Merge branch 'staging-v4' of github.com:simstudioai/sim into staging-v4

Author: icecrasher321

.github/workflows/ci.yml

@@ -52,6 +52,48 @@ jobs:
             echo "ℹ️ Not a release commit"
           fi
 
+  # Detect shell-code changes on dev/staging pushes. Web-only changes never
+  # need a desktop build (installed shells load the web app live); changes to
+  # the Electron app or the bridge packages trigger a per-env prerelease build
+  # (dev → alpha channel, staging → beta) that the env's update feed
+  # (/api/desktop/update) starts offering automatically.
+  detect-desktop-changes:
+    name: Detect Desktop Changes
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 5
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/staging')
+    outputs:
+      changed: ${{ steps.diff.outputs.changed }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 50
+
+      - name: Diff desktop paths
+        id: diff
+        env:
+          BEFORE: ${{ github.event.before }}
+        run: |
+          # Force pushes (dev resets) can reference a BEFORE we don't have;
+          # fall back to the previous commit, and to no build when even that
+          # is unavailable.
+          if [ -z "$BEFORE" ] || ! git cat-file -e "$BEFORE" 2>/dev/null; then
+            BEFORE="$(git rev-parse HEAD^ 2>/dev/null || echo '')"
+          fi
+          if [ -z "$BEFORE" ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "ℹ️ No comparable base commit; skipping desktop prerelease"
+            exit 0
+          fi
+          if git diff --name-only "$BEFORE" HEAD | grep -qE '^(apps/desktop/|packages/desktop-bridge/|packages/browser-protocol/)'; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "✅ Desktop shell code changed"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "ℹ️ No desktop shell changes"
+          fi
+
   # Run database migrations before images are promoted: the ECR latest/staging
   # tag push triggers CodePipeline, so migrating first guarantees the schema is
   # in place before the new app version deploys (replaces the removed ECS
@@ -541,8 +583,10 @@ jobs:
     name: Check Desktop Signing Secrets
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 2
-    needs: [detect-version]
-    if: needs.detect-version.outputs.is_release == 'true'
+    needs: [detect-version, detect-desktop-changes]
+    # !cancelled(): detect-desktop-changes is skipped on main (and
+    # detect-version tags only on main); either path may need the probe.
+    if: ${{ !cancelled() && (needs.detect-version.outputs.is_release == 'true' || needs.detect-desktop-changes.outputs.changed == 'true') }}
     outputs:
       configured: ${{ steps.check.outputs.configured }}
     steps:
@@ -567,3 +611,92 @@ jobs:
       version: ${{ needs.detect-version.outputs.version }}
       publish: true
     secrets: inherit
+
+  # Per-env desktop prereleases: a dev/staging push that touches shell code
+  # publishes a channel-tagged GitHub prerelease (vX.Y.Z-alpha.N from dev,
+  # vX.Y.Z-beta.N from staging). Each environment's /api/desktop/update feed
+  # offers only its channel, so dev-pointed shells pick up alpha builds,
+  # staging-pointed shells beta builds, and prod-pointed shells stable
+  # releases — independently. Unlike stable releases, prereleases build even
+  # before the Apple signing secrets exist — unsigned, so the update pipeline
+  # is testable end to end; installed shells detect the missing Developer ID
+  # and offer a manual download instead of a Squirrel install.
+  create-desktop-prerelease:
+    name: Create Desktop Prerelease
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 5
+    needs: [detect-desktop-changes, check-desktop-signing]
+    if: ${{ !cancelled() && needs.detect-desktop-changes.outputs.changed == 'true' }}
+    permissions:
+      contents: write
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+
+      - name: Compute prerelease version and create release
+        id: version
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          SIGNED: ${{ needs.check-desktop-signing.outputs.configured }}
+        run: |
+          if [ "$GITHUB_REF" = "refs/heads/dev" ]; then CHANNEL=alpha; else CHANNEL=beta; fi
+          # Prerelease core = next patch after the latest stable release, so
+          # channel builds always outrank the stable they are built on top of
+          # and are always superseded by the next stable.
+          LATEST="$(gh release list --exclude-pre-releases --limit 1 --json tagName --jq '.[0].tagName' || true)"
+          LATEST="${LATEST:-v0.0.0}"
+          IFS='.' read -r MAJOR MINOR PATCH <<< "${LATEST#v}"
+          TAG="v${MAJOR}.${MINOR}.$((PATCH + 1))-${CHANNEL}.${GITHUB_RUN_NUMBER}"
+          NOTES="Automated ${CHANNEL}-channel desktop build from ${GITHUB_REF_NAME} @ ${GITHUB_SHA::7}."
+          if [ "$SIGNED" != "true" ]; then
+            NOTES="$NOTES
+
+          ⚠️ Unsigned test build (Apple signing secrets not configured). Gatekeeper will quarantine a downloaded copy: right-click → Open, or clear the flag with \`xattr -dr com.apple.quarantine /Applications/Sim.app\`."
+          fi
+          gh release create "$TAG" \
+            --prerelease \
+            --target "$GITHUB_SHA" \
+            --title "$TAG" \
+            --notes "$NOTES"
+          echo "version=$TAG" >> "$GITHUB_OUTPUT"
+          echo "✅ Created prerelease $TAG"
+
+  desktop-prerelease:
+    name: Desktop Prerelease Build
+    needs: [create-desktop-prerelease, check-desktop-signing]
+    permissions:
+      contents: write
+    uses: ./.github/workflows/desktop-release.yml
+    with:
+      version: ${{ needs.create-desktop-prerelease.outputs.version }}
+      publish: true
+      sign: ${{ needs.check-desktop-signing.outputs.configured == 'true' }}
+    secrets: inherit
+
+  # Keep the release list tidy: per channel, retain the newest 5 prereleases
+  # and delete the rest (with their tags, so dev force-resets don't strand
+  # commits behind stale tags).
+  prune-desktop-prereleases:
+    name: Prune Desktop Prereleases
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 5
+    needs: [desktop-prerelease]
+    permissions:
+      contents: write
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_REPO: ${{ github.repository }}
+    steps:
+      - name: Delete stale prereleases
+        run: |
+          if [ "$GITHUB_REF" = "refs/heads/dev" ]; then CHANNEL=alpha; else CHANNEL=beta; fi
+          gh release list --limit 100 --json tagName,isPrerelease,createdAt \
+            --jq "[.[] | select(.isPrerelease and (.tagName | test(\"-${CHANNEL}\\\\.\")))] | sort_by(.createdAt) | reverse | .[5:] | .[].tagName" |
+          while read -r TAG; do
+            [ -n "$TAG" ] || continue
+            echo "Deleting stale prerelease $TAG"
+            gh release delete "$TAG" --cleanup-tag --yes
+          done

.github/workflows/desktop-release.yml

@@ -18,6 +18,14 @@ on:
         required: false
         type: boolean
         default: true
+      sign:
+        description: Sign and notarize with the Apple Developer identity. When
+          false (prerelease testing before the signing secrets exist) the build
+          is packaged unsigned; installed shells detect this and offer manual
+          downloads instead of Squirrel installs.
+        required: false
+        type: boolean
+        default: true
   workflow_dispatch:
     inputs:
       version:
@@ -29,6 +37,11 @@ on:
         required: false
         type: boolean
         default: false
+      sign:
+        description: Sign and notarize with the Apple Developer identity
+        required: false
+        type: boolean
+        default: true
 
 permissions:
   contents: write
@@ -78,11 +91,39 @@ jobs:
             exit 1
           fi
 
+      # Prerelease versions carry their environment in the tag: -alpha.N is a
+      # dev build, -beta.N a staging build. The channel decides the app's
+      # identity (name/bundle id — a separate app per environment, installable
+      # side by side) and the default origin baked into the bundle, which in
+      # turn selects the update feed the installed app polls.
+      - name: Resolve channel identity
+        id: channel
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          case "$VERSION" in
+            *-alpha.*)
+              NAME='Sim Dev'; APP_ID=ai.sim.desktop.dev; ORIGIN=https://www.dev.sim.ai ;;
+            *-beta.*)
+              NAME='Sim Staging'; APP_ID=ai.sim.desktop.staging; ORIGIN=https://www.staging.sim.ai ;;
+            *)
+              NAME='Sim'; APP_ID=ai.sim.desktop; ORIGIN='' ;;
+          esac
+          {
+            echo "name=$NAME"
+            echo "app_id=$APP_ID"
+            echo "origin=$ORIGIN"
+          } >> "$GITHUB_OUTPUT"
+          echo "Building $NAME ($APP_ID) default origin: ${ORIGIN:-production}"
+
       - name: Bundle main and preload
         working-directory: apps/desktop
+        env:
+          SIM_DESKTOP_DEFAULT_ORIGIN: ${{ steps.channel.outputs.origin }}
         run: bun run build
 
       - name: Write App Store Connect API key
+        if: ${{ inputs.sign }}
         env:
           APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
         run: |
@@ -91,6 +132,7 @@ jobs:
           chmod 600 "$RUNNER_TEMP/appstoreconnect/AuthKey.p8"
 
       - name: Package, sign, and notarize
+        if: ${{ inputs.sign }}
         working-directory: apps/desktop
         env:
           CSC_LINK: ${{ secrets.CSC_LINK }}
@@ -101,9 +143,28 @@ jobs:
           APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
           APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-        run: bunx electron-builder --mac --publish never
+          PRODUCT_NAME: ${{ steps.channel.outputs.name }}
+          APP_ID: ${{ steps.channel.outputs.app_id }}
+        run: >
+          bunx electron-builder --mac --publish never
+          -c.productName="$PRODUCT_NAME" -c.appId="$APP_ID"
+
+      # Unsigned prerelease path: no Developer ID, no notarization. The
+      # binaries end up ad-hoc/linker-signed, which runs locally but gets
+      # quarantined when downloaded — fine for testing the update pipeline.
+      - name: Package unsigned
+        if: ${{ !inputs.sign }}
+        working-directory: apps/desktop
+        env:
+          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
+          PRODUCT_NAME: ${{ steps.channel.outputs.name }}
+          APP_ID: ${{ steps.channel.outputs.app_id }}
+        run: >
+          bunx electron-builder --mac --publish never -c.mac.notarize=false
+          -c.productName="$PRODUCT_NAME" -c.appId="$APP_ID"
 
       - name: Validate signature and notarization
+        if: ${{ inputs.sign }}
         run: |
           DMG="$(ls apps/desktop/release/*.dmg | head -1)"
           xcrun stapler validate "$DMG"

.github/workflows/test-build.yml

@@ -113,6 +113,9 @@ jobs:
       - name: API contract boundary audit
         run: bun run check:api-validation:strict
 
+      - name: Desktop bridge contract audit
+        run: bun run check:desktop-bridge
+
       - name: Shared utils enforcement audit
         run: bun run check:utils
 

apps/desktop/README.md

@@ -137,19 +137,17 @@ Good fits for the bridge: OS notifications + dock badge on workflow completion,
 
 ### Local filesystem access
 
-The main Copilot agent can inspect a user-selected local directory in the desktop app through request-local client tools (`local_mount_directory`, `local_list_mounts`, `local_list`, `local_glob`, `local_read`, `local_grep`, `local_stat`, and `local_forget_mount`). This capability is:
+Copilot can inspect user-selected local directories through the ordinary VFS tools. Granted folders appear beneath the top-level `user-local/` namespace, and `glob`, `grep`, and `read` are routed to Electron only when their path/pattern is explicitly scoped there. This capability is:
 
-- **Explicit and read-only:** the native folder picker creates the grant; there are no write/delete/execute operations.
+- **Explicit and read-only:** only a user click may open the native folder picker or revoke a grant; model tool calls cannot do either. There are no write/delete/execute/upload operations.
 - **Remembered securely:** grants are encrypted in Electron's private app data with OS-backed `safeStorage` and restored with the same opaque URI after a normal app restart. (A security-scoped bookmark is stored alongside each grant, but it is a no-op in the current Developer ID build — only the macOS App Sandbox consumes it — and is kept purely for forward-compatibility should a sandboxed/MAS build ever ship.) There is no plaintext fallback: when secure storage is unavailable, the returned mount has `remembered: false` and lasts only for that app session.
-- **Revocable:** `local_forget_mount` removes one grant. All grants are removed on explicit sign-out or server-origin change so another Sim account or server cannot inherit them. Normal app quit only releases active OS handles and keeps the encrypted grants.
-- **Opaque:** renderer and model see only `localfs://<mount-id>/...` URIs. Electron resolves every URI, checks lexical and realpath containment, and refuses symlink escapes.
-- **Desktop-only:** the web app advertises these request-local tools only when `window.simDesktop.localFilesystem` is present. They are available directly to the main agent and are not added to subagent allowlists.
+- **Revocable:** Desktop settings removes one grant. All grants are removed on explicit sign-out or server-origin change so another Sim account or server cannot inherit them. Normal app quit only releases active OS handles and keeps the encrypted grants.
+- **Opaque:** the model sees canonical paths such as `user-local/Project--<mount-id>/README.md`, never host paths or internal `localfs://` URIs. Electron resolves every request, checks lexical and realpath containment, and refuses symlink escapes.
+- **Desktop-only:** the web app advertises `desktopCapabilities.localFilesystem` only when the Electron bridge is present. Mothership adds the `user-local/` prompt surface and per-call client routing only for that capability, including delegated and resumed work.
+- **Bound to a live Copilot call:** before a native read/search or browser action, Electron asks the authenticated Sim origin for the pending tool-call record. Local requests must exactly match its persisted operation, path, and options; browser actions run with the persisted arguments rather than renderer-supplied ones. Completed, failed, and aborted runs are rejected.
+- **Abort-aware and bounded:** stop/cancel propagates to active native scans and reads. File size, aggregate grep bytes, line, result, traversal-depth, and scan-count limits remain enforced in Electron, and unsafe regular expressions are rejected before execution.
 
-Server-side tools cannot consume a `localfs://` URI. `local_stage_file` reads the granted file in Electron and uploads its bytes as a normal chat upload, returning `uploads/...` plus the collision-safe `fileName`. The agent then calls `materialize_file(fileName)` to promote it to durable `files/...` before passing that path to tools such as `function_execute` or `generate_image`:
-
-```text
-localfs://... → local_stage_file → uploads/... → materialize_file → files/... → server tool
-```
+Raw local file bytes are never exposed through the preload bridge and cannot be staged or uploaded by a model. Bounded text read/search results are returned to the active Copilot request; a user must use the normal attachment UI when they want the file itself to leave the device.
 
 ## Auto-update, channels, rollout, rollback
 

apps/desktop/electron-builder.yml

@@ -13,6 +13,11 @@ files:
 
 asar: true
 
+# Space-free regardless of productName ("Sim Dev" etc.): GitHub rewrites
+# asset names containing spaces, which would desync the electron-updater
+# manifest from the uploaded files.
+artifactName: "Sim-${version}-${arch}.${ext}"
+
 electronFuses:
   runAsNode: false
   enableCookieEncryption: true

apps/desktop/package.json

@@ -35,11 +35,14 @@
     "@sim/logger": "workspace:*",
     "@sim/security": "workspace:*",
     "@sim/utils": "workspace:*",
-    "electron-updater": "6.8.9"
+    "electron-updater": "6.8.9",
+    "micromatch": "4.0.8",
+    "safe-regex2": "5.1.0"
   },
   "devDependencies": {
     "@playwright/test": "1.61.1",
     "@sim/tsconfig": "workspace:*",
+    "@types/micromatch": "4.0.10",
     "@types/node": "24.2.1",
     "electron": "43.1.1",
     "electron-builder": "26.15.3",

apps/desktop/scripts/build.ts

@@ -8,9 +8,13 @@ const watch = process.argv.includes('--watch')
 // unlike the SIM_DESKTOP_ORIGIN env var, which only affects terminal-launched
 // processes. Official builds leave it unset (default https://sim.ai).
 const bakedDefaultOrigin = process.env.SIM_DESKTOP_DEFAULT_ORIGIN ?? ''
-if (bakedDefaultOrigin && !/^https:\/\/[^\s/]+$/.test(bakedDefaultOrigin)) {
+if (
+  bakedDefaultOrigin &&
+  !/^https:\/\/[^\s/]+$/.test(bakedDefaultOrigin) &&
+  !/^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(bakedDefaultOrigin)
+) {
   console.error(
-    `SIM_DESKTOP_DEFAULT_ORIGIN must be a bare https origin (got "${bakedDefaultOrigin}")`
+    `SIM_DESKTOP_DEFAULT_ORIGIN must be a bare https origin or http://localhost (got "${bakedDefaultOrigin}")`
   )
   process.exit(1)
 }