fix(socket): sync deploy button state across collaborators

[waleedlatif1]

Summary

• Broadcast workflow-deployed socket events when deployment state changes so all connected users see the correct deploy button status
• Added handleWorkflowDeployed to socket room managers (memory + Redis), HTTP endpoint, and client-side listener
• Covers all deploy paths: full deploy/undeploy, version activation, and chat/form deploy triggers

Type of Change

• Bug fix

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Apr 17, 2026 0:37am

[cursor]

PR Summary

Medium Risk
Touches deploy/undeploy orchestration and Socket.IO notification paths; a missed notification or misconfigured URL could leave clients out of sync or break internal socket-server callbacks.

Overview
Ensures collaborators see up-to-date deployment status by broadcasting a new workflow-deployed Socket.IO event whenever a workflow’s deployment state changes.

Adds an internal socket-server endpoint (POST /api/workflow-deployed) and room-manager handlers (memory + Redis) to fan out this event, and wires client-side listeners (SocketProvider + useCollaborativeWorkflow) to invalidate deployment queries for the active workflow.

Also centralizes socket/ollama URL resolution via new helpers in lib/core/utils/urls (used across API routes, copilot tools, CSP generation, and Ollama provider/models API), and updates tests/mocks accordingly.

^{Reviewed by Cursor Bugbot for commit a6bae8f. Configure here.}

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

[greptile-apps]

Greptile Summary

This PR broadcasts a workflow-deployed socket event whenever deployment state changes, so all connected collaborators can refresh their deploy button status. It adds notifySocketDeploymentChanged to the five deploy paths (full deploy, full undeploy, version activation, chat PATCH, form POST), wires up the new /api/workflow-deployed HTTP endpoint on the socket server, and consolidates previously scattered env.SOCKET_SERVER_URL || 'http://localhost:3002' literals into typed utility functions.

• After a form is auto-deployed via POST /api/form (or a chat redeployed via PATCH /api/chat/manage/[id]), notifySocketDeploymentChanged fires and the client calls invalidateDeploymentQueries — but that helper only invalidates info, deployedState, and versions. The formStatus/chatStatus query keys are not included, so collaborators' form/chat panels in the deploy dialog show stale data even though the main deploy button correctly updates.

Confidence Score: 5/5

Safe to merge — the core deploy-button sync works correctly across all stated paths; the remaining finding is a minor completeness gap in the deploy panel's secondary queries.

All five deploy paths emit the socket event and handle errors gracefully. The URL utility consolidation is clean and well-documented. The only finding is P2: chatStatus/formStatus are not invalidated for collaborators on the workflow-deployed event, leaving secondary panel data stale in some cases — but the primary deploy button state is always correct. No P0 or P1 issues found.

apps/sim/hooks/use-collaborative-workflow.ts — consider expanding invalidateDeploymentQueries coverage to include chatStatus/formStatus for full panel sync.

Important Files Changed

Filename	Overview
apps/sim/lib/workflows/orchestration/deploy.ts	Adds notifySocketDeploymentChanged helper covering full deploy, undeploy, and version activation paths; correctly handles errors and logs non-2xx responses.
apps/sim/hooks/use-collaborative-workflow.ts	Adds handleWorkflowDeployed listener that calls invalidateDeploymentQueries; the function is not async so the returned Promise is fire-and-forget, consistent with similar patterns in this file.
apps/sim/socket/rooms/memory-manager.ts	Adds handleWorkflowDeployed to emit workflow-deployed socket event to room occupants; mirrors handleWorkflowUpdate pattern correctly.
apps/sim/socket/rooms/redis-manager.ts	Adds handleWorkflowDeployed using the Redis manager's async hasWorkflowRoom check, consistent with other methods in this class.
apps/sim/socket/routes/http.ts	New /api/workflow-deployed route follows the exact same structure as existing /api/workflow-updated and /api/workflow-deleted routes; auth and ready-check are applied globally before routing.
apps/sim/lib/core/utils/urls.ts	Extracts getSocketServerUrl, getSocketUrl, and getOllamaUrl helpers, eliminating scattered hardcoded fallback literals; DEFAULT_SOCKET_URL is intentionally duplicated in csp.ts with an explanatory comment.
apps/sim/app/workspace/providers/socket-provider.tsx	Adds onWorkflowDeployed callback and workflow-deployed socket listener following the same pattern as all other event handlers in this provider.
apps/sim/app/api/chat/manage/[id]/route.ts	PATCH handler correctly calls notifySocketDeploymentChanged after redeploy; DELETE handler calls performChatUndeploy (removes chat record only, workflow isDeployed flag unchanged) so no notification needed there.
apps/sim/app/api/form/route.ts	Adds notifySocketDeploymentChanged after auto-deploy in the form creation POST handler; formStatus query not invalidated on collaborators but that gap is pre-existing in local mutations too.
apps/sim/lib/core/security/csp.ts	Extracts toWebSocketUrl helper and uses DEFAULT_SOCKET_URL/DEFAULT_OLLAMA_URL constants; comment explains why imports from urls.ts are intentionally avoided here.

Sequence Diagram

sequenceDiagram
    participant API as Next.js API Route
    participant Deploy as orchestration/deploy.ts
    participant Socket as Socket Server
    participant Room as RoomManager
    participant Client as Collaborator Browser

    API->>Deploy: performFullDeploy / performFullUndeploy / performActivateVersion
    Deploy->>Deploy: update DB deployment state
    Deploy->>Socket: POST /api/workflow-deployed
    Socket->>Room: handleWorkflowDeployed(workflowId)
    Room->>Client: emit workflow-deployed event
    Client->>Client: handleWorkflowDeployed(data)
    Client->>Client: invalidateDeploymentQueries(queryClient, workflowId)
    Note over Client: Refreshes info, deployedState, versions

    Note over API,Client: Also triggered by chat PATCH and form POST paths

Loading

_{Reviews (3): Last reviewed commit: "fix(queries): invalidate chat and form s..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 0daddf6. Configure here.}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a6bae8f. Configure here.}