feat(mothership):

[Sg312]

Summary

Brief description of what this PR does and why.

Fixes #(issue)

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other: ___________

Testing

How has this been tested? What should reviewers focus on?

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Screenshots/Videos

[cursor]

PR Summary

High Risk
High risk because it restructures core Copilot/Mothership chat streaming, persistence, and replay semantics, and adds new execution/file-export paths that touch auth, storage, and background job status behavior.

Overview
Copilot/Mothership APIs: Refactors many endpoints to use the new @/lib/copilot/request/http + request/session helpers, extracts chat GET logic into chat/queries.ts, adds PATCH /api/copilot/chat/rename, and tightens validation (e.g., api-keys/validate now rejects unknown userId). Chat streaming/persistence is reworked to use explicit per-chat stream locks (acquirePendingChatStream/getPendingChatStreamId/releasePendingChatStream) and a shared finalizeAssistantTurn flow; stream replay (/api/copilot/chat/stream) switches to cursor-based reads, adds preview-session batching, and emits structured terminal/error envelopes when recovery fails.

Mothership + admin: Adds POST /api/mothership/chats/read to mark chats read, updates mothership chat snapshot endpoints to include preview sessions and run-derived status, and introduces an admin-only proxy route api/admin/mothership that forwards GET/POST to environment-specific mothership admin APIs using MOTHERSHIP_API_ADMIN_KEY.

Execution/files/jobs/CI: Extends file serving to compile and cache .pptx, .docx, and .pdf from code via doc-vm, and enhances function/execute to support shell execution in E2B plus optional export of sandbox output files into workspace storage. Simplifies job-status lookup to BullMQ-only (removes dispatcher awareness), updates schedule execution to enqueue via the job queue (and run mothership “jobs” inline), and adjusts CI to build/push dev images separately and run dev migrations; README and landing markdown rendering switch to streamdown.

^{Reviewed by Cursor Bugbot for commit 5f7b98d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 3 potential issues.

Bugbot Autofix prepared fixes for 2 of the 3 issues found in the latest run.

• ✅ Fixed: Promise.allSettled silently swallows chat resolution errors
  • Added explicit check for rejected chatResult status that logs the error and returns a 500 response, preventing silent error swallowing.
• ✅ Fixed: Endpoint parameter allows path traversal in proxy URL
  • Added regex validation to restrict endpoint parameter to alphanumeric characters, underscores, and hyphens only, preventing path traversal attacks.

Or push these changes by commenting:

@cursor push d1fd2cb4f0

Preview (d1fd2cb4f0)

diff --git a/apps/sim/app/api/admin/mothership/route.ts b/apps/sim/app/api/admin/mothership/route.ts
--- a/apps/sim/app/api/admin/mothership/route.ts
+++ b/apps/sim/app/api/admin/mothership/route.ts
@@ -41,6 +41,10 @@
     return NextResponse.json({ error: 'endpoint query param required' }, { status: 400 })
   }
 
+  if (!/^[a-zA-Z0-9_-]+$/.test(endpoint)) {
+    return NextResponse.json({ error: 'Invalid endpoint parameter' }, { status: 400 })
+  }
+
   const baseUrl = getMothershipUrl(environment)
   if (!baseUrl) {
     return NextResponse.json(
@@ -93,6 +97,10 @@
     return NextResponse.json({ error: 'endpoint query param required' }, { status: 400 })
   }
 
+  if (!/^[a-zA-Z0-9_-]+$/.test(endpoint)) {
+    return NextResponse.json({ error: 'Invalid endpoint parameter' }, { status: 400 })
+  }
+
   const baseUrl = getMothershipUrl(environment)
   if (!baseUrl) {
     return NextResponse.json(

diff --git a/apps/sim/app/api/mothership/chat/route.ts b/apps/sim/app/api/mothership/chat/route.ts
--- a/apps/sim/app/api/mothership/chat/route.ts
+++ b/apps/sim/app/api/mothership/chat/route.ts
@@ -142,6 +142,14 @@
       return NextResponse.json({ error: 'Workspace not found or access denied' }, { status: 403 })
     }
 
+    if (chatResult.status === 'rejected') {
+      logger.error(`[${tracker.requestId}] Failed to resolve chat`, {
+        chatId,
+        error: chatResult.reason instanceof Error ? chatResult.reason.message : 'Unknown error',
+      })
+      return NextResponse.json({ error: 'Failed to resolve chat' }, { status: 500 })
+    }
+
     let currentChat: any = null
     let conversationHistory: any[] = []
     let actualChatId = chatId

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 949601c. Configure here.}

[cursor]

Promise.allSettled silently swallows chat resolution errors

High Severity

When resolveOrCreateChat rejects (e.g., a database error while chatId is provided), Promise.allSettled catches the rejection silently. The chatResult.status will be 'rejected', so the if (chatResult.status === 'fulfilled' && chatResult.value) block is skipped entirely — including the chatId && !currentChat guard that returns a 404. The code then continues with actualChatId still set to the user-provided chatId, leading to lock acquisition, user message persistence, and SSE stream creation against a potentially non-existent or inaccessible chat.

 

^{Reviewed by Cursor Bugbot for commit 949601c. Configure here.}

[cursor]

Endpoint parameter allows path traversal in proxy URL

Medium Severity

The endpoint query parameter is interpolated directly into the target URL (${baseUrl}/api/admin/${endpoint}) without any sanitization or validation. A value like ../../other-path would resolve to ${baseUrl}/other-path, allowing an admin user to reach arbitrary paths on the mothership server beyond /api/admin/. The same issue exists in both the POST and GET handlers.

Additional Locations (1)

• apps/sim/app/api/admin/mothership/route.ts#L89-L112

 

^{Reviewed by Cursor Bugbot for commit 949601c. Configure here.}