fix(desktop,cli): scope deployment capabilities to their origin

Changing the server left two device-global stores in place that grant the
INCOMING deployment authority the user only handed the outgoing one: local
filesystem grants (directories its agent may read, plus security-scoped
bookmarks) and the agent browser's cookie jar (live third-party sessions its
agent may drive). Sign-out clears exactly this pair; an origin change is the
same boundary, so it now clears it too — awaited before the relaunch, since a
quit racing an async clear could leave either behind. browserKnownSites goes
with the jar it describes, so Sim is never left believing in sign-ins the
profile no longer has.

The CLI printed the redirect's filename straight to the terminal. It is read
out of a Location the deployment chose, so percent-encoded ANSI or OSC survives
decodeURIComponent as real control bytes and could forge CLI output; control
characters are stripped and the name is bounded before it reaches the spinner.

resolveDeploymentUrl took the first source naming an app URL. A machine with
both a local checkout and a real deployment would be probed, printed, and
opened at whichever enumerated first, silently — so disagreeing sources are now
an error naming each candidate and asking for --url, the way
resolveFeatureSetupDestination already refuses ambiguity.

Author: waleedlatif1

apps/desktop/src/main/index.ts

@@ -482,6 +482,10 @@ function main(): void {
     preloadPath,
     isPackaged: app.isPackaged,
     getParentWindow: getMainWindow,
+    clearDeploymentScopedState: async () => {
+      await localFilesystem.forgetAll()
+      await clearAgentBrowserProfile()
+    },
     relaunch: relaunchApp,
   })
 

apps/desktop/src/main/ipc.test.ts

@@ -319,7 +319,7 @@ describe('registerIpcHandlers', () => {
       server: {
         open: vi.fn(),
         getConfiguration: vi.fn(() => ({ origin: APP, defaultOrigin: APP, isSimCloud: true })),
-        setOrigin: vi.fn(() => ({ ok: true as const, origin: APP, unchanged: true })),
+        setOrigin: vi.fn(async () => ({ ok: true as const, origin: APP, unchanged: true })),
       },
     }
     registerIpcHandlers(deps)

apps/desktop/src/main/ipc.ts

@@ -306,7 +306,7 @@ export interface IpcDeps {
   server: {
     open: () => void
     getConfiguration: () => DesktopServerConfiguration
-    setOrigin: (origin: string) => DesktopServerChangeResult
+    setOrigin: (origin: string) => Promise<DesktopServerChangeResult>
   }
 }
 

apps/desktop/src/main/server-window.test.ts

@@ -34,6 +34,7 @@ function makeDeps(overrides: Partial<ServerWindowDeps> = {}): ServerWindowDeps {
     preloadPath: '/tmp/preload.cjs',
     isPackaged: false,
     getParentWindow: () => null,
+    clearDeploymentScopedState: vi.fn(async () => {}),
     relaunch: vi.fn(),
     ...overrides,
   }
@@ -64,8 +65,8 @@ describe('server window', () => {
     expect(createServerWindow(cloud).getConfiguration().isSimCloud).toBe(true)
   })
 
-  it('relaunches after storing a different origin', () => {
-    const result = createServerWindow(deps).setOrigin('https://sim.other.example')
+  it('relaunches after storing a different origin', async () => {
+    const result = await createServerWindow(deps).setOrigin('https://sim.other.example')
 
     expect(result).toEqual({ ok: true, origin: 'https://sim.other.example', unchanged: false })
     expect(deps.config.flush).toHaveBeenCalled()
@@ -75,28 +76,61 @@ describe('server window', () => {
   // The saved route carries the previous deployment's workspace id, and
   // resolveStartRoute only discards a route on a confirmed 403 — a fresh
   // partition answers 401, so a kept route would survive onto the new server.
-  it('drops the saved route when the origin changes', () => {
-    createServerWindow(deps).setOrigin('https://sim.other.example')
+  it('drops the saved route when the origin changes', async () => {
+    await createServerWindow(deps).setOrigin('https://sim.other.example')
 
     expect(deps.config.set).toHaveBeenCalledWith('lastRoute', undefined)
   })
 
-  it('keeps the saved route when the origin is unchanged', () => {
-    createServerWindow(deps).setOrigin(CURRENT)
+  it('keeps the saved route when the origin is unchanged', async () => {
+    await createServerWindow(deps).setOrigin(CURRENT)
 
     expect(deps.config.set).not.toHaveBeenCalled()
   })
 
   // Re-confirming the pre-filled URL is the common case here.
-  it('does not relaunch when the origin is unchanged', () => {
-    const result = createServerWindow(deps).setOrigin(CURRENT)
+  it('does not relaunch when the origin is unchanged', async () => {
+    const result = await createServerWindow(deps).setOrigin(CURRENT)
 
     expect(result).toEqual({ ok: true, origin: CURRENT, unchanged: true })
     expect(deps.relaunch).not.toHaveBeenCalled()
   })
 
-  it('surfaces a rejected origin without relaunching', () => {
-    const result = createServerWindow(deps).setOrigin('ftp://sim.example.com')
+  // Filesystem grants and the agent browser's jar are device-global with no
+  // origin key, so without this the incoming deployment inherits directory
+  // access and live third-party sessions the user granted the outgoing one.
+  it('clears deployment-scoped capabilities before relaunching', async () => {
+    await createServerWindow(deps).setOrigin('https://sim.other.example')
+
+    expect(deps.clearDeploymentScopedState).toHaveBeenCalledTimes(1)
+    expect(vi.mocked(deps.clearDeploymentScopedState).mock.invocationCallOrder[0]).toBeLessThan(
+      vi.mocked(deps.relaunch).mock.invocationCallOrder[0]
+    )
+  })
+
+  it('does not clear them when the origin is unchanged', async () => {
+    await createServerWindow(deps).setOrigin(CURRENT)
+
+    expect(deps.clearDeploymentScopedState).not.toHaveBeenCalled()
+  })
+
+  // The origin is already persisted by this point, so a failed clear must not
+  // strand the shell on the old server — but it is logged, not swallowed.
+  it('still relaunches when the teardown fails', async () => {
+    const failing = makeDeps({
+      clearDeploymentScopedState: vi.fn(async () => {
+        throw new Error('keychain unavailable')
+      }),
+    })
+
+    const result = await createServerWindow(failing).setOrigin('https://sim.other.example')
+
+    expect(result).toMatchObject({ ok: true, unchanged: false })
+    expect(failing.relaunch).toHaveBeenCalledTimes(1)
+  })
+
+  it('surfaces a rejected origin without relaunching', async () => {
+    const result = await createServerWindow(deps).setOrigin('ftp://sim.example.com')
 
     expect(result).toEqual({ ok: false, error: 'bad origin' })
     expect(deps.relaunch).not.toHaveBeenCalled()

apps/desktop/src/main/server-window.ts

@@ -36,17 +36,14 @@ const SERVER_WINDOW_PARTITION = 'server-selection'
  * `/workspace/<old-id>` on the new server. `resolveStartRoute` cannot rescue
  * that: it discards a route only on a confirmed 403, and a fresh partition has
  * no session, so the new server answers 401 and the stale route survives the
- * probe.
- *
- * The agent browser is deliberately untouched — both its cookie jar and the
- * `browserKnownSites` inference metadata that describes it. Sign-out clears the
- * pair because the ACCOUNT changed; pointing the shell at another deployment
- * does not imply that, and signing the operator out of every unrelated site in
- * the built-in browser is not a reasonable side effect of correcting a server
- * URL. They are kept together on purpose: clearing the metadata alone would
- * leave Sim blind to sign-ins that are still live in the profile.
+ * probe. `browserKnownSites` describes the agent-browser profile that
+ * {@link ServerWindowDeps.clearDeploymentScopedState} clears, and is dropped
+ * with it so Sim is never left believing in sign-ins the profile no longer has.
  */
-const ORIGIN_SCOPED_SETTINGS: readonly (keyof DesktopSettings)[] = ['lastRoute']
+const ORIGIN_SCOPED_SETTINGS: readonly (keyof DesktopSettings)[] = [
+  'lastRoute',
+  'browserKnownSites',
+]
 
 export interface ServerWindowDeps {
   config: ConfigStore
@@ -56,6 +53,19 @@ export interface ServerWindowDeps {
   preloadPath: string
   isPackaged: boolean
   getParentWindow: () => BrowserWindow | null
+  /**
+   * Drops the capabilities the OUTGOING deployment was granted, before the new
+   * one can inherit them.
+   *
+   * Local-filesystem grants and the agent browser's cookie jar live in
+   * device-global stores with no origin key, and both are capabilities the user
+   * handed to a specific Sim server: directories its agent may read, and live
+   * third-party sessions its agent may drive. Carrying them across would let
+   * the next deployment act with authority it was never given — which is why
+   * sign-out clears exactly this pair. Awaited before the relaunch, since a
+   * quit racing an async clear could leave either behind.
+   */
+  clearDeploymentScopedState: () => Promise<void>
   /**
    * Relaunches the shell against the newly stored origin. A full restart rather
    * than an in-place swap: the origin decides the cookie partition, the update
@@ -72,7 +82,7 @@ export interface ServerWindowDeps {
 export interface ServerWindowHandle {
   open(): void
   getConfiguration(): DesktopServerConfiguration
-  setOrigin(origin: string): DesktopServerChangeResult
+  setOrigin(origin: string): Promise<DesktopServerChangeResult>
 }
 
 /**
@@ -149,7 +159,7 @@ export function createServerWindow(deps: ServerWindowDeps): ServerWindowHandle {
     })
   }
 
-  const setOrigin = (raw: string): DesktopServerChangeResult => {
+  const setOrigin = async (raw: string): Promise<DesktopServerChangeResult> => {
     const current = deps.config.getOrigin()
     const validated = deps.config.setOrigin(raw)
     if (!validated.ok) {
@@ -164,6 +174,14 @@ export function createServerWindow(deps: ServerWindowDeps): ServerWindowHandle {
     for (const key of ORIGIN_SCOPED_SETTINGS) {
       deps.config.set(key, undefined)
     }
+    // Failing to clear must not strand the shell on the old origin — that is
+    // already persisted — but it must be loud, because what survives is access
+    // the next deployment did not earn.
+    await deps.clearDeploymentScopedState().catch((error) => {
+      logger.error('Could not clear deployment-scoped state before relaunch', {
+        error: getErrorMessage(error),
+      })
+    })
     // setOrigin writes through immediately; the clears above are debounced like
     // every other setting. `before-quit` flushes too, but doing it here keeps
     // the write independent of the Electron quit sequence.

packages/sim-setup/src/desktop.test.ts

@@ -1,11 +1,14 @@
 import { describe, expect, it, vi } from 'vitest'
-import { describeProbe, probeDownload, resolveDeploymentUrl } from './desktop'
+import { describeProbe, probeDownload, resolveDeploymentUrl, sanitizeForTerminal } from './desktop'
 import { SetupError } from './errors'
 
 const ASSET = 'https://github.com/simstudioai/sim/releases/download/v1.2.3/Sim-1.2.3-universal.dmg'
 
-function source(appUrl?: string) {
-  return { values: appUrl ? new Map([['NEXT_PUBLIC_APP_URL', appUrl]]) : new Map<string, string>() }
+function source(appUrl?: string, label = 'configuration') {
+  return {
+    label,
+    values: appUrl ? new Map([['NEXT_PUBLIC_APP_URL', appUrl]]) : new Map<string, string>(),
+  }
 }
 
 function respond(status: number, headers: Record<string, string> = {}): typeof fetch {
@@ -37,6 +40,27 @@ describe('resolveDeploymentUrl', () => {
     expect(resolveDeploymentUrl([source()])).toBe('http://localhost:3000')
   })
 
+  // This command prints one URL as the one to trust and offers to open it, so
+  // preferring whichever source happened to enumerate first would quietly send
+  // an operator with a local checkout AND a real deployment to localhost.
+  it('refuses to guess when sources name different deployments', () => {
+    expect(() =>
+      resolveDeploymentUrl([source('http://localhost:3000'), source('https://sim.example.com')])
+    ).toThrow(SetupError)
+  })
+
+  it('accepts agreeing sources and an override that settles the ambiguity', () => {
+    expect(
+      resolveDeploymentUrl([source('https://sim.example.com'), source('https://sim.example.com')])
+    ).toBe('https://sim.example.com')
+    expect(
+      resolveDeploymentUrl(
+        [source('http://localhost:3000'), source('https://sim.example.com')],
+        'https://sim.example.com'
+      )
+    ).toBe('https://sim.example.com')
+  })
+
   it('rejects a value that is not an http(s) URL', () => {
     expect(() => resolveDeploymentUrl([source('sim.example.com')])).toThrow(SetupError)
     expect(() => resolveDeploymentUrl([source('ftp://sim.example.com')])).toThrow(SetupError)
@@ -65,6 +89,24 @@ describe('probeDownload', () => {
     }
   })
 
+  // The end-to-end path that matters: a deployment can percent-encode ANSI in
+  // the redirect, and decodeURIComponent turns it into real control bytes on
+  // their way to the spinner.
+  it('sanitizes a redirect filename before it reaches the terminal', async () => {
+    const hostile = 'https://example.com/d/v1/Sim%1b%5b2K%1b%5b1Gforged.dmg'
+
+    const result = await probeDownload(
+      'https://sim.example.com/x',
+      respond(302, { location: hostile })
+    )
+
+    expect(result).toEqual({
+      status: 'ok',
+      installerUrl: hostile,
+      installerName: 'Sim[2K[1Gforged.dmg',
+    })
+  })
+
   it('distinguishes no-release from a broken release feed', async () => {
     expect(await probeDownload('https://sim.example.com/x', respond(404))).toEqual({
       status: 'no-release',
@@ -96,6 +138,22 @@ describe('probeDownload', () => {
   })
 })
 
+describe('sanitizeForTerminal', () => {
+  // The name comes out of a redirect the deployment chose, so it is remote
+  // input on its way to a TTY.
+  it('strips control characters a deployment could smuggle through the redirect', () => {
+    expect(sanitizeForTerminal('Sim\u001b[2K\u001b[1G forged.dmg')).toBe('Sim[2K[1G forged.dmg')
+    expect(sanitizeForTerminal('a\u0000b\u007fc\u009fd')).toBe('abcd')
+    expect(sanitizeForTerminal('Sim-1.2.3-universal.dmg')).toBe('Sim-1.2.3-universal.dmg')
+  })
+
+  it('caps a name that would overrun the spinner line', () => {
+    const capped = sanitizeForTerminal('x'.repeat(500))
+
+    expect(capped).toBe(`${'x'.repeat(120)}...`)
+  })
+})
+
 describe('describeProbe', () => {
   // Failure statuses are the ones an operator has to act on, so each must
   // arrive with something to try.

packages/sim-setup/src/desktop.ts

@@ -1,4 +1,5 @@
 import { getErrorMessage } from '@sim/utils/errors'
+import { truncate } from '@sim/utils/string'
 import { openBrowser } from './cli-auth'
 import { discoverConfigurationSources } from './configuration-sources'
 import { SetupError } from './errors'
@@ -23,6 +24,21 @@ const REDIRECT_STATUSES: ReadonlySet<number> = new Set([301, 302, 307, 308])
 /** The env var every deployment sets to its own public origin. */
 const APP_URL_KEY = 'NEXT_PUBLIC_APP_URL'
 
+/** Keeps a rendered artifact name from overrunning the spinner line. */
+const MAX_INSTALLER_NAME = 120
+
+/**
+ * Strips anything that could move the cursor, repaint, or retitle the terminal.
+ *
+ * The artifact name is read out of a redirect the deployment chose, so it is
+ * remote input on its way to a TTY: percent-encoded ANSI or OSC bytes survive
+ * `decodeURIComponent` as real control characters and would let a compromised
+ * deployment forge CLI output. C0 (including ESC), DEL, and C1 all go.
+ */
+export function sanitizeForTerminal(value: string): string {
+  return truncate(value.replace(/[\u0000-\u001f\u007f-\u009f]/g, ''), MAX_INSTALLER_NAME)
+}
+
 export interface DesktopFlags {
   /** Overrides the deployment origin when the CLI runs away from the install. */
   url?: string
@@ -35,12 +51,31 @@ export interface DesktopFlags {
  * Read from every discovered source, not only the one `add` may write: an
  * operator running a Helm release or an external Compose project still needs
  * the URL, and reading it changes nothing.
+ *
+ * Sources that disagree are an error rather than a first-match win. This
+ * command probes a URL, prints it as the one to trust, and offers to open it —
+ * so silently preferring whichever source enumerated first would point an
+ * operator with both a local checkout and a real deployment at localhost and
+ * never say so. `resolveFeatureSetupDestination` refuses ambiguity the same way.
  */
 export function resolveDeploymentUrl(
-  sources: readonly { values?: Map<string, string> | null }[],
+  sources: readonly { label?: string; values?: Map<string, string> | null }[],
   override?: string
 ): string {
-  const raw = override ?? sources.map((source) => source.values?.get(APP_URL_KEY)).find(Boolean)
+  const discovered = sources.filter((source) => source.values?.get(APP_URL_KEY))
+  const distinct = new Set(discovered.map((source) => source.values?.get(APP_URL_KEY)?.trim()))
+  if (!override && distinct.size > 1) {
+    throw new SetupError(
+      `Found ${distinct.size} configurations naming different ${APP_URL_KEY} values.`,
+      [
+        ...discovered.map(
+          (source) => `${source.label ?? 'configuration'}: ${source.values?.get(APP_URL_KEY)}`
+        ),
+        'Re-run with --url <deployment url> to say which one the desktop app should use.',
+      ]
+    )
+  }
+  const raw = override ?? discovered[0]?.values?.get(APP_URL_KEY)
   if (!raw) {
     // A wizard-provisioned local install has the compose interpolation default
     // rather than an explicit value, so an absent key is not a misconfiguration.
@@ -94,7 +129,7 @@ export async function probeDownload(
     } catch {
       // Keep the raw Location; it is still the most useful thing to print.
     }
-    return { status: 'ok', installerUrl: location, installerName: name }
+    return { status: 'ok', installerUrl: location, installerName: sanitizeForTerminal(name) }
   }
   if (response.status === 404) return { status: 'no-release' }
   if (response.status === 502) return { status: 'feed-unavailable' }