improvement(desktop): harden browser agent (#7311)

* improvement(desktop): harden browser agent

* fix(desktop): close browser review gaps

Author: waleedlatif1

.github/workflows/desktop-release.yml

@@ -55,6 +55,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
+          persist-credentials: false
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.version || github.sha }}
 
       # Prerelease versions carry their environment in the tag: -dev.N is a
@@ -340,10 +341,18 @@ jobs:
             exit 1
           fi
           export GH_TOKEN
-          if ! gh release view "$VERSION" --repo "$RELEASE_REPOSITORY" >/dev/null; then
+          if ! RELEASE_ID="$(
+            gh release view "$VERSION" --repo "$RELEASE_REPOSITORY" \
+              --json databaseId --jq '.databaseId'
+          )"; then
             echo "::error::Release $VERSION does not exist in $RELEASE_REPOSITORY."
             exit 1
           fi
+          if ! [[ "$RELEASE_ID" =~ ^[0-9]+$ ]]; then
+            echo "::error::Release $VERSION returned an invalid database ID."
+            exit 1
+          fi
+          RELEASE_JSON="$(gh api "repos/${RELEASE_REPOSITORY}/releases/${RELEASE_ID}")"
           SEMVER="${VERSION#v}"
           ARTIFACTS=(
             "apps/desktop/release/Sim-${SEMVER}-universal.dmg"
@@ -354,11 +363,10 @@ jobs:
           )
           upload_or_verify() {
             local ARTIFACT="$1"
-            local NAME SIZE DIGEST RELEASE_JSON REMOTE REMOTE_SIZE REMOTE_DIGEST
+            local NAME SIZE DIGEST REMOTE REMOTE_SIZE REMOTE_DIGEST
             NAME="$(basename "$ARTIFACT")"
             SIZE="$(stat -f%z "$ARTIFACT")"
             DIGEST="sha256:$(shasum -a 256 "$ARTIFACT" | awk '{print $1}')"
-            RELEASE_JSON="$(gh api "repos/${RELEASE_REPOSITORY}/releases/tags/${VERSION}")"
             REMOTE="$(jq -c --arg name "$NAME" '.assets[] | select(.name == $name)' <<< "$RELEASE_JSON")"
             if [ -n "$REMOTE" ]; then
               REMOTE_SIZE="$(jq -r '.size' <<< "$REMOTE")"

apps/desktop/README.md

@@ -34,7 +34,9 @@ src/main/           # main process (bundled to dist/main.cjs)
   browser-credentials/ # saved passwords, OS-auth gated, safeStorage at rest
   browser-sites/    # imported site directory, safeStorage at rest
   browser-import/   # one-shot import of profiles, cookies and passwords
-src/preload/        # contextBridge IPC bridge (bundled to dist/preload.cjs)
+src/preload/        # isolated renderer bridges
+  index.ts          # hosted-app contextBridge IPC bridge (dist/preload.cjs)
+  browser/          # minimal agent-browser credential helper (dist/browser-preload.cjs)
 native/             # Node-API/AppKit bridge for native macOS Help docs search
 static/             # bundled local pages (offline.html)
 e2e/                # Playwright _electron smoke suite
@@ -54,7 +56,7 @@ SIM_DESKTOP_ORIGIN=http://localhost:3000 bun run dev   # against local sim
 - `bun run type-check` / `lint:check` — standard workspace checks; CI picks these up automatically via `turbo run`.
 - `SIM_DESKTOP_USER_DATA=<dir>` isolates settings/partition state (used by e2e).
 
-Everything is bundled by esbuild into `dist/main.cjs` + `dist/preload.cjs` — including `electron-updater` and the `@sim/*` packages — so the packaged app has **no runtime node_modules** and `electron-builder` needs no lockfile/npmRebuild step (this is the deliberate workaround for Bun ↔ electron-builder friction; there is no `package-lock.json`).
+The main process and two preloads are bundled by esbuild into `dist/main.cjs`, `dist/preload.cjs`, and `dist/browser-preload.cjs`, including `electron-updater` and the `@sim/*` packages. The native `@lydell/node-pty` packages stay external so Electron can load their architecture-specific prebuilds from the packaged runtime `node_modules`; `npmRebuild` remains disabled because those Node-API prebuilds are already ABI-stable. There is no `package-lock.json`.
 
 ## Auth model (read before touching auth)
 
@@ -99,7 +101,7 @@ Overall this is **within normal thin-wrapper coupling** — every item is either
 
 Local unsigned build: `bun run package:dir` (app in `release/mac-universal/`). Signed: `bun run package:mac` with `CSC_LINK`/`CSC_KEY_PASSWORD` exported.
 
-Pre-release share (no Developer ID yet): `SIM_DESKTOP_DEFAULT_ORIGIN=https://www.dev.sim.ai bun run package:share` builds a DMG whose fresh installs default to that origin (baked at build time; official builds leave it unset → prod) and skips per-file signature timestamps. Recipients must clear quarantine once: `xattr -cr /Applications/Sim.app`.
+Local unsigned pre-release share: `SIM_DESKTOP_DEFAULT_ORIGIN=https://www.dev.sim.ai bun run package:share` builds a DMG whose fresh installs default to that origin (baked at build time; official builds leave it unset → prod) and skips per-file signature timestamps. Recipients must clear quarantine once: `xattr -cr /Applications/Sim.app`.
 
 The build also derives the app icon from `SIM_DESKTOP_DEFAULT_ORIGIN`. Every channel uses the exact production icon with its white background and black `sim` mark. Non-production channels add a thin outline using existing platform colors: dev uses orange, staging uses Loop blue, and localhost uses Workflow violet. The macOS menu-bar icon also carries a compact `D`, `S`, or `L` subscript for those environments; production remains unmarked. Native Icon Composer assets live in `build/`; `scripts/build.ts` copies the selected variant to the ignored `build/generated-icon.icon` path consumed by electron-builder. Electron-builder compiles it to `Assets.car` and derives the legacy `.icns` fallback from the same source. Matching 512px PNGs in `static/` provide the Dock icon for unpackaged runs.
 
@@ -185,10 +187,11 @@ Raw local file bytes are never exposed through the preload bridge and cannot be
 
 ## Known caveats
 
-- Microphone and camera are denied by design (the permission matrix grants only sanitized clipboard writes to the app origin).
+- The hosted Sim renderer may request microphone access for voice input from the configured app origin; camera access remains denied. On macOS the shell also requires the operating-system microphone grant. Separately, a page in the isolated agent browser may request microphone or camera only from its main frame after a recent native user gesture; Sim then requires an explicit document-scoped prompt and the operating-system grant where applicable.
+- The built-in agent browser is not a general-purpose download manager. Its dedicated partition applies the same bounded policy to every download, including one started by a direct user click: at most 2 GiB per file, two active downloads per task, six app-wide, and a 1 GiB free-disk reserve. A rejected download appears in the browser's downloads menu; use a normal browser for an intentionally larger transfer.
 - Default Electron ships H.264/AAC/MP3 — do not swap in the codec-free ffmpeg build.
 - Third-party web analytics (GTM/GA) are blocked at the network layer by default (`blockThirdPartyAnalytics`); first-party PostHog `/ingest` is untouched.
-- `Cmd+F` find-in-page overlay is not implemented (Monaco and tables ship their own finds); revisit if users ask.
+- `Cmd+F` opens the native find overlay in built-in browser tabs. The hosted Sim workspace continues to use Monaco- and table-specific find surfaces.
 - Sign-in uses only the `127.0.0.1` loopback callback, which needs no OS registration — so it completes identically under `bun run dev` (unpackaged) and in a packaged build. There is no custom URL scheme.
 
 ## Electron upgrades

apps/desktop/package.json

@@ -50,7 +50,7 @@
     "@sim/tsconfig": "workspace:*",
     "@types/micromatch": "4.0.10",
     "@types/node": "24.2.1",
-    "electron": "43.1.1",
+    "electron": "43.5.0",
     "electron-builder": "26.15.3",
     "esbuild": "0.28.1",
     "typescript": "^7.0.2",

apps/desktop/src/main/browser-agent/driver-profile.test.ts

@@ -10,6 +10,8 @@ const mocks = vi.hoisted(() => ({
 vi.mock('@/main/browser-agent/session', () => ({
   clearProfileStorage: mocks.clearProfileStorage,
   initSession: vi.fn(),
+  isBrowserScopeSuspended: vi.fn(() => false),
+  resolveBrowserScopeId: vi.fn((scopeId: string) => scopeId),
 }))
 
 vi.mock('@/main/browser-credentials', () => ({
@@ -18,7 +20,12 @@ vi.mock('@/main/browser-credentials', () => ({
   initFillCoordinator: vi.fn(),
 }))
 
-import { clearBrowserProfile, initDriver } from '@/main/browser-agent/driver'
+import {
+  captureBrowserToolQueueBoundary,
+  clearBrowserProfile,
+  executeTool,
+  initDriver,
+} from '@/main/browser-agent/driver'
 import type { ConfigStore } from '@/main/config'
 
 describe('clearBrowserProfile', () => {
@@ -52,4 +59,35 @@ describe('clearBrowserProfile', () => {
     expect(mocks.clearCredentials).toHaveBeenCalledTimes(2)
     expect(config.flush).toHaveBeenCalledTimes(2)
   })
+
+  it('invalidates pre-wipe authorization and retires live work before profile teardown', async () => {
+    initDriver(
+      {
+        onPageState: vi.fn(),
+        onTabsState: vi.fn(),
+        onSessionStatus: vi.fn(),
+        onFillAvailability: vi.fn(),
+      },
+      () => null
+    )
+    const boundary = captureBrowserToolQueueBoundary('chat-before-wipe')
+    expect(boundary).not.toBeNull()
+    if (!boundary) throw new Error('Expected browser tool authorization admission')
+
+    await clearBrowserProfile()
+    const staleExecution = await executeTool(
+      'chat-before-wipe',
+      'browser_list_sessions',
+      {},
+      'tool-authorized-before-wipe',
+      boundary
+    )
+
+    expect(mocks.clearProfileStorage).toHaveBeenCalledOnce()
+    expect(mocks.clearCredentials).toHaveBeenCalledOnce()
+    expect(staleExecution).toMatchObject({
+      ok: false,
+      error: expect.stringContaining('cancelled before it started'),
+    })
+  })
 })