improvement(links): make go/ and sim/ work with no setup (#9698)

* improvement(links): make go/ and sim/ work on install with no setup

Chrome treats go/x as a search until it has seen the host. It counts a visit to an unfamiliar single-label host as typed, so the extension now visits both hosts once on install, in background tabs that close themselves. That removes the Browser shortcuts modal and its Enable buttons, and the Links header now just links to the store.

Drop the managed bookmarks export with it. The /sim-links/<org>/<name> route stays so bookmarks already distributed keep opening.

* improvement(links): only teach Chrome when links are on, and open links in the organization they belong to

Teaching Chrome go/ for everyone would turn a typed go/foo into a Sim page for people without links, so the visit now waits for the signed-in session to report links as enabled. History expires after 90 days, so the visit repeats weekly at browser start and retries when it did not complete.

Links page Open and Copy, the shortcut chips and the org route now resolve in the organization they name rather than the session's landing organization. A link can't point back into link resolution. Suggestions match inside names, a missing link offers similar names, a typed phrase searches Links, and an organization without links gets an explanation instead of a 404.

* improvement(extension): tidy page capture and session handling

Use the shared UTF-8 length helper, drop redundant mounted guards, reuse ExtensionSessionExpired and the repeated capture messages, style the page-access error, and guard that the stale-transcript e2e sends before the socket closes.

* fix(extension): visit short hosts when a signed-in panel is ready

Installing signed out and signing in through the panel left go/ and sim/ untaught until the next browser start. Prove it end to end: nothing is visited signed out, and each host is visited once after sign-in.

* improvement(links): keep sim/ URLs, tell the extension when sign-in finishes, and fix what the feature audit found

A user belongs to one organization, so org-scoped link URLs fixed nothing and lost values and queries. Restore them, and drop the redirect-loop guard, which refused real aliases and broke editing them. The hosted app now posts signed-in from the extension layout, so members without chat access still get shortcuts. Typed phrases find hyphenated names, Copy link confirms, the omnibox hint matches what Enter does, and the docs match the behaviour. Share the extension dialog shell and remove an unreachable recovery branch.

* improvement(extension): remove opt-in search recovery

Shortcuts now work without setup, so recovery was extra config that needed search-site access and could catch real searches like go/ast. An update clears the rules and setting from earlier versions, and the recover route stays until those versions have updated.

* improvement(links): remove the search recovery and organization link routes

Links has few users so far, so nothing needs to keep working from earlier versions: no bookmarks export remains to serve, and no recovery rules to catch.

* improvement(extension): disclose the keyboard shortcut in the privacy policy

Author: waleedlatif1

apps/docs/content/docs/browser-extension/index.mdx

@@ -33,9 +33,9 @@ Change the binding in Chrome’s **Extensions → Keyboard shortcuts**. If Chrom
 
 ## Open team links
 
-Open **Links → Browser shortcuts** in Sim and select **Enable go/ shortcuts**. Then type a shortcut such as `go/handbook` in Chrome’s address bar. You can enable `sim/handbook` there too.
+Type a shortcut such as `go/handbook` or `sim/handbook` in Chrome’s address bar. Both work once you're signed in to Sim and Links is on for your organization.
 
-For suggestions, type `sim`, press **Space**, and enter part of a link name. If Chrome searches instead of opening a shortcut, enable your search engine under the extension’s **+ → Browser shortcuts**. Other searches stay unchanged.
+For suggestions, type `sim`, press **Space**, and enter part of a link name. If Chrome searches instead of opening a shortcut, open the Sim extension and sign in.
 
 See [Links](/search/sim-links#open-links-from-the-address-bar) for supported inputs, Glean conflicts, and team rollout. Administrators can [allow the extension for a Chrome organizational unit](https://support.google.com/chrome/a/answer/6306504).
 

apps/docs/content/docs/platform/enterprise/audit-logs.mdx

@@ -101,7 +101,7 @@ Events use identifiers such as `resource.action`. These categories are represent
 | API keys | `api_key.created`, `api_key.revoked` |
 | Credentials | `credential.created`, `credential.deleted`, `oauth.disconnected` |
 | Organization | `organization.updated`, `org_member.added`, `org_member.role_changed`, `organization.sso_provider.updated` |
-| Sim links | `sim_link.created`, `sim_link.updated`, `sim_link.deleted` |
+| Links | `sim_link.created`, `sim_link.updated`, `sim_link.deleted` |
 | Exports and drains | `audit_logs.exported`, `data_drain.created`, `data_drain.updated`, `data_drain.ran`, `data_drain.tested` |
 
 Authentication failures and password-reset requests use an anonymous actor and record the target account separately. Impersonation and administrative session revocations identify the operator and target organization. Table-row mutations record summaries and counts without copying row contents.

apps/docs/content/docs/search/sim-links.mdx

@@ -15,17 +15,17 @@ Names ignore case and punctuation, so `sim/Team-Handbook` and `sim/teamhandbook`
 
 ## Open links from the address bar
 
-[Install Sim for Chrome](https://chromewebstore.google.com/detail/sim/oanlcahddodnjpdoopcpjlcageejjpmg) in your work profile. In Sim, open **Links → Browser shortcuts** and select **Enable go/ shortcuts**. Type `go/handbook` in the address bar to open a link. Enable **sim/ shortcuts** there if you prefer `sim/handbook`.
+[Install Sim for Chrome](https://chromewebstore.google.com/detail/sim/oanlcahddodnjpdoopcpjlcageejjpmg) in your work profile, then type `go/handbook` or `sim/handbook` in the address bar. Both work once you're signed in to Sim.
 
 For suggestions, type `sim`, press **Space**, and enter part of a name. Matching links appear with the most opened first. Unlisted links still open by name.
 
 ### If a shortcut opens search
 
-Open the extension’s **+ → Browser shortcuts** and turn on your search engine. Approve Chrome’s site-access prompt if shown. Google (`google.com`), Bing, DuckDuckGo, and Yahoo are supported. Other searches and your default search engine stay unchanged.
+This can happen if you installed the extension while signed out, or just cleared your browsing history. Opening the Sim extension and signing in fixes the first case, and the second fixes itself within a week. Until then, a trailing slash (`go/handbook/`) or `http://go/handbook` tells Chrome to navigate directly.
 
-This handles whole shortcuts such as `go/handbook` or `go/jira/123`. For spaces, query parameters, unsupported search sites, or blocked site access, use `sim` + **Space** or the full `https://www.sim.ai/sim/<name>` address. A trailing slash (`go/handbook/`) or `http://go/handbook` also tells Chrome to navigate directly.
+### Roll out to your team
 
-Turning shortcuts off keeps site access. To remove it, open Chrome’s **Extensions → Manage extensions → Sim → Details**.
+Administrators can [force-install Sim for Chrome](https://support.google.com/chrome/a/answer/6306504) for an organizational unit. Shortcuts start working once each person signs in through the extension, or the next time Chrome starts after they've signed in.
 
 ### If another tool uses go/ or sim
 
@@ -45,9 +45,7 @@ Type `sim`, press **Space**, then type a link name and press **Enter**. For mana
 
 ### Show favorites in regular Chrome suggestions
 
-In Sim, choose **Copy link** for a favorite. In Chrome’s bookmark manager (`chrome://bookmarks`), add a bookmark with that URL and name it after the shortcut, such as `sim/handbook`. Chrome can suggest that bookmark when you type `sim/handb` or `handbook` in the address bar. Administrators can distribute selected team favorites through Chrome’s [managed bookmarks policy](https://chromeenterprise.google/policies/managed-bookmarks/).
-
-Organization admins can also open **Browser shortcuts → Team bookmarks**, choose listed links, and select **Export bookmarks**. The downloaded JSON contains a folder to merge into Chrome’s managed bookmarks policy. Its links resolve in the exporting organization, so a bookmark shared outside the team cannot open another team's same-name destination.
+In Sim, choose **Copy link** for a favorite. In Chrome’s bookmark manager (`chrome://bookmarks`), add a bookmark with that URL and name it after the shortcut, such as `sim/handbook`. Chrome can suggest that bookmark when you type `sim/handb` or `handbook` in the address bar.
 
 ## Create a link
 

apps/extension/DESIGN.md

@@ -60,16 +60,20 @@ other workspace resources or browser-control tools.
 ## Permission and lifetime rules
 
 - Required browser capabilities: side panel, scripting, active tab, context menus,
-  and short-lived session storage for selection handoff. Required host access is
+  short-lived session storage for selection handoff, and local storage for preferences. Required host access is
   limited to the configured Sim origin and to `http(s)://sim/*` and `http(s)://go/*`, which exist
   only so one static redirect rule can send top-level navigations to those hosts to the link resolver.
 - HTTP(S) page access is one optional browser-wide grant, requested from a direct
   user gesture. The browser owns revocation and restrictions. Approval enables
   capture across sites; switching tabs alone does not extract content.
-- No history, bookmarks, cookie API, debugger, native messaging, external messaging,
+- No history permission, bookmarks, cookie API, debugger, native messaging, external messaging,
   or arbitrary remote code execution. The only network interception is the static
-  `sim/` and `go/` redirect rule above, plus opt-in search recovery.
-- The only background network request is the `sim` address-bar keyword: after
+  `sim/` and `go/` redirect rule above.
+- Background network requests are limited to two. Once a week at browser start, and after
+  signing in to the panel, the worker asks the Sim origin whether links are on for the session;
+  if so, it opens `http://go/` and `http://sim/` in background tabs that close themselves, which
+  teaches Chrome's address bar these hosts and adds entries to browser history. The other is the
+  `sim` address-bar keyword: after
   `sim` and Space, the text typed before the first `/` or `?` is sent to the
   configured Sim origin with the signed-in session to suggest matching Sim links,
   unless it contains a space (a search) or is longer than a link name can be. Page

apps/extension/README.md

@@ -30,21 +30,20 @@ SIM_EXTENSION_DEV=1 SIM_EXTENSION_ORIGIN=http://localhost:3000 bun run --cwd app
 ## Data and permissions
 
 - Required capabilities: `activeTab`, `scripting`, `sidePanel`, `storage`, `contextMenus`, `declarativeNetRequestWithHostAccess`, and access to the configured Sim origin and to `http(s)://sim/*` and `http(s)://go/*`.
-- Type `sim`, press Space, enter the name, and press Enter to open an organization's [link](https://docs.sim.ai/search/sim-links). `go/<name>` opens the same link. Chrome can treat bare `go/<name>` or `sim/<name>` as a search before the redirect rule runs. Typing `http://go/<name>` once lets Chrome learn the short host in that profile. A trailing slash (`go/<name>/`) also selects navigation without relying on that history. A single static redirect rule rewrites top-level navigations to `http(s)://sim/*` and `http(s)://go/*` to `<Sim origin>/sim/*` with the path and query unchanged. The `sim` and `go` host permissions exist only for that rule: every navigation to those hosts is redirected before it loads, and no other request is matched or observed. An organization that already serves an intranet host named `sim` or `go` should not install this build, since its links would be redirected to Sim. When another extension (such as another go-links tool) also redirects `go/`, Chrome applies the most recently installed extension's rule.
+- Type `sim`, press Space, enter the name, and press Enter to open an organization's [link](https://docs.sim.ai/search/sim-links). `go/<name>` opens the same link. Chrome treats bare `go/<name>` or `sim/<name>` as a search until its history holds that short host, so on install, and at browser start once a week, the extension opens `http://go/` and `http://sim/` in background tabs that close themselves. It does this only once Sim says links are on for the signed-in session, so `go/x` stays an ordinary search for everyone else; signing in through the side panel checks again. Chrome counts a visit to an unfamiliar single-label host as typed, which is what the address bar checks, and repeating covers history that expires after 90 days or is cleared. A trailing slash (`go/<name>/`) always selects navigation. A single static redirect rule rewrites top-level navigations to `http(s)://sim/*` and `http(s)://go/*` to `<Sim origin>/sim/*` with the path and query unchanged. The `sim` and `go` host permissions exist only for that rule: every navigation to those hosts is redirected before it loads, and no other request is matched or observed. An organization that already serves an intranet host named `sim` or `go` should not install this build, since its links would be redirected to Sim. When another extension (such as another go-links tool) also redirects `go/`, Chrome applies the most recently installed extension's rule.
 - The `sim` address-bar keyword (`sim`, then Space) lists matching Sim links while you type and opens what you enter through the same resolver. For these suggestions, the background worker sends the text typed before the first `/` or `?`, and nothing else, unless that text contains a space (a search) or is longer than a link name can be, to `<Sim origin>/api/sim-links/suggestions` with the signed-in session, and the extension's content security policy allows connections to that origin alone. Unlisted links are never suggested.
-- **+ → Browser shortcuts** separately opts into recovery for exact Google, Bing, DuckDuckGo, or Yahoo HTTPS search hosts. After a direct Chrome permission grant, dynamic request rules redirect only top-level GET requests with one query parameter containing a whole `go/<name>` or `sim/<name>` shortcut. Only that value reaches `/sim-links/recover`, which validates it and redirects to the existing authenticated resolver. Ordinary search terms, additional search parameters, subframes, and unsupported inputs are not forwarded. Chrome applies these rules without an extension search-URL observer. Turning a provider off removes its rules while preserving site access; revoking access clears its recovery choice. This does not enable page reference or change the default search provider.
 - Optional HTTP/HTTPS access is requested together by **Allow across websites**, from a direct user action. Chrome's `activeTab` access is temporary and does not follow arbitrary new sites.
 - Page capture runs on demand in Chrome's isolated world. It excludes editable fields, inputs, hidden elements, scripts, and embedded documents. It reads only the top frame. PDF viewers and canvas documents may have no accessible text.
 - Extraction stops at 50,000 text characters, 150,000 serialized UTF-8 bytes, 15,000 visited nodes, or 150ms. The composer exposes truncation.
 - Attached pages share a 150,000-character and 450,000-byte snapshot budget per message, within the general 100-context ceiling. Shorter pages can share the available budget without a separate page-count restriction.
 - Source URLs omit credentials, query parameters, and fragments. Human-readable text can still contain sensitive information; it is the user-selected material they review and send into their conversation.
-- Snapshots stay in memory until handed to Sim and acknowledged or expired after 30 seconds. Extension storage contains only a short-lived intent with a tab/document identity and a SHA-256 URL digest, never raw URLs, captured text, or credentials. Closing a tab or navigating invalidates its pending intent. Sim applies its normal conversation retention once a message is sent.
-- No browser history, bookmarks, cookie access, debugger access, remote extension JavaScript, arbitrary network proxy, or background content collection is requested. Incognito use is disabled.
-- The iframe bridge checks both the exact configured origin and the exact frame, then validates versioned messages. The hosted composer may request only page capture, selection capture, the native page-access and browser-shortcut dialogs, or the browser's fixed microphone settings page. Requests require the current conversation nonce and Chrome transient user activation; arbitrary URLs, tabs, script execution, and network operations are never accepted. Permission grants still require a click in the extension-owned page-access control and browser approval. Shortcut settings are advertised separately so older installed shells keep working without the new action.
+- Snapshots stay in memory until handed to Sim and acknowledged or expired after 30 seconds. For captures, extension storage contains only a short-lived intent with a tab/document identity and a SHA-256 URL digest, never raw URLs, captured text, or credentials. Closing a tab or navigating invalidates its pending intent. Sim applies its normal conversation retention once a message is sent.
+- No browser history permission, bookmarks, cookie access, debugger access, remote extension JavaScript, arbitrary network proxy, or background content collection is requested. Incognito use is disabled.
+- The iframe bridge checks both the exact configured origin and the exact frame, then validates versioned messages. The hosted composer may request only page capture, selection capture, the native page-access dialog, or the browser's fixed microphone settings page. Requests require the current conversation nonce and Chrome transient user activation; arbitrary URLs, tabs, script execution, and network operations are never accepted. Permission grants still require a click in the extension-owned page-access control and browser approval.
 - Captures and queued toolbar intents are scoped to the receiving conversation. Changing conversation, workspace, or account discards an unfinished handoff. Captured attachments remain explicit snapshots when the source tab changes.
 - The complete hosted document, including portaled source dialogs and menus, is blocked from session replay. Clipboard writing and microphone capture are delegated only to the configured Sim origin; clipboard reading and camera access are not delegated. Voice input starts only after the user clicks the microphone and the browser grants permission. The shared Sim voice service streams microphone audio to ElevenLabs for transcription into the editable draft. Stop ends capture while allowing the final transcript to arrive; Send and conversation changes cancel unfinished transcription. There is no tab-audio capture or background recording.
 
-With **Reference current page** enabled, a composer Send requests a single fresh snapshot for that conversation. The extension stores only the preference in local storage. A tab change does not read any content. Explicit snapshots take precedence; access denial, navigation and timeouts keep the draft unsent. **Allow across websites** works even when Chrome hides the active address; no address entry is required. The grant covers HTTP and HTTPS sites across tabs until the user revokes or restricts it in browser settings. Uploaded screenshot files stay in the hosted app’s normal attachment flow.
+With **Reference current page** enabled, a composer Send requests a single fresh snapshot for that conversation. Local storage holds only this preference and when the short hosts were last visited. A tab change does not read any content. Explicit snapshots take precedence; access denial, navigation and timeouts keep the draft unsent. **Allow across websites** works even when Chrome hides the active address; no address entry is required. The grant covers HTTP and HTTPS sites across tabs until the user revokes or restricts it in browser settings. Uploaded screenshot files stay in the hosted app’s normal attachment flow.
 
 ## Verification
 
@@ -56,7 +55,7 @@ bun run --cwd apps/extension build
 
 The E2E suite uses real Chromium, the packaged extension, and a disposable HTTP app fixture. It pregrants only the fixture page origin in a temporary package to exercise extraction without automating the browser's permission dialog. It checks HttpOnly session-cookie transport, origin/frame spoofing, sensitive-field exclusion, source URL minimization, selected excerpts, UTF-8 limits, stale-document handoffs, denied host access, and absence of page bytes in extension storage. The cookie check uses a fixture, not Better Auth or SSO. JSON results and a screenshot are written beside the caller-supplied report path. The E2E suite builds into a temporary directory and leaves shipping `dist` untouched.
 
-Release verification must additionally exercise the native toolbar and shortcut, Chrome's real grant/revoke prompt, sign-in/SSO and expiry against the running Sim app, side-panel closing/reopening, workspace changes, narrow widths, and the real Mothership streaming response. The fixture suite does not establish those integrations. The design document records launch scope and release criteria.
+Release verification must additionally exercise typing `go/<name>` in Chrome's real address bar on a clean profile (the e2e proves the visits, not the address bar), the native toolbar and shortcut, Chrome's real grant/revoke prompt, sign-in/SSO and expiry against the running Sim app, side-panel closing/reopening, workspace changes, narrow widths, and the real Mothership streaming response. The fixture suite does not establish those integrations. The design document records launch scope and release criteria.
 
 The authenticated acceptance suite runs against a real local app, Better Auth, and a disposable Postgres database whose name contains `test`. Enable `KNOWLEDGE_MEMBER_ACCESS`, `CREDENTIAL_GROUPS`, `ACCESS_CONTROL_ENABLED`, and `NEXT_PUBLIC_ACCESS_CONTROL_ENABLED` on that app to exercise restricted organization members:
 

apps/extension/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sim/extension",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "private": true,
   "type": "module",
   "license": "Apache-2.0",