fix(cli): bind sim-setup's containers to loopback, fix reset and env quoting, retire the legacy simstudio CLI

Merged
WA
2d ago
+156-710

Summary

  • sim-setup binds its managed Redis and Postgres to 127.0.0.1 and writes 127.0.0.1 URLs. Docker's default -p port:port listens on every interface and bypasses host firewalls, and the official Redis image ships with protected mode off and no password, so dev-mode Redis was reachable from the network. Containers an earlier release published on every interface are flagged at the start of dev setup, with the steps to recreate them on loopback (sim-setup down, then re-run; data is kept). They are not replaced automatically: Redis holds live realtime sessions, and a DATABASE_URL may name its own database.
  • sim-setup reset tears down before archiving .env. Compose interpolates the required ${VAR:?} secrets even for down -v, so archiving first made a Compose reset fail with the stack still running and the config moved aside. A failed teardown now leaves the env files in place, for dev and Kubernetes too.
  • Env values that need it are quoted on write. dotenv (Next's loader) cuts an unquoted value at any # (a#b read as a), and every reader trims edge whitespace and strips a leading quote. Those values are single-quoted, which dotenv, Bun, Compose and our own parser all read literally. Ordinary values (hex secrets, URLs, DSNs) are written byte-for-byte as before. A value with a line break is refused instead of spilling into a second line.
  • sim-setup's THIRD_PARTY_LICENSES adds the five bundled MIT packages it was missing: fast-string-truncated-width, fast-string-width, fast-wrap-ansi, ipaddr.js and sisteransi.
  • The published sim manifest drops the source-only ./embed export and the #sim-cli/* imports. They point at src/*.ts, which the tarball doesn't ship, so import 'sim/embed' from npm failed. The repo manifest is unchanged because apps/sim consumes sim/embed from source through the workspace. The smoke test now fails if any export target is missing from the tarball.
  • Remove the legacy packages/cli (simstudio) and its publish workflow. It hasn't published since 0.1.19. That release starts Postgres as postgres/postgres on all interfaces with a placeholder auth secret, and current realtime images refuse to start with that secret. Nothing in the repo or docs points at it, and sim-setup replaces it. The npm package will be deprecated separately.
  • Kept out of scope: moving sim's bundled runtime deps to devDependencies. apps/sim imports the CLI source through sim/embed, so its Docker build resolves them through those dependencies.

Type of Change

  • Bug fix

Testing

  • New env-files.test.ts cases: round-trips for #, edge whitespace and quotes, and line-break refusal. All 5 fail against the staging source and pass with the fix. Plain values are checked to stay unquoted.
  • Wrote the new lines and read them back through @next/env, Bun's loader and docker compose config: every value came back identical.
  • Docker Compose 2.39: down -v without .env fails on the required variables, and with it present succeeds.
  • Docker: an old-style -p binding was reachable on the LAN address, the new loopback binding was not, and docker port still parses.
  • Docker: exposure detection flags legacy containers (including stopped ones) and stays quiet for loopback-bound containers and when no containers exist.
  • Ran the new workflow steps against the published sim@2.2.23 tarball: the export check fails on the current manifest and passes after the strip, and sim/runtime still imports.
  • sim-setup suite (79 tests), test:scripts (739 tests), sim-setup type-check, check:utils, check:file-names, check:comment-hygiene, check:boundaries, bun run lint, actionlint.
  • bun install --frozen-lockfile --lockfile-only confirms the lockfile edit.
  • Full type-check, check:audits and the full test suite run in CI.

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing (new tests pass the test-audit authoring gate)
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)