Merge remote-tracking branch 'origin/staging' into feat/deploy-requires-write

Author: mzxchandra

apps/desktop/src/main/menu.test.ts

@@ -90,9 +90,9 @@ describe('buildMenuTemplate', () => {
     ])
   })
 
-  it('keeps Help limited to documentation and system status', () => {
+  it('keeps Help limited to documentation and Sim status', () => {
     const help = submenu(buildMenuTemplate(makeDeps()), 'Help')
-    expect(help.map((item) => item.label)).toEqual(['Sim Documentation', 'System Status'])
+    expect(help.map((item) => item.label)).toEqual(['Sim Documentation', 'Sim Status'])
   })
 
   it('never exposes developer tools in the application menu', () => {

apps/desktop/src/main/menu.ts

@@ -211,7 +211,7 @@ export function buildMenuTemplate(deps: MenuDeps): MenuItemConstructorOptions[]
           click: () => void openExternalSafe(DOCS_URL, deps.allowHttpLocalhost()),
         },
         {
-          label: 'System Status',
+          label: 'Sim Status',
           click: () => void openExternalSafe(STATUS_URL, deps.allowHttpLocalhost()),
         },
       ],

apps/docs/openapi-v2-workflows.json

@@ -1021,7 +1021,7 @@
       "post": {
         "operationId": "executeWorkflowV2",
         "summary": "Execute Workflow",
-        "description": "Execute a deployed workflow synchronously, asynchronously, or as Server-Sent Events. Public workflows permit anonymous synchronous and streaming execution; asynchronous execution requires an API key. A synchronous run that exceeds its execution timeout returns HTTP 200 with `status: \"failed\"` and `error.code: \"TIMEOUT\"` rather than an HTTP error, so branch on `status`. The optional `X-Run-Id` header is a one-shot uniqueness claim, not an idempotency key: reusing a value returns 409 with `error.details.code: \"RUN_ID_CONFLICT\"` and never replays the earlier run. Option constraints — each is a 400: (1) `async: true` requires an API key; anonymous public-workflow callers may only execute synchronously or as a stream. (2) `async` and `stream` cannot both be true. (3) `executionTimeoutSeconds` is accepted only when `async: true`. (4) `async: true` rejects every streaming and output-shaping option — `selectedOutputs`, `includeThinking`, `includeToolCalls`, `includeFileBase64`, and `base64MaxBytes`. (5) `includeThinking` and `includeToolCalls` require the `X-Sim-Stream-Protocol: agent-events-v1` request header, which declares that the client understands agent-event frames.",
+        "description": "Execute a deployed workflow synchronously, asynchronously, or as Server-Sent Events. Public workflows permit anonymous synchronous and streaming execution; asynchronous execution requires an API key. A synchronous run that exceeds its execution timeout returns HTTP 200 with `status: \"failed\"` and `error.code: \"TIMEOUT\"` rather than an HTTP error, so branch on `status`. The optional `X-Run-Id` header is a one-shot uniqueness claim, not an idempotency key: reusing a value returns 409 with `error.details.code: \"RUN_ID_CONFLICT\"` and never replays the earlier run. Option constraints — each is a 400: (1) `async: true` requires an API key; anonymous public-workflow callers may only execute synchronously or as a stream. (2) `async` and `stream` cannot both be true. (3) `executionTimeoutSeconds` is accepted only when `async: true`. (4) `async: true` rejects every streaming and output-shaping option — `selectedOutputs`, `includeThinking`, `includeToolCalls`, `includeFileBase64`, and `base64MaxBytes`. (5) `includeThinking` and `includeToolCalls` require `stream: true`. (6) `includeThinking` and `includeToolCalls` require the `X-Sim-Stream-Protocol: agent-events-v1` request header, which declares that the client understands agent-event frames.",
         "tags": ["Workflows"],
         "security": [
           {
@@ -1069,7 +1069,7 @@
         ],
         "requestBody": {
           "required": true,
-          "description": "Input and execution-mode options for a deployed workflow. Option constraints — each is a 400: (1) `async: true` requires an API key; anonymous public-workflow callers may only execute synchronously or as a stream. (2) `async` and `stream` cannot both be true. (3) `executionTimeoutSeconds` is accepted only when `async: true`. (4) `async: true` rejects every streaming and output-shaping option — `selectedOutputs`, `includeThinking`, `includeToolCalls`, `includeFileBase64`, and `base64MaxBytes`. (5) `includeThinking` and `includeToolCalls` require the `X-Sim-Stream-Protocol: agent-events-v1` request header, which declares that the client understands agent-event frames.",
+          "description": "Input and execution-mode options for a deployed workflow. Option constraints — each is a 400: (1) `async: true` requires an API key; anonymous public-workflow callers may only execute synchronously or as a stream. (2) `async` and `stream` cannot both be true. (3) `executionTimeoutSeconds` is accepted only when `async: true`. (4) `async: true` rejects every streaming and output-shaping option — `selectedOutputs`, `includeThinking`, `includeToolCalls`, `includeFileBase64`, and `base64MaxBytes`. (5) `includeThinking` and `includeToolCalls` require `stream: true`. (6) `includeThinking` and `includeToolCalls` require the `X-Sim-Stream-Protocol: agent-events-v1` request header, which declares that the client understands agent-event frames.",
           "content": {
             "application/json": {
               "schema": {
@@ -3861,12 +3861,12 @@
           },
           "includeThinking": {
             "default": false,
-            "description": "Include model reasoning events in an agent-event stream. Requires the `X-Sim-Stream-Protocol: agent-events-v1` request header, and is rejected when `async` is true.",
+            "description": "Include model reasoning events in an agent-event stream. Requires `stream: true` and the `X-Sim-Stream-Protocol: agent-events-v1` request header, and is rejected when `async` is true.",
             "type": "boolean"
           },
           "includeToolCalls": {
             "default": false,
-            "description": "Include tool-call events in an agent-event stream. Requires the `X-Sim-Stream-Protocol: agent-events-v1` request header, and is rejected when `async` is true.",
+            "description": "Include tool-call events in an agent-event stream. Requires `stream: true` and the `X-Sim-Stream-Protocol: agent-events-v1` request header, and is rejected when `async` is true.",
             "type": "boolean"
           },
           "includeFileBase64": {
@@ -3882,7 +3882,7 @@
         },
         "additionalProperties": false,
         "title": "Execute workflow request",
-        "description": "Input and execution-mode options for a deployed workflow. Option constraints — each is a 400: (1) `async: true` requires an API key; anonymous public-workflow callers may only execute synchronously or as a stream. (2) `async` and `stream` cannot both be true. (3) `executionTimeoutSeconds` is accepted only when `async: true`. (4) `async: true` rejects every streaming and output-shaping option — `selectedOutputs`, `includeThinking`, `includeToolCalls`, `includeFileBase64`, and `base64MaxBytes`. (5) `includeThinking` and `includeToolCalls` require the `X-Sim-Stream-Protocol: agent-events-v1` request header, which declares that the client understands agent-event frames.",
+        "description": "Input and execution-mode options for a deployed workflow. Option constraints — each is a 400: (1) `async: true` requires an API key; anonymous public-workflow callers may only execute synchronously or as a stream. (2) `async` and `stream` cannot both be true. (3) `executionTimeoutSeconds` is accepted only when `async: true`. (4) `async: true` rejects every streaming and output-shaping option — `selectedOutputs`, `includeThinking`, `includeToolCalls`, `includeFileBase64`, and `base64MaxBytes`. (5) `includeThinking` and `includeToolCalls` require `stream: true`. (6) `includeThinking` and `includeToolCalls` require the `X-Sim-Stream-Protocol: agent-events-v1` request header, which declares that the client understands agent-event frames.",
         "examples": [
           {
             "input": {

apps/sim/app/api/desktop/update/latest-mac.yml/route.test.ts

@@ -1,6 +1,7 @@
 /**
  * @vitest-environment node
  */
+import { setEnv } from '@sim/testing'
 import { NextRequest } from 'next/server'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { MANIFEST_ASSET_NAME } from '@/lib/desktop/update-feed'
@@ -27,8 +28,11 @@ function manifest(version: string) {
   return [`version: ${version}`, 'files:', `  - url: Sim-${version}-universal-mac.zip`].join('\n')
 }
 
-async function getFeed(hostname: string): Promise<Response> {
-  return GET(new NextRequest(`https://${hostname}/api/desktop/update/latest-mac.yml`), undefined)
+async function getFeed(hostname: string, headers?: HeadersInit): Promise<Response> {
+  return GET(
+    new NextRequest(`https://${hostname}/api/desktop/update/latest-mac.yml`, { headers }),
+    undefined
+  )
 }
 
 describe('desktop update manifest route', () => {
@@ -37,17 +41,19 @@ describe('desktop update manifest route', () => {
   beforeEach(() => {
     fetchMock.mockReset()
     vi.stubGlobal('fetch', fetchMock)
+    setEnv({ APPCONFIG_ENVIRONMENT: undefined })
   })
 
   afterEach(() => {
     vi.unstubAllGlobals()
   })
 
   it.each([
-    ['www.dev.sim.ai', 'v1.2.0-dev.4', '1.2.0-dev.4'],
-    ['www.staging.sim.ai', 'v1.2.0-staging.5', '1.2.0-staging.5'],
-    ['www.sim.ai', 'v1.1.0', '1.1.0'],
-  ])('serves the newest release for %s', async (hostname, tag, version) => {
+    ['dev', 'v1.2.0-dev.4', '1.2.0-dev.4'],
+    ['staging', 'v1.2.0-staging.5', '1.2.0-staging.5'],
+    ['production', 'v1.1.0', '1.1.0'],
+  ])('serves the newest release for the %s deployment', async (environment, tag, version) => {
+    setEnv({ APPCONFIG_ENVIRONMENT: environment })
     fetchMock.mockImplementation(async (input: string | URL | Request) => {
       const url = String(input)
       if (url === RELEASES_URL) {
@@ -63,7 +69,7 @@ describe('desktop update manifest route', () => {
       return new Response(null, { status: 404 })
     })
 
-    const response = await getFeed(hostname)
+    const response = await getFeed('internal.service.local')
     const body = await response.text()
 
     expect(response.status).toBe(200)
@@ -74,6 +80,62 @@ describe('desktop update manifest route', () => {
     )
   })
 
+  it.each([
+    ['dev', 'www.staging.sim.ai:443', 'v1.2.0-dev.4', '1.2.0-dev.4'],
+    ['staging', 'www.sim.ai:443', 'v1.2.0-staging.5', '1.2.0-staging.5'],
+    ['production', 'www.dev.sim.ai:443', 'v1.1.0', '1.1.0'],
+  ])(
+    'ignores request-controlled host headers for the %s deployment',
+    async (environment, spoofedHost, tag, version) => {
+      setEnv({ APPCONFIG_ENVIRONMENT: environment })
+      fetchMock.mockImplementation(async (input: string | URL | Request) => {
+        const url = String(input)
+        if (url === RELEASES_URL) {
+          return Response.json([
+            release('v1.2.0-dev.4'),
+            release('v1.2.0-staging.5'),
+            release('v1.1.0'),
+          ])
+        }
+        if (url === `https://downloads.example/${tag}/${MANIFEST_ASSET_NAME}`) {
+          return new Response(manifest(version))
+        }
+        return new Response(null, { status: 404 })
+      })
+
+      const response = await getFeed('internal.service.local', {
+        host: spoofedHost,
+        'x-forwarded-host': `attacker.example, ${spoofedHost}`,
+      })
+      const body = await response.text()
+
+      expect(response.status).toBe(200)
+      expect(response.headers.get(FEED_STATUS_HEADER)).toBe('release')
+      expect(body).toContain(`version: ${version}`)
+    }
+  )
+
+  it('defaults self-hosted deployments to the stable channel', async () => {
+    fetchMock.mockImplementation(async (input: string | URL | Request) => {
+      const url = String(input)
+      if (url === RELEASES_URL) {
+        return Response.json([release('v1.2.0-dev.4'), release('v1.1.0')])
+      }
+      if (url === `https://downloads.example/v1.1.0/${MANIFEST_ASSET_NAME}`) {
+        return new Response(manifest('1.1.0'))
+      }
+      return new Response(null, { status: 404 })
+    })
+
+    const response = await getFeed('internal.service.local', {
+      host: 'www.dev.sim.ai:443',
+      'x-forwarded-host': 'www.dev.sim.ai:443',
+    })
+
+    expect(response.status).toBe(200)
+    expect(await response.text()).toContain('version: 1.1.0')
+  })
+
   it('reports an authoritative no-release result for production with only prereleases', async () => {
     fetchMock.mockResolvedValueOnce(
       Response.json([release('v1.2.0-dev.4'), release('v1.2.0-staging.5')])
@@ -88,6 +150,7 @@ describe('desktop update manifest route', () => {
   })
 
   it('rejects a manifest whose version does not match its selected release', async () => {
+    setEnv({ APPCONFIG_ENVIRONMENT: 'dev' })
     fetchMock
       .mockResolvedValueOnce(Response.json([release('v1.2.0-dev.4')]))
       .mockResolvedValueOnce(new Response(manifest('1.2.0-staging.5')))

apps/sim/app/api/desktop/update/latest-mac.yml/route.ts

@@ -1,8 +1,9 @@
 import { createLogger } from '@sim/logger'
 import { type NextRequest, NextResponse } from 'next/server'
+import { env } from '@/lib/core/config/env'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import {
-  channelForHostname,
+  channelForDeploymentEnvironment,
   DESKTOP_RELEASE_REPO,
   type DesktopReleaseCandidate,
   MANIFEST_ASSET_NAME,
@@ -29,12 +30,14 @@ const RELEASES_API_URL = `https://api.github.com/repos/${DESKTOP_RELEASE_REPO}/r
  * design: the updater's HTTP client carries no session, and the response
  * only describes public GitHub release artifacts.
  */
-export const GET = withRouteHandler(async (request: NextRequest): Promise<Response> => {
-  // The same deployment configuration can be promoted across environments, so
-  // its baked NEXT_PUBLIC_APP_URL is not authoritative for this public feed.
-  // The hostname the installed shell actually requested is the channel:
-  // dev -> dev, staging -> staging, and prod/self-hosted -> stable.
-  const channel = channelForHostname(request.nextUrl.hostname)
+export const GET = withRouteHandler(async (_request: NextRequest): Promise<Response> => {
+  /**
+   * Hosted deployments inject APPCONFIG_ENVIRONMENT independently at runtime,
+   * so it stays correct when the same image is promoted across environments.
+   * Request host headers are intentionally excluded: this public route must not
+   * let a caller choose which app-identity release the feed serves.
+   */
+  const channel = channelForDeploymentEnvironment(env.APPCONFIG_ENVIRONMENT)
 
   // A token raises the GitHub API quota from 60/h per NAT IP to 5000/h.
   // Optional: the repo is public, so the feed works without one.

apps/sim/app/api/v2/workflows/[id]/execute/route.test.ts

@@ -408,6 +408,27 @@ describe('POST /api/v2/workflows/[id]/execute', () => {
     expect(mockPreprocessExecution).not.toHaveBeenCalled()
   })
 
+  it.each(['includeThinking', 'includeToolCalls'])(
+    'rejects %s unless stream is true before checking the protocol header',
+    async (option) => {
+      const withProtocol = await callExecute(
+        { [option]: true },
+        { 'X-Sim-Stream-Protocol': 'agent-events-v1' }
+      )
+      const withoutProtocol = await callExecute({ [option]: true })
+
+      expect(withProtocol.status).toBe(400)
+      expect((await withProtocol.json()).error.message).toBe(
+        'includeThinking and includeToolCalls require stream: true'
+      )
+      expect(withoutProtocol.status).toBe(400)
+      expect((await withoutProtocol.json()).error.message).toBe(
+        'includeThinking and includeToolCalls require stream: true'
+      )
+      expect(mockPreprocessExecution).not.toHaveBeenCalled()
+    }
+  )
+
   it('conceals a workspace-key/workflow mismatch as not found', async () => {
     mockAuthenticateV2ApiKey.mockResolvedValue({
       principal: {

apps/sim/app/api/v2/workflows/[id]/execute/route.ts

@@ -216,13 +216,14 @@ export const POST = withRouteHandler(
           'Async execution does not support streaming or output-shaping options'
         )
       }
-      if (
-        hasAgentStreamPolicy({
-          includeThinking: body.includeThinking,
-          includeToolCalls: body.includeToolCalls,
-        }) &&
-        !clientAcceptsAgentStreamProtocol(req.headers)
-      ) {
+      const hasAgentStreamOptions = hasAgentStreamPolicy({
+        includeThinking: body.includeThinking,
+        includeToolCalls: body.includeToolCalls,
+      })
+      if (hasAgentStreamOptions && !body.stream) {
+        return v2Error('BAD_REQUEST', 'includeThinking and includeToolCalls require stream: true')
+      }
+      if (hasAgentStreamOptions && !clientAcceptsAgentStreamProtocol(req.headers)) {
         return v2Error(
           'BAD_REQUEST',
           `includeThinking and includeToolCalls require the ${AGENT_STREAM_PROTOCOL_HEADER_LABEL}: ${AGENT_STREAM_PROTOCOL_V1} request header, which declares that the client understands agent-event frames.`

apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/add-resource-dropdown/add-resource-dropdown.tsx

@@ -686,10 +686,13 @@ export function AddResourceDropdown({
             filtered.length > 0 ? (
               filtered.map(({ type, item }, index) => {
                 const config = getResourceConfig(type)
+                /* The search box keeps focus, so rows never take DOM focus and the menu's
+                   own `focus:` highlight never fires — `activeIndex` is this list's
+                   cursor, so it paints the hover surface rather than the selected one. */
                 return (
                   <DropdownMenuItem
                     key={`${type}:${item.id}`}
-                    className={cn(index === activeIndex && 'bg-[var(--surface-active)]')}
+                    className={cn(index === activeIndex && 'bg-[var(--surface-hover)]')}
                     onMouseEnter={() => setActiveIndex(index)}
                     onClick={() => select({ type, id: item.id, title: item.name })}
                   >

apps/sim/app/workspace/[workspaceId]/home/components/user-input/components/plus-menu-dropdown/plus-menu-dropdown.tsx

@@ -345,8 +345,9 @@ export const PlusMenuDropdown = React.memo(
                         handleSelect({ type, id: item.id, title: item.name })
                       }}
                       className={cn(
-                        'relative flex w-full min-w-0 cursor-pointer select-none items-center gap-2 rounded-[5px] px-2 py-1.5 text-left text-[var(--text-body)] text-caption outline-none transition-colors [&>span]:min-w-0 [&>span]:truncate [&_svg]:pointer-events-none [&_svg]:size-[14px] [&_svg]:shrink-0 [&_svg]:text-[var(--text-icon)]',
-                        isActive && 'bg-[var(--surface-active)]'
+                        'relative flex w-full min-w-0 cursor-pointer select-none items-center gap-2 rounded-[5px] px-2 py-1.5 text-left text-[var(--text-body)] text-caption outline-none transition-colors duration-0 [&>span]:min-w-0 [&>span]:truncate [&_svg]:pointer-events-none [&_svg]:size-[14px] [&_svg]:shrink-0 [&_svg]:text-[var(--text-icon)]',
+                        /* `activeIndex` is the cursor, not a selection — hover surface. */
+                        isActive && 'bg-[var(--surface-hover)]'
                       )}
                     >
                       {config.renderDropdownItem({ item })}

apps/sim/app/workspace/[workspaceId]/home/components/user-input/components/skills-menu-dropdown/skills-menu-dropdown.tsx

@@ -210,8 +210,9 @@ export const SkillsMenuDropdown = React.memo(
                     onMouseEnter={() => setActiveIndex(index)}
                     onClick={() => handleSelect(target)}
                     className={cn(
-                      'relative flex w-full min-w-0 cursor-pointer select-none items-center gap-2 rounded-[5px] px-2 py-1.5 text-left text-[var(--text-body)] text-caption outline-none transition-colors [&>span]:min-w-0 [&>span]:truncate [&_svg]:pointer-events-none [&_svg]:size-[14px] [&_svg]:shrink-0 [&_svg]:text-[var(--text-icon)]',
-                      isActive && 'bg-[var(--surface-active)]'
+                      'relative flex w-full min-w-0 cursor-pointer select-none items-center gap-2 rounded-[5px] px-2 py-1.5 text-left text-[var(--text-body)] text-caption outline-none transition-colors duration-0 [&>span]:min-w-0 [&>span]:truncate [&_svg]:pointer-events-none [&_svg]:size-[14px] [&_svg]:shrink-0 [&_svg]:text-[var(--text-icon)]',
+                      /* `activeIndex` is the cursor, not a selection — hover surface. */
+                      isActive && 'bg-[var(--surface-hover)]'
                     )}
                   >
                     {target.kind === 'skill' ? <AgentSkillsIcon /> : <McpIcon />}