v0.6.84: redis pub/sub SNI override, security hardening, copilot reads trimmed

[TheodoreSpeaks]

• fix(redis): apply TLS SNI override to pub/sub clients (fix(redis): apply TLS SNI override to pub/sub clients #4638)
• improvement(copilot): drop unused columns from mothership chat detail reads (improvement(copilot): drop unused columns from mothership chat detail reads #4640)
• fix(security): KB fileUrl LFI, MCP/Agiloft SSRF pinning, form OTP, KB authz (fix(security): KB fileUrl LFI, MCP/Agiloft SSRF pinning, form OTP, KB authz #4639)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	May 17, 2026 6:10am

[cursor]

PR Summary

Medium Risk
Touches Redis connection initialization and pub/sub transport selection; misconfiguration (missing REDIS_TLS_SERVERNAME with rediss:// IP) will now throw instead of silently falling back to local pub/sub, potentially changing runtime behavior.

Overview
Adds a shared getRedisConnectionDefaults() helper (including TLS SNI override when rediss:// targets an IP) and uses it for both the global Redis client and Redis-backed pub/sub connections.

Updates createPubSubChannel to resolve these defaults outside the try/catch so config errors (notably missing REDIS_TLS_SERVERNAME) surface rather than silently degrading to the in-process EventEmitter fallback.

^{Reviewed by Cursor Bugbot for commit 4945d55. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR refactors shared Redis connection options (keepAlive, connectTimeout, enableOfflineQueue, and TLS SNI override) into a new exported getRedisConnectionDefaults() helper, then applies it to the pub/sub clients that previously lacked the TLS SNI override — the root cause of TLS failures when connecting to trigger.dev PrivateLink via an IP-addressed rediss:// endpoint.

• redis.ts: Renames resolveTlsOptions → resolveRedisTlsOptions, extracts shared defaults into the new getRedisConnectionDefaults() export, and keeps the existing getRedisClient() wired through it.
• pubsub.ts: Imports and passes connectionDefaults to RedisPubSubChannel, ensuring both the publish and subscribe connections use the TLS SNI override. The getRedisConnectionDefaults() call is deliberately placed outside the try/catch so a misconfigured REDIS_TLS_SERVERNAME surfaces as an error rather than silently degrading to the process-local EventEmitter and breaking cross-replica pub/sub.

Confidence Score: 5/5

Safe to merge — the change is a clean refactor plus a targeted bug fix with no unintended side effects.

Both files receive identical connection options to what they had before, with the addition of the TLS SNI override that was previously missing from the pub/sub clients. The error-surfacing behavior change in createPubSubChannel is intentional, well-commented, and consistent with how getRedisClient() already handled the same case before this PR.

No files require special attention; both changed files are straightforward and the logic is easy to follow.

Important Files Changed

Filename	Overview
apps/sim/lib/core/config/redis.ts	Extracts shared Redis connection defaults into getRedisConnectionDefaults() and renames the internal TLS resolver; no logic changes to existing behavior.
apps/sim/lib/events/pubsub.ts	Applies shared connection defaults (including TLS SNI) to pub/sub clients; moves config resolution outside the try/catch intentionally to surface misconfiguration rather than silently falling back.

Sequence Diagram

sequenceDiagram
    participant Caller
    participant createPubSubChannel
    participant getRedisConnectionDefaults
    participant resolveRedisTlsOptions
    participant RedisPubSubChannel
    participant Redis as ioredis (pub + sub)

    Caller->>createPubSubChannel: createPubSubChannel(config)
    createPubSubChannel->>getRedisConnectionDefaults: getRedisConnectionDefaults(redisUrl)
    getRedisConnectionDefaults->>resolveRedisTlsOptions: resolveRedisTlsOptions(url)
    alt rediss plus IP host plus REDIS_TLS_SERVERNAME set
        resolveRedisTlsOptions-->>getRedisConnectionDefaults: servername
        getRedisConnectionDefaults-->>createPubSubChannel: keepAlive connectTimeout enableOfflineQueue tls
    else rediss plus IP host plus REDIS_TLS_SERVERNAME missing
        resolveRedisTlsOptions-->>createPubSubChannel: throws Error surfaces to Caller
    else DNS host or non-TLS
        resolveRedisTlsOptions-->>getRedisConnectionDefaults: undefined
        getRedisConnectionDefaults-->>createPubSubChannel: keepAlive connectTimeout enableOfflineQueue
    end
    createPubSubChannel->>RedisPubSubChannel: new RedisPubSubChannel(redisUrl connectionDefaults config)
    RedisPubSubChannel->>Redis: new Redis pub connection with SNI
    RedisPubSubChannel->>Redis: new Redis sub connection with SNI
    Redis-->>RedisPubSubChannel: connections established TLS SNI applied
    RedisPubSubChannel-->>createPubSubChannel: instance
    createPubSubChannel-->>Caller: PubSubChannel

Loading

_{Reviews (1): Last reviewed commit: "fix(security): KB fileUrl LFI, MCP/Agilo..." | Re-trigger Greptile}