Merge remote-tracking branch 'origin/staging' into fix/integration-defect-ledger

Author: waleedlatif1

apps/desktop/src/main/ipc.test.ts

@@ -130,7 +130,7 @@ import {
 } from '@/main/browser-import'
 import { getSearchSuggestions } from '@/main/browser-search/suggestions'
 import { trackInputActivity } from '@/main/input-activity'
-import { type IpcDeps, registerIpcHandlers } from '@/main/ipc'
+import { type IpcDeps, openMicrophoneSettings, registerIpcHandlers } from '@/main/ipc'
 import { LocalFilesystemService } from '@/main/local-filesystem'
 import { TerminalRegistry } from '@/main/terminal/registry'
 import { findCachedTerminalThemeProfile, listTerminalThemeProfiles } from '@/main/terminal-themes'
@@ -337,6 +337,26 @@ describe('registerIpcHandlers', () => {
     expect(shell.openExternal).toHaveBeenCalledTimes(1)
   })
 
+  it('opens microphone privacy settings only for the trusted app origin', async () => {
+    const { invoke } = collectHandlers()
+    const handler = invoke.get('desktop:open-microphone-settings')
+
+    expect(await handler?.(evilEvent)).toBe(false)
+    expect(await handler?.(appEvent)).toBe(process.platform === 'darwin')
+    expect(shell.openExternal).toHaveBeenCalledTimes(process.platform === 'darwin' ? 1 : 0)
+  })
+
+  it('uses fixed native microphone settings URLs', async () => {
+    await expect(openMicrophoneSettings('darwin')).resolves.toBe(true)
+    expect(shell.openExternal).toHaveBeenLastCalledWith(
+      'x-apple.systempreferences:com.apple.preference.security?Privacy_Microphone'
+    )
+
+    await expect(openMicrophoneSettings('win32')).resolves.toBe(true)
+    expect(shell.openExternal).toHaveBeenLastCalledWith('ms-settings:privacy-microphone')
+    await expect(openMicrophoneSettings('linux')).resolves.toBe(false)
+  })
+
   it('keeps live search suggestions behind the app origin and privacy preference', async () => {
     const { invoke } = collectHandlers()
     const handler = invoke.get('browser-agent:search-suggestions')

apps/desktop/src/main/ipc.ts

@@ -19,14 +19,16 @@ import {
   isDesktopZoomPercent,
   isPendingDesktopScopeId,
 } from '@sim/desktop-bridge'
+import { createLogger } from '@sim/logger'
 import {
   isTerminalOperation,
   isTerminalToolName,
   type TerminalToolArgs,
 } from '@sim/terminal-protocol'
+import { getErrorMessage } from '@sim/utils/errors'
 import { isRecordLike } from '@sim/utils/object'
 import type { BrowserWindow, IpcMainEvent, IpcMainInvokeEvent, WebContents } from 'electron'
-import { clipboard, ipcMain } from 'electron'
+import { clipboard, ipcMain, shell } from 'electron'
 import {
   type BrowserToolQueueBoundary,
   cancelActiveTool,
@@ -84,9 +86,35 @@ import type { ScopedEventRouter } from '@/main/scoped-event-router'
 import type { TerminalRegistry } from '@/main/terminal/registry'
 import { findCachedTerminalThemeProfile, listTerminalThemeProfiles } from '@/main/terminal-themes'
 
+const logger = createLogger('DesktopIpc')
+
 /** Workspace/chat ids are opaque tokens; anything else never reaches a URL. */
 const ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/
 
+const MICROPHONE_SETTINGS_URLS: Partial<Record<NodeJS.Platform, string>> = {
+  darwin: 'x-apple.systempreferences:com.apple.preference.security?Privacy_Microphone',
+  win32: 'ms-settings:privacy-microphone',
+}
+
+/** Opens the native microphone privacy pane without accepting a renderer-provided URL. */
+export async function openMicrophoneSettings(
+  platform: NodeJS.Platform = process.platform
+): Promise<boolean> {
+  const settingsUrl = MICROPHONE_SETTINGS_URLS[platform]
+  if (!settingsUrl) return false
+
+  try {
+    await shell.openExternal(settingsUrl)
+    return true
+  } catch (error) {
+    logger.warn('Could not open microphone privacy settings', {
+      error: getErrorMessage(error),
+      platform,
+    })
+    return false
+  }
+}
+
 /**
  * Desktop state is partitioned by the existing chat id. A new-chat view uses
  * the composer’s existing provisional key until the server assigns that id.
@@ -627,6 +655,12 @@ export function registerIpcHandlers(deps: IpcDeps): void {
       handler: (url) =>
         typeof url === 'string' ? openExternalSafe(url, deps.allowHttpLocalhost()) : false,
     },
+    'desktop:open-microphone-settings': {
+      kind: 'invoke',
+      gate: 'app-origin',
+      denied: false,
+      handler: () => openMicrophoneSettings(),
+    },
     // OAuth connect handoff: the whole flow runs in the system browser (state
     // is cookie-bound to the initiating user agent), returning via loopback.
     'desktop:oauth-connect': {

apps/desktop/src/preload/index.test.ts

@@ -45,4 +45,21 @@ describe('desktop preload bridge', () => {
       ['desktop:settings:set-browser-search-suggestions', false],
     ])
   })
+
+  it('exposes native microphone settings only on supported platforms', async () => {
+    const exposed = exposeInMainWorld.mock.calls.find(([name]) => name === 'simDesktop')?.[1] as
+      | SimDesktopApi
+      | undefined
+    if (!exposed) throw new Error('Expected the desktop preload API to be exposed')
+
+    const isSupportedPlatform = process.platform === 'darwin' || process.platform === 'win32'
+    expect(typeof exposed.openMicrophoneSettings).toBe(
+      isSupportedPlatform ? 'function' : 'undefined'
+    )
+
+    if (isSupportedPlatform) {
+      await exposed.openMicrophoneSettings?.()
+      expect(invoke).toHaveBeenLastCalledWith('desktop:open-microphone-settings')
+    }
+  })
 })

apps/desktop/src/preload/index.ts

@@ -114,6 +114,12 @@ function shellVersion(): string {
 const api: SimDesktopApi = {
   version: shellVersion(),
   openExternal: (url: string): Promise<boolean> => ipcRenderer.invoke('desktop:open-external', url),
+  ...(process.platform === 'darwin' || process.platform === 'win32'
+    ? {
+        openMicrophoneSettings: (): Promise<boolean> =>
+          ipcRenderer.invoke('desktop:open-microphone-settings'),
+      }
+    : {}),
   beginOAuthConnect: (providerId: string, scope?: DesktopOAuthConnectScope): Promise<boolean> =>
     ipcRenderer.invoke('desktop:oauth-connect', providerId, scope),
   onOAuthConnectComplete: (callback: (result: DesktopOAuthConnectResult) => void): (() => void) => {

apps/sim/app/api/organizations/[id]/route.ts

@@ -1,6 +1,6 @@
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
-import { member, organization } from '@sim/db/schema'
+import { member, organization, organizationColumns } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { isOrgAdminRole } from '@sim/platform-authz/workspace'
 import { and, eq, ne } from 'drizzle-orm'
@@ -64,7 +64,7 @@ export const GET = withRouteHandler(
       }
 
       const organizationEntry = await db
-        .select()
+        .select(organizationColumns)
         .from(organization)
         .where(eq(organization.id, organizationId))
         .limit(1)
@@ -156,7 +156,7 @@ export const PUT = withRouteHandler(
       if (name !== undefined || slug !== undefined || logo !== undefined) {
         if (slug !== undefined) {
           const existingSlug = await db
-            .select()
+            .select(organizationColumns)
             .from(organization)
             .where(and(eq(organization.slug, slug), ne(organization.id, organizationId)))
             .limit(1)
@@ -180,7 +180,7 @@ export const PUT = withRouteHandler(
           .update(organization)
           .set(updateData)
           .where(eq(organization.id, organizationId))
-          .returning()
+          .returning(organizationColumns)
 
         if (updatedOrg.length === 0) {
           return NextResponse.json({ error: 'Organization not found' }, { status: 404 })

apps/sim/app/api/v1/admin/organizations/[id]/billing/route.ts

@@ -16,7 +16,7 @@
  */
 
 import { db, dbReplica } from '@sim/db'
-import { member, organization } from '@sim/db/schema'
+import { member, organization, organizationColumns } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { count, eq } from 'drizzle-orm'
 import {
@@ -155,7 +155,7 @@ export const PATCH = withRouteHandler(
       if (!parsed.success) return parsed.response
 
       const [orgData] = await db
-        .select()
+        .select(organizationColumns)
         .from(organization)
         .where(eq(organization.id, organizationId))
         .limit(1)

apps/sim/app/api/v1/admin/organizations/[id]/route.ts

@@ -38,7 +38,7 @@ import {
   recordAuditBatch,
 } from '@sim/audit'
 import { db } from '@sim/db'
-import { member, organization, subscription } from '@sim/db/schema'
+import { member, organization, organizationColumns, subscription } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, count, eq, inArray, isNull, not, or } from 'drizzle-orm'
 import {
@@ -92,7 +92,7 @@ export const GET = withRouteHandler(
 
     try {
       const [orgData] = await db
-        .select()
+        .select(organizationColumns)
         .from(organization)
         .where(eq(organization.id, organizationId))
         .limit(1)
@@ -143,7 +143,7 @@ export const PATCH = withRouteHandler(
 
     try {
       const [existing] = await db
-        .select()
+        .select(organizationColumns)
         .from(organization)
         .where(eq(organization.id, organizationId))
         .limit(1)
@@ -182,7 +182,7 @@ export const PATCH = withRouteHandler(
         .update(organization)
         .set(updateData)
         .where(eq(organization.id, organizationId))
-        .returning()
+        .returning(organizationColumns)
 
       const updatedFields = auditUpdatedFields(updateData)
       logger.info(`Admin API: Updated organization ${organizationId}`, { updatedFields })

apps/sim/app/api/v1/admin/organizations/route.ts

@@ -23,7 +23,7 @@
 
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db, dbReplica } from '@sim/db'
-import { member, organization, user } from '@sim/db/schema'
+import { member, organization, organizationColumns, user } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { slugify } from '@sim/utils/string'
 import { count, eq } from 'drizzle-orm'
@@ -81,7 +81,6 @@ export const GET = withRouteHandler(
             logo: organization.logo,
             orgUsageLimit: organization.orgUsageLimit,
             storageUsedBytes: organization.storageUsedBytes,
-            departedMemberUsage: organization.departedMemberUsage,
             createdAt: organization.createdAt,
             updatedAt: organization.updatedAt,
           })
@@ -152,7 +151,7 @@ export const POST = withRouteHandler(
       })
 
       const [createdOrg] = await db
-        .select()
+        .select(organizationColumns)
         .from(organization)
         .where(eq(organization.id, organizationId))
         .limit(1)

apps/sim/app/api/v1/admin/types.ts

@@ -358,7 +358,6 @@ export interface AdminOrganization {
   logo: string | null
   orgUsageLimit: string | null
   storageUsedBytes: number
-  departedMemberUsage: string
   createdAt: string
   updatedAt: string
 }
@@ -370,15 +369,7 @@ export interface AdminOrganizationDetail extends AdminOrganization {
 
 export type AdminOrganizationSource = Pick<
   DbOrganization,
-  | 'id'
-  | 'name'
-  | 'slug'
-  | 'logo'
-  | 'orgUsageLimit'
-  | 'storageUsedBytes'
-  | 'departedMemberUsage'
-  | 'createdAt'
-  | 'updatedAt'
+  'id' | 'name' | 'slug' | 'logo' | 'orgUsageLimit' | 'storageUsedBytes' | 'createdAt' | 'updatedAt'
 >
 
 export function toAdminOrganization(dbOrg: AdminOrganizationSource): AdminOrganization {
@@ -389,7 +380,6 @@ export function toAdminOrganization(dbOrg: AdminOrganizationSource): AdminOrgani
     logo: dbOrg.logo,
     orgUsageLimit: dbOrg.orgUsageLimit,
     storageUsedBytes: dbOrg.storageUsedBytes,
-    departedMemberUsage: dbOrg.departedMemberUsage,
     createdAt: dbOrg.createdAt.toISOString(),
     updatedAt: dbOrg.updatedAt.toISOString(),
   }
@@ -480,8 +470,7 @@ interface AdminUserBilling {
   billedOverageThisPeriod: string
   storageUsedBytes: number
   billingBlocked: boolean
-  // Copilot usage (active per-period baselines)
-  currentPeriodCopilotCost: string
+  // Copilot usage
   lastPeriodCopilotCost: string | null
 }
 

apps/sim/app/api/v1/admin/users/[id]/billing/route.ts

@@ -20,7 +20,14 @@
  */
 
 import { db } from '@sim/db'
-import { member, organization, subscription, user, userStats } from '@sim/db/schema'
+import {
+  member,
+  organization,
+  subscription,
+  user,
+  userStats,
+  userStatsColumns,
+} from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { generateShortId } from '@sim/utils/id'
 import { eq, or } from 'drizzle-orm'
@@ -78,7 +85,11 @@ export const GET = withRouteHandler(
         return notFoundResponse('User')
       }
 
-      const [stats] = await db.select().from(userStats).where(eq(userStats.userId, userId)).limit(1)
+      const [stats] = await db
+        .select(userStatsColumns)
+        .from(userStats)
+        .where(eq(userStats.userId, userId))
+        .limit(1)
 
       // Canonical current-period usage (attributed usage_log, refresh-adjusted)
       // comes from the same helper users see.
@@ -119,7 +130,6 @@ export const GET = withRouteHandler(
         billedOverageThisPeriod: stats?.billedOverageThisPeriod ?? '0',
         storageUsedBytes: stats?.storageUsedBytes ?? 0,
         billingBlocked: stats?.billingBlocked ?? false,
-        currentPeriodCopilotCost: stats?.currentPeriodCopilotCost ?? '0',
         lastPeriodCopilotCost: stats?.lastPeriodCopilotCost ?? null,
         subscriptions: subscriptions.map(toAdminSubscription),
         organizationMemberships: memberOrgs.map((m) => ({
@@ -169,7 +179,7 @@ export const PATCH = withRouteHandler(
       }
 
       const [existingStats] = await db
-        .select()
+        .select(userStatsColumns)
         .from(userStats)
         .where(eq(userStats.userId, userId))
         .limit(1)