v0.9.37: search split, deps bumps, db improvements, unified integration permissions, sim links, new docs

.gitattributes

@@ -41,3 +41,6 @@ Dockerfile* text eol=lf
 *.ttf binary
 *.eot binary
 *.pdf binary
+
+apps/docs/migration/report.json linguist-generated=true
+apps/docs/migration/verification/** linguist-generated=true

.github/ci-suites.json

@@ -16,6 +16,10 @@
       "group": "desktop-inbox",
       "task": "ci:e2e-desktop-inbox"
     },
+    {
+      "group": "browser-extension",
+      "task": "ci:e2e-browser-extension"
+    },
     {
       "group": "seo",
       "task": "ci:e2e-seo"

.github/scripts/ci-plan.gql

@@ -3,7 +3,7 @@ query($base: String!, $head: String!) {
   affectedTasks(base: $base, head: $head, tasks: [
     "test", "build", "type-check", "ci:integration", "ci:desktop-live",
     "ci:e2e-scim", "ci:e2e-cli", "ci:e2e-stop-after", "ci:e2e-desktop-inbox",
-    "ci:e2e-project-files", "ci:e2e-mobile", "ci:e2e-seo"
+    "ci:e2e-browser-extension", "ci:e2e-project-files", "ci:e2e-mobile", "ci:e2e-seo"
   ]) {
     items {
       name

.github/scripts/http-e2e.sh

@@ -3,7 +3,7 @@
 # CI groups, which reuse the production build from `e2e-build`.
 # The job extracts it into apps/sim/.next before running these suites.
 #
-# Usage: http-e2e.sh <scim|cli|stop-after|desktop-inbox|project-files|mobile|seo>   (run from apps/sim)
+# Usage: http-e2e.sh <scim|cli|stop-after|desktop-inbox|browser-extension|project-files|mobile|seo>   (run from apps/sim)
 #
 # The job provides DATABASE_URL, BETTER_AUTH_SECRET and ENCRYPTION_KEY; each group sets the rest of
 # its app's environment here. Reports and server logs land in $RUNNER_TEMP/e2e.
@@ -20,7 +20,7 @@
 # telemetry flush runs detached and still writes .next/dev).
 set -euo pipefail
 
-group=${1:?usage: http-e2e.sh <scim|cli|stop-after|desktop-inbox|project-files|mobile|seo>}
+group=${1:?usage: http-e2e.sh <scim|cli|stop-after|desktop-inbox|browser-extension|project-files|mobile|seo>}
 report_dir="$RUNNER_TEMP/e2e"
 ready_timeout_seconds=600
 mkdir -p "$report_dir"
@@ -144,6 +144,7 @@ case "$group" in
     export INTERNAL_API_SECRET=scim-http-ci-local-secret-at-least-32-characters
     export DB_TX_TRIPWIRE=throw
     export NEXT_PUBLIC_CHAT_DISABLED=true
+    export SIM_LINKS=true
     start_app scim 3017 SCIM record-http-status
     SCIM_E2E_BASE_URL="$local_app_url" \
     SCIM_E2E_DATABASE_URL="$DATABASE_URL" \
@@ -155,6 +156,11 @@ case "$group" in
     VERSION_COMPARE_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
     VERSION_COMPARE_E2E_REPORT_PATH="$report_dir/version-compare-http-report.json" \
       bun run test:workflow-version-compare:e2e
+    SIM_LINKS_E2E_BASE_URL="$local_app_url" \
+    SIM_LINKS_E2E_DATABASE_URL="$DATABASE_URL" \
+    SIM_LINKS_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+    SIM_LINKS_E2E_REPORT_PATH="$report_dir/sim-links-e2e-report.json" \
+      bun run test:sim-links:e2e
     ;;
 
   # The search suites serve their own fixtures in-process and need no app. They share this group
@@ -198,11 +204,14 @@ case "$group" in
     ;;
 
   # The desktop background executor's protocol: device registration, the SSE doorbell over Redis
-  # pub/sub, presence, leased claims, Stop and isolation. The only group whose app gets Redis.
+  # pub/sub, presence, leased claims, Stop and isolation.
   desktop-inbox)
     export REDIS_URL=redis://127.0.0.1:6379
     export NEXT_PUBLIC_FORCE_HOSTED=false
     export COPILOT_TOOL_PERMISSIONS_ENABLED=true
+    export KNOWLEDGE_MEMBER_ACCESS=true CREDENTIAL_GROUPS=true ACCESS_CONTROL_ENABLED=true
+    export NEXT_PUBLIC_ACCESS_CONTROL_ENABLED=true NEXT_PUBLIC_ORGANIZATIONS_ENABLED=true
+    bunx --no-install playwright install --with-deps chromium
     export INTERNAL_API_SECRET=desktop-inbox-http-ci-local-secret-at-least-32-characters
     export DB_TX_TRIPWIRE=throw
     start_app desktop-inbox 3019 'desktop executor' record-http-status
@@ -212,6 +221,41 @@ case "$group" in
     DESKTOP_INBOX_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
     DESKTOP_INBOX_E2E_REPORT_PATH="$report_dir/desktop-inbox-http-report.json" \
       bun run test:desktop-inbox:e2e
+    ASSISTANT_ACTIONS_E2E_BASE_URL="$local_app_url" \
+    ASSISTANT_ACTIONS_E2E_DATABASE_URL="$DATABASE_URL" \
+    ASSISTANT_ACTIONS_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+    ASSISTANT_ACTIONS_E2E_REPORT_PATH="$report_dir/assistant-actions-ui-report.json" \
+      bun --no-env-file scripts/test-assistant-actions-e2e.ts
+    ORGANIZATION_SEARCH_E2E_BASE_URL="$local_app_url" \
+    ORGANIZATION_SEARCH_E2E_DATABASE_URL="$DATABASE_URL" \
+    ORGANIZATION_SEARCH_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+    ORGANIZATION_SEARCH_E2E_REPORT_PATH="$report_dir/organization-search-ui-report.json" \
+      bun --no-env-file scripts/test-organization-search-e2e.ts
+    ;;
+
+  browser-extension)
+    export REDIS_URL=redis://127.0.0.1:6379
+    export NEXT_PUBLIC_FORCE_HOSTED=false
+    export KNOWLEDGE_MEMBER_ACCESS=true CREDENTIAL_GROUPS=true ACCESS_CONTROL_ENABLED=true
+    export NEXT_PUBLIC_ACCESS_CONTROL_ENABLED=true
+    export API_ENCRYPTION_KEY="$ENCRYPTION_KEY"
+    bunx --no-install playwright install --with-deps chromium
+    extension_identity=$(bun - <<'JS'
+      import { generateKeyPairSync, createHash } from 'node:crypto'
+      const { publicKey } = generateKeyPairSync('rsa', { modulusLength: 2048 })
+      const der = publicKey.export({ type: 'spki', format: 'der' })
+      const id = [...createHash('sha256').update(der).digest('hex').slice(0, 32)]
+        .map(c => String.fromCharCode(97 + parseInt(c, 16))).join('')
+      process.stdout.write(`${der.toString('base64')}\n${id}`)
+JS
+    )
+    export SIM_EXTENSION_KEY="${extension_identity%%$'\n'*}"
+    export BROWSER_EXTENSION_IDS="${extension_identity#*$'\n'}"
+    start_app browser-extension 3007 'browser extension' record-http-status
+    EXTENSION_APP_E2E_BASE_URL="$local_app_url" \
+    EXTENSION_APP_E2E_DATABASE_URL="$DATABASE_URL" \
+    EXTENSION_APP_E2E_REPORT_PATH="$report_dir/browser-extension/report.json" \
+      bun run test:browser-extension:e2e
     ;;
 
   project-files)

.github/workflows/browser-extension.yml

@@ -0,0 +1,58 @@
+name: browser-extension
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/browser-extension.yml'
+      - 'apps/extension/**'
+      - 'packages/browser-extension-protocol/**'
+      - 'apps/sim/app/extension/**'
+      - 'apps/sim/app/workspace/**/home/**'
+      - 'apps/sim/stores/mothership-drafts/**'
+      - 'apps/sim/scripts/test-browser-extension-e2e.ts'
+      - 'apps/sim/lib/core/security/**'
+      - 'apps/sim/lib/mothership/chat/**'
+      - 'apps/sim/lib/api/contracts/mothership-chat-context.ts'
+      - 'apps/sim/proxy.ts'
+      - 'apps/sim/next.config.ts'
+      - 'apps/sim/package.json'
+      - 'packages/emcn/**'
+      - 'packages/logger/**'
+      - 'packages/utils/**'
+      - 'bun.lock'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: browser-extension-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  transport:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
+        with:
+          node-version: '24'
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.4.4
+      - run: bun install --frozen-lockfile
+      - run: bunx playwright install --with-deps chromium
+        working-directory: apps/extension
+      - run: bun run type-check && bun run build && bun run test:e2e
+        working-directory: apps/extension
+        env:
+          EXTENSION_REPORT_PATH: test-results/extension-report.json
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        if: always()
+        with:
+          name: browser-extension-results
+          path: apps/extension/test-results
+          retention-days: 7

.github/workflows/checks.yml

@@ -217,9 +217,9 @@ jobs:
           --health-interval 5s
           --health-timeout 5s
           --health-retries 10
-      # Desktop inbox and Project Files use Redis.
+      # Desktop inbox, browser extension, and Project Files use Redis.
       redis:
-        image: ${{ (matrix.group == 'desktop-inbox' || matrix.group == 'project-files') && 'redis:8.2-alpine' || '' }}
+        image: ${{ (matrix.group == 'desktop-inbox' || matrix.group == 'browser-extension' || matrix.group == 'project-files') && 'redis:8.2-alpine' || '' }}
         ports:
           - 6379:6379
         options: >-
@@ -296,7 +296,10 @@ jobs:
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: e2e-reports-${{ matrix.group }}
-          path: ${{ runner.temp }}/e2e/**/*.json
+          path: |
+            ${{ runner.temp }}/e2e/**/*.json
+            ${{ runner.temp }}/e2e/browser-extension/**/*.png
+            ${{ runner.temp }}/e2e/*-ui-report.json.artifacts/*.png
           if-no-files-found: ignore
           retention-days: 7
 
@@ -681,6 +684,9 @@ jobs:
           tar -xzf "$archive" -C "$RUNNER_TEMP" actionlint
           "$RUNNER_TEMP/actionlint" -color -shellcheck= -pyflakes=
 
+      - name: Generate documentation modules for import audits
+        run: bun run --cwd apps/docs content:generate
+
       # Every zero-argument `check:*` script, run concurrently. The list is derived in
       # scripts/run-audits.ts, which also writes the per-audit timing table to the job
       # summary and annotates failures. Audits needing a base ref stay separate below.

.github/workflows/ci.yml

@@ -287,7 +287,7 @@ jobs:
           if [ -n "$TRIGGER_BRANCH" ]; then
             TARGET_ARGS+=(--branch "$TRIGGER_BRANCH")
           fi
-          bunx trigger.dev@4.7.6 deploy "${TARGET_ARGS[@]}" --skip-promotion
+          bunx trigger.dev@4.8.2 deploy "${TARGET_ARGS[@]}" --skip-promotion
 
       - name: Validate deployment version output
         env:
@@ -638,7 +638,7 @@ jobs:
           if [ -n "$TRIGGER_BRANCH" ]; then
             TARGET_ARGS+=(--branch "$TRIGGER_BRANCH")
           fi
-          bunx trigger.dev@4.7.6 promote "$VERSION" "${TARGET_ARGS[@]}"
+          bunx trigger.dev@4.8.2 promote "$VERSION" "${TARGET_ARGS[@]}"
 
   # Production only, once the new app serves traffic: submit the library and comparison URLs this
   # push changed to IndexNow. Best effort: nothing depends on it, and a failure never fails the run.
@@ -1149,9 +1149,20 @@ jobs:
         with:
           filters: |
             docs:
-              - 'apps/docs/content/docs/**'
-              - 'apps/sim/scripts/process-docs.ts'
-              - 'apps/sim/lib/chunkers/**'
+              - 'apps/docs/content/**'
+              - 'apps/docs/components/workflow-preview/examples.ts'
+              - 'apps/docs/components/workflow-preview/block-display-workflows.ts'
+              - 'apps/docs/scripts/compile-content.ts'
+              - 'apps/docs/scripts/index-search.ts'
+              - 'apps/docs/lib/content/**'
+              - 'apps/docs/lib/search/**'
+              - 'apps/docs/lib/openapi-specs.ts'
+              - 'apps/docs/lib/urls.ts'
+              - 'apps/docs/openapi*.json'
+              - 'apps/docs/package.json'
+              - 'bun.lock'
+              - '.github/workflows/docs.yml'
+              - '.github/workflows/ci.yml'
 
   # Process docs embeddings (only when docs change, after images are promoted)
   docs: