improvement(copilot): replace crypto.randomUUID() with generateId() per project rule by voidborne-d · Pull Request #4268 · simstudioai/sim

voidborne-d · 2026-04-23T00:28:08Z

Problem

AGENTS.md / CLAUDE.md forbid crypto.randomUUID():

ID Generation: Never use crypto.randomUUID(), nanoid, or uuid package. Use generateId() (UUID v4) or generateShortId() (compact) from @sim/utils/id

generateId exists for a reason: crypto.randomUUID() is unavailable on non-secure (plain HTTP) browser contexts — the root cause of #3393, where self-hosted Sim served over http://192.168.x.x:3000 white-screens with TypeError: crypto.randomUUID is not a function. PR #3397 polyfilled the client, but four copilot server-side files still call crypto.randomUUID() directly, in violation of the project rule.

apps/sim/lib/copilot/chat/persisted-message.ts   (2 sites)
apps/sim/lib/copilot/chat/post.ts                (3 sites: executionId, runId, userMessageId)
apps/sim/lib/copilot/request/tools/tables.ts     (2 sites: row_ ID prefix)
apps/sim/lib/copilot/tools/handlers/oauth.ts     (1 site: pendingCredentialDraft.id)

Fix

Replace every crypto.randomUUID() call in apps/sim/lib/copilot/** with generateId() imported from @sim/utils/id. generateId is a drop-in: it returns a lowercase RFC 4122 UUID v4 string, using crypto.randomUUID when available and falling back to crypto.getRandomValues otherwise. In tables.ts the .replace(/-/g, '') suffix is preserved so row-ID shape (row_<32-hex>) is unchanged.

Server-side Node 22 always has randomUUID, so behavior is identical today — this is about obeying the project's own hard rule and not leaving the copilot subtree as a footgun if any of these call paths ever reach a non-secure-context runtime (e.g. future edge-runtime migration, Workers, Deno, or an imported shared module).

Why small

PRs #3485 and #3574 tried to sweep the whole repo (100 / 42 files, new parallel generateId utilities); both stalled. This PR is four files, uses the canonical @sim/utils/id that already ships, and touches only the copilot subtree that was missed in the earlier cleanup. No new utilities, no behavior change.

Verification

Run from repo root:

bun run lint:check — ✅ clean (6594 sim files checked)
bun run format:check — ✅ clean
bun run turbo run type-check --filter=sim — ✅ clean
cd apps/sim && bunx vitest run lib/copilot — ✅ 40 files / 218 tests pass

Refs #3393.

vercel · 2026-04-23T00:28:14Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Apr 23, 2026 5:04am

cursor · 2026-04-23T00:28:17Z

PR Summary

Low Risk
Low risk: this is a mechanical swap of UUID generation in a few Copilot code paths, with minimal behavioral change beyond improved compatibility in non-secure or non-Node runtimes.

Overview
Replaces all remaining crypto.randomUUID() usage under apps/sim/lib/copilot/** with the project-standard generateId().

This affects IDs generated for persisted assistant messages, chat request execution/run/user message IDs, table row IDs (preserving the row_<32-hex> shape), and OAuth pendingCredentialDraft records to avoid failures in environments where crypto.randomUUID() is unavailable.

^{Reviewed by Cursor Bugbot for commit 639faf0. Configure here.}

greptile-apps · 2026-04-23T00:29:35Z

Greptile Summary

This PR replaces all crypto.randomUUID() calls in the copilot subtree (8 sites across 4 files) with generateId() from @sim/utils/id, bringing these files into compliance with the project's ID-generation rule. The generateId() utility is a verified drop-in that returns the same UUID v4 format, with a crypto.getRandomValues() fallback for non-secure contexts — no behavior change on Node 22.

Confidence Score: 5/5

Safe to merge — mechanical rule-compliance fix with no behavior change on the current server-side runtime.

All 8 substitutions are correct drop-in replacements. No remaining crypto.randomUUID() calls exist in the copilot directory. The generateId() implementation is verified to produce identical output on Node 22 while adding a secure-context fallback. No logic, schema, or API contract changes.

No files require special attention.

Important Files Changed

Filename	Overview
apps/sim/lib/copilot/chat/persisted-message.ts	Replaces 2 `crypto.randomUUID()` calls with `generateId()` — straightforward, correct substitution.
apps/sim/lib/copilot/chat/post.ts	Replaces 3 `crypto.randomUUID()` calls (`executionId`, `runId`, `userMessageId`) with `generateId()` — correct and complete.
apps/sim/lib/copilot/request/tools/tables.ts	Replaces 2 `crypto.randomUUID().replace(/-/g, '')` calls with `generateId().replace(/-/g, '')` — row-ID shape preserved, correct substitution.
apps/sim/lib/copilot/tools/handlers/oauth.ts	Replaces 1 `crypto.randomUUID()` call for `pendingCredentialDraft.id` with `generateId()` — correct substitution.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["generateId() call"] --> B{crypto.randomUUID available?}
    B -- Yes --> C["crypto.randomUUID() → UUID v4"]
    B -- No --> D["crypto.getRandomValues() → UUID v4"]
    C --> E["Return UUID string"]
    D --> E

    subgraph "Replaced call sites"
        F["persisted-message.ts ×2"]
        G["post.ts ×3"]
        H["tables.ts ×2 + .replace(/-/g,''')"]
        I["oauth.ts ×1"]
    end

    F & G & H & I --> A

_{Reviews (1): Last reviewed commit: "fix(copilot): replace crypto.randomUUID(..." | Re-trigger Greptile}

gitguardian · 2026-04-23T03:42:21Z

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

waleedlatif1 · 2026-04-23T03:42:38Z

@voidborne-d please rebase with origin staging, then we can merge

…ct rule AGENTS.md / CLAUDE.md forbid crypto.randomUUID() (non-secure contexts throw TypeError in browsers). Four copilot server-side files still violated this rule, left over after PR simstudioai#3397 polyfilled the client. Routes through request lifecycle, OAuth draft insertion, persisted message normalization, and table-row generation now use generateId from @sim/utils/id, which is a drop-in UUID v4 producer that falls back to crypto.getRandomValues when randomUUID is unavailable. Refs simstudioai#3393.

voidborne-d · 2026-04-23T05:04:38Z

Rebased against origin/staging — clean cherry-pick, no conflicts. Ready to merge.

icecrasher321 · 2026-04-24T18:57:59Z

bugbot run

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 639faf0. Configure here.}

vercel Bot temporarily deployed to Preview April 23, 2026 00:28 Inactive

waleedlatif1 changed the base branch from main to staging April 23, 2026 03:42

voidborne-d force-pushed the fix/copilot-crypto-randomuuid branch from 63523fe to 639faf0 Compare April 23, 2026 05:04

vercel Bot temporarily deployed to Preview April 23, 2026 05:04 Inactive

cursor Bot reviewed Apr 24, 2026

View reviewed changes

icecrasher321 changed the title ~~fix(copilot): replace crypto.randomUUID() with generateId() per project rule~~ improvement(copilot): replace crypto.randomUUID() with generateId() per project rule Apr 24, 2026

icecrasher321 merged commit efc8682 into simstudioai:staging Apr 24, 2026
4 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

improvement(copilot): replace crypto.randomUUID() with generateId() per project rule#4268

improvement(copilot): replace crypto.randomUUID() with generateId() per project rule#4268
icecrasher321 merged 1 commit intosimstudioai:stagingfrom
voidborne-d:fix/copilot-crypto-randomuuid

voidborne-d commented Apr 23, 2026

Uh oh!

vercel Bot commented Apr 23, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Apr 23, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Apr 23, 2026

Uh oh!

gitguardian Bot commented Apr 23, 2026 •

edited

Loading

Uh oh!

waleedlatif1 commented Apr 23, 2026

Uh oh!

voidborne-d commented Apr 23, 2026

Uh oh!

icecrasher321 commented Apr 24, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

voidborne-d commented Apr 23, 2026

Problem

Fix

Why small

Verification

Uh oh!

vercel Bot commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Apr 23, 2026

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

gitguardian Bot commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

️✅ There are no secrets present in this pull request anymore.

Uh oh!

waleedlatif1 commented Apr 23, 2026

Uh oh!

voidborne-d commented Apr 23, 2026

Uh oh!

icecrasher321 commented Apr 24, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vercel Bot commented Apr 23, 2026 •

edited

Loading

cursor Bot commented Apr 23, 2026 •

edited

Loading

gitguardian Bot commented Apr 23, 2026 •

edited

Loading