Merge branch 'feat/desktop-windows-support' of https://github.com/simstudioai/sim into feat/desktop-windows-v2

Author: waleedlatif1

.github/workflows/ci.yml

@@ -1330,9 +1330,11 @@ jobs:
   # Windows desktop builds are signed with Azure Artifact Signing over GitHub
   # OIDC. Gated like the macOS build: until the Azure identity and signing
   # variables exist, the Windows build skips with a warning, and nothing is
-  # ever published unsigned. Windows jobs are separate workflow calls that no
-  # other job needs, so a Windows failure never blocks a macOS release; the
-  # update feed treats a release without latest.yml as having no Windows build.
+  # ever published unsigned. Windows jobs are separate workflow calls, and a
+  # Windows failure never blocks a macOS release; the update feed treats a
+  # release without latest.yml as having no Windows build. The prerelease path
+  # still waits for them: prerelease-publish needs prerelease-build-windows, so
+  # it starts only once that job finishes, whatever its result.
   desktop-signing-windows:
     name: desktop-signing-windows
     runs-on: *runner-2vcpu

.github/workflows/desktop-release.yml

@@ -600,8 +600,9 @@ jobs:
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
-      # forceCodeSigning fails the build if any file that should be signed is
-      # not. publisherName also lands in resources/app-update.yml, where the
+      # forceCodeSigning fails the build when no signing configuration is
+      # found (electron-builder 26 checks for one, not each file's signature),
+      # so a missing Azure setup cannot produce an unsigned installer. publisherName also lands in resources/app-update.yml, where the
       # installed app's updater checks each downloaded installer against it.
       - name: Package and sign
         if: ${{ inputs.sign }}

apps/desktop/README.md

@@ -200,7 +200,7 @@ The native `read_local_file` and `import_local_files` tools also accept absolute
 
 Approved native reads can return bounded text, directory listings, images, or PDFs to the chat. Approved imports transfer file bytes to Workspace Files. Electron revalidates every pending call before using a grant, including remembered grants, checks canonical containment and grant identity throughout the operation, and opens files with no-follow and descriptor identity checks. On macOS and Linux, a native module opens each path component relative to the verified grant descriptor, and directory enumeration uses `fdopendir` on the verified descriptor, so replacing a parent path cannot redirect the open or the listing. Listings scan at most 1,001 entries and return up to 1,000 sorted names with an explicit truncation flag; the cap bounds both memory and filesystem work, rather than promising the globally first 1,000 names in an arbitrarily large directory. Imports reject truncated listings. A model or hosted renderer cannot answer the local consent dialog. These permissions govern the native file tools; the separately enabled terminal still runs with the user's OS privileges.
 
-On Windows, Node cannot open a path relative to a directory handle, so the same tools use checked Node fs opens instead (`src/main/win32-native-files.ts`). Paths are validated lexically first: only drive paths and `~\` paths are accepted, and reserved device names, alternate data streams, and trailing dots or spaces are refused. Then Electron checks that the granted folder still has its recorded identity, resolves the path and refuses it unless it is already canonical beneath the granted folder (so any symlink or junction in it, even one pointing back inside, is refused), and opens it only when the opened handle has the identity the path had just before the open; after the open it checks the path and the granted folder again. A directory listing must leave the path naming the opened handle. Listings report symlinks and junctions as links and never follow them, under the same caps as macOS. These checks narrow, but cannot eliminate, a race by a process already running as the user that swaps a path component between a check and the open. The model itself cannot create links or junctions: the tools are read-only. OneDrive Files-On-Demand placeholders are downloaded when they are read or imported. UNC and other network paths, including a drive letter mapped to a share, are refused in this release.
+On Windows, Node cannot open a path relative to a directory handle, so the same tools use checked Node fs opens instead (`src/main/win32-native-files.ts`). Paths are validated lexically first: only drive paths and `~\` paths are accepted, and reserved device names, alternate data streams, and trailing dots or spaces are refused. Then Electron checks that the granted folder still has its recorded identity, resolves the path and refuses it unless it is already canonical beneath the granted folder (so any symlink or junction in it, even one pointing back inside, is refused), and opens it only when the opened handle has the identity the path had just before the open; after the open it checks the path and the granted folder again. A directory listing must leave the path naming the opened handle. Listings report symlinks and junctions as links and never follow them, under the same caps as macOS. These checks narrow, but cannot eliminate, a race by a process already running as the user that swaps a path component between a check and the open: unlike macOS's `openat(O_NOFOLLOW)` walk, the open follows a swapped-in junction or symlink (the identity check then refuses any handle that is not the checked file, but a symlink to a share has already been contacted). The model itself cannot create links or junctions: the tools are read-only. OneDrive Files-On-Demand placeholders are downloaded when they are read or imported. UNC and other network paths, including a drive letter mapped to a share, are refused in this release, at authorization before any consent dialog; a symlink to a share inside a requested path is found by walking the path with `lstat` and refused before it is followed (`src/main/local-realpath.ts`).
 
 ## Windows
 
@@ -209,9 +209,9 @@ The Windows build is a one-click, per-user NSIS installer (`Sim-<version>-x64.ex
 - Local: `bun run package:win` (installer) or `bun run package:win:dir` (unpacked app in `release/win-unpacked/`), on Windows. `scripts/build-native.ts` skips the macOS/Linux native modules there, and `scripts/ensure-pty-prebuilds.ts` fetches the `win32-x64` ConPTY prebuild. `install:local` and `package:share` are macOS-only.
 - Channel isolation: one-click installs derive their install directory and updater cache from the package **name**, not `productName`, so CI passes `-c.extraMetadata.name=<slug>` (`sim`, `sim-staging`, `sim-dev`, `sim-local`) beside `-c.productName`/`-c.appId`. `-c.appId` must match the AppUserModelID the app sets at runtime, or toasts and taskbar pins split. Local builds without the slug install as the package name.
 - Icons: `build/icon*.ico` (16–256 px) are committed, generated from the per-channel `static/dock-icon*.png` by `bun run scripts/generate-windows-icons.ts` (needs the workspace's hoisted `sharp`); `scripts/build.ts` copies the channel's one to the ignored `build/generated-icon.ico`.
-- Signing: Azure Artifact Signing through `win.azureSignOptions`, authenticated by GitHub OIDC (`azure/login`); nothing in `electron-builder.yml` or the workflow names the account. `signExts: [".node"]` also signs the node-pty addons, and `-c.forceCodeSigning=true` fails the build on anything unsigned. `azureSignOptions.publisherName` is written into `resources/app-update.yml`; without it electron-updater **skips** signature verification of downloaded installers, so CI asserts it is present, and it must equal the certificate's subject CN exactly. Windows ASAR integrity is embedded in the exe by electron-builder, so the fuse policy carries over unchanged.
+- Signing: Azure Artifact Signing through `win.azureSignOptions`, authenticated by GitHub OIDC (`azure/login`); nothing in `electron-builder.yml` or the workflow names the account. `signExts: [".node"]` also signs the node-pty addons, and `-c.forceCodeSigning=true` fails the build when no signing configuration is found (electron-builder 26 checks for the configuration, not each file's signature). `azureSignOptions.publisherName` is written into `resources/app-update.yml`; without it electron-updater **skips** signature verification of downloaded installers, so CI asserts it is present, and it must equal the certificate's subject CN exactly. Windows ASAR integrity is embedded in the exe by electron-builder, so the fuse policy carries over unchanged.
 - Updates: the NSIS updater requests `latest.yml` from the same `/api/desktop/update` feed. `ready` is reached when electron-updater's own `update-downloaded` fires (after the publisher check); there is no native staging step. Restart runs the installer silently and relaunches; as on macOS it asks first only when it would interrupt running work (see Terminal below for what counts on Windows), and a required update never asks. Builds without a packaged `app-update.yml` fall back to the manual-download pipeline. Deltas use `.exe.blockmap`.
-- Publication: Windows publishes independently of macOS. `desktop-signing-windows` probes the Azure configuration and skips with a warning until it exists; unsigned Windows builds are never published. No job waits on the Windows calls, so a Windows failure never blocks the macOS release, and the feed treats a release without `latest.yml` as having no Windows build (Windows shells keep the newest release that has one). `latest.yml` is uploaded last.
+- Publication: Windows publishes independently of macOS. `desktop-signing-windows` probes the Azure configuration and skips with a warning until it exists; unsigned Windows builds are never published. A Windows failure never blocks the macOS release, though the prerelease path waits for it to finish (`prerelease-publish` needs `prerelease-build-windows`), and the feed treats a release without `latest.yml` as having no Windows build (Windows shells keep the newest release that has one). `latest.yml` is uploaded last.
 - SmartScreen: a new signing identity starts without download reputation, so early installers can show "Windows protected your PC" until reputation builds. Keep the same certificate profile across releases.
 - Terminal: runs PowerShell 7 (`pwsh.exe`) when it is on `Path`, else Windows PowerShell 5.1, else cmd, which has no shell integration, so the agent cannot run commands in it. `SHELL` set to a Windows path (`C:\Program Files\Git\bin\bash.exe`) selects Git Bash; its init file reads `/etc/profile` as a login shell would (for the MSYS `PATH`) and reports the cwd through `cygpath -w`. PowerShell starts with `-NoProfile -NoExit -EncodedCommand`: the script emits the startup marker, loads the user's profiles in PowerShell's order under their own execution policy, then wraps `prompt` and PSReadLine's `PSConsoleHostReadLine` to emit the OSC 633 markers (no PSReadLine, no integration). Windows has no process groups, so Stop sends Ctrl-C, then `taskkill /T /F` to each process the shell started since the command was typed, found among its descendants because a launcher can sit between the pty and the real shell; a process started earlier, such as a background server, is left running. An update restart asks first while an integrated shell is running a command, or, in cmd, while any process the shell started is still running. tmux and terminal themes are macOS and Linux only. `src/main/terminal/windows-shells.test.ts` drives PowerShell 7, Windows PowerShell 5.1 and Git Bash through ConPTY on the Windows CI leg.
 - Native local-file tools: ship with the checks described in [Local filesystem access](#local-filesystem-access).

apps/desktop/electron-builder.yml

@@ -109,8 +109,9 @@ win:
     - target: nsis
       arch: [x64]
   icon: build/generated-icon.ico
-  # .exe files are always signed; also sign the native addons (node-pty) so
-  # every binary Sim loads carries the publisher's Authenticode signature.
+  # .exe files are always signed; this also signs the native addons (node-pty).
+  # DLLs are not in signExts, so conpty.dll and Electron's own DLLs ship as
+  # their upstream builds left them, not with Sim's signature.
   signExts: [".node"]
   files:
     - "!**/node_modules/@lydell/node-pty-darwin-*/**"

apps/desktop/src/main/browser-credentials/vault.ts

@@ -14,8 +14,9 @@ import { normalizeOrigin, normalizeUsername } from '@/main/browser-credentials/o
  * The encrypted credential store.
  *
  * The whole record set is encrypted as one blob with Electron `safeStorage`
- * (Keychain on macOS, DPAPI on Windows), written atomically with restrictive
- * permissions. There is no plaintext fallback: when OS-backed encryption is unavailable the vault
+ * (Keychain on macOS, DPAPI on Windows) and written atomically. On macOS the file is owner-only
+ * (0600); Windows ignores POSIX modes, so there the protection is DPAPI's per-user key plus the
+ * ACL on the user's profile folder. There is no plaintext fallback: when OS-backed encryption is unavailable the vault
  * reports itself unavailable and refuses to store anything, because a password
  * file Sim cannot encrypt is worse than a feature the user does not get.
  *

apps/desktop/src/main/downloads.test.ts

@@ -42,6 +42,13 @@ describe('sanitizeFilename', () => {
     expect(sanitized).not.toContain('/')
     expect(sanitized.startsWith('.')).toBe(false)
   })
+
+  it('keeps a long reserved Windows device name within the length cap once prefixed', () => {
+    const sanitized = sanitizeFilename(`con.${'a'.repeat(300)}`, 'win32')
+
+    expect(sanitized.startsWith('_con.')).toBe(true)
+    expect(sanitized.length).toBeLessThanOrEqual(200)
+  })
 })
 
 describe('uniqueDownloadPath', () => {

apps/desktop/src/main/downloads.ts

@@ -41,7 +41,11 @@ export function sanitizeFilename(
     .replace(/^\.+/, '')
     .trim()
     .slice(0, MAX_FILENAME_LENGTH)
-  return platform === 'win32' ? toWin32SafeFileName(cleaned) : cleaned
+  if (platform !== 'win32') return cleaned
+  const safe = toWin32SafeFileName(cleaned)
+  return safe.length > MAX_FILENAME_LENGTH
+    ? toWin32SafeFileName(cleaned.slice(0, MAX_FILENAME_LENGTH - 1))
+    : safe
 }
 
 /**

apps/desktop/src/main/local-file-permissions.ts

@@ -1,11 +1,12 @@
-import { lstat, realpath, stat } from 'node:fs/promises'
+import { lstat, stat } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path'
 import { isDesktopScopeId } from '@sim/desktop-bridge'
 import type { BrowserWindow } from 'electron'
 import { showShellDialog } from '@/main/dialogs'
 import type { LocalFileAuthorization } from '@/main/local-files'
 import type { LocalFileAccess, LocalFilesystemService } from '@/main/local-filesystem'
+import { localRealpath } from '@/main/local-realpath'
 import { openNativeFile } from '@/main/native-directory'
 import { resolveWin32NativePath } from '@/main/win32-path'
 
@@ -27,8 +28,9 @@ interface PendingFolderDecision {
 }
 
 /**
- * Lexically resolves a model-supplied path. Runs before any filesystem call,
- * which on Windows is what keeps a UNC path from reaching the network.
+ * Lexically resolves a model-supplied path without touching the filesystem. On
+ * Windows it refuses a path that is itself a share; a link inside the path is
+ * left to {@link localRealpath}, which callers resolve it with.
  */
 export function nativePath(
   value: unknown,
@@ -39,7 +41,7 @@ export function nativePath(
     throw new Error('A native absolute path or ~/ path is required.')
   if (platform === 'win32') return resolveWin32NativePath(value, home())
   const path =
-    value === '~' ? homedir() : value.startsWith('~/') ? join(homedir(), value.slice(2)) : value
+    value === '~' ? home() : value.startsWith('~/') ? join(home(), value.slice(2)) : value
   if (!isAbsolute(path)) throw new Error('Use an absolute path or ~/ path.')
   return resolve(path)
 }
@@ -80,7 +82,7 @@ export class LocalFilePermissions {
           !isDesktopScopeId(authorization.args.folderId)))
     )
       throw new Error('A valid destination workspace and folder are required for imports.')
-    const path = await realpath(nativePath(authorization.args.path))
+    const path = await localRealpath(nativePath(authorization.args.path))
     if (this.fullFileAccess()) {
       return this.unrestrictedAccess(path, context)
     }
@@ -130,7 +132,7 @@ export class LocalFilePermissions {
     return this.authorizedAccess(
       {
         path,
-        resolve: realpath,
+        resolve: (requested) => localRealpath(requested),
         open: (requested, directory = false) =>
           openNativeFile(folder, relative(folder, requested), identity, directory),
       },

apps/desktop/src/main/local-files.ts

@@ -1,3 +1,4 @@
+import type { BigIntStats } from 'node:fs'
 import { lstat, stat } from 'node:fs/promises'
 import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path'
 import type {
@@ -23,8 +24,9 @@ export interface LocalFileAuthorization {
   args: Record<string, unknown>
 }
 
-function revision(info: Awaited<ReturnType<typeof stat>>): string {
-  return `${info.dev}:${info.ino}:${info.size}:${info.mtimeMs}`
+/** Bigint fields, since NTFS file IDs exceed 2^53 and would collide as numbers. */
+function revision(info: BigIntStats): string {
+  return `${info.dev}:${info.ino}:${info.size}:${info.mtimeNs}`
 }
 
 function boundedInteger(value: unknown, fallback: number, max: number): number {
@@ -183,18 +185,19 @@ async function manifest(
       )
     const canonical = await access.resolve(current)
     assertImportPath(root, canonical)
-    const info = await stat(canonical)
+    const info = await stat(canonical, { bigint: true })
+    const size = Number(info.size)
     if (!info.isDirectory() && !info.isFile())
       throw new Error(`Cannot import special filesystem entry: ${current}`)
     if (ancestors.has(canonical)) throw new Error(`Directory link cycle: ${current}`)
-    if (info.isFile() && info.size > MAX_DESKTOP_IMPORT_FILE_BYTES)
+    if (info.isFile() && size > MAX_DESKTOP_IMPORT_FILE_BYTES)
       throw new Error(
         'Desktop imports support files up to 64 MB. Use the file uploader for larger files.'
       )
     entries.push({
       relativePath: relative(path, current).split(sep).join('/'),
       kind: info.isDirectory() ? 'directory' : 'file',
-      size: info.size,
+      size,
       revision: revision(info),
     })
     if (info.isDirectory()) {
@@ -252,23 +255,24 @@ export async function executeLocalFileRequest(
     const offset = boundedInteger(request.offset, 0, Number.MAX_SAFE_INTEGER)
     const file = await access.open(canonical)
     try {
-      const info = await file.stat()
+      const info = await file.statBigint()
+      const size = Number(info.size)
       if (!info.isFile() || revision(info) !== request.revision)
         throw new Error(
           'The source file changed during import. Inspect the partial result before retrying.'
         )
-      if (offset > info.size) throw new Error('The requested offset is outside the file.')
-      const buffer = Buffer.alloc(Math.min(CHUNK_BYTES, info.size - offset))
+      if (offset > size) throw new Error('The requested offset is outside the file.')
+      const buffer = Buffer.alloc(Math.min(CHUNK_BYTES, size - offset))
       const { bytesRead } = await file.read(buffer, 0, buffer.length, offset)
-      if (revision(await file.stat()) !== request.revision)
+      if (revision(await file.statBigint()) !== request.revision)
         throw new Error('The source file changed during import.')
       await access.resolve(child)
       return {
         ok: true,
         data: {
           kind: 'chunk',
           bytes: new Uint8Array(buffer.subarray(0, bytesRead)),
-          eof: offset + bytesRead >= info.size,
+          eof: offset + bytesRead >= size,
         },
       }
     } finally {