fix(desktop): validate manual-update download urls against the scheme allowlist

`buildManualEngine` regex-extracted `url:` values from the manifest served by
the configured origin and handed the first `.dmg`/`.zip` straight to
`shell.openExternal` — the only openExternal in non-test code that skipped
`openExternalSafe`, whose own docs state "Every openExternal in the app goes
through here". A hostile feed, or a hostile self-host origin the user was
tricked into configuring, could return `version: 999.0.0` plus
`url: smb://attacker/share/x.dmg` or `file:///…`; both pass the suffix test, so
a Download click handed an arbitrary scheme to the macOS URL handler, launching
a registered protocol handler instead of downloading.

Candidates are now filtered with `isSafeExternalUrl` at selection, so an
unusable url is never advertised as an available update at all, and the open
goes through `openExternalSafe` so the allowlist also holds at the sink.
Loopback http stays allowed because `feedUrlForOrigin` accepts an http origin,
so a self-host on localhost is legitimate.

Reachability is capped: `detectSelfUpdateCapability` selects the
signature-verifying electron-updater engine on Developer-ID builds, so the
manual engine runs only on ad-hoc-signed local/CI prerelease builds.

Author: waleedlatif1

apps/desktop/src/main/updater.test.ts

@@ -326,6 +326,51 @@ describe('initUpdater manual mode (no Developer ID signature)', () => {
     expect(shell.openExternal).toHaveBeenCalledTimes(2)
   })
 
+  it('refuses a manifest whose download urls are not http(s)', async () => {
+    const hostile = [
+      'version: 9.9.9',
+      'files:',
+      '  - url: smb://attacker.example/share/Sim-9.9.9-universal.dmg',
+      '    sha512: abc',
+      '  - url: file:///Applications/Calculator.app',
+      '    sha512: def',
+      "releaseDate: '2026-07-23T00:00:00.000Z'",
+    ].join('\n')
+    const { handle } = await createManualUpdater(async () => hostile)
+
+    handle.check()
+    await vi.advanceTimersByTimeAsync(0)
+
+    // Never advertised, so the user is never offered a Download button for it.
+    expect(handle.getState()).toEqual({ status: 'idle', manual: true })
+
+    handle.check()
+    handle.install()
+    expect(shell.openExternal).not.toHaveBeenCalled()
+  })
+
+  it('skips an unusable url but still offers a safe one from the same manifest', async () => {
+    const mixed = [
+      'version: 9.9.9',
+      'files:',
+      '  - url: javascript:alert(1)//Sim-9.9.9-universal.dmg',
+      '    sha512: abc',
+      '  - url: https://github.com/simstudioai/sim/releases/download/v9.9.9/Sim-9.9.9-universal.dmg',
+      '    sha512: def',
+      "releaseDate: '2026-07-23T00:00:00.000Z'",
+    ].join('\n')
+    const { handle } = await createManualUpdater(async () => mixed)
+
+    handle.check()
+    await vi.advanceTimersByTimeAsync(0)
+    expect(handle.getState()).toEqual({ status: 'available', version: '9.9.9', manual: true })
+
+    handle.check()
+    expect(shell.openExternal).toHaveBeenCalledWith(
+      'https://github.com/simstudioai/sim/releases/download/v9.9.9/Sim-9.9.9-universal.dmg'
+    )
+  })
+
   it('stays idle when the feed version is not newer', async () => {
     const { handle } = await createManualUpdater(async () => manifest(app.getVersion()))
     handle.check()

apps/desktop/src/main/updater.ts

@@ -3,7 +3,8 @@ import type { DesktopUpdateState } from '@sim/desktop-bridge'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import type { BrowserWindow } from 'electron'
-import { app, dialog, net, shell } from 'electron'
+import { app, dialog, net } from 'electron'
+import { isSafeExternalUrl, openExternalSafe } from '@/main/navigation'
 import type { EventRecorder } from '@/main/observability'
 
 const logger = createLogger('DesktopUpdater')
@@ -434,12 +435,26 @@ export function initUpdater(deps: UpdaterDeps): UpdaterHandle {
         }
         // The feed rewrites manifest urls to absolute GitHub asset URLs;
         // prefer the dmg for a human download.
-        const urls = Array.from(manifest.matchAll(/^\s*(?:-\s*)?url:\s*(\S+)\s*$/gm), (m) => m[1])
+        //
+        // Filtered before selection, not just before opening: the manifest is
+        // whatever the configured origin served, so `smb://…/x.dmg` or a bare
+        // `file:///…` would otherwise pass the suffix test and be advertised as
+        // an available update. Loopback http is kept because feedUrlForOrigin
+        // accepts an http origin, so a self-host on localhost is legitimate.
+        const urls = Array.from(
+          manifest.matchAll(/^\s*(?:-\s*)?url:\s*(\S+)\s*$/gm),
+          (m) => m[1]
+        ).filter((url) => isSafeExternalUrl(url, true))
         downloadUrl =
           urls.find((url) => url.endsWith('.dmg')) ??
           urls.find((url) => url.endsWith('.zip')) ??
           urls[0] ??
           null
+        if (!downloadUrl) {
+          logger.warn('Update manifest had no usable download url')
+          setState({ status: 'idle', manual: true })
+          return
+        }
         deps.events.record('update_check', { available: version, manual: true })
         setState({ status: 'available', version, manual: true })
       } catch (error) {
@@ -451,7 +466,10 @@ export function initUpdater(deps: UpdaterDeps): UpdaterHandle {
     const openDownload = () => {
       if (downloadUrl) {
         deps.events.record('update_manual_download', { url: downloadUrl })
-        void shell.openExternal(downloadUrl)
+        // Through openExternalSafe like every other external open in the app,
+        // so the scheme allowlist is enforced at the sink and not only where
+        // the url was chosen.
+        void openExternalSafe(downloadUrl, true)
       }
     }