Restore desktop parity and preserve interrupted chat progress

Author: Sg312

.github/workflows/test-build.yml

@@ -8,6 +8,151 @@ permissions:
   contents: read
 
 jobs:
+  oauth-postgres:
+    name: PostgreSQL integration (${{ matrix.provision }})
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        provision: [push, migrate]
+    services:
+      postgres:
+        image: pgvector/pgvector:pg17
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: sim_auth_scim
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d sim_auth_scim"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_auth_scim
+      OAUTH_TOKEN_FAMILY_TEST_DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_auth_scim
+      BETTER_AUTH_SECRET: oauth-postgres-ci-secret-at-least-32-characters
+      NEXT_PUBLIC_APP_URL: https://test.sim.ai
+      ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000'
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.4.1
+
+      - name: Setup Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 24
+
+      - name: Mount Bun cache
+        uses: ./.github/actions/cache-mount
+        with:
+          provider: ${{ vars.CI_PROVIDER }}
+          key: ${{ github.repository }}-bun-cache-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
+          path: ~/.bun/install/cache
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile --ignore-scripts
+
+      - name: Provision a fresh database through the supported command
+        working-directory: packages/db
+        run: |
+          bun -e 'import postgres from "postgres"; const sql = postgres(process.env.DATABASE_URL); for (const extension of ["vector", "btree_gin", "pg_trgm"]) await sql`CREATE EXTENSION IF NOT EXISTS ${sql(extension)}`; await sql.end()'
+          bun run db:${{ matrix.provision }}
+
+      - name: Verify migration replay is a no-op
+        if: matrix.provision == 'migrate'
+        working-directory: packages/db
+        run: bun run db:migrate
+
+      - name: Verify OAuth lifecycle and SCIM membership guards in PostgreSQL
+        working-directory: apps/sim
+        run: >-
+          bunx vitest run
+          lib/auth/oauth-token-family.postgres.test.ts
+          lib/auth/oauth-provider-lifecycle.postgres.test.ts
+          app/api/auth/oauth2/token/route.postgres.test.ts
+          lib/auth/sim-auth-adapter.test.ts
+          ee/scim/lib/managed-membership.postgres.test.ts
+          lib/auth/sso/application/admit-sso-user.postgres.test.ts
+
+      - name: Verify SCIM and administration over real HTTP
+        working-directory: apps/sim
+        env:
+          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3017
+          BETTER_AUTH_URL: http://127.0.0.1:3017
+          NEXT_PUBLIC_FORCE_HOSTED: 'true'
+          BILLING_ENABLED: 'true'
+          NEXT_PUBLIC_BILLING_ENABLED: 'true'
+          ENTERPRISE_ENABLED: 'true'
+          NEXT_PUBLIC_ENTERPRISE_ENABLED: 'true'
+          SCIM_ENABLED: 'true'
+          NEXT_PUBLIC_SCIM_ENABLED: 'true'
+          SSO_ENABLED: 'true'
+          NEXT_PUBLIC_SSO_ENABLED: 'true'
+          ORGANIZATIONS_ENABLED: 'true'
+          NEXT_PUBLIC_ORGANIZATIONS_ENABLED: 'true'
+          INTERNAL_API_SECRET: scim-http-ci-local-secret-at-least-32-characters
+          DB_TX_TRIPWIRE: throw
+          DISABLE_TELEMETRY: 'true'
+          NEXT_TELEMETRY_DISABLED: '1'
+          NEXT_PUBLIC_CHAT_DISABLED: 'true'
+        run: |
+          server_log="$RUNNER_TEMP/scim-next.log"
+          node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 --port 3017 > "$server_log" 2>&1 &
+          server_pid=$!
+          finish() {
+            kill "$server_pid" 2>/dev/null || true
+            wait "$server_pid" 2>/dev/null || true
+            awk '/^ (GET|POST|PUT|PATCH|DELETE|HEAD) \/api\// { print }' "$server_log" > "$RUNNER_TEMP/scim-http-status.log"
+          }
+          trap finish EXIT
+          deadline=$((SECONDS + 120))
+          until curl --fail --silent --max-time 3 http://127.0.0.1:3017/api/health > /dev/null; do
+            if ! kill -0 "$server_pid" 2>/dev/null; then
+              echo 'Local SCIM app exited during startup.'
+              exit 1
+            fi
+            if [ "$SECONDS" -ge "$deadline" ]; then
+              echo 'Local SCIM app did not become ready within 120 seconds.'
+              exit 1
+            fi
+            sleep 2
+          done
+          SCIM_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
+          SCIM_E2E_DATABASE_URL="$DATABASE_URL" \
+          SCIM_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+          SCIM_E2E_REPORT_PATH="$RUNNER_TEMP/scim-e2e-report.json" \
+            bun run test:scim:e2e
+
+      - name: Upload SCIM failure report and HTTP status log
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: scim-failure-${{ matrix.provision }}
+          path: |
+            ${{ runner.temp }}/scim-e2e-report.json
+            ${{ runner.temp }}/scim-http-status.log
+          if-no-files-found: ignore
+          retention-days: 7
+
+      - name: Verify durable provenance bindings and concurrent memory writes
+        working-directory: apps/sim
+        env:
+          TABLE_PROVENANCE_TEST_DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_auth_scim
+          MEMORY_PROVENANCE_TEST_DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_auth_scim
+        run: >-
+          bunx vitest run
+          lib/table/rows/secret-provenance.postgres.test.ts
+          lib/memory/message-provenance.postgres.test.ts
+
   test-build:
     name: Lint and Test
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}

apps/desktop/e2e/browser-tools.spec.ts

@@ -29,7 +29,7 @@ const FORM = `<!doctype html><html><head><title>Form fixture</title></head><body
 test.describe('browser tools', () => {
   const calls = new Map<
     string,
-    { chatId: string; toolName: BrowserToolName; args: Record<string, unknown> }
+    { chatId: string; toolName: BrowserToolName | 'terminal'; args: Record<string, unknown> }
   >()
   let server: Server
   let origin: string
@@ -44,6 +44,7 @@ test.describe('browser tools', () => {
         let body = ''
         for await (const chunk of request) body += chunk.toString()
         const authorization = calls.get(JSON.parse(body).toolCallId)
+        calls.delete(JSON.parse(body).toolCallId)
         response.writeHead(authorization ? 200 : 403, { 'Content-Type': 'application/json' })
         response.end(JSON.stringify(authorization ?? {}))
         return
@@ -241,4 +242,37 @@ test.describe('browser tools', () => {
     expect(fill.result).toMatchObject({ completed: false, completedCount: 0 })
     expect(await formState()).toMatchObject({ name: '', password: '' })
   })
+  test('local terminal executes through its native PTY and refuses repeated authorization', async () => {
+    await window.evaluate(async (scope) => {
+      const api = (globalThis as typeof globalThis & { simDesktop: SimDesktopApi }).simDesktop
+      await api.terminal.activateScope(scope)
+      await api.terminal.start({ cols: 100, rows: 30 }, scope)
+    }, SCOPE)
+    calls.set('local-cwd', {
+      chatId: SCOPE,
+      toolName: 'terminal',
+      args: { operation: 'cwd', args: {} },
+    })
+    const cwd = await window.evaluate(async (scope) => {
+      const api = (globalThis as typeof globalThis & { simDesktop: SimDesktopApi }).simDesktop
+      return api.terminal.executeTool('local-cwd', 'cwd', {}, scope)
+    }, SCOPE)
+    expect(cwd.ok).toBe(true)
+    calls.set('local-run', {
+      chatId: SCOPE,
+      toolName: 'terminal',
+      args: { operation: 'run', args: { command: "printf 'SIM_NATIVE_TERMINAL_VERIFIED\\n'" } },
+    })
+    const result = await window.evaluate(async (scope) => {
+      const api = (globalThis as typeof globalThis & { simDesktop: SimDesktopApi }).simDesktop
+      return api.terminal.executeTool('local-run', 'run', {}, scope)
+    }, SCOPE)
+    expect(result.ok).toBe(true)
+    expect(JSON.stringify(result)).toContain('SIM_NATIVE_TERMINAL_VERIFIED')
+    const replay = await window.evaluate(async (scope) => {
+      const api = (globalThis as typeof globalThis & { simDesktop: SimDesktopApi }).simDesktop
+      return api.terminal.executeTool('local-run', 'run', {}, scope)
+    }, SCOPE)
+    expect(replay.ok).toBe(false)
+  })
 })

apps/desktop/src/main/browser-agent/session.test.ts

@@ -2512,6 +2512,26 @@ describe('browser-agent session', () => {
     expect(session.listTabs()).toHaveLength(13)
   })
 
+  it('gives background automation a viewport without taking panel ownership', () => {
+    const tab = session.withBrowserScope('background-chat', () => session.ensureTab())
+
+    expect(tab.view.setBounds).toHaveBeenCalledWith({
+      x: 0,
+      y: 0,
+      width: 1180,
+      height: 850,
+    })
+    expect(win.contentView.addChildView).not.toHaveBeenCalledWith(tab.view)
+    expect(session.getActiveBrowserScopeId()).toBe('chat-test')
+  })
+
+  it('initializes a detached viewport when no application window exists', () => {
+    const headlessSession = freshSession(null)
+    const tab = headlessSession.ensureTab()
+
+    expect(tab.view.setBounds).toHaveBeenCalledWith({ x: 0, y: 0, width: 1280, height: 720 })
+  })
+
   it('embeds the active view in the MAIN window only while panel bounds are reported', () => {
     const tab = session.ensureTab()
     const view = tab.view as unknown as MockView

apps/desktop/src/main/browser-agent/session.ts

@@ -2217,6 +2217,9 @@ function createTabView(): WebContentsView {
     },
   })
   try {
+    /** Detached tabs must lay out before a foreground panel owns their native view. */
+    const [width, height] = getMainWindow()?.getContentSize() ?? [1280, 720]
+    view.setBounds({ x: 0, y: 0, width: Math.max(1, width), height: Math.max(1, height) })
     return initializeTabView(view, scopeId)
   } catch (error) {
     if (!view.webContents.isDestroyed()) view.webContents.close()

apps/sim/app/api/copilot/chat/stop/route.test.ts

@@ -5,10 +5,15 @@ import { authMockFns, dbChainMockFns, resetDbChainMock } from '@sim/testing'
 import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockAppendCopilotChatMessages, mockPublishStatusChanged } = vi.hoisted(() => ({
-  mockAppendCopilotChatMessages: vi.fn(),
-  mockPublishStatusChanged: vi.fn(),
-}))
+const { mockAppendCopilotChatMessages, mockPublishStatusChanged, mockReadEvents } = vi.hoisted(
+  () => ({
+    mockAppendCopilotChatMessages: vi.fn(),
+    mockPublishStatusChanged: vi.fn(),
+    mockReadEvents: vi.fn(),
+  })
+)
+
+vi.mock('@/lib/mothership/request/session/buffer', () => ({ readEvents: mockReadEvents }))
 
 vi.mock('@/lib/mothership/chat/messages-store', () => ({
   appendCopilotChatMessages: mockAppendCopilotChatMessages,
@@ -52,6 +57,7 @@ describe('copilot chat stop route', () => {
     dbChainMockFns.limit.mockReset()
     resetDbChainMock()
     authMockFns.mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+    mockReadEvents.mockResolvedValue([])
   })
 
   it('preserves task and subagent identity through the partial-response contract', async () => {
@@ -133,6 +139,7 @@ describe('copilot chat stop route', () => {
       createRequest({ chatId: 'chat-1', streamId: 'stream-1', content: '' })
     )
 
+    expect(mockReadEvents).toHaveBeenCalledWith('stream-1', '0')
     expect(response.status).toBe(200)
     expect(await response.json()).toEqual({ success: true })
 

apps/sim/app/api/copilot/chat/stop/route.ts

@@ -72,6 +72,7 @@ export const POST = withRouteHandler((req: NextRequest) =>
         userMessageId: streamId,
         assistantMessage,
         streamMarkerPolicy: 'active-or-cleared',
+        preferServerReplay: true,
       })
       span.setAttribute(TraceAttr.CopilotStopAppendedAssistant, result.appendedAssistant)
       const stopOutcome = !result.found