chore(desktop): validate rebased consent polish in isolation

Author: waleedlatif1

.github/workflows/desktop-e2e.yml

@@ -1,239 +1,34 @@
-name: desktop-e2e
-
-# Smoke coverage of the real Electron shell on desktop changes, plus a weekly
-# advisory canary against electron@latest so Chromium-cadence breakage surfaces
-# before an upgrade is attempted.
-
+name: desktop-consent-full-validation
 on:
-  pull_request:
-    paths:
-      - '.github/workflows/desktop-e2e.yml'
-      - '.github/workflows/desktop-release.yml'
-      - 'apps/desktop/**'
-      - 'apps/sim/app/_shell/desktop-update-*.tsx'
-      - 'apps/sim/app/workspace/**/home/hooks/use-mothership-resize.ts'
-      - 'apps/sim/app/workspace/**/home/hooks/use-resource-panel.ts'
-      - 'apps/sim/app/workspace/**/home/components/chat-panel-layout.tsx'
-      - 'apps/sim/stores/chat-panel/**'
-      - 'apps/sim/stores/constants.ts'
-      - 'apps/sim/lib/browser-agent/transport.ts'
-      - 'apps/sim/lib/core/utils/separator-keys.ts'
-      - 'apps/sim/scripts/fixtures/chat-panel.tsx'
-      - 'apps/sim/app/layout.tsx'
-      - 'apps/sim/hooks/use-desktop-update-state.ts'
-      - 'apps/sim/lib/desktop/**'
-      - 'apps/sim/app/desktop/connect/**'
-      - 'apps/sim/app/credential-groups/**'
-      - 'apps/sim/hooks/queries/slack-search.ts'
-      - 'apps/sim/hooks/queries/personal-search-integrations.ts'
-      - 'apps/sim/hooks/use-search-integration-connection.ts'
-      - 'apps/sim/hooks/use-github-installation-setup.ts'
-      - 'apps/sim/lib/api/contracts/desktop-source-connect.ts'
-      - 'apps/sim/scripts/fixtures/desktop-source-connect.tsx'
-      - 'apps/sim/app/workspace/**/browser-session/**'
-      - 'apps/sim/app/_styles/**'
-      - 'apps/sim/lib/postcss/**'
-      - 'apps/sim/postcss.config.mjs'
-      - 'apps/sim/public/brand/fonts/**'
-      - 'packages/emcn/**'
-      - 'packages/desktop-bridge/**'
-      - 'packages/browser-protocol/**'
-      - 'packages/terminal-protocol/**'
-      - 'packages/logger/**'
-      - 'packages/security/**'
-      - 'packages/tsconfig/**'
-      - 'packages/utils/**'
-      - 'bun.lock'
-      - 'package.json'
-  schedule:
-    - cron: '23 9 * * 1'
   workflow_dispatch:
-
 permissions:
   contents: read
-
-concurrency:
-  group: desktop-e2e-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
-  e2e:
-    name: e2e
-    if: github.event_name != 'schedule'
-    runs-on: macos-26
-    timeout-minutes: 30
+  gate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
     steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
           bun-version: 1.4.2
-
-      # Electron, electron-builder and Playwright download their binaries on every cold install. All
-      # three caches are keyed by version inside, so an older entry restored by prefix is harmless.
-      - name: Cache Electron and Playwright downloads
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
-        with:
-          path: |
-            ~/Library/Caches/electron
-            ~/Library/Caches/electron-builder
-            ~/Library/Caches/ms-playwright
-          key: desktop-downloads-${{ runner.os }}-${{ hashFiles('bun.lock') }}
-          restore-keys: desktop-downloads-${{ runner.os }}-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Bundle main and preload
-        working-directory: apps/desktop
-        run: bun run build
-
-      - name: Install system-browser fixture
-        working-directory: apps/desktop
-        run: bunx playwright install chromium
-
-      # The terminal-cancel suite drives a real tmux server; without tmux its tmux scenarios skip.
-      - name: Install tmux
-        run: brew install tmux
-
-      - name: Run Playwright _electron smoke suite
-        working-directory: apps/desktop
-        run: bunx playwright test
-        env:
-          BACKGROUND_EXECUTOR_REPORT_PATH: test-results/background-executor-report.json
-          TERMINAL_CANCEL_REPORT_PATH: test-results/terminal-cancel-report.json
-
-      - name: Upload test results
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: desktop-e2e-results-pinned
-          path: apps/desktop/test-results
-          retention-days: 7
-
-  e2e-canary:
-    name: e2e-canary
-    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-    runs-on: macos-26
-    timeout-minutes: 30
-    continue-on-error: true
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-        with:
-          persist-credentials: false
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: 1.4.2
-
-      # Electron, electron-builder and Playwright download their binaries on every cold install. All
-      # three caches are keyed by version inside, so an older entry restored by prefix is harmless.
-      - name: Cache Electron and Playwright downloads
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
-        with:
-          path: |
-            ~/Library/Caches/electron
-            ~/Library/Caches/electron-builder
-            ~/Library/Caches/ms-playwright
-          key: desktop-downloads-${{ runner.os }}-${{ hashFiles('bun.lock') }}
-          restore-keys: desktop-downloads-${{ runner.os }}-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Switch to electron@latest
-        working-directory: apps/desktop
-        run: bun add --no-save -d electron@latest
-
-      - name: Bundle main and preload
-        working-directory: apps/desktop
-        run: bun run build
-
-      - name: Install system-browser fixture
-        working-directory: apps/desktop
-        run: bunx playwright install chromium
-
-      # The terminal-cancel suite drives a real tmux server; without tmux its tmux scenarios skip.
-      - name: Install tmux
-        run: brew install tmux
-
-      - name: Run Playwright _electron smoke suite
-        working-directory: apps/desktop
-        run: bunx playwright test
-        env:
-          BACKGROUND_EXECUTOR_REPORT_PATH: test-results/background-executor-report.json
-          TERMINAL_CANCEL_REPORT_PATH: test-results/terminal-cancel-report.json
-
-      - name: Upload test results
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: desktop-e2e-results-latest
-          path: apps/desktop/test-results
-          retention-days: 7
-
-  package-smoke:
-    name: package-smoke
-    if: github.event_name != 'schedule'
-    runs-on: macos-26
-    timeout-minutes: 20
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-        with:
-          persist-credentials: false
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: 1.4.2
-
-      - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
           node-version: 22
-
-      # Electron, electron-builder and Playwright download their binaries on every cold install. All
-      # three caches are keyed by version inside, so an older entry restored by prefix is harmless.
-      - name: Cache Electron and Playwright downloads
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
-        with:
-          path: |
-            ~/Library/Caches/electron
-            ~/Library/Caches/electron-builder
-            ~/Library/Caches/ms-playwright
-          key: desktop-downloads-${{ runner.os }}-${{ hashFiles('bun.lock') }}
-          restore-keys: desktop-downloads-${{ runner.os }}-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Bundle and package unsigned
-        working-directory: apps/desktop
+      - name: Install the native search dependency
+        run: sudo apt-get update && sudo apt-get install -y ripgrep
+      - run: bun install --frozen-lockfile
+      - name: Run the complete repository test gate
         env:
-          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
-        run: |
-          bun run build
-          bunx electron-builder --mac dir --universal --publish never \
-            -c.mac.identity=- -c.mac.hardenedRuntime=false
-
-      - name: Run packaged Electron smoke suite
-        working-directory: apps/desktop
+          VITEST_MAX_WORKERS: '2'
         run: |
-          APP_BUNDLE="$(find release -maxdepth 2 -name '*.app' -print -quit)"
-          if [ -z "$APP_BUNDLE" ]; then
-            echo "::error::Packaged app bundle was not found."
-            exit 1
-          fi
-          EXECUTABLE="$(find "$APP_BUNDLE/Contents/MacOS" -maxdepth 1 -type f -perm -111 -print -quit)"
-          if [ -z "$EXECUTABLE" ]; then
-            echo "::error::Packaged app executable was not found."
-            exit 1
-          fi
-          SIM_DESKTOP_EXECUTABLE="$EXECUTABLE" bunx playwright test e2e/packaged-smoke.spec.ts
+          set -o pipefail
+          bun run test 2>&1 | tee full-test.log
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        if: always()
+        with:
+          name: desktop-consent-full-test-log
+          path: full-test.log
+          retention-days: 7

apps/desktop/e2e/browser-page-dialogs.spec.ts

@@ -433,6 +433,12 @@ createRoot(document.getElementById('root')).render(createElement(Fixture));`,
       await userInput('#draft')
       await panelAction({ action: 'reload' })
       await expect(shell.getByRole('button', { name: 'Stay', exact: true })).toBeFocused()
+      await shell.getByRole('dialog').screenshot({
+        path: test.info().outputPath('leave-page-modal.png'),
+        animations: 'allow',
+        caret: 'initial',
+      })
+      await expect(shell.getByRole('button', { name: 'Stay', exact: true })).toBeFocused()
       await shell.keyboard.press('Escape')
       await expect.poll(pageDialog).toBeNull()
       await expect

apps/desktop/e2e/executor-sim.ts

@@ -462,6 +462,7 @@ export async function launch(
   app.context().pages().forEach(leaveDialogsToDesktop)
   app.context().on('page', leaveDialogsToDesktop)
   const window = await app.firstWindow()
+  await window.waitForURL((url) => url.origin === sim.origin, { waitUntil: 'load' })
   return { app, window }
 }
 

apps/desktop/e2e/local-files.spec.ts

@@ -316,12 +316,12 @@ createRoot(document.getElementById('settings')).render(
       })
       const shown = app.waitForEvent('window')
       await permission.prompt
-        .getByRole('button', { name: 'Allow all files…', exact: true })
+        .getByRole('button', { name: 'Full file access', exact: true })
         .click({ noWaitAfter: true })
       const confirmation = await shown
       calls.expiringFullAccess = undefined
       await confirmation
-        .getByRole('button', { name: 'Allow all files', exact: true })
+        .getByRole('button', { name: 'Enable', exact: true })
         .click({ noWaitAfter: true })
       expect(await permission.result).toMatchObject({ ok: false })
       expect(
@@ -347,7 +347,7 @@ createRoot(document.getElementById('settings')).render(
       const permission = await requestPermission({ operation: 'read', toolCallId: 'fullAccess' })
       const confirmationShown = app.waitForEvent('window')
       await permission.prompt
-        .getByRole('button', { name: 'Allow all files…', exact: true })
+        .getByRole('button', { name: 'Full file access', exact: true })
         .click({ noWaitAfter: true })
       const confirmation = await confirmationShown
       await expect(confirmation.getByRole('button', { name: 'Cancel', exact: true })).toBeFocused()
@@ -365,14 +365,14 @@ createRoot(document.getElementById('settings')).render(
       ).toMatchObject({ fullFileAccess: false })
       const acceptedConfirmation = app.waitForEvent('window')
       await folderPrompt
-        .getByRole('button', { name: 'Allow all files…', exact: true })
+        .getByRole('button', { name: 'Full file access', exact: true })
         .click({ noWaitAfter: true })
       const allowAll = await acceptedConfirmation
       await allowAll.screenshot({
         path: test.info().outputPath('full-file-access-confirmation.png'),
       })
       await allowAll
-        .getByRole('button', { name: 'Allow all files', exact: true })
+        .getByRole('button', { name: 'Enable', exact: true })
         .click({ noWaitAfter: true })
       expect(await permission.result).toMatchObject({
         ok: true,
@@ -939,7 +939,10 @@ createRoot(document.getElementById('settings')).render(
         try {
           await toggle.click()
           await expect(
-            window.getByText('Could not update file access', { exact: true })
+            window.getByText(
+              'Could not save file access settings. Your previous setting may return after restarting Sim.',
+              { exact: true }
+            )
           ).toBeVisible()
           await expect(toggle).not.toBeChecked()
           expect(

apps/desktop/e2e/smoke.spec.ts

@@ -138,6 +138,7 @@ test.describe('desktop shell smoke', () => {
   test('OAuth popups share the session without inheriting the privileged preload', async () => {
     app = await launchApp(origin)
     const window = await app.firstWindow()
+    await window.waitForURL(`${origin}/home`, { waitUntil: 'load' })
     await window.evaluate(() => {
       document.cookie = 'sim-e2e-session=shared; Path=/; SameSite=Lax'
     })
@@ -319,7 +320,7 @@ test.describe('desktop shell smoke', () => {
     await window.locator('#server').click()
     const picker = await pickerPromise
 
-    expect(picker.url()).toBe('sim-shell://pages/server.html')
+    await expect(picker).toHaveURL('sim-shell://pages/server.html')
     await expect(picker.getByRole('dialog', { name: 'Sim server', exact: true })).toBeVisible()
     await expect(picker.getByLabel('Server URL')).toHaveValue('http://127.0.0.1:1')
     await expect(picker.getByLabel('Server URL')).toBeFocused()

apps/desktop/src/main/desktop-settings.ts

@@ -187,7 +187,9 @@ export function createDesktopSettingsService(
       if (!deps.config.flush()) {
         deps.config.set('fullFileAccess', false)
         deps.onFullFileAccessChanged?.(read())
-        throw new Error('Could not save file access settings')
+        throw new Error(
+          'Could not save file access settings. Your previous setting may return after restarting Sim.'
+        )
       }
       const preferences = read()
       deps.onFullFileAccessChanged?.(preferences)

apps/desktop/src/main/local-file-permissions.ts

@@ -197,7 +197,7 @@ export class LocalFilePermissions {
       buttons: [
         'Allow folder',
         "Don't allow",
-        ...(this.enableFullFileAccess ? ['Allow all files…'] : []),
+        ...(this.enableFullFileAccess ? ['Full file access'] : []),
       ],
       defaultId: 1,
       cancelId: 1,
@@ -209,10 +209,10 @@ export class LocalFilePermissions {
       if (result.response === 2 && this.enableFullFileAccess) {
         const confirmation = {
           signal,
-          title: 'Allow full file access?',
+          title: 'Enable full file access?',
           message: `Sim can read and import files from any folder on this computer across chats on ${context.origin}.`,
           detail: 'Turn this off in Settings → Desktop → Full file access.',
-          buttons: ['Allow all files', 'Cancel'],
+          buttons: ['Enable', 'Cancel'],
           defaultId: 1,
           cancelId: 1,
         }

apps/sim/app/workspace/[workspaceId]/settings/components/desktop/desktop.tsx

@@ -77,7 +77,7 @@ export function Desktop() {
   const { pending: fullFileAccessPending, mutate: setFullFileAccess } =
     useDesktopPreferenceMutation(
       async (bridge, enabled: boolean) => bridge.settings.setFullFileAccess?.(enabled),
-      'Could not update file access',
+      'Could not save file access settings. Your previous setting may return after restarting Sim.',
       setPreferences
     )