fix(desktop): reuse Sim login for authenticated browser previews

Author: Sg312

apps/desktop/README.md

@@ -156,6 +156,26 @@ const desktop = useDesktop()
 
 Good fits for the bridge: OS notifications + dock badge on workflow completion, global shortcuts, "reveal in Finder", tray, secure OS-keychain storage. Anything that touches the server/DB still goes through normal APIs — the bridge is only for **native** capability. This same bridge is also the robust way to retire the web-app couplings in the table above: have the web app *tell* the shell (`signalLogout()`, `markAuthSurface()`) instead of the shell inferring from URLs.
 
+### Browser authentication and Sim previews
+
+Browser tabs for the exact configured Sim origin share the desktop app's existing
+Electron session. This includes dev: authenticated file previews and deployed chat
+pages use the current login without copying cookies or exposing tokens to the model.
+Normal resource permissions and any separate deployed-chat password still apply.
+External websites use the independent `persist:sim-browser-agent` partition.
+
+Crossing between Sim and an external site opens a tab in the destination session and
+preserves the source tab's history; an unused blank tab adopts its first destination's
+session. A cross-session form POST is blocked instead of replayed as a GET. Restored
+tabs and popups select their session from the destination origin. Sign-out and account
+or server changes use the existing browser teardown. Browser views retain their own
+permission/download policy, SSRF guards, and minimal preload with no `simDesktop` API.
+
+Generated HTML remains inside its `allow-scripts` sandbox. The driver can inspect and
+interact with inline frames through isolated Chromium worlds, including out-of-process
+frames; it does not grant those pages access to the parent app. These shell changes
+require a desktop update, not just a hosted web deployment.
+
 ### Local filesystem access
 
 Copilot can inspect user-selected local directories through the ordinary VFS tools. Granted folders appear beneath the top-level `user-local/` namespace, and `glob`, `grep`, and `read` are routed to Electron only when their path/pattern is explicitly scoped there. This capability is:
@@ -188,8 +208,8 @@ Raw local file bytes are never exposed through the preload bridge and cannot be
 
 ## Known caveats
 
-- The hosted Sim renderer may request microphone access for voice input from the configured app origin; camera access remains denied. On macOS the shell also requires the operating-system microphone grant. Separately, a page in the isolated agent browser may request microphone or camera only from its main frame after a recent native user gesture; Sim then requires an explicit document-scoped prompt and the operating-system grant where applicable.
-- The built-in agent browser is not a general-purpose download manager. Its dedicated partition applies the same bounded policy to every download, including one started by a direct user click: at most 2 GiB per file, two active downloads per task, six app-wide, and a 1 GiB free-disk reserve. A rejected download appears in the browser's downloads menu; use a normal browser for an intentionally larger transfer.
+- The hosted Sim renderer may request microphone access for voice input from the configured app origin; camera access remains denied. On macOS the shell also requires the operating-system microphone grant. Separately, a page in the agent browser may request microphone or camera only from its main frame after a recent native user gesture; Sim then requires an explicit document-scoped prompt and the operating-system grant where applicable.
+- The built-in agent browser is not a general-purpose download manager. Both browser session types apply the same bounded policy to every download, including one started by a direct user click: at most 2 GiB per file, two active downloads per task, six app-wide, and a 1 GiB free-disk reserve. A rejected download appears in the browser's downloads menu; use a normal browser for an intentionally larger transfer.
 - Default Electron ships H.264/AAC/MP3 — do not swap in the codec-free ffmpeg build.
 - Third-party web analytics (GTM/GA) are blocked at the network layer by default (`blockThirdPartyAnalytics`); first-party PostHog `/ingest` is untouched.
 - `Cmd+F` opens the native find overlay in built-in browser tabs. The hosted Sim workspace continues to use Monaco- and table-specific find surfaces.

apps/desktop/e2e/browser-tools.spec.ts

@@ -71,6 +71,44 @@ test.describe('browser tools', () => {
         response.end()
         return
       }
+      if (path === '/enter-sim') {
+        response.writeHead(302, { Location: `${origin}/private-chat` })
+        response.end()
+        return
+      }
+      if (path === '/api/auth/get-session') {
+        response.writeHead(200, { 'Content-Type': 'application/json' })
+        response.end(
+          JSON.stringify(
+            request.headers.cookie?.includes('better-auth.session_token=fixture')
+              ? { user: { id: 'browser-auth-fixture' }, session: { id: 'fixture-session' } }
+              : null
+          )
+        )
+        return
+      }
+      if (path === '/api/auth/sign-out') {
+        response.writeHead(200, {
+          'Content-Type': 'application/json',
+          'Set-Cookie': 'better-auth.session_token=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0',
+        })
+        response.end('{}')
+        return
+      }
+      if (path === '/private-chat' || path === '/private-preview') {
+        if (!request.headers.cookie?.includes('better-auth.session_token=fixture')) {
+          response.writeHead(302, { Location: '/login' })
+          response.end()
+          return
+        }
+        response.writeHead(200, { 'Content-Type': 'text/html' })
+        response.end(
+          path === '/private-chat'
+            ? '<!doctype html><title>Private deployed chat</title><h1>Authenticated deployed chat</h1><label>Message <input id="message"></label><button onclick="document.getElementById(\'reply\').textContent = document.getElementById(\'message\').value">Send</button><p id="reply"></p>'
+            : `<!doctype html><title>Private HTML preview</title><h1>Authenticated HTML preview</h1><iframe sandbox="allow-scripts" srcdoc="<button onclick='document.body.dataset.clicked = true'>Test quiz</button><script>try { parent.document.body.dataset.escaped = true } catch { document.body.dataset.isolated = true }</script>"></iframe>`
+        )
+        return
+      }
       if (path === '/api/desktop/tool/authorize') {
         let body = ''
         for await (const chunk of request) body += chunk.toString()
@@ -80,7 +118,12 @@ test.describe('browser tools', () => {
         response.end(JSON.stringify(authorization ?? {}))
         return
       }
-      response.writeHead(200, { 'Content-Type': 'text/html' })
+      response.writeHead(200, {
+        'Content-Type': 'text/html',
+        ...(path === '/workspace' || path === '/home' || path === '/'
+          ? { 'Set-Cookie': 'better-auth.session_token=fixture; HttpOnly; SameSite=Lax; Path=/' }
+          : {}),
+      })
       response.end(
         path === '/click'
           ? CLICK_FIXTURE
@@ -168,6 +211,104 @@ test.describe('browser tools', () => {
     }
   }
 
+  test('shares desktop authentication for private HTML previews and deployed chats', async () => {
+    for (const path of ['/private-preview', '/private-chat']) {
+      const result = await execute('browser_open_url', { url: `${origin}${path}` })
+      expect(result.ok, result.error).toBe(true)
+      expect(result.result).toMatchObject({ url: `${origin}${path}` })
+      const state = await app.evaluate(async ({ webContents, BrowserWindow }, url) => {
+        const host = BrowserWindow.getAllWindows()[0].webContents
+        const page = webContents.getAllWebContents().find((contents) => contents.getURL() === url)
+        if (!page) throw new Error('Missing protected page')
+        return {
+          sharedSession: page.session === host.session,
+          hasDesktopBridge: await page.executeJavaScript(
+            'typeof window.simDesktop !== "undefined"'
+          ),
+          heading: await page.executeJavaScript('document.querySelector("h1").textContent'),
+          escaped: await page.executeJavaScript('document.body.dataset.escaped === "true"'),
+        }
+      }, `${origin}${path}`)
+      expect(state.sharedSession).toBe(true)
+      expect(state.hasDesktopBridge).toBe(false)
+      expect(state.heading).toContain('Authenticated')
+      expect(state.escaped).toBe(false)
+      if (path === '/private-preview') {
+        const outline = (result.result as { snapshot: { outline: string } }).snapshot.outline
+        const button = outline
+          .split('\n')
+          .find((line) => line.includes('"Test quiz"') && /\[ref=\d+\]/.test(line))
+          ?.match(/\[ref=(\d+)\]/)?.[1]
+        expect(button, JSON.stringify(result.result)).toBeTruthy()
+        const click = await execute('browser_click', { elementId: Number(button) })
+        expect(click.ok, click.error).toBe(true)
+        const frameState = await app.evaluate(async ({ webContents }, url) => {
+          const page = webContents.getAllWebContents().find((contents) => contents.getURL() === url)
+          const frame = page?.mainFrame.frames.find((frame) => frame.url === 'about:srcdoc')
+          if (!frame) throw new Error('Missing sandboxed preview')
+          return frame.executeJavaScript(
+            '({ clicked: document.body.dataset.clicked, isolated: document.body.dataset.isolated, bridge: typeof window.simDesktop })'
+          )
+        }, `${origin}${path}`)
+        expect(frameState).toEqual({ clicked: 'true', isolated: 'true', bridge: 'undefined' })
+      }
+    }
+    const typed = await execute('browser_open_url', { url: `${origin}/private-chat` })
+    expect(typed.ok, typed.error).toBe(true)
+    const result = typed.result as { snapshot: { outline: string } }
+    const message = result.snapshot.outline
+      .split('\n')
+      .find((line) => line.includes('"Message"') && /\[ref=\d+\]/.test(line))
+      ?.match(/\[ref=(\d+)\]/)?.[1]
+    const send = result.snapshot.outline
+      .split('\n')
+      .find((line) => line.includes('"Send"') && /\[ref=\d+\]/.test(line))
+      ?.match(/\[ref=(\d+)\]/)?.[1]
+    expect(message, result.snapshot.outline).toBeTruthy()
+    expect(send, result.snapshot.outline).toBeTruthy()
+    expect(
+      (await execute('browser_type', { elementId: Number(message), text: 'Session works' })).ok
+    ).toBe(true)
+    expect((await execute('browser_click', { elementId: Number(send) })).ok).toBe(true)
+    expect(JSON.stringify(await execute('browser_snapshot', {}))).toContain('Session works')
+  })
+
+  test('keeps external navigation isolated and authenticates redirects back into Sim', async () => {
+    expect((await execute('browser_open_url', { url: `${origin}/private-chat` })).ok).toBe(true)
+    const external = origin.replace('127.0.0.1', 'localhost')
+    const result = await execute('browser_open_url', { url: `${origin}/redirect` })
+    expect(result.ok, result.error).toBe(true)
+    expect(result.result).toMatchObject({ url: `${external}/landing` })
+    expect(
+      await app.evaluate(({ webContents, BrowserWindow }, url) => {
+        const page = webContents.getAllWebContents().find((contents) => contents.getURL() === url)
+        return page?.session === BrowserWindow.getAllWindows()[0].webContents.session
+      }, `${external}/landing`)
+    ).toBe(false)
+    const back = await execute('browser_open_url', { url: `${external}/enter-sim` })
+    expect(back.ok, back.error).toBe(true)
+    expect(back.result).toMatchObject({ url: `${origin}/private-chat` })
+  })
+
+  test('sign-out clears authenticated browser pages with the desktop session', async () => {
+    const opened = await execute('browser_open_url', { url: `${origin}/private-chat` })
+    expect(opened.ok, opened.error).toBe(true)
+    expect(opened.result).toMatchObject({ url: `${origin}/private-chat` })
+    await window.evaluate(async () => {
+      await fetch('/api/auth/sign-out', { method: 'POST' })
+    })
+    await expect
+      .poll(() =>
+        app.evaluate(
+          ({ webContents }, url) =>
+            webContents.getAllWebContents().some((contents) => contents.getURL() === url),
+          `${origin}/private-chat`
+        )
+      )
+      .toBe(false)
+    await expect(window).toHaveURL(`${origin}/login`)
+  })
+
   async function formState() {
     return app.evaluate(async ({ webContents }, origin) => {
       const page = webContents

apps/desktop/src/main/browser-agent/cdp.test.ts

@@ -45,6 +45,7 @@ function createOopifFrameFixture() {
         {
           frame: {
             id: 'child',
+            parentId: 'top',
             name: 'account-menu',
             url: 'https://accounts.example/menu',
           },
@@ -310,76 +311,99 @@ describe('browser-agent CDP instrumentation', () => {
     }
   })
 
-  it('routes OOPIF isolated-world creation and evaluation through its flattened session', async () => {
-    const contents = new WebContentsView().webContents
-    const { child, frameTree } = createOopifFrameFixture()
-    await ensureInstrumented(contents, { onDialog: vi.fn() })
-    const listener = vi
-      .mocked(contents.debugger.on)
-      .mock.calls.find(([event]) => event === 'message')?.[1] as
-      | ((event: unknown, method: string, params: unknown, sessionId?: string) => void)
-      | undefined
-    expect(listener).toBeTypeOf('function')
-
-    listener?.(
-      {},
-      'Target.attachedToTarget',
-      {
-        sessionId: 'child-session',
-        targetInfo: { targetId: 'child', type: 'iframe' },
-      },
-      undefined
-    )
-    expect(contents.debugger.sendCommand).toHaveBeenCalledWith(
-      'Target.setAutoAttach',
-      { autoAttach: true, waitForDebuggerOnStart: false, flatten: true },
-      'child-session'
-    )
-    vi.mocked(contents.debugger.sendCommand).mockClear()
-    vi.mocked(contents.debugger.sendCommand).mockImplementation((method) => {
-      if (method === 'Page.getFrameTree') {
-        return Promise.resolve({ frameTree })
-      }
-      if (method === 'Page.createIsolatedWorld') {
-        return Promise.resolve({ executionContextId: 42 })
-      }
-      if (method === 'Runtime.evaluate') {
-        return Promise.resolve({ result: { type: 'number', value: 4 } })
-      }
-      return Promise.resolve({})
-    })
-
-    await expect(evaluateInIsolatedFrame(contents, child, '2 + 2')).resolves.toBe(4)
-
-    expect(
-      vi
-        .mocked(contents.debugger.sendCommand)
-        .mock.calls.filter(([method]) =>
-          ['Page.createIsolatedWorld', 'Runtime.evaluate'].includes(method)
-        )
-    ).toEqual([
-      [
-        'Page.createIsolatedWorld',
-        {
-          frameId: 'child',
-          worldName: 'sim-browser-agent',
-          grantUniveralAccess: false,
-        },
-        'child-session',
-      ],
-      [
-        'Runtime.evaluate',
+  it.each(['complete', 'split', 'ambiguous'])(
+    'routes OOPIF evaluation through its session (%s tree)',
+    async (treeKind) => {
+      const contents = new WebContentsView().webContents
+      const { child, frameTree } = createOopifFrameFixture()
+      await ensureInstrumented(contents, { onDialog: vi.fn() })
+      const listener = vi
+        .mocked(contents.debugger.on)
+        .mock.calls.find(([event]) => event === 'message')?.[1] as
+        | ((event: unknown, method: string, params: unknown, sessionId?: string) => void)
+        | undefined
+      expect(listener).toBeTypeOf('function')
+
+      listener?.(
+        {},
+        'Target.attachedToTarget',
         {
-          expression: '2 + 2',
-          contextId: 42,
-          returnByValue: true,
-          awaitPromise: true,
-          userGesture: false,
+          sessionId: 'child-session',
+          targetInfo: { targetId: 'child', type: 'iframe' },
         },
-        'child-session',
-      ],
-    ])
-  })
+        undefined
+      )
+      expect(contents.debugger.sendCommand).toHaveBeenCalledWith(
+        'Target.setAutoAttach',
+        { autoAttach: true, waitForDebuggerOnStart: false, flatten: true },
+        'child-session'
+      )
+      vi.mocked(contents.debugger.sendCommand).mockClear()
+      vi.mocked(contents.debugger.sendCommand).mockImplementation((method, _params, sessionId) => {
+        if (method === 'Page.getFrameTree') {
+          return Promise.resolve({
+            frameTree:
+              treeKind === 'complete'
+                ? frameTree
+                : sessionId
+                  ? frameTree.childFrames[0]
+                  : { frame: frameTree.frame },
+          })
+        }
+        if (method === 'Page.createIsolatedWorld') {
+          return Promise.resolve({ executionContextId: 42 })
+        }
+        if (method === 'Runtime.evaluate') {
+          return Promise.resolve({ result: { type: 'number', value: 4 } })
+        }
+        return Promise.resolve({})
+      })
+
+      if (treeKind === 'ambiguous') {
+        /** An omitted twin must not be mistaken for the only frame in a partial tree. */
+        child.parent?.frames.push(createOopifFrameFixture().child)
+        await expect(evaluateInIsolatedFrame(contents, child, '2 + 2')).rejects.toThrow(
+          'Could not map'
+        )
+        expect(
+          vi
+            .mocked(contents.debugger.sendCommand)
+            .mock.calls.some(([method]) => method === 'Runtime.evaluate')
+        ).toBe(false)
+        return
+      }
+      await expect(evaluateInIsolatedFrame(contents, child, '2 + 2')).resolves.toBe(4)
+
+      expect(
+        vi
+          .mocked(contents.debugger.sendCommand)
+          .mock.calls.filter(([method]) =>
+            ['Page.createIsolatedWorld', 'Runtime.evaluate'].includes(method)
+          )
+      ).toEqual([
+        [
+          'Page.createIsolatedWorld',
+          {
+            frameId: 'child',
+            worldName: 'sim-browser-agent',
+            grantUniveralAccess: false,
+          },
+          'child-session',
+        ],
+        [
+          'Runtime.evaluate',
+          {
+            expression: '2 + 2',
+            contextId: 42,
+            returnByValue: true,
+            awaitPromise: true,
+            userGesture: false,
+          },
+          'child-session',
+        ],
+      ])
+    }
+  )
 
   it('falls back to the root target when OOPIF isolated-world creation fails', async () => {
     const contents = new WebContentsView().webContents