2, 2026•
edited
Loading