fix(realtime): validate cursor and selection presence payloads

[waleedlatif1]

Summary

• cursor-update and selection-update stored whatever object a client sent into the shared room presence hash and rebroadcast it to every peer, with no shape or size check. An authenticated user with read access to any workflow could park a multi-megabyte blob (bounded only by the 8 MiB Socket.IO frame ceiling) in shared Redis on every socket they opened, and have the server fan it out on every later presence broadcast.
• Both payloads are now rebuilt from a fixed field set before they reach room state or any broadcast, so unexpected keys can't ride along. This mirrors normalizeCellSelection in the table presence handler, which already guards the sibling path — the workflow path was the unguarded one.
• Added a defensive per-field length cap in updateUserActivity so future presence-bearing events inherit the bound. At 4096 it sits ~8x above the largest legitimate payload, so it never trims real presence.
• Marked UserPresence.cursor nullable. The client already sends cursor: null to clear, and that null is genuinely stored — the type just didn't say so, which only type-checked before because the handler destructured an untyped payload.

Type of Change

• Bug fix

Testing

• New presence.test.ts covers both handlers: well-formed payloads, cleared cursor, unexpected-key stripping, and malformed/oversized rejection. Verified the tests can fail — reverting the handler turns 15 of the 20 red, while the 5 behavior-preservation cases stay green either way.
• Full realtime suite passes (408 tests, 18 files).
• bunx turbo run type-check green across all 26 tasks; bun run lint and all 47 audits pass.
• No wire-format change, so old and new pods interoperate during a rolling deploy — normalized payloads are a subset of what the previous handler accepted.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 19, 2026 11:16pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no actionable new issue or outstanding previous finding remains.

Summary

This PR hardens workflow presence handling against oversized or malformed client payloads.

• Rebuilds cursor and selection updates from validated, allowlisted fields before storage and broadcast.
• Adds a UTF-8 byte-based 16 KiB defensive limit for each Redis-backed presence field.
• Updates the presence type to represent cursor clearing with null.
• Adds handler tests covering valid values, clearing, malformed input, oversized input, and unexpected-key removal.
• The change since the previous review corrects the field-size calculation and fully addresses the resolved review concern.

_{Reviews (2) · Last reviewed commit: "fix(realtime): measure presence field ca..."}

[cubic-dev-ai]

All reported issues were addressed across 4 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}