Merge origin/staging into feat/mothership-revamp

Staging: e2cdee6
Branch parent: d370714

Reconciles staging's public organization APIs with scoped Mothership settings operations, keeping canonical application use cases, current-role checks, and the locked invitation resend lifecycle.

Preserves federated Search, Slack/Search MCP, organization/member Generic Secrets, and the expanded Search composer. Keeps the GitHub repository selector in both live and rollback modes. Retains staging's shared HomeSection and GitLab PAT selector patterns.

Reconciles the divergent migration journals with an additive, replay-safe 0380 migration. Verified upgrades from the actual previous branch and staging DDL on disposable PostgreSQL, including skipped-index recovery and existing secret/usage data preservation.

Validation: all 26 workspace type-checks; all 49 repository audits; changed-file lint/format; app/auth/Search/CLI/desktop/database suites; disposable Search integration suites; localhost Home, Sources, Gmail configuration, and Generic Secrets smoke checks.

Author: icecrasher321

.github/workflows/ci.yml

@@ -234,7 +234,7 @@ jobs:
       github.event_name == 'push' &&
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging')
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
-    timeout-minutes: 15
+    timeout-minutes: 30
     outputs:
       version: ${{ steps.deploy.outputs.deploymentVersion }}
       environment: ${{ steps.target.outputs.environment }}
@@ -291,7 +291,7 @@ jobs:
           if [ -n "$TRIGGER_BRANCH" ]; then
             TARGET_ARGS+=(--branch "$TRIGGER_BRANCH")
           fi
-          bunx trigger.dev@4.5.12 deploy "${TARGET_ARGS[@]}" --skip-promotion
+          bunx trigger.dev@4.5.16 deploy "${TARGET_ARGS[@]}" --skip-promotion
 
       - name: Validate deployment version output
         env:
@@ -644,7 +644,7 @@ jobs:
           if [ -n "$TRIGGER_BRANCH" ]; then
             TARGET_ARGS+=(--branch "$TRIGGER_BRANCH")
           fi
-          bunx trigger.dev@4.5.12 promote "$VERSION" "${TARGET_ARGS[@]}"
+          bunx trigger.dev@4.5.16 promote "$VERSION" "${TARGET_ARGS[@]}"
 
   # Build ARM64 images for GHCR (main branch only, runs in parallel with
   # tests). Pushes only the immutable sha tag — latest-arm64/version-arm64

.github/workflows/test-build.yml

@@ -108,6 +108,7 @@ jobs:
           bunx vitest run
           scripts/retired-columns.postgres.test.ts
           scripts/connector-sync-schedule-precision.postgres.test.ts
+          scripts/database-failure-classification.postgres.test.ts
 
       - name: Verify OAuth lifecycle and SCIM membership guards in PostgreSQL
         working-directory: apps/sim
@@ -133,8 +134,19 @@ jobs:
           lib/billing/core/usage-log.postgres.test.ts
           lib/billing/core/organization-activity.postgres.test.ts
           lib/billing/core/usage-analytics-queries.postgres.test.ts
+          lib/billing/core/organization-usage-pagination.postgres.test.ts
+          lib/billing/organizations/member-limits.postgres.test.ts
+          lib/workspaces/organization-workspaces.postgres.test.ts
           lib/billing/calculations/usage-reservation.test.ts
 
+      - name: Verify access request flows, pagination, and impact in PostgreSQL
+        working-directory: apps/sim
+        env:
+          ACCESS_REQUESTS_TEST_DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_access_requests_test
+        run: |
+          bun -e 'import postgres from "postgres"; const sql = postgres(process.env.DATABASE_URL); await sql.unsafe("CREATE DATABASE sim_access_requests_test"); await sql.end()'
+          bunx vitest run ee/access-requests/lib/repository.postgres.test.ts ee/access-requests/lib/impact.postgres.test.ts ee/access-requests/lib/application/flow.postgres.test.ts
+
       - name: Verify fork previews ignore execution file history in PostgreSQL
         working-directory: apps/sim
         env:
@@ -263,14 +275,23 @@ jobs:
           lib/knowledge/__integration__/search-source-pagination.integration.ts
           lib/knowledge/__integration__/search-reference-batching.integration.ts
           lib/knowledge/__integration__/embedding-insert-batches.integration.ts
+          lib/knowledge/__integration__/processing-lock-scope.integration.ts
           lib/knowledge/__integration__/connector-lifecycle-locks.integration.ts
           lib/knowledge/__integration__/connector-deferral.integration.ts
           lib/knowledge/__integration__/stored-document-recovery.integration.ts
           lib/knowledge/__integration__/connector-partition-work.integration.ts
+          lib/knowledge/__integration__/user-document-visibility.integration.ts
           lib/knowledge/__integration__/listing-continuation.integration.ts
           lib/knowledge/__integration__/member-scope-renewal.integration.ts
+          lib/knowledge/__integration__/member-document-lifecycle.integration.ts
+          lib/knowledge/__integration__/connector-lease-pages.integration.ts
           lib/knowledge/__integration__/slack-empty-threads.integration.ts
           lib/knowledge/__integration__/kb-block-search.integration.ts
+          lib/knowledge/__integration__/gitlab-workspace.integration.ts
+          lib/knowledge/__integration__/unfilled-projection-source.integration.ts
+          lib/knowledge/__integration__/knowledge-projection.integration.ts
+          lib/knowledge/__integration__/async-projection-processing.integration.ts
+          lib/knowledge/__integration__/purged-detach-reservation.integration.ts
           lib/core/outbox/service.integration.ts
           lib/knowledge/__integration__/connector-upload.integration.ts
           lib/uploads/contexts/organization-logo/application.integration.ts
@@ -293,7 +314,17 @@ jobs:
           bunx vitest run --mode integration lib/knowledge/access/group-membership.integration.ts
           bunx vitest run \
             lib/knowledge/access/predicate.postgres.test.ts \
-            lib/knowledge/connectors/external-directory.postgres.test.ts
+            lib/knowledge/connectors/external-directory.postgres.test.ts \
+            lib/knowledge/connectors/sync-persistence.postgres.test.ts \
+            lib/knowledge/connectors/sync-content-pass.postgres.test.ts
+
+      - name: Verify the projection source and ACL trigger and backfill in PostgreSQL
+        working-directory: packages/db
+        env:
+          KNOWLEDGE_ACL_TEST_DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_acl_test
+        run: |
+          bun -e 'import postgres from "postgres"; const sql = postgres(process.env.DATABASE_URL); const [row] = await sql`SELECT 1 FROM pg_database WHERE datname = ${"sim_acl_test"}`; if (!row) await sql`CREATE DATABASE sim_acl_test`; await sql.end()'
+          bunx vitest run script-migrations/0021_embedding_search_connector.postgres.test.ts
 
   test-build:
     name: Lint and Test

apps/desktop/README.md

@@ -192,7 +192,7 @@ Raw local file bytes are never exposed through the preload bridge and cannot be
 
 ## Auto-update, channels, rollout, rollback
 
-- `electron-updater` reads the deployment's `/api/desktop/update` feed; production resolves stable releases from `simstudioai/sim`, while dev/staging resolve prereleases from `simstudioai/sim-desktop-releases`. Artifact downloads go directly to GitHub and deltas use `.zip.blockmap`. Sim validates every candidate before starting its download. Developer ID builds installed under `/Applications` use a prompt (Restart and update / Later; Later installs on quit); other packaged builds offer a validated installer download — never forced mid-session.
+- `electron-updater` reads the deployment's `/api/desktop/update` feed; production resolves stable releases from `simstudioai/sim`, while dev/staging resolve prereleases from `simstudioai/sim-desktop-releases`. Artifact downloads go directly to GitHub and deltas use `.zip.blockmap`. Sim validates every candidate before starting its download. Developer ID builds installed under `/Applications` use a prompt (Restart and update / Later; Later installs on quit); other packaged builds offer a validated installer download — never forced mid-session. A staged or offered update keeps being re-checked on the normal cadence, and a newer release replaces it, so a shell left running across several releases installs the latest build in one restart instead of the stale one followed by another prompt.
 - Streams: production follows stable `X.Y.Z` releases, dev follows `-dev.N`, and staging follows `-staging.N`. The feed still recognizes legacy `-alpha.N`/`-beta.N` releases during migration.
 - Staged rollout: after publishing, edit `stagingPercentage: 10` into the release's `latest-mac.yml`, then raise as crash metrics stay clean.
 - Rollback: a pulled release must be superseded by a **higher** version — users on the broken build will not reinstall an equal one. (A blocked-versions kill-switch was removed as unwired dead code; reintroduce it in `updater.ts` if a remote config source ever exists to feed it.)

apps/desktop/e2e/smoke.spec.ts

@@ -21,9 +21,13 @@ const PAGES: Record<string, string> = {
   '/login': '<!doctype html><html><body><h1 id="login">fixture-login</h1></body></html>',
 }
 
+/** `User-Agent` of every request the fixture origin has served, in arrival order. */
+const requestUserAgents: string[] = []
+
 function startFixtureServer(): Promise<{ server: Server; origin: string }> {
   return new Promise((resolvePromise) => {
     const server = createServer((request, response) => {
+      requestUserAgents.push(request.headers['user-agent'] ?? '')
       const path = new URL(request.url ?? '/', 'http://127.0.0.1').pathname
       const sessionCookie = request.headers.cookie
         ?.split(';')
@@ -85,6 +89,21 @@ test.describe('desktop shell smoke', () => {
     expect(window.url()).toBe(`${origin}/home`)
   })
 
+  test('presents one stock Chrome user agent on every request from the first load', async () => {
+    requestUserAgents.length = 0
+    app = await launchApp(origin)
+    const window = await app.firstWindow()
+    await expect(window.locator('#app')).toHaveText('fixture-app')
+    await window.evaluate(() => fetch('/home').then((response) => response.text()))
+
+    const pageUserAgent = await window.evaluate(() => navigator.userAgent)
+    expect(pageUserAgent).toMatch(
+      /^Mozilla\/5\.0 \(.+\) AppleWebKit\/537\.36 \(KHTML, like Gecko\) Chrome\/\d+\.0\.0\.0 Safari\/537\.36$/
+    )
+    expect(requestUserAgents.length).toBeGreaterThanOrEqual(2)
+    expect(new Set(requestUserAgents)).toEqual(new Set([pageUserAgent]))
+  })
+
   test('internal window.open creates an independent full Sim window', async () => {
     app = await launchApp(origin)
     const window = await app.firstWindow()

apps/desktop/src/main/browser-agent/session.test.ts

@@ -39,6 +39,7 @@ interface MockView {
     session: {
       setPermissionRequestHandler: ReturnType<typeof vi.fn>
       setPermissionCheckHandler: ReturnType<typeof vi.fn>
+      setUserAgent: ReturnType<typeof vi.fn>
       webRequest: { onBeforeRequest: ReturnType<typeof vi.fn> }
     }
     on: ReturnType<typeof vi.fn>
@@ -362,15 +363,14 @@ describe('browser-agent session', () => {
     expect(onTabNavigated).toHaveBeenCalledWith(contents, true)
   })
 
-  it('gives every tab a user agent with no Electron token in it', () => {
+  it('leaves every tab on the process-wide user agent instead of overriding it', () => {
     const first = session.ensureTab()
     const second = session.addTab()
 
     for (const tab of [first, second]) {
       const contents = (tab.view as unknown as MockView).webContents
-      const agent = contents.setUserAgent.mock.calls.at(-1)?.[0] as string | undefined
-      expect(agent).toMatch(/^Mozilla\/5\.0 \(.+\) .*Chrome\/\d+\.0\.0\.0 Safari\/537\.36$/)
-      expect(agent).not.toMatch(/Electron|Sim\//)
+      expect(contents.setUserAgent).not.toHaveBeenCalled()
+      expect(contents.session.setUserAgent).not.toHaveBeenCalled()
     }
   })
 

apps/desktop/src/main/browser-agent/session.ts

@@ -68,7 +68,6 @@ import {
 } from '@/main/browser-agent/registry'
 import { handleBrowserRequest } from '@/main/browser-agent/request-policy'
 import { clearHostVerdictCache } from '@/main/browser-agent/url-guard'
-import { browserUserAgent } from '@/main/browser-agent/user-agent'
 import type { BrowserSessionSnapshot } from '@/main/desktop-chat-session-store'
 import { suggestedFilename, uniqueDownloadPath } from '@/main/downloads'
 import { isAppOrigin } from '@/main/navigation'
@@ -1432,11 +1431,6 @@ function configureAgentPartition(ses: Session): void {
   configuredPartitions.add(ses)
   ses.setPermissionRequestHandler(browserPermissions.request)
   ses.setPermissionCheckHandler(browserPermissions.check)
-  // Service workers do not inherit a tab's user agent. With only the tab's set,
-  // the document request carries the browser string while the worker's own
-  // script request still announces Electron — and on a site that routes its
-  // fetches through a worker, that is the one the server sees.
-  ses.setUserAgent(browserUserAgent())
   ses.webRequest.onBeforeRequest((details, callback) => {
     handleBrowserRequest(details, callback)
   })
@@ -1984,10 +1978,6 @@ function initializeTabView(
     }
   }
   registerAgentNavigation(contents, routeNavigation)
-  // The session default does not reach a WebContents that already exists, and
-  // the first tab is what brings the session into being, so each tab sets its
-  // own as well — otherwise tab one browses as Electron and the rest as Chrome.
-  contents.setUserAgent(browserUserAgent())
   attachAgentContextMenu(contents, {
     addToChat: (text) => withBrowserScope(scopeId, () => addPageSelectionToChat(contents, text)),
     openTab: (url) => withBrowserScope(scopeId, () => openTabWithUrl(url, { agentOwned: false })),

apps/desktop/src/main/index.ts

@@ -83,6 +83,7 @@ import { attachTelemetryPolicy } from '@/main/telemetry-policy'
 import { TerminalRegistry } from '@/main/terminal/registry'
 import { installTray, type TrayHandle } from '@/main/tray'
 import { checkForUpdatesInteractive, initUpdater, type UpdaterHandle } from '@/main/updater'
+import { installBrowserUserAgent } from '@/main/user-agent'
 import { createMainWindow, setupPermissionHandlers } from '@/main/window'
 import { attachWindowOpenPolicy, isPopupContents } from '@/main/windows'
 
@@ -900,6 +901,7 @@ app.setName(APP_NAME_FOR_CHANNEL[channelForOrigin(DEFAULT_ORIGIN)])
 if (process.env.SIM_DESKTOP_USER_DATA) {
   app.setPath('userData', process.env.SIM_DESKTOP_USER_DATA)
 }
+installBrowserUserAgent()
 
 // The scheme the offline page and server picker load from must be declared
 // before the app is ready; the per-session handlers attach later.