Merge remote-tracking branch 'origin/staging' into staging-v11

# Conflicts:
#	apps/sim/blocks/types.ts
#	apps/sim/lib/core/config/env.ts
#	apps/sim/lib/execution/remote-sandbox/conformance.test.ts
#	apps/sim/lib/execution/remote-sandbox/index.ts
#	apps/sim/lib/execution/remote-sandbox/types.ts

Author: icecrasher321

apps/desktop/package.json

@@ -18,7 +18,7 @@
     "start": "electron .",
     "package:dir": "bun run build && electron-builder --mac dir --publish never",
     "package:mac": "bun run build && electron-builder --mac --publish never",
-    "package:share": "bun run build && electron-builder --mac --publish never -c.mac.timestamp=none",
+    "package:share": "bun run scripts/package-share.ts",
     "install:local": "bun run scripts/install-local.ts",
     "type-check": "tsc --noEmit",
     "lint": "biome check --write --unsafe .",

apps/desktop/scripts/channels.ts

@@ -0,0 +1,82 @@
+/**
+ * Build-time channel identity, derived from the origin a build is baked to.
+ *
+ * Must stay in sync with APP_NAME_FOR_CHANNEL / channelForOrigin in
+ * src/main/config.ts. That pair is the RUNTIME source of truth — the app calls
+ * app.setName() from its baked origin at startup, which decides the userData
+ * directory and single-instance lock — and this is what the packager stamps
+ * into the bundle. When the two disagree, the bundle on disk and the running
+ * app disagree about which app they are: a dev-pointed build packaged as
+ * "Sim.app" with the production bundle id installs over a real production
+ * install while naming itself "Sim Dev" at runtime.
+ */
+
+/** Canonical no-redirect origins per environment. */
+export const PROD_ORIGIN = 'https://www.sim.ai'
+export const STAGING_ORIGIN = 'https://www.staging.sim.ai'
+export const DEV_ORIGIN = 'https://www.dev.sim.ai'
+export const LOCAL_ORIGIN = 'http://localhost:3000'
+
+export interface ChannelIdentity {
+  /** Display + bundle name; also the userData directory name. */
+  name: string
+  appId: string
+  /** Baked default origin + persisted settings origin. */
+  origin: string
+  /**
+   * Artifact filename stem, and the per-channel scratch directory name.
+   * Space-free for the same reason electron-builder.yml's artifactName is:
+   * GitHub rewrites asset names containing spaces, which desyncs the
+   * electron-updater manifest from the uploaded files.
+   */
+  slug: string
+}
+
+export const PROD: ChannelIdentity = {
+  name: 'Sim',
+  appId: 'ai.sim.desktop',
+  origin: PROD_ORIGIN,
+  slug: 'sim',
+}
+export const STAGING: ChannelIdentity = {
+  name: 'Sim Staging',
+  appId: 'ai.sim.desktop.staging',
+  origin: STAGING_ORIGIN,
+  slug: 'sim-staging',
+}
+export const DEV: ChannelIdentity = {
+  name: 'Sim Dev',
+  appId: 'ai.sim.desktop.dev',
+  origin: DEV_ORIGIN,
+  slug: 'sim-dev',
+}
+export const LOCAL: ChannelIdentity = {
+  name: 'Sim Local',
+  appId: 'ai.sim.desktop.local',
+  origin: LOCAL_ORIGIN,
+  slug: 'sim-local',
+}
+
+/** Every channel, in the order a full run builds them. */
+export const ALL_CHANNELS: readonly ChannelIdentity[] = [PROD, STAGING, DEV, LOCAL]
+
+/**
+ * Resolves the identity a build baked to `origin` must carry. Mirrors
+ * channelForOrigin in src/main/config.ts, including its fall-through to
+ * production for unrecognized hosts (self-hosted origins are production
+ * builds pointed elsewhere). An empty origin means "unset", which the app
+ * resolves to DEFAULT_ORIGIN — production.
+ */
+export function identityForOrigin(origin: string): ChannelIdentity {
+  if (!origin) return PROD
+  let host: string
+  try {
+    host = new URL(origin).hostname.toLowerCase()
+  } catch {
+    return PROD
+  }
+  if (host === 'localhost' || host === '127.0.0.1') return LOCAL
+  if (host === 'dev.sim.ai' || host.endsWith('.dev.sim.ai')) return DEV
+  if (host === 'staging.sim.ai' || host.endsWith('.staging.sim.ai')) return STAGING
+  return PROD
+}

apps/desktop/scripts/package-share.ts

@@ -0,0 +1,124 @@
+/**
+ * Share build: packages distributable .dmg/.zip artifacts from the current
+ * checkout, signed with whatever identity is on the machine (no notarization,
+ * no trusted timestamps) — the "send someone a build to try" loop.
+ *
+ *   bun run package:share                    # production only
+ *   bun run package:share --all              # all four channels
+ *   bun run package:share --staging --dev    # just these two
+ *   bun run package:share --dir              # skip dmg/zip, package the .app only (fast)
+ *   SIM_DESKTOP_DEFAULT_ORIGIN=https://sim.acme.example bun run package:share
+ *
+ * Each channel lands in release/<slug>/ with artifacts named for it — sim,
+ * sim-staging, sim-dev, sim-local. electron-builder.yml's artifactName is a
+ * single literal ("Sim-${version}-${arch}"), so without the override every
+ * channel writes the same filename and the last build silently wins. Only this
+ * path overrides it: the release workflow publishes one channel per GitHub
+ * release, where the flat name is what electron-updater expects.
+ *
+ * The baked origin decides the bundle identity, exactly as it decides the
+ * runtime one. This used to shell straight into electron-builder, which took
+ * productName/appId from electron-builder.yml — always the production pair — so
+ * a dev-pointed share packaged as "Sim.app" with the production bundle id while
+ * naming itself "Sim Dev" at runtime.
+ *
+ * Channels build ONE AT A TIME on purpose. scripts/build.ts writes the bundle
+ * to dist/ and the app icon to build/generated-icon.icns, both fixed paths, so
+ * concurrent channels would overwrite each other's bundle mid-package and ship
+ * a dmg whose baked origin belongs to a different environment — invisible until
+ * someone signs in. Giving each channel its own bundle directory is what would
+ * make concurrency safe, and the flag that redirects the app entry point
+ * (-c.extraMetadata.main) rewrites this package.json IN THE SOURCE TREE,
+ * stripping scripts and devDependencies. If parallelism is worth it later, the
+ * way to get it is a per-channel project directory (electron-builder --project)
+ * — not extraMetadata.
+ */
+import { spawnSync } from 'node:child_process'
+import { rmSync } from 'node:fs'
+import { ALL_CHANNELS, type ChannelIdentity, identityForOrigin } from './channels'
+
+const FLAG_TO_CHANNEL: Record<string, ChannelIdentity> = Object.fromEntries(
+  ALL_CHANNELS.map((channel) => [
+    `--${channel.slug.replace(/^sim-/, '').replace(/^sim$/, 'prod')}`,
+    channel,
+  ])
+)
+
+const args = process.argv.slice(2)
+const dirOnly = args.includes('--dir')
+const bakedOriginOverride = process.env.SIM_DESKTOP_DEFAULT_ORIGIN ?? ''
+
+function selectedChannels(): ChannelIdentity[] {
+  if (args.includes('--all')) return [...ALL_CHANNELS]
+  const picked = args.filter((arg) => arg in FLAG_TO_CHANNEL).map((arg) => FLAG_TO_CHANNEL[arg])
+  if (picked.length > 0) return picked
+  // No channel flags: honour an explicit origin (self-hosted shares resolve to
+  // the production identity), otherwise plain production.
+  return [identityForOrigin(bakedOriginOverride)]
+}
+
+const channels = selectedChannels()
+// An explicit origin only makes sense for a single-channel run; with several
+// channels each one supplies its own.
+const originFor = (channel: ChannelIdentity): string =>
+  channels.length === 1 && bakedOriginOverride ? bakedOriginOverride : channel.origin
+
+function run(command: string, commandArgs: string[], env?: Record<string, string>): void {
+  const result = spawnSync(command, commandArgs, {
+    stdio: 'inherit',
+    env: env ? { ...process.env, ...env } : process.env,
+  })
+  if (result.status !== 0) {
+    console.error(`\n✖ ${command} ${commandArgs.join(' ')} failed`)
+    process.exit(result.status ?? 1)
+  }
+}
+
+function buildChannel(channel: ChannelIdentity): void {
+  const origin = originFor(channel)
+  console.log(`\n• ${channel.slug}: ${channel.name} (${channel.appId}) → ${origin}`)
+
+  // electron-builder only writes the output dir for the CURRENT target/arch, so
+  // an app left by an earlier run with different settings would survive
+  // alongside the new one.
+  for (const dir of ['mac-universal', 'mac-arm64', 'mac']) {
+    rmSync(`release/${channel.slug}/${dir}`, { recursive: true, force: true })
+  }
+  // electron-builder's `files: dist/**` packages whatever is in dist/, not just
+  // what this build wrote. Anything left there by an earlier run — another
+  // channel's bundle, scratch from an experiment — rides along inside the dmg,
+  // so a production artifact can end up carrying a dev-pointed bundle. Dead
+  // weight rather than a live risk (the app boots package.json's `main`), but
+  // not something to hand to anyone. build.ts rewrites the directory on the
+  // next line.
+  rmSync('dist', { recursive: true, force: true })
+
+  run('bun', ['run', 'scripts/build.ts'], { SIM_DESKTOP_DEFAULT_ORIGIN: origin })
+  run('bunx', [
+    'electron-builder',
+    '--mac',
+    ...(dirOnly ? ['dir'] : []),
+    '--publish',
+    'never',
+    // Trusted timestamps make codesign do a network round trip to Apple per
+    // file (hundreds inside the Electron framework). Distribution builds need
+    // them; a share build does not, and it turns signing into a long stall.
+    '-c.mac.timestamp=none',
+    `-c.productName=${channel.name}`,
+    `-c.appId=${channel.appId}`,
+    `-c.directories.output=release/${channel.slug}`,
+    // The ${...} placeholders are electron-builder's own templating, expanded
+    // by it at packaging time — escaped here so JS leaves them alone.
+    `-c.artifactName=${channel.slug}-\${version}-\${arch}.\${ext}`,
+  ])
+  console.log(`✔ ${channel.slug}: release/${channel.slug}/`)
+}
+
+// Shared node_modules state, and the one step every channel has in common.
+run('bun', ['run', 'scripts/ensure-pty-prebuilds.ts'])
+console.log(
+  `• Building ${channels.length} channel(s)${dirOnly ? ' (dir only)' : ''}: ${channels.map((c) => c.slug).join(', ')}`
+)
+for (const channel of channels) {
+  buildChannel(channel)
+}

apps/desktop/src/main/browser-agent/page-functions.test.ts

@@ -140,6 +140,20 @@ describe('secret-field detection', () => {
     ],
     ['new-password field', '<input type="text" autocomplete="new-password" />'],
     ['uppercase autocomplete token', '<input type="text" autocomplete="Current-Password" />'],
+    // The spec allows space-separated detail tokens and WebAuthn recommends
+    // this exact value, so whole-string equality missed it.
+    [
+      'WebAuthn multi-token autocomplete',
+      '<input type="text" autocomplete="current-password webauthn" />',
+    ],
+    [
+      'section-scoped autocomplete',
+      '<input type="text" autocomplete="section-login current-password" />',
+    ],
+    [
+      'multi-token new-password with surrounding whitespace',
+      '<input type="text" autocomplete="  new-password   webauthn  " />',
+    ],
   ]
 
   it.each(secretCases)('clickElement refuses a %s', (_label, html) => {
@@ -276,6 +290,24 @@ describe('collectSnapshot', () => {
     expect(outline).not.toContain('value=')
   })
 
+  it.each([
+    ['a one-time code', 'one-time-code', '123456'],
+    ['a card number', 'cc-number', '4111111111111111'],
+    ['a card security code', 'cc-csc', '737'],
+    ['a card expiry', 'cc-exp', '12/29'],
+  ])('withholds the value of %s while still listing the field', (_label, token, value) => {
+    document.body.innerHTML = `<input type="text" autocomplete="${token}" value="${value}" aria-label="Field" />`
+    visible(document.querySelector('input') as HTMLInputElement)
+
+    const outline = outlineOf(collectSnapshot())
+
+    // Not reported as a password-field: the agent must still be able to fill
+    // these, it just never learns what is already there.
+    expect(outline).not.toContain('password-field')
+    expect(outline).not.toContain(value)
+    expect(outline).toContain('value-withheld')
+  })
+
   it('withholds the value of a revealed password field', () => {
     document.body.innerHTML =
       '<input type="text" autocomplete="current-password" value="hunter2" aria-label="Password" />'
@@ -317,6 +349,25 @@ describe('readActiveElementState', () => {
     expect(readActiveElementState()).toMatchObject({ redacted: true, valuePreview: '' })
   })
 
+  it.each([
+    ['a one-time code', 'one-time-code', '123456'],
+    ['a card number', 'cc-number', '4111111111111111'],
+    ['a card security code', 'cc-csc', '737'],
+  ])('withholds %s on readback but still confirms the fill', (_label, token, value) => {
+    document.body.innerHTML = `<input type="text" autocomplete="${token}" value="${value}" />`
+    setActiveElement(document, document.querySelector('input'))
+
+    // valueLength is kept: without it a successful type reads as "still empty"
+    // and the agent types the code a second time.
+    expect(readActiveElementState()).toEqual({
+      activeElement: 'input',
+      selectedChars: 0,
+      valueLength: value.length,
+      valuePreview: '',
+      redacted: true,
+    })
+  })
+
   it('reports ordinary fields in full', () => {
     document.body.innerHTML = '<input type="text" value="tokyo" />'
     setActiveElement(document, document.querySelector('input'))
@@ -343,6 +394,35 @@ describe('readActiveElementState', () => {
   })
 })
 
+describe('XHTML lower-case tagName', () => {
+  /** An element whose tagName reads lower-case, as it does in an XHTML document. */
+  function lowerCaseTagInput(html: string): HTMLInputElement {
+    document.body.innerHTML = html
+    const input = document.querySelector('input') as HTMLInputElement
+    Object.defineProperty(input, 'tagName', { configurable: true, get: () => 'input' })
+    return input
+  }
+
+  it('still refuses a password field whose tagName is lower-case', () => {
+    const input = lowerCaseTagInput('<input type="password" />')
+    register(visible(input))
+
+    expect(typeIntoElement(0, 'hunter2', false)).toEqual({ error: 'password' })
+    expect(input.value).toBe('')
+  })
+
+  it('still withholds the value of a lower-case-tagName credential field', () => {
+    const input = lowerCaseTagInput(
+      '<input type="password" value="hunter2" aria-label="Password" />'
+    )
+    visible(input)
+
+    const outline = outlineOf(collectSnapshot())
+
+    expect(outline).not.toContain('hunter2')
+  })
+})
+
 describe('activeElementSecrecy', () => {
   it('reports safe for an ordinary field', () => {
     document.body.innerHTML = '<input type="text" />'
@@ -386,6 +466,46 @@ describe('activeElementSecrecy', () => {
     expect(activeElementSecrecy()).toBe('opaque')
   })
 
+  it('reports opaque for a password field inside a CLOSED shadow root', () => {
+    const host = document.createElement('div')
+    document.body.append(host)
+    const shadow = host.attachShadow({ mode: 'closed' })
+    shadow.innerHTML = '<input type="password" />'
+    // Focus inside a closed root retargets to the host and `shadowRoot` reads
+    // null, which is exactly what the browser reports and what made this 'safe'.
+    setActiveElement(document, host)
+
+    expect(host.shadowRoot).toBeNull()
+    expect(activeElementSecrecy()).toBe('opaque')
+  })
+
+  it('reports opaque for a closed shadow root on a custom element', () => {
+    const host = document.createElement('my-login')
+    document.body.append(host)
+    host.attachShadow({ mode: 'closed' }).innerHTML = '<input autocomplete="new-password" />'
+    setActiveElement(document, host)
+
+    expect(activeElementSecrecy()).toBe('opaque')
+  })
+
+  it('still reports safe for a focused element that is focusable in its own right', () => {
+    // The false-positive guard: a div the page made focusable is focused
+    // itself, not hiding a shadow tree, so keystrokes are not refused.
+    document.body.innerHTML = '<div tabindex="0">menu</div>'
+    setActiveElement(document, document.querySelector('div'))
+
+    expect(activeElementSecrecy()).toBe('safe')
+  })
+
+  it('still reports safe for a focused contenteditable', () => {
+    document.body.innerHTML = '<div contenteditable="true">note</div>'
+    const editable = document.querySelector('div') as HTMLElement
+    Object.defineProperty(editable, 'isContentEditable', { get: () => true })
+    setActiveElement(document, editable)
+
+    expect(activeElementSecrecy()).toBe('safe')
+  })
+
   it('descends into a same-origin frame instead of calling it opaque', () => {
     const frame = document.createElement('iframe')
     document.body.append(frame)