improvement(links): keep sim/ URLs, tell the extension when sign-in finishes, and fix what the feature audit found

A user belongs to one organization, so org-scoped link URLs fixed nothing and lost values and queries. Restore them, and drop the redirect-loop guard, which refused real aliases and broke editing them. The hosted app now posts signed-in from the extension layout, so members without chat access still get shortcuts. Typed phrases find hyphenated names, Copy link confirms, the omnibox hint matches what Enter does, and the docs match the behaviour. Share the extension dialog shell and remove an unreachable recovery branch.

Author: waleedlatif1

apps/docs/content/docs/browser-extension/index.mdx

@@ -33,9 +33,9 @@ Change the binding in Chrome’s **Extensions → Keyboard shortcuts**. If Chrom
 
 ## Open team links
 
-Type a shortcut such as `go/handbook` or `sim/handbook` in Chrome’s address bar. Both work as soon as the extension is installed.
+Type a shortcut such as `go/handbook` or `sim/handbook` in Chrome’s address bar. Both work once you're signed in to Sim and Links is on for your organization.
 
-For suggestions, type `sim`, press **Space**, and enter part of a link name. If Chrome searches instead of opening a shortcut, enable your search engine under the extension’s **+ → Browser shortcuts**. Other searches stay unchanged.
+For suggestions, type `sim`, press **Space**, and enter part of a link name. If Chrome searches instead of opening a shortcut, open the Sim extension and sign in. If it still searches, enable your search engine under the extension’s **+ → Browser shortcuts**. Other searches stay unchanged.
 
 See [Links](/search/sim-links#open-links-from-the-address-bar) for supported inputs, Glean conflicts, and team rollout. Administrators can [allow the extension for a Chrome organizational unit](https://support.google.com/chrome/a/answer/6306504).
 

apps/docs/content/docs/platform/enterprise/audit-logs.mdx

@@ -101,7 +101,7 @@ Events use identifiers such as `resource.action`. These categories are represent
 | API keys | `api_key.created`, `api_key.revoked` |
 | Credentials | `credential.created`, `credential.deleted`, `oauth.disconnected` |
 | Organization | `organization.updated`, `org_member.added`, `org_member.role_changed`, `organization.sso_provider.updated` |
-| Sim links | `sim_link.created`, `sim_link.updated`, `sim_link.deleted` |
+| Links | `sim_link.created`, `sim_link.updated`, `sim_link.deleted` |
 | Exports and drains | `audit_logs.exported`, `data_drain.created`, `data_drain.updated`, `data_drain.ran`, `data_drain.tested` |
 
 Authentication failures and password-reset requests use an anonymous actor and record the target account separately. Impersonation and administrative session revocations identify the operator and target organization. Table-row mutations record summaries and counts without copying row contents.

apps/docs/content/docs/search/sim-links.mdx

@@ -15,7 +15,7 @@ Names ignore case and punctuation, so `sim/Team-Handbook` and `sim/teamhandbook`
 
 ## Open links from the address bar
 
-[Install Sim for Chrome](https://chromewebstore.google.com/detail/sim/oanlcahddodnjpdoopcpjlcageejjpmg) in your work profile, then type `go/handbook` or `sim/handbook` in the address bar. Both work as soon as it's installed.
+[Install Sim for Chrome](https://chromewebstore.google.com/detail/sim/oanlcahddodnjpdoopcpjlcageejjpmg) in your work profile, then type `go/handbook` or `sim/handbook` in the address bar. Both work once you're signed in to Sim.
 
 For suggestions, type `sim`, press **Space**, and enter part of a name. Matching links appear with the most opened first. Unlisted links still open by name.
 
@@ -31,7 +31,7 @@ Turning shortcuts off keeps site access. To remove it, open Chrome’s **Extensi
 
 ### Roll out to your team
 
-Administrators can [force-install Sim for Chrome](https://support.google.com/chrome/a/answer/6306504) for an organizational unit. Shortcuts start working once each person signs in to Sim and Chrome next starts.
+Administrators can [force-install Sim for Chrome](https://support.google.com/chrome/a/answer/6306504) for an organizational unit. Shortcuts start working once each person signs in through the extension, or the next time Chrome starts after they've signed in.
 
 ### If another tool uses go/ or sim
 

apps/extension/DESIGN.md

@@ -60,16 +60,20 @@ other workspace resources or browser-control tools.
 ## Permission and lifetime rules
 
 - Required browser capabilities: side panel, scripting, active tab, context menus,
-  and short-lived session storage for selection handoff. Required host access is
+  short-lived session storage for selection handoff, and local storage for preferences. Required host access is
   limited to the configured Sim origin and to `http(s)://sim/*` and `http(s)://go/*`, which exist
   only so one static redirect rule can send top-level navigations to those hosts to the link resolver.
 - HTTP(S) page access is one optional browser-wide grant, requested from a direct
   user gesture. The browser owns revocation and restrictions. Approval enables
   capture across sites; switching tabs alone does not extract content.
-- No history, bookmarks, cookie API, debugger, native messaging, external messaging,
+- No history permission, bookmarks, cookie API, debugger, native messaging, external messaging,
   or arbitrary remote code execution. The only network interception is the static
   `sim/` and `go/` redirect rule above, plus opt-in search recovery.
-- The only background network request is the `sim` address-bar keyword: after
+- Background network requests are limited to two. Once a week at browser start, and after
+  signing in to the panel, the worker asks the Sim origin whether links are on for the session;
+  if so, it opens `http://go/` and `http://sim/` in background tabs that close themselves, which
+  teaches Chrome's address bar these hosts and adds entries to browser history. The other is the
+  `sim` address-bar keyword: after
   `sim` and Space, the text typed before the first `/` or `?` is sent to the
   configured Sim origin with the signed-in session to suggest matching Sim links,
   unless it contains a space (a search) or is longer than a link name can be. Page

apps/extension/README.md

@@ -38,13 +38,13 @@ SIM_EXTENSION_DEV=1 SIM_EXTENSION_ORIGIN=http://localhost:3000 bun run --cwd app
 - Extraction stops at 50,000 text characters, 150,000 serialized UTF-8 bytes, 15,000 visited nodes, or 150ms. The composer exposes truncation.
 - Attached pages share a 150,000-character and 450,000-byte snapshot budget per message, within the general 100-context ceiling. Shorter pages can share the available budget without a separate page-count restriction.
 - Source URLs omit credentials, query parameters, and fragments. Human-readable text can still contain sensitive information; it is the user-selected material they review and send into their conversation.
-- Snapshots stay in memory until handed to Sim and acknowledged or expired after 30 seconds. Extension storage contains only a short-lived intent with a tab/document identity and a SHA-256 URL digest, never raw URLs, captured text, or credentials. Closing a tab or navigating invalidates its pending intent. Sim applies its normal conversation retention once a message is sent.
-- No browser history, bookmarks, cookie access, debugger access, remote extension JavaScript, arbitrary network proxy, or background content collection is requested. Incognito use is disabled.
+- Snapshots stay in memory until handed to Sim and acknowledged or expired after 30 seconds. For captures, extension storage contains only a short-lived intent with a tab/document identity and a SHA-256 URL digest, never raw URLs, captured text, or credentials. Closing a tab or navigating invalidates its pending intent. Sim applies its normal conversation retention once a message is sent.
+- No browser history permission, bookmarks, cookie access, debugger access, remote extension JavaScript, arbitrary network proxy, or background content collection is requested. Incognito use is disabled.
 - The iframe bridge checks both the exact configured origin and the exact frame, then validates versioned messages. The hosted composer may request only page capture, selection capture, the native page-access and browser-shortcut dialogs, or the browser's fixed microphone settings page. Requests require the current conversation nonce and Chrome transient user activation; arbitrary URLs, tabs, script execution, and network operations are never accepted. Permission grants still require a click in the extension-owned page-access control and browser approval. Shortcut settings are advertised separately so older installed shells keep working without the new action.
 - Captures and queued toolbar intents are scoped to the receiving conversation. Changing conversation, workspace, or account discards an unfinished handoff. Captured attachments remain explicit snapshots when the source tab changes.
 - The complete hosted document, including portaled source dialogs and menus, is blocked from session replay. Clipboard writing and microphone capture are delegated only to the configured Sim origin; clipboard reading and camera access are not delegated. Voice input starts only after the user clicks the microphone and the browser grants permission. The shared Sim voice service streams microphone audio to ElevenLabs for transcription into the editable draft. Stop ends capture while allowing the final transcript to arrive; Send and conversation changes cancel unfinished transcription. There is no tab-audio capture or background recording.
 
-With **Reference current page** enabled, a composer Send requests a single fresh snapshot for that conversation. The extension stores only the preference in local storage. A tab change does not read any content. Explicit snapshots take precedence; access denial, navigation and timeouts keep the draft unsent. **Allow across websites** works even when Chrome hides the active address; no address entry is required. The grant covers HTTP and HTTPS sites across tabs until the user revokes or restricts it in browser settings. Uploaded screenshot files stay in the hosted app’s normal attachment flow.
+With **Reference current page** enabled, a composer Send requests a single fresh snapshot for that conversation. Local storage holds only this preference, search recovery choices, and when the short hosts were last visited. A tab change does not read any content. Explicit snapshots take precedence; access denial, navigation and timeouts keep the draft unsent. **Allow across websites** works even when Chrome hides the active address; no address entry is required. The grant covers HTTP and HTTPS sites across tabs until the user revokes or restricts it in browser settings. Uploaded screenshot files stay in the hosted app’s normal attachment flow.
 
 ## Verification
 
@@ -56,7 +56,7 @@ bun run --cwd apps/extension build
 
 The E2E suite uses real Chromium, the packaged extension, and a disposable HTTP app fixture. It pregrants only the fixture page origin in a temporary package to exercise extraction without automating the browser's permission dialog. It checks HttpOnly session-cookie transport, origin/frame spoofing, sensitive-field exclusion, source URL minimization, selected excerpts, UTF-8 limits, stale-document handoffs, denied host access, and absence of page bytes in extension storage. The cookie check uses a fixture, not Better Auth or SSO. JSON results and a screenshot are written beside the caller-supplied report path. The E2E suite builds into a temporary directory and leaves shipping `dist` untouched.
 
-Release verification must additionally exercise the native toolbar and shortcut, Chrome's real grant/revoke prompt, sign-in/SSO and expiry against the running Sim app, side-panel closing/reopening, workspace changes, narrow widths, and the real Mothership streaming response. The fixture suite does not establish those integrations. The design document records launch scope and release criteria.
+Release verification must additionally exercise typing `go/<name>` in Chrome's real address bar on a clean profile (the e2e proves the visits, not the address bar), the native toolbar and shortcut, Chrome's real grant/revoke prompt, sign-in/SSO and expiry against the running Sim app, side-panel closing/reopening, workspace changes, narrow widths, and the real Mothership streaming response. The fixture suite does not establish those integrations. The design document records launch scope and release criteria.
 
 The authenticated acceptance suite runs against a real local app, Better Auth, and a disposable Postgres database whose name contains `test`. Enable `KNOWLEDGE_MEMBER_ACCESS`, `CREDENTIAL_GROUPS`, `ACCESS_CONTROL_ENABLED`, and `NEXT_PUBLIC_ACCESS_CONTROL_ENABLED` on that app to exercise restricted organization members:
 

apps/extension/scripts/test-e2e.ts

@@ -17,6 +17,7 @@ import {
 import { SecretReveal } from '@sim/emcn'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
+import { sleep } from '@sim/utils/helpers'
 import { generateId } from '@sim/utils/id'
 import { renderToStaticMarkup } from 'react-dom/server'
 
@@ -226,6 +227,7 @@ try {
     )
   await check('Installing signed out leaves go/ and sim/ as ordinary searches', async () => {
     await expect.poll(() => linksChecks, { timeout: 30_000 }).toBeGreaterThan(0)
+    await sleep(2_000)
     assert((await shortHostsVisitedAt()) === 'undefined', 'Visits were recorded while signed out')
     assert(shortHostVisits === 0, 'Short hosts were visited while signed out')
   })
@@ -526,6 +528,14 @@ try {
   await check(
     'A signed-in panel visits each short host in tabs that close themselves',
     async () => {
+      await app.evaluate(
+        (targetOrigin) =>
+          parent.postMessage(
+            { channel: 'sim-extension', version: 1, type: 'signed-in' },
+            targetOrigin
+          ),
+        `chrome-extension://${extensionId}`
+      )
       await expect.poll(shortHostsVisitedAt, { timeout: 30_000 }).toBe('number')
       assert(shortHostVisits === SIM_LINK_HOSTS.length, `Visited ${shortHostVisits} short hosts`)
       const leftBehind = await worker.evaluate(

apps/extension/src/extension-dialog.tsx

@@ -0,0 +1,40 @@
+import type { ReactNode } from 'react'
+
+interface ExtensionDialogProps {
+  labelledBy: string
+  describedBy?: string
+  onClose: () => void
+  children: ReactNode
+}
+
+/** Chrome owns modality so the dialog works without the scroll-lock stylesheet the CSP blocks. */
+function showDialog(dialog: HTMLDialogElement | null) {
+  if (!dialog) return
+  dialog.showModal()
+  return () => dialog.close()
+}
+
+export function ExtensionDialog({
+  labelledBy,
+  describedBy,
+  onClose,
+  children,
+}: ExtensionDialogProps) {
+  return (
+    <dialog
+      ref={showDialog}
+      aria-labelledby={labelledBy}
+      aria-describedby={describedBy}
+      className='m-auto max-h-[85vh] w-[90vw] max-w-[440px] overflow-visible border-0 bg-transparent p-0 text-inherit backdrop:bg-black/10 backdrop:backdrop-blur-[2px]'
+      onCancel={(event) => {
+        event.preventDefault()
+        onClose()
+      }}
+      onClick={(event) => {
+        if (event.target === event.currentTarget) onClose()
+      }}
+    >
+      {children}
+    </dialog>
+  )
+}

apps/extension/src/omnibox.ts

@@ -15,6 +15,7 @@ const SUGGEST_DELAY_MS = 220
 const SEARCH_HINT = 'Find a link in Sim'
 // Chrome persists this template and substitutes the input when rendering the default row.
 const OPEN_LINK_HINT = 'Open <match>%s</match> in Sim'
+const SEARCH_LINKS_HINT = 'Find <match>%s</match> in Sim'
 
 /** A Sim link as suggested: its name, and what it shows beside the name. */
 interface SuggestedLink {
@@ -140,9 +141,10 @@ export function registerSimLinkOmnibox() {
   chrome.omnibox.onInputChanged.addListener((text, suggest) => {
     pending?.abort()
     const { name, rest } = readTyped(text)
-    showHint(name || rest ? OPEN_LINK_HINT : SEARCH_HINT)
     // A name can't hold a space, so `sim card prices` is a search, not a link: ask Sim nothing.
-    if (/\s/.test(name) || name.length > SIM_LINK_NAME_MAX_LENGTH) {
+    const phrase = /\s/.test(name)
+    showHint(phrase ? SEARCH_LINKS_HINT : name || rest ? OPEN_LINK_HINT : SEARCH_HINT)
+    if (phrase || name.length > SIM_LINK_NAME_MAX_LENGTH) {
       suggest([])
       return
     }

apps/extension/src/search-recovery-dialog.tsx

@@ -9,6 +9,7 @@ import {
   ChipModalSurface,
   Switch,
 } from '@sim/emcn'
+import { ExtensionDialog } from '@/extension-dialog'
 import {
   readSearchRecovery,
   SEARCH_RECOVERY_KEY,
@@ -23,13 +24,6 @@ interface SearchRecoveryDialogProps {
 type SearchProvider = (typeof SEARCH_RECOVERY_PROVIDERS)[number]
 type SearchRecovery = Awaited<ReturnType<typeof readSearchRecovery>>
 
-/** Chrome owns modality so the dialog works without an injected scroll-lock stylesheet. */
-function mountSearchRecoveryDialog(dialog: HTMLDialogElement | null) {
-  if (!dialog) return
-  dialog.showModal()
-  return () => dialog.close()
-}
-
 export function SearchRecoveryDialog({ onClose }: SearchRecoveryDialogProps) {
   const generation = useRef(0)
   const [settings, setSettings] = useState<SearchRecovery>()
@@ -93,26 +87,19 @@ export function SearchRecoveryDialog({ onClose }: SearchRecoveryDialogProps) {
   }
 
   return (
-    <dialog
-      ref={mountSearchRecoveryDialog}
-      aria-labelledby='search-recovery-title'
-      aria-describedby='search-recovery-description'
-      className='m-auto max-h-[85vh] w-[90vw] max-w-[440px] overflow-visible border-0 bg-transparent p-0 text-inherit backdrop:bg-black/10 backdrop:backdrop-blur-[2px]'
-      onCancel={(event) => {
-        event.preventDefault()
-        onClose()
-      }}
-      onClick={(event) => {
-        if (event.target === event.currentTarget) onClose()
-      }}
+    <ExtensionDialog
+      labelledBy='search-recovery-title'
+      describedBy='search-recovery-description'
+      onClose={onClose}
     >
       <ChipModalSurface className='max-h-[85vh]'>
         <ChipModalHeader onClose={onClose}>
           <span id='search-recovery-title'>Browser shortcuts</span>
         </ChipModalHeader>
         <ChipModalBody>
           <ChipModalDescription id='search-recovery-description'>
-            Open go/ and sim/ links from search. Other searches stay unchanged.
+            If Chrome searches for a go/ or sim/ link instead of opening it, open the link anyway.
+            Other searches stay unchanged.
           </ChipModalDescription>
           {SEARCH_RECOVERY_PROVIDERS.map((provider) => (
             <ChipModalField
@@ -151,6 +138,6 @@ export function SearchRecoveryDialog({ onClose }: SearchRecoveryDialogProps) {
         </ChipModalBody>
         <ChipModalFooter defaultAction='dismiss' cancelLabel='Done' onCancel={onClose} />
       </ChipModalSurface>
-    </dialog>
+    </ExtensionDialog>
   )
 }

apps/extension/src/search-recovery.ts

@@ -40,6 +40,7 @@ export const SEARCH_RECOVERY_PROVIDERS = [
   },
 ] as const
 
+type SearchRecoveryProvider = (typeof SEARCH_RECOVERY_PROVIDERS)[number]
 type ProviderId = (typeof SEARCH_RECOVERY_PROVIDERS)[number]['id']
 type RecoveryPreferences = Record<ProviderId, boolean>
 const logger = createLogger('BrowserShortcutRecovery')
@@ -122,20 +123,16 @@ export async function setSearchRecovery(provider: ProviderId, enabled: boolean):
 /** Reconcile persisted, permission-bound rules at startup, on revocation, and after an explicit choice. */
 export function registerSearchRecovery() {
   let pending = Promise.resolve()
-  const update = (choice?: { provider: ProviderId; enabled: boolean }) => {
+  const update = (choice?: { provider: SearchRecoveryProvider; enabled: boolean }) => {
     const operation = pending.then(async () => {
       const preferences = await readSearchRecovery()
       if (choice) {
-        const provider = SEARCH_RECOVERY_PROVIDERS.find(
-          (provider) => provider.id === choice.provider
-        )
-        if (!provider) throw new Error('Unknown shortcut provider.')
         if (
           choice.enabled &&
-          !(await chrome.permissions.contains({ origins: [...provider.origins] }))
+          !(await chrome.permissions.contains({ origins: [...choice.provider.origins] }))
         )
           throw new Error('Search site access has not been granted.')
-        preferences[choice.provider] = choice.enabled
+        preferences[choice.provider.id] = choice.enabled
       }
       const rules = SEARCH_RECOVERY_PROVIDERS.filter(
         (provider) => preferences[provider.id]
@@ -190,7 +187,7 @@ export function registerSearchRecovery() {
       return
     const provider = SEARCH_RECOVERY_PROVIDERS.find((provider) => provider.id === message.provider)
     if (!provider) return
-    void update({ provider: provider.id, enabled: message.enabled }).then(
+    void update({ provider, enabled: message.enabled }).then(
       () => respond({ ok: true }),
       () => respond({ ok: false })
     )