fix session arch for desktop

Author: icecrasher321

apps/desktop/README.md

@@ -48,11 +48,12 @@ Everything is bundled by esbuild into `dist/main.cjs` + `dist/preload.cjs` — i
 - The app loads the hosted origin top-level; better-auth session cookies live in a persistent partition (`persist:sim`, per-origin for self-hosts). Email/password and verified-lenient providers (GitHub) sign in fully in-window.
 - **Google / Microsoft / SSO cannot OAuth inside an embedded browser** (`disallowed_useragent`; UA spoofing is fingerprint-defeated — do not ship it). Navigation to those hosts from an auth surface is intercepted and rerouted through the **system-browser handoff**:
   1. App starts a one-shot `127.0.0.1` loopback listener on an ephemeral port and opens `<origin>/desktop/auth?state=<random>&port=<port>` in the browser. The state is single-use, in-memory (the app is always running when the callback returns, so nothing is persisted), and constant-time compared.
-  2. `apps/sim/app/desktop/auth/page.tsx` requires a browser session (redirects through `/login?callbackUrl=…`), mints a better-auth one-time token, and **redirects straight to the loopback** (`http://127.0.0.1:<port>/auth/callback?token=…&state=…`, RFC 8252 §7.3). This is the single hand-back channel — a deterministic server redirect, no OS scheme registration, no client-side step, works identically in dev and packaged builds. Interception of loopback is mitigated the way PKCE mitigates it: the token is single-use, short-TTL, and bound to a 128-bit state the app compares in constant time. (RFC 8252's *most*-preferred callback is claimed-`https` / macOS universal links, which bind the OS to a verified app identity — a future hardening step that needs an associated-domains entitlement + `apple-app-site-association` on the origin.)
+  2. `apps/sim/app/desktop/auth/page.tsx` requires a browser session (redirects through `/login?callbackUrl=…`) and renders a **Continue** gesture gate; only that click mints a one-time token (`POST /api/desktop/auth/handoff`) and sends the browser to the loopback (`http://127.0.0.1:<port>/auth/callback?token=…&state=…`, RFC 8252 §7.3). The gate is the security boundary — state and port are attacker-choosable in a crafted link, so a bare GET must never mint. The loopback is the single hand-back channel: no OS scheme registration, works identically in dev and packaged builds. Interception of loopback is mitigated the way PKCE mitigates it: the token is single-use, short-TTL, and bound to a 128-bit state the app compares in constant time. (RFC 8252's *most*-preferred callback is claimed-`https` / macOS universal links, which bind the OS to a verified app identity — a future hardening step that needs an associated-domains entitlement + `apple-app-site-association` on the origin.)
   3. The loopback fires the callback in the main process: the app validates the state, then a renderer in the app partition POSTs the token to `/api/auth/one-time-token/verify` (same-origin ⇒ trustedOrigins/CSRF pass; better-auth sets the session cookie and burns the token) and loads `/workspace`.
+- **The app gets its own session, never the browser's.** The token is minted by `POST /api/desktop/auth/handoff` (`apps/sim/lib/auth/desktop-handoff.ts`), which creates a *new* session row for the user and points the one-time token at that. Better-auth's own `generateOneTimeToken` binds to the *calling* session, so using it directly made the app and the authorizing browser share one row: signing out of either deleted the row the other was still presenting, and — because the session cookie cache is not revalidated against the database — the survivor kept looking signed in while every database-backed session resolution failed (the socket handshake logged `Session not found` and 401-looped). A session per device is what better-auth's own device authorization grant does and what RFC 8252 assumes: sign-out, revocation, and expiry apply to one surface at a time. **Do not "simplify" this back to `generateOneTimeToken`.**
 - Integration connects are **same-window redirects** (`client.oauth2.link`), not popups. Unknown provider hosts stay in-window (lenient default); Google/Microsoft connects get a native dialog offering to finish in the browser — the browser is signed in after the login handoff, tokens land server-side, the app just refreshes.
 - The MCP OAuth popup (`mcp-oauth-*`) is allowed as a same-partition child so `window.opener.postMessage` keeps working.
-- Sign-out clears cookies/localStorage/IndexedDB/cache/service workers plus any pending handoff state. Two signals trigger it: the `/login?fromLogout=true` navigation (fast path) **and** deletion of the better-auth session cookie confirmed by a `get-session` probe (robust backstop — catches every sign-out path, not just the settings one, and rotation can't cause a false teardown). API 401s (probe-confirmed) surface a native re-auth prompt.
+- Sign-out **revokes server-side first** (`POST /api/auth/sign-out` from the app-origin renderer — a main-process `session.fetch` would be rejected by better-auth's origin check), then clears cookies/localStorage/IndexedDB/cache/service workers plus any pending handoff state. The revoke is not optional: since the app owns its own session row, clearing the partition alone would strand a live 30-day credential that nothing can revoke. Two signals trigger teardown: the `/login?fromLogout=true` navigation (fast path) **and** deletion of the better-auth session cookie confirmed by a `get-session` probe (robust backstop — catches every sign-out path, not just the settings one, and rotation can't cause a false teardown). API 401s (probe-confirmed) surface a native re-auth prompt.
 
 Deviations from the original plan doc (deliberate):
 - **One hand-back channel, not two.** The plan proposed a `sim://` deep link with a loopback fallback; that was collapsed to loopback-only. The app is always running when the callback returns (it started the loopback), so the custom scheme added complexity and a dev-only failure mode without buying anything — loopback works identically everywhere. No `sim://` scheme is registered.
@@ -77,6 +78,7 @@ A thin shell over a hosted web app unavoidably knows a few of the web app's conv
 | `navigation.ts` `mcp-oauth-*` frame name | `hooks/queries/mcp.ts` opens `mcp-oauth-${id}` | renames the popup frame | MCP popup treated as generic → opener lost, flow hangs | String contract; add a shared constant if it churns |
 | `window.ts` theme probe | `document.documentElement.classList.contains('dark')` (next-themes `attribute='class'`) | drops the `dark` class convention | pre-paint background may flash once | Cosmetic only; self-corrects on next load |
 | `handoff.ts` redeem | `POST /api/auth/one-time-token/verify` sets the cookie | better-auth changes the endpoint | handoff sign-in fails | better-auth built-in endpoint; pinned by the `better-auth` version |
+| `apps/sim/lib/auth/desktop-handoff.ts` mint | better-auth stores one-time tokens as `verification` rows keyed `one-time-token:<token>`, unhashed (`storeToken: 'plain'` default) | better-auth renames the namespace or hashes by default | every redeem fails with `Invalid token` | Single constant in one module; the covering test asserts the identifier shape. Revisit on better-auth major |
 
 Overall this is **within normal thin-wrapper coupling** — every item is either backstopped (sign-out), cosmetic (theme), or a stable library/route contract. The only one that genuinely can't self-heal without a release is the IdP host list, which is inherent to the "pin Chromium, ship a binary" model and is managed by the upgrade program.
 

apps/desktop/src/main/handoff.test.ts

@@ -25,6 +25,7 @@ function makeDeps(overrides: Partial<HandoffManagerDeps> = {}): HandoffManagerDe
     origin: () => 'https://sim.ai',
     openExternal: vi.fn(async () => true),
     events: makeEvents(),
+    currentUserId: vi.fn(async () => 'user-1'),
     ...overrides,
   }
 }
@@ -105,12 +106,17 @@ describe('createHandoffManager', () => {
     expect(badToken.status).toBe(400)
     expect(received).toHaveLength(0)
 
-    const ok = await fetch(`${base}/auth/callback?token=${VALID_TOKEN}&state=${state}`)
-    expect(ok.status).toBe(200)
+    const ok = await fetch(`${base}/auth/callback?token=${VALID_TOKEN}&state=${state}`, {
+      redirect: 'manual',
+    })
+    // Hands the browser back to a real app page rather than serving HTML from
+    // the main process, so the closing screen matches the rest of Sim.
+    expect(ok.status).toBe(302)
+    expect(ok.headers.get('location')).toBe('https://sim.ai/desktop/done?kind=auth')
     expect(received).toEqual([{ token: VALID_TOKEN, state }])
 
     await expect(
-      fetch(`${base}/auth/callback?token=${VALID_TOKEN}&state=${state}`)
+      fetch(`${base}/auth/callback?token=${VALID_TOKEN}&state=${state}`, { redirect: 'manual' })
     ).rejects.toThrow()
   })
 
@@ -135,8 +141,10 @@ describe('createHandoffManager', () => {
     expect(wrongState.status).toBe(403)
     expect(received).toHaveLength(0)
 
-    const ok = await fetch(`${base}/auth/callback?token=${VALID_TOKEN}&state=${state}`)
-    expect(ok.status).toBe(200)
+    const ok = await fetch(`${base}/auth/callback?token=${VALID_TOKEN}&state=${state}`, {
+      redirect: 'manual',
+    })
+    expect(ok.status).toBe(302)
     expect(received).toEqual([{ token: VALID_TOKEN, state }])
   })
 
@@ -212,8 +220,11 @@ describe('createHandoffManager', () => {
     expect(badError.status).toBe(400)
     expect(received).toHaveLength(0)
 
-    const ok = await fetch(`${base}/connect/callback?state=${state}&error=oauth_failed`)
-    expect(ok.status).toBe(200)
+    const ok = await fetch(`${base}/connect/callback?state=${state}&error=oauth_failed`, {
+      redirect: 'manual',
+    })
+    expect(ok.status).toBe(302)
+    expect(ok.headers.get('location')).toBe('https://sim.ai/desktop/done?kind=connect')
     expect(received).toEqual([{ state, error: 'oauth_failed' }])
     expect(manager.consume(state, 'connect')).toBe(true)
   })
@@ -229,3 +240,33 @@ describe('createHandoffManager', () => {
     expect(manager.consume(state, 'connect')).toBe(true)
   })
 })
+
+describe('connect handoff account pinning', () => {
+  it('pins the connect flow to the account the app is signed in as', async () => {
+    // The OAuth flow runs in the browser under the BROWSER's session, which is
+    // a different row from the app's — without this the credential would attach
+    // to whichever account the browser happens to be signed into.
+    const deps = makeDeps({ currentUserId: vi.fn(async () => 'desktop-user') })
+    const manager = createHandoffManager(deps, makeCallbacks())
+
+    expect(await manager.beginConnect('google-email')).toBe(true)
+
+    const landing = new URL(vi.mocked(deps.openExternal).mock.calls[0][0])
+    expect(landing.pathname).toBe('/desktop/connect')
+    expect(landing.searchParams.get('user')).toBe('desktop-user')
+    manager.clear()
+  })
+
+  it('omits the pin when the app account cannot be read', async () => {
+    // Offline or signed out: fall back to the page's own login redirect rather
+    // than blocking a connect on a failed probe.
+    const deps = makeDeps({ currentUserId: vi.fn(async () => null) })
+    const manager = createHandoffManager(deps, makeCallbacks())
+
+    expect(await manager.beginConnect('google-email')).toBe(true)
+
+    const landing = new URL(vi.mocked(deps.openExternal).mock.calls[0][0])
+    expect(landing.searchParams.has('user')).toBe(false)
+    manager.clear()
+  })
+})

apps/desktop/src/main/handoff.ts

@@ -25,13 +25,13 @@ const ERROR_SLUG_PATTERN = /^[A-Za-z0-9_-]{1,64}$/
 // stay valid.
 const HANDOFF_TTL_MS = 30 * 60 * 1000
 
-function responsePage(message: string): string {
-  return `<!doctype html>
-<html><head><meta charset="utf-8"><title>Sim</title></head>
-<body style="font-family:-apple-system,sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0">
-<p>${message}</p>
-</body></html>`
-}
+/**
+ * Where the browser lands once the loopback has taken the callback. Redirecting
+ * to a real app page — rather than serving HTML from here — keeps the closing
+ * screen on Sim's design system instead of a page hand-rolled in the main
+ * process. Purely informational: the handoff has already completed by then.
+ */
+const DONE_PATH = '/desktop/done'
 
 export type HandoffKind = 'login' | 'connect'
 
@@ -54,6 +54,11 @@ export interface HandoffManagerDeps {
   origin: () => string
   openExternal: (url: string) => Promise<boolean>
   events: EventRecorder
+  /**
+   * The account the app is signed in as, used to pin an OAuth connect to it.
+   * See {@link HandoffManager.beginConnect}.
+   */
+  currentUserId: () => Promise<string | null>
   now?: () => number
 }
 
@@ -104,12 +109,12 @@ export function createHandoffManager(
    * is one new row.
    */
   interface LoopbackRoute {
-    html: string
+    kind: HandoffKind
     parse: (url: URL) => { state: string; dispatch: () => void } | null
   }
   const routes: Record<string, LoopbackRoute> = {
     [CALLBACK_PATH]: {
-      html: responsePage('You’re signed in — return to the Sim app. You can close this tab.'),
+      kind: 'login',
       parse: (url) => {
         const token = url.searchParams.get('token') ?? ''
         const state = url.searchParams.get('state') ?? ''
@@ -120,7 +125,7 @@ export function createHandoffManager(
       },
     },
     [CONNECT_CALLBACK_PATH]: {
-      html: responsePage('Connection finished — return to the Sim app. You can close this tab.'),
+      kind: 'connect',
       parse: (url) => {
         const state = url.searchParams.get('state') ?? ''
         const error = url.searchParams.get('error')
@@ -181,7 +186,9 @@ export function createHandoffManager(
         response.writeHead(403, { 'Content-Type': 'text/plain' }).end('Forbidden')
         return
       }
-      response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' }).end(route.html)
+      const done = new URL(DONE_PATH, deps.origin())
+      done.searchParams.set('kind', route.kind === 'login' ? 'auth' : 'connect')
+      response.writeHead(302, { Location: done.toString() }).end()
       stopLoopback()
       callback.dispatch()
     })
@@ -239,13 +246,21 @@ export function createHandoffManager(
     begin() {
       return beginFlow('login', '/desktop/auth', {})
     },
-    beginConnect(providerId: string, scope: ConnectScope = {}) {
+    async beginConnect(providerId: string, scope: ConnectScope = {}) {
       if (!PROVIDER_ID_PATTERN.test(providerId)) {
         logger.warn('Rejected connect handoff for invalid providerId')
-        return Promise.resolve(false)
+        return false
       }
+      // The whole OAuth flow runs in the browser, under whatever account the
+      // browser is signed into — which is no longer guaranteed to be this app's
+      // account. Pin the flow to the app's user so a mismatch is refused instead
+      // of quietly attaching the credential to the wrong account. Omitted when
+      // unknown (offline, signed out): the page then falls back to its normal
+      // login redirect rather than blocking a connect on a failed probe.
+      const userId = await deps.currentUserId()
       return beginFlow('connect', '/desktop/connect', {
         provider: providerId,
+        ...(userId ? { user: userId } : {}),
         ...(scope.workspaceId ? { workspaceId: scope.workspaceId } : {}),
         ...(scope.credentialId ? { credentialId: scope.credentialId } : {}),
       })

apps/desktop/src/main/index.ts

@@ -42,6 +42,7 @@ import {
   createSessionLifecycleCoordinator,
   decideStartRoute,
   handleConnectIntercept,
+  readSessionUserId,
   resolveStartRoute,
 } from '@/main/session-lifecycle'
 import { attachTelemetryPolicy } from '@/main/telemetry-policy'
@@ -133,6 +134,7 @@ function main(): void {
       origin: appOrigin,
       openExternal: (url) => openExternalSafe(url, allowHttpLocalhost()),
       events,
+      currentUserId: () => readSessionUserId(ensureAppSession(), appOrigin()),
     },
     {
       onLogin: (callback) => void authFlow.handleCallback(callback),
@@ -200,6 +202,7 @@ function main(): void {
       getWindows,
       clearHandoffState: async () => {
         handoff.clear()
+        tray?.clearRecentChats()
         await localFilesystem.forgetAll()
       },
       clearBrowserProfile: clearAgentBrowserProfile,