Merge remote-tracking branch 'origin/staging' into feat/credential-v2-api

Author: TheodoreSpeaks

apps/desktop/src/main/browser-agent/session.test.ts

@@ -21,6 +21,7 @@ interface MockView {
       setPermissionCheckHandler: ReturnType<typeof vi.fn>
     }
     on: ReturnType<typeof vi.fn>
+    setUserAgent: ReturnType<typeof vi.fn>
     setWindowOpenHandler: ReturnType<typeof vi.fn>
     loadURL: ReturnType<typeof vi.fn>
     reload: ReturnType<typeof vi.fn>
@@ -169,6 +170,18 @@ describe('browser-agent session', () => {
     expect(onTabNavigated).toHaveBeenCalledWith(contents, true)
   })
 
+  it('gives every tab a user agent with no Electron token in it', () => {
+    const first = session.ensureTab()
+    const second = session.addTab()
+
+    for (const tab of [first, second]) {
+      const contents = (tab.view as unknown as MockView).webContents
+      const agent = contents.setUserAgent.mock.calls.at(-1)?.[0] as string | undefined
+      expect(agent).toMatch(/^Mozilla\/5\.0 \(.+\) .*Chrome\/\d+\.0\.0\.0 Safari\/537\.36$/)
+      expect(agent).not.toMatch(/Electron|Sim\//)
+    }
+  })
+
   it('settles the tab spinner when only subresources are still loading', () => {
     const tab = session.ensureTab()
     const contents = (tab.view as unknown as MockView).webContents
@@ -1757,20 +1770,34 @@ describe('browser-agent session', () => {
     expect(event.preventDefault).toHaveBeenCalledOnce()
   })
 
-  it('permission handlers deny every request on the agent partition', () => {
+  it('permission handlers deny every request on the agent partition but the copy button', () => {
     const tab = session.ensureTab()
     const ses = (tab.view as unknown as MockView).webContents.session
     const requestHandler = ses.setPermissionRequestHandler.mock.calls[0][0] as (
       wc: unknown,
       permission: string,
       callback: (granted: boolean) => void
     ) => void
-    const callback = vi.fn()
-    requestHandler(null, 'media', callback)
-    expect(callback).toHaveBeenCalledWith(false)
+    const checkHandler = ses.setPermissionCheckHandler.mock.calls[0][0] as (
+      wc: unknown,
+      permission: string
+    ) => boolean
+
+    // Reading the clipboard would leak whatever the user last copied anywhere
+    // else, so it stays denied alongside everything a page could spy through.
+    for (const permission of ['media', 'geolocation', 'notifications', 'clipboard-read']) {
+      const callback = vi.fn()
+      requestHandler(null, permission, callback)
+      expect(callback).toHaveBeenCalledWith(false)
+      expect(checkHandler(null, permission)).toBe(false)
+    }
 
-    const checkHandler = ses.setPermissionCheckHandler.mock.calls[0][0] as () => boolean
-    expect(checkHandler()).toBe(false)
+    // Chromium routes navigator.clipboard.writeText through this one; denying
+    // it silently broke every copy button that does not use execCommand.
+    const writeCallback = vi.fn()
+    requestHandler(null, 'clipboard-sanitized-write', writeCallback)
+    expect(writeCallback).toHaveBeenCalledWith(true)
+    expect(checkHandler(null, 'clipboard-sanitized-write')).toBe(true)
   })
 
   it('leaves nothing of the signed-out user behind in the browser profile', async () => {

apps/desktop/src/main/browser-agent/session.ts

@@ -62,6 +62,7 @@ import {
   isBlockedSubresourceUrl,
   subresourceNeedsResolution,
 } from '@/main/browser-agent/url-guard'
+import { browserUserAgent } from '@/main/browser-agent/user-agent'
 import type { BrowserSessionSnapshot } from '@/main/desktop-chat-session-store'
 import { suggestedFilename, uniqueDownloadPath } from '@/main/downloads'
 import {
@@ -809,16 +810,40 @@ export async function importAgentCookies(
   return { imported, failed }
 }
 
+/**
+ * The single site permission a browsing surface cannot withhold: the one every
+ * "Copy" button on the web goes through. Blanket-denying it made
+ * `navigator.clipboard.writeText` reject with `NotAllowedError`, so those
+ * buttons did nothing at all — no error, no copied text — while the legacy
+ * `document.execCommand('copy')` path kept working, which is why only some
+ * sites looked broken.
+ *
+ * Granting it hands the page no reach it lacked: Chromium still requires the
+ * document to be focused and to hold a transient user activation, and a
+ * sanitized write only places text the page already renders onto the clipboard.
+ * Reading stays denied — that is the direction that would leak whatever the
+ * user last copied from anywhere else.
+ */
+const ALLOWED_SITE_PERMISSIONS = new Set(['clipboard-sanitized-write'])
+
 /**
  * Default-deny hardening for the agent partition. Site permissions remain
- * denied, while uploads use Chromium's native file chooser and downloads are
- * saved into the device-level browser download directory.
+ * denied apart from ALLOWED_SITE_PERMISSIONS, while uploads use Chromium's
+ * native file chooser and downloads are saved into the device-level browser
+ * download directory.
  */
 function configureAgentPartition(ses: Session): void {
   if (configuredPartitions.has(ses)) return
   configuredPartitions.add(ses)
-  ses.setPermissionRequestHandler((_wc, _permission, callback) => callback(false))
-  ses.setPermissionCheckHandler(() => false)
+  ses.setPermissionRequestHandler((_wc, permission, callback) =>
+    callback(ALLOWED_SITE_PERMISSIONS.has(permission))
+  )
+  ses.setPermissionCheckHandler((_wc, permission) => ALLOWED_SITE_PERMISSIONS.has(permission))
+  // Service workers do not inherit a tab's user agent. With only the tab's set,
+  // the document request carries the browser string while the worker's own
+  // script request still announces Electron — and on a site that routes its
+  // fetches through a worker, that is the one the server sees.
+  ses.setUserAgent(browserUserAgent())
   // SSRF choke point for the agent partition. Document navigations (top-level +
   // iframes) get the full DNS-resolving check — the one seam every navigation
   // passes through, including page-initiated ones the driver never sees (server
@@ -1101,6 +1126,10 @@ function createTabView(): WebContentsView {
   const contents = view.webContents
   registerAgentWebContents(contents)
   configureAgentPartition(contents.session)
+  // The session default does not reach a WebContents that already exists, and
+  // the first tab is what brings the session into being, so each tab sets its
+  // own as well — otherwise tab one browses as Electron and the rest as Chrome.
+  contents.setUserAgent(browserUserAgent())
   attachAgentContextMenu(contents, {
     addToChat: (text) => withBrowserScope(scopeId, () => addPageSelectionToChat(contents, text)),
     openTab: (url) => withBrowserScope(scopeId, () => openTabWithUrl(url, false)),

apps/desktop/src/main/browser-agent/user-agent.test.ts

@@ -0,0 +1,43 @@
+import { app } from 'electron'
+import { describe, expect, it, vi } from 'vitest'
+import { browserUserAgent, stockChromeUserAgent } from '@/main/browser-agent/user-agent'
+
+vi.mock('electron', () => import('@/test/electron-mock'))
+
+const ELECTRON_DEFAULT =
+  'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Sim/1.0.0 Chrome/140.0.7339.207 Electron/43.1.1 Safari/537.36'
+
+describe('stockChromeUserAgent', () => {
+  it('drops the application and Electron tokens a browser allowlist rejects', () => {
+    const agent = stockChromeUserAgent(ELECTRON_DEFAULT)
+    expect(agent).not.toMatch(/Electron/)
+    expect(agent).not.toMatch(/Sim\//)
+  })
+
+  it('reproduces the desktop string Chrome sends under user-agent reduction', () => {
+    expect(stockChromeUserAgent(ELECTRON_DEFAULT)).toBe(
+      'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36'
+    )
+  })
+
+  it('keeps the platform token of the machine it is running on', () => {
+    const windowsDefault =
+      'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Sim/1.0.0 Chrome/140.0.7339.207 Electron/43.1.1 Safari/537.36'
+    expect(stockChromeUserAgent(windowsDefault)).toContain('(Windows NT 10.0; Win64; x64)')
+  })
+
+  it('passes through a string that is not a Chromium user agent', () => {
+    expect(stockChromeUserAgent('curl/8.4.0')).toBe('curl/8.4.0')
+    expect(stockChromeUserAgent('')).toBe('')
+  })
+})
+
+describe('browserUserAgent', () => {
+  it('derives from the string Electron would otherwise have sent', () => {
+    app.userAgentFallback = ELECTRON_DEFAULT
+
+    expect(browserUserAgent()).toBe(
+      'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36'
+    )
+  })
+})

apps/desktop/src/main/browser-agent/user-agent.ts

@@ -0,0 +1,46 @@
+/**
+ * The user agent the browser resource presents to sites.
+ *
+ * Electron's default string carries two tokens no browser sends —
+ * `Sim/<version>` and `Electron/<version>`. Chromium's own token sits right
+ * beside them, but that does not save it: the detection libraries sites gate on
+ * test for Electron BEFORE Chrome (bowser matches `/electron/i` several
+ * descriptors ahead of its Chrome one, ua-parser-js reports `Electron` as the
+ * browser name), so the browser reads as "Electron", which is on nobody's
+ * supported list. Ashby warns "Ashby does not support this browser"; stricter
+ * sites refuse to render at all.
+ *
+ * Reporting stock Chrome is accurate rather than a disguise — the engine is the
+ * Chromium build the token already names, and Electron's user-agent client
+ * hints (`Sec-CH-UA`, `navigator.userAgentData`) only ever carried a Chromium
+ * brand, so dropping the token makes the header and the hints agree instead of
+ * contradicting each other.
+ */
+import { app } from 'electron'
+
+/** Platform token, then the Chromium major version, in the order a Chromium user agent lists them. */
+const CHROMIUM_USER_AGENT = /^Mozilla\/5\.0 \(([^)]*)\).* Chrome\/(\d+)\./
+
+/**
+ * Rebuilds the default user agent as the string Chrome itself sends. Chrome's
+ * user-agent reduction fixes the desktop form at
+ * `Mozilla/5.0 (<platform>) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/<major>.0.0.0 Safari/537.36`,
+ * so keeping the platform token and the Chromium major version — and zeroing
+ * the rest — reproduces it exactly, with no room left for an application or
+ * Electron token. A string that is not a Chromium user agent is returned
+ * unchanged rather than replaced with a guess.
+ */
+export function stockChromeUserAgent(defaultUserAgent: string): string {
+  const match = defaultUserAgent.match(CHROMIUM_USER_AGENT)
+  if (!match) return defaultUserAgent
+  const [, platform, chromeMajor] = match
+  return `Mozilla/5.0 (${platform}) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${chromeMajor}.0.0.0 Safari/537.36`
+}
+
+/**
+ * Derived from the string Electron would otherwise have sent, so the reported
+ * Chromium version tracks whatever Chromium the app actually ships.
+ */
+export function browserUserAgent(): string {
+  return stockChromeUserAgent(app.userAgentFallback)
+}

apps/desktop/src/test/electron-mock.ts

@@ -11,6 +11,8 @@ import { vi } from 'vitest'
 export const app = {
   name: 'Sim',
   isPackaged: false,
+  userAgentFallback:
+    'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Sim/1.0.0 Chrome/140.0.7339.207 Electron/43.1.1 Safari/537.36',
   getVersion: vi.fn(() => '1.0.0'),
   getName: vi.fn(() => 'Sim'),
   setName: vi.fn(),
@@ -152,6 +154,7 @@ function createWebContentsMock() {
     findInPage: vi.fn(() => 1),
     stopFindInPage: vi.fn(),
     setBackgroundThrottling: vi.fn(),
+    setUserAgent: vi.fn(),
     setIgnoreMenuShortcuts: vi.fn(),
     getZoomFactor: vi.fn(() => 1),
     setZoomFactor: vi.fn(),
@@ -185,6 +188,7 @@ function createWebContentsMock() {
     session: {
       setPermissionRequestHandler: vi.fn(),
       setPermissionCheckHandler: vi.fn(),
+      setUserAgent: vi.fn(),
       webRequest: { onBeforeRequest: vi.fn() },
       on: vi.fn(),
     },

apps/docs/content/docs/en/integrations/logrocket.mdx

@@ -5,7 +5,7 @@ description: Summarize sessions, manage users, and tag releases in LogRocket
 
 import { BlockInfoCard } from "@/components/ui/block-info-card"
 
-<BlockInfoCard
+<BlockInfoCard 
   type="logrocket"
   color="#764ABC"
 />
@@ -187,3 +187,4 @@ Register a release version in LogRocket so uploaded source maps can decode stack
 | Parameter | Type | Description |
 | --------- | ---- | ----------- |
 | `version` | string | Release version that was registered |
+

apps/docs/content/docs/en/platform/credentials.mdx

@@ -124,8 +124,16 @@ When a workspace secret and a personal secret share the same key name, the **wor
 
 When a workflow runs, secrets resolve in this order:
 
-1. **Workspace secrets** are checked first
-2. **Personal secrets** are used as a fallback — from the user who triggered the run (manual) or the workflow owner (automated runs via API, webhook, or schedule)
+1. **Workspace secrets** are checked first, and always resolve against the identity running the workflow — the caller when one can be identified, otherwise the workspace's billing account. A run only sees the workspace secrets that identity is allowed to use.
+2. **Personal secrets** are used as a fallback, from whichever identity is running:
+
+| Run started by | Personal secrets come from |
+| --- | --- |
+| Clicking Run, or a personal API key | The person running it |
+| A workspace API key, schedule, or webhook | The workflow owner |
+| A public API URL with no authentication | Nobody — personal secrets do not resolve |
+
+The workflow owner is the fallback only where nobody can be identified but somebody in the workspace set the trigger up, since those workflows are usually built against the owner's own keys. A public URL can be called by anyone, so it never borrows a person's keys at all — put every secret such a workflow needs in **Workspace**.
 
 ## Best Practices
 
@@ -138,7 +146,7 @@ When a workflow runs, secrets resolve in this order:
   { question: "Are my secrets encrypted at rest?", answer: "Yes. Values saved under Secrets are encrypted before being stored in the database." },
   { question: "Can a saved secret still appear in a workflow result?", answer: "Yes. Functional workflow data is not rewritten, so the raw value can still reach downstream blocks and tools and can appear in workflow execution responses, streams, or callbacks if your workflow deliberately returns or prints it. Log-facing views and read APIs receive a protected copy after a successful {{KEY}} resolution. Before content is sent to a model, exact values from the run's authorized secret catalog are replaced with placeholders, but encoded or otherwise transformed values remain outside that protection." },
   { question: "What happens if both a workspace secret and a personal secret have the same key name?", answer: "Among secrets available to the execution actor, the workspace secret takes precedence and the personal secret is the fallback. An inaccessible workspace secret does not shadow an authorized personal value." },
-  { question: "Who determines which personal secret is used for automated runs?", answer: "For manual runs, the personal secrets of the user who clicked Run are used as fallback. For automated runs triggered by API, webhook, or schedule, the personal secrets of the workflow owner are used instead." },
+  { question: "Who determines which personal secret is used for automated runs?", answer: "Whoever is running it, when that can be identified. Clicking Run or calling with a personal API key uses that person's personal secrets. A workspace API key, schedule, or webhook has no identifiable caller, so it falls back to the workflow owner's — those triggers are set up inside the workspace and the workflow is usually built against the owner's own keys. A public API URL with no authentication can be called by anyone, so no personal secrets resolve at all — those workflows run on workspace secrets only." },
   { question: "Can I import secrets from a .env file?", answer: "Yes. Paste .env-style content (KEY=VALUE format) into any key or value field and the secrets will be auto-populated. The parser supports export KEY=VALUE, quoted values, and inline comments." },
   { question: "What happens if I delete a secret that is used in a workflow?", answer: "The workflow will fail at any block that references the deleted secret during execution because the value cannot be resolved. Update any references before deleting a secret." },
 ]} />

apps/docs/openapi-v2-tables.json

@@ -6806,7 +6806,7 @@
             "enum": ["live", "deployed"]
           },
           "type": {
-            "description": "Replacement workflow-group producer type.",
+            "description": "Workflow-group producer type. Must match the group's stored type — a group's producer cannot be changed after creation.",
             "type": "string",
             "enum": ["manual", "enrichment"]
           },

apps/sim/app/_styles/globals.css

@@ -11,7 +11,7 @@
  */
 :root {
   --sidebar-width: 0px; /* 0 outside workspace; blocking script always sets actual value on workspace pages */
-  --sidebar-collapsed-width: 51px; /* icon rail on web; desktop overrides to 0 before first paint */
+  --sidebar-collapsed-width: 48px; /* icon rail on web; desktop overrides to 0 before first paint */
   --sidebar-expanded-width: 238px; /* SIDEBAR_WIDTH.DEFAULT; the width to restore to, held even while collapsed */
   --desktop-title-bar-height: 0px; /* macOS traffic-light lane; desktop overrides before first paint */
   --workspace-content-title-bar-inset: 0px; /* lane the content pane must leave clear; only non-zero when the pane, not the sidebar, sits under it */

apps/sim/app/api/cron/cleanup-stale-executions/route.test.ts

@@ -37,6 +37,21 @@ function flattenConditions(condition: unknown): MockCondition[] {
   return [node, ...(node.conditions?.flatMap((child) => flattenConditions(child)) ?? [])]
 }
 
+function hasToSQL(value: unknown): value is { toSQL: () => { sql: string; params: unknown[] } } {
+  return typeof value === 'object' && value !== null && 'toSQL' in value
+}
+
+/**
+ * Collects the leaves of a nested `sql` expression. The duration expression is
+ * built by a shared helper, so the values it binds sit one level below the
+ * fragment this route assembles rather than directly in its own params.
+ */
+function flattenSqlParams(expression: { sql: string; params: unknown[] }): unknown[] {
+  return expression.params.flatMap((param) =>
+    hasToSQL(param) ? flattenSqlParams(param.toSQL()) : [param]
+  )
+}
+
 function createRequest() {
   return createMockRequest(
     'GET',
@@ -96,11 +111,7 @@ describe('stale execution cleanup deadline grace', () => {
           'toSQL' in value &&
           value.toSQL().sql.includes('EXTRACT(EPOCH')
       )
-      const totalDurationExpression = update.totalDurationMs.toSQL()
-      const cleanupTimestamp = totalDurationExpression.params.find(
-        (value): value is { toSQL: () => { sql: string; params: unknown[] } } =>
-          typeof value === 'object' && value !== null && 'toSQL' in value
-      )
+      const totalDurationLeaves = flattenSqlParams(update.totalDurationMs.toSQL())
 
       expect(errorExpression.sql).toContain('CASE')
       expect(errorExpression.sql).toContain('IS NOT NULL')
@@ -111,11 +122,9 @@ describe('stale execution cleanup deadline grace', () => {
       )
       expect(staleDurationExpression?.toSQL().sql).toContain('ROUND')
       expect(staleDurationExpression?.toSQL().params).toContain(workflowExecutionLogs.startedAt)
-      expect(totalDurationExpression.sql).toContain('LEAST')
-      expect(totalDurationExpression.sql).toContain('ROUND')
-      expect(totalDurationExpression.params).toContain(2_147_483_647)
-      expect(totalDurationExpression.params).toContain(workflowExecutionLogs.startedAt)
-      expect(cleanupTimestamp?.toSQL().params).toEqual([new Date('2026-08-03T12:10:00.000Z')])
+      expect(totalDurationLeaves).toContain(2_147_483_647)
+      expect(totalDurationLeaves).toContain(workflowExecutionLogs.startedAt)
+      expect(totalDurationLeaves).toContainEqual(new Date('2026-08-03T12:10:00.000Z'))
       expect(update.endedAt).toEqual(new Date('2026-08-03T12:10:00.000Z'))
     } finally {
       vi.useRealTimers()