feat(desktop): re-integrate SSRF guard + hardening onto rewritten dev

Re-applies the browser-agent SSRF guard and hardening onto dev's evolved
desktop files (dev rewrote session/driver/handoff/index and split out
errors.ts/keyboard.ts):

- session.ts: agent-partition onBeforeRequest is the SSRF choke point —
  DNS-resolving check (fail-closed) for document navigations, synchronous
  literal-IP backstop for subresources.
- driver.ts: browser_navigate/browser_open_tab validate via checkAgentUrl for a
  clean model error; also adopt shared sleep/getErrorMessage and drop the local
  reimplementations + banner separators.
- index.ts: local-only crashReporter (native minidumps, no upload) + CSP
  fallback wired into the app session.
- window.ts: record the crash-dump dir on renderer_gone.
- config.ts: drop the local LOCAL_HOSTNAMES set for the shared isLoopbackHostname
  (also removes the dead bare '::1').
- cdp.ts: per-WebContents callbacks so a background tab's events reach its own
  driver.
- updater.ts: the manual check now surfaces network/manifest failures instead of
  silently swallowing them.
- README: correct the App Sandbox / security-scoped-bookmark note.
- electron-mock: webRequest.onBeforeRequest + crashReporter stubs.
- api-validation: annotate dev's validated-envelope double-cast; bump the
  route-count baseline 964→965 for dev's already-merged route (ratchets stay
  tight; non-Zod and double-cast at baseline).

Skipped as moot (dev already did them independently): launcher isVisible removal,
decideStartRoute param drop, local-filesystem clear() removal.

Author: waleedlatif1

apps/desktop/README.md

@@ -138,7 +138,7 @@ Good fits for the bridge: OS notifications + dock badge on workflow completion,
 The main Copilot agent can inspect a user-selected local directory in the desktop app through request-local client tools (`local_mount_directory`, `local_list_mounts`, `local_list`, `local_glob`, `local_read`, `local_grep`, `local_stat`, and `local_forget_mount`). This capability is:
 
 - **Explicit and read-only:** the native folder picker creates the grant; there are no write/delete/execute operations.
-- **Remembered securely:** grants are encrypted in Electron's private app data with OS-backed `safeStorage` and restored with the same opaque URI after a normal app restart. Sandboxed macOS builds also retain the security-scoped bookmark. There is no plaintext fallback: when secure storage is unavailable, the returned mount has `remembered: false` and lasts only for that app session.
+- **Remembered securely:** grants are encrypted in Electron's private app data with OS-backed `safeStorage` and restored with the same opaque URI after a normal app restart. (A security-scoped bookmark is stored alongside each grant, but it is a no-op in the current Developer ID build — only the macOS App Sandbox consumes it — and is kept purely for forward-compatibility should a sandboxed/MAS build ever ship.) There is no plaintext fallback: when secure storage is unavailable, the returned mount has `remembered: false` and lasts only for that app session.
 - **Revocable:** `local_forget_mount` removes one grant. All grants are removed on explicit sign-out or server-origin change so another Sim account or server cannot inherit them. Normal app quit only releases active OS handles and keeps the encrypted grants.
 - **Opaque:** renderer and model see only `localfs://<mount-id>/...` URIs. Electron resolves every URI, checks lexical and realpath containment, and refuses symlink escapes.
 - **Desktop-only:** the web app advertises these request-local tools only when `window.simDesktop.localFilesystem` is present. They are available directly to the main agent and are not added to subagent allowlists.

apps/desktop/src/main/browser-agent/cdp.ts

@@ -28,7 +28,9 @@ export interface CdpCallbacks {
   onFileChooser: () => void
 }
 
-let callbacks: CdpCallbacks | null = null
+/** Per-tab callbacks, so a background tab's events reach ITS driver, not the
+ * most-recently-instrumented tab's. */
+const callbacksByContents = new WeakMap<WebContents, CdpCallbacks>()
 /** Contents already instrumented (attach survives for the tab's lifetime). */
 const instrumented = new WeakSet<WebContents>()
 
@@ -42,7 +44,7 @@ async function send<T = unknown>(
 
 /** Idempotently instruments a tab's WebContents. */
 export async function ensureInstrumented(contents: WebContents, cb: CdpCallbacks): Promise<void> {
-  callbacks = cb
+  callbacksByContents.set(contents, cb)
   if (instrumented.has(contents) && contents.debugger.isAttached()) return
 
   if (!contents.debugger.isAttached()) {
@@ -76,6 +78,7 @@ function handleDebuggerEvent(
   method: string,
   params: Record<string, unknown>
 ): void {
+  const callbacks = callbacksByContents.get(contents)
   if (method === 'Page.javascriptDialogOpening') {
     const type = String(params.type ?? 'dialog')
     const message = String(params.message ?? '').slice(0, 500)

apps/desktop/src/main/browser-agent/driver.ts

@@ -22,6 +22,8 @@ import type {
   BrowserToolName,
 } from '@sim/browser-protocol'
 import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { sleep } from '@sim/utils/helpers'
 import type { BrowserWindow, WebContents } from 'electron'
 import * as cdp from '@/main/browser-agent/cdp'
 import { ToolError } from '@/main/browser-agent/errors'
@@ -41,6 +43,7 @@ import {
   typeIntoElement,
 } from '@/main/browser-agent/page-functions'
 import * as session from '@/main/browser-agent/session'
+import { checkAgentUrl } from '@/main/browser-agent/url-guard'
 
 const logger = createLogger('BrowserAgentDriver')
 
@@ -126,7 +129,7 @@ function instrumentTab(contents: WebContents): void {
     .then(() => cdp.setColorScheme(contents, session.getBrowserTheme()))
     .catch((error) => {
       logger.warn('CDP instrumentation failed', {
-        error: error instanceof Error ? error.message : String(error),
+        error: getErrorMessage(error),
       })
     })
   for (const event of [
@@ -160,7 +163,7 @@ export function initDriver(
       onTabThemeChanged: (contents, theme) => {
         void cdp.setColorScheme(contents, theme).catch((error) => {
           logger.warn('Could not update browser tab theme', {
-            error: error instanceof Error ? error.message : String(error),
+            error: getErrorMessage(error),
           })
         })
       },
@@ -174,10 +177,6 @@ export function initDriver(
   )
 }
 
-function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms))
-}
-
 function str(params: Record<string, unknown>, key: string): string | undefined {
   const value = params[key]
   return typeof value === 'string' && value.length > 0 ? value : undefined
@@ -205,10 +204,6 @@ function requireNum(params: Record<string, unknown>, key: string): number {
   return value
 }
 
-// ---------------------------------------------------------------------------
-// Page-function execution
-// ---------------------------------------------------------------------------
-
 /**
  * Serializes a self-contained page function and executes it in the page's
  * main world with JSON-encoded arguments (Electron's executeJavaScript has no
@@ -223,7 +218,7 @@ async function execInPage<Args extends unknown[], Result>(
   try {
     return (await contents.executeJavaScript(expression, true)) as Result
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error)
+    const message = getErrorMessage(error)
     throw new ToolError(
       `Cannot act on this page (${message}). Browser-internal pages cannot be automated — ` +
         'navigate to a regular website first.'
@@ -263,10 +258,6 @@ function unwrapPageResult(result: unknown): unknown {
   return result
 }
 
-// ---------------------------------------------------------------------------
-// Navigation
-// ---------------------------------------------------------------------------
-
 function waitForLoadComplete(contents: WebContents, timeoutMs: number): Promise<void> {
   return new Promise((resolve) => {
     let settled = false
@@ -301,10 +292,6 @@ async function activeElementState(contents: WebContents): Promise<Record<string,
   return typeof state === 'object' && state !== null ? (state as Record<string, unknown>) : {}
 }
 
-// ---------------------------------------------------------------------------
-// Takeover
-// ---------------------------------------------------------------------------
-
 /**
  * Hands control to the user: the page is already natively interactive in the
  * panel, and the chat's takeover tool row shows the reason with a Done chip.
@@ -338,19 +325,16 @@ async function runTakeover(): Promise<unknown> {
   }
 }
 
-// ---------------------------------------------------------------------------
-// Tool implementations
-// ---------------------------------------------------------------------------
-
 async function executeToolInner(
   tool: BrowserToolName,
   params: Record<string, unknown>
 ): Promise<unknown> {
   switch (tool) {
     case 'browser_navigate': {
       const url = requireStr(params, 'url')
-      if (!/^https?:\/\//i.test(url)) {
-        throw new ToolError('URL must be absolute and start with http:// or https://')
+      const guard = await checkAgentUrl(url)
+      if (!guard.ok) {
+        throw new ToolError(guard.error ?? 'That address was blocked.')
       }
       const tab = session.ensureTab()
       const contents = tab.view.webContents
@@ -378,12 +362,15 @@ async function executeToolInner(
 
     case 'browser_open_tab': {
       const url = str(params, 'url')
+      if (url) {
+        const guard = await checkAgentUrl(url)
+        if (!guard.ok) {
+          throw new ToolError(guard.error ?? 'That address was blocked.')
+        }
+      }
       const tab = session.addTab()
       const contents = tab.view.webContents
       if (url) {
-        if (!/^https?:\/\//i.test(url)) {
-          throw new ToolError('URL must be absolute and start with http:// or https://')
-        }
         void contents.loadURL(url).catch(() => {})
         const result = await navigationResult(contents)
         return { tabId: tab.id, ...result }
@@ -580,10 +567,6 @@ function withNotices(result: unknown): unknown {
   return { value: result, notices }
 }
 
-// ---------------------------------------------------------------------------
-// Public entry points
-// ---------------------------------------------------------------------------
-
 /** One real browser can only do one thing at a time — serialize tool calls. */
 let toolQueue: Promise<unknown> = Promise.resolve()
 
@@ -623,7 +606,7 @@ export async function executeTool(
   try {
     return { ok: true, result: await settled }
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error)
+    const message = getErrorMessage(error)
     logger.warn('Browser tool failed', { tool, error: message })
     return { ok: false, error: message }
   }

apps/desktop/src/main/browser-agent/session.ts

@@ -12,6 +12,7 @@ import { getErrorMessage } from '@sim/utils/errors'
 import type { BrowserWindow, Input, Session, WebContents } from 'electron'
 import { nativeTheme, WebContentsView } from 'electron'
 import { registerAgentWebContents } from '@/main/browser-agent/registry'
+import { checkAgentUrl, isBlockedRequestUrl } from '@/main/browser-agent/url-guard'
 
 const logger = createLogger('BrowserAgentSession')
 
@@ -127,6 +128,31 @@ function configureAgentPartition(ses: Session): void {
   partitionConfigured = true
   ses.setPermissionRequestHandler((_wc, _permission, callback) => callback(false))
   ses.setPermissionCheckHandler(() => false)
+  // SSRF choke point for the agent partition. Document navigations (top-level +
+  // iframes) get the full DNS-resolving check — the one seam every navigation
+  // passes through, including page-initiated ones the driver never sees (server
+  // redirects, link clicks, location.href, meta-refresh) — so an internal host
+  // can't slip in that way. Subresources take the cheap synchronous literal-IP
+  // backstop instead of a DNS lookup per asset.
+  ses.webRequest.onBeforeRequest((details, callback) => {
+    if (details.resourceType === 'mainFrame' || details.resourceType === 'subFrame') {
+      void checkAgentUrl(details.url)
+        .then((guard) => {
+          if (!guard.ok) {
+            logger.warn('Blocked agent document navigation to a private host')
+          }
+          callback({ cancel: !guard.ok })
+        })
+        .catch((error) => {
+          // Fail closed: an unexpected rejection must cancel, never leave the
+          // request suspended with no callback.
+          logger.error('Agent SSRF check failed; cancelling request', { error })
+          callback({ cancel: true })
+        })
+      return
+    }
+    callback({ cancel: isBlockedRequestUrl(details.url) })
+  })
   ses.on('will-download', (_event, item) => {
     const filename = item.getFilename()
     const url = item.getURL()

apps/desktop/src/main/config.ts

@@ -1,14 +1,12 @@
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
 import { dirname } from 'node:path'
 import { createLogger } from '@sim/logger'
+import { isLoopbackHostname } from '@sim/security/ssrf'
 
 const logger = createLogger('DesktopConfig')
 
 export const DEFAULT_ORIGIN = 'https://sim.ai'
 
-/** Loopback hostnames that may use plain HTTP (dev + self-host testing). */
-export const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '[::1]', '::1'])
-
 export interface WindowBounds {
   x?: number
   y?: number
@@ -57,7 +55,7 @@ export function validateOriginInput(raw: string): OriginValidation {
   if (url.protocol === 'https:') {
     return { ok: true, origin: url.origin }
   }
-  if (url.protocol === 'http:' && LOCAL_HOSTNAMES.has(url.hostname)) {
+  if (url.protocol === 'http:' && isLoopbackHostname(url.hostname)) {
     return { ok: true, origin: url.origin }
   }
   return { ok: false, error: 'Server URL must use HTTPS (HTTP is allowed for localhost only)' }

apps/desktop/src/main/index.ts

@@ -1,11 +1,12 @@
 import { join } from 'node:path'
 import { createLogger } from '@sim/logger'
 import type { BrowserWindow } from 'electron'
-import { app, net, session } from 'electron'
+import { app, crashReporter, net, session } from 'electron'
 import { initDriver as initBrowserAgentDriver } from '@/main/browser-agent/driver'
 import { setPanelBounds as setBrowserAgentPanelBounds } from '@/main/browser-agent/session'
 import { createConfigStore, partitionForOrigin } from '@/main/config'
 import { attachContextMenu } from '@/main/context-menu'
+import { attachCspFallback } from '@/main/csp'
 import { createDesktopSettingsService } from '@/main/desktop-settings'
 import { attachDownloadHandling } from '@/main/downloads'
 import { createAuthFlow, createConnectFlow, createHandoffManager } from '@/main/handoff'
@@ -127,6 +128,7 @@ function main(): void {
     }
     configuredPartitions.add(partition)
     setupPermissionHandlers(ses, appOrigin)
+    attachCspFallback(ses, appOrigin)
     attachDownloadHandling(ses, events)
     attachTelemetryPolicy(ses, config.get('blockThirdPartyAnalytics') ?? true)
     ses.setSpellCheckerLanguages(['en-US'])
@@ -388,6 +390,13 @@ if (process.env.SIM_DESKTOP_USER_DATA) {
   app.setPath('userData', process.env.SIM_DESKTOP_USER_DATA)
 }
 
+// Capture native minidumps for main/renderer/GPU crashes. Local-only: there is
+// no crash-ingest backend, so nothing is uploaded — the dumps land under
+// userData/Crashpad and the event log records where. Must start before the app
+// is ready so Crashpad initializes first. Set after userData so dumps follow
+// any test/instance override.
+crashReporter.start({ uploadToServer: false, compress: true })
+
 const gotSingleInstanceLock = app.requestSingleInstanceLock()
 if (!gotSingleInstanceLock) {
   app.quit()

apps/desktop/src/main/updater.ts

@@ -221,11 +221,22 @@ export function checkForUpdatesInteractive(deps: UpdaterDeps): void {
   deps.events.record('update_check', { manual: true })
   try {
     const { autoUpdater } = require('electron-updater') as typeof import('electron-updater')
-    void autoUpdater.checkForUpdates().then((result) => {
-      if (!result || result.updateInfo.version === app.getVersion()) {
-        void dialog.showMessageBox({ type: 'info', message: 'Sim is up to date' })
-      }
-    })
+    void autoUpdater
+      .checkForUpdates()
+      .then((result) => {
+        if (!result || result.updateInfo.version === app.getVersion()) {
+          void dialog.showMessageBox({ type: 'info', message: 'Sim is up to date' })
+        }
+      })
+      .catch((error) => {
+        // Surface network/manifest/cert failures instead of silently swallowing.
+        logger.error('Manual update check failed', { error })
+        void dialog.showMessageBox({
+          type: 'error',
+          message: 'Could not check for updates',
+          detail: 'Something went wrong reaching the update server. Try again later.',
+        })
+      })
   } catch (error) {
     logger.error('Manual update check failed', { error })
   }

apps/desktop/src/main/window.ts

@@ -264,7 +264,11 @@ export function createMainWindow(deps: CreateMainWindowDeps): BrowserWindow {
     if (details.reason === 'clean-exit') {
       return
     }
-    deps.events.record('renderer_gone', { reason: details.reason, exitCode: details.exitCode })
+    deps.events.record('renderer_gone', {
+      reason: details.reason,
+      exitCode: details.exitCode,
+      crashDumpDir: app.getPath('crashDumps'),
+    })
     setTimeout(() => {
       if (win.isDestroyed()) {
         return

apps/desktop/src/test/electron-mock.ts

@@ -30,6 +30,10 @@ export const app = {
   dock: { downloadFinished: vi.fn() },
 }
 
+export const crashReporter = {
+  start: vi.fn(),
+}
+
 export const shell = {
   openExternal: vi.fn(() => Promise.resolve()),
   showItemInFolder: vi.fn(),
@@ -177,6 +181,7 @@ function createWebContentsMock() {
     session: {
       setPermissionRequestHandler: vi.fn(),
       setPermissionCheckHandler: vi.fn(),
+      webRequest: { onBeforeRequest: vi.fn() },
       on: vi.fn(),
     },
   }

apps/sim/app/desktop/launcher/use-launcher-chat.ts

@@ -226,6 +226,7 @@ export function useLauncherChat() {
               logger.info('Skipping unrecognized stream event', { reason: parsed.reason })
               return undefined
             }
+            // double-cast-allowed: parsePersistedStreamEventEnvelope validates the envelope structurally; EnvelopeLike is the local narrowed view for this read-only consumer
             const event = parsed.event as unknown as EnvelopeLike
 
             if (event.type === 'session' && event.payload.kind === 'chat') {