v0.9.39: people page, desktop agent browser sign-in and updates, mothership memory erasure, oauth refresh hardening, v2 file paths, disposable email blocking

.github/scripts/http-e2e.sh

@@ -145,6 +145,7 @@ case "$group" in
     export DB_TX_TRIPWIRE=throw
     export NEXT_PUBLIC_CHAT_DISABLED=true
     export SIM_LINKS=true
+    export PEOPLE=true
     start_app scim 3017 SCIM record-http-status
     SCIM_E2E_BASE_URL="$local_app_url" \
     SCIM_E2E_DATABASE_URL="$DATABASE_URL" \
@@ -161,6 +162,11 @@ case "$group" in
     SIM_LINKS_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
     SIM_LINKS_E2E_REPORT_PATH="$report_dir/sim-links-e2e-report.json" \
       bun run test:sim-links:e2e
+    PEOPLE_E2E_BASE_URL="$local_app_url" \
+    PEOPLE_E2E_DATABASE_URL="$DATABASE_URL" \
+    PEOPLE_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+    PEOPLE_E2E_REPORT_PATH="$report_dir/people-e2e-report.json" \
+      bun run test:people:e2e
     ;;
 
   # The search suites serve their own fixtures in-process and need no app. They share this group

.github/workflows/ci.yml

@@ -114,6 +114,7 @@ jobs:
   migrate:
     permissions:
       contents: read
+      id-token: write
     name: migrate
     needs: [checks]
     # Explicit need results instead of the implicit success(): a skipped job
@@ -133,6 +134,8 @@ jobs:
       STAGING_DATABASE_URL: ${{ secrets.STAGING_DATABASE_URL }}
       MIGRATION_DATABASE_URL: ${{ secrets.MIGRATION_DATABASE_URL }}
       STAGING_MIGRATION_DATABASE_URL: ${{ secrets.STAGING_MIGRATION_DATABASE_URL }}
+      TS_OAUTH_CLIENT_ID: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+      TS_AUDIENCE: ${{ secrets.TS_AUDIENCE }}
 
   # Same ordering for dev (schema push before the dev image lands in ECR)
   migrate-dev:
@@ -146,6 +149,8 @@ jobs:
       environment: dev
     secrets:
       DEV_DATABASE_URL: ${{ secrets.DEV_DATABASE_URL }}
+      TS_OAUTH_CLIENT_ID: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+      TS_AUDIENCE: ${{ secrets.TS_AUDIENCE }}
 
   # Dev: build immutable images alongside the schema push and Trigger upload.
   image-dev:
@@ -1166,6 +1171,9 @@ jobs:
 
   # Process docs embeddings (only when docs change, after images are promoted)
   docs:
+    permissions:
+      contents: read
+      id-token: write
     name: docs
     needs: [promote, docs-changes]
     # Explicit results: see migrate's comment.
@@ -1178,6 +1186,8 @@ jobs:
     secrets:
       DATABASE_URL: ${{ secrets.DATABASE_URL }}
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      TS_OAUTH_CLIENT_ID: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+      TS_AUDIENCE: ${{ secrets.TS_AUDIENCE }}
 
   # Create GitHub Release (only for version commits on main, after all builds complete)
   release:

.github/workflows/desktop-e2e.yml

@@ -115,6 +115,7 @@ jobs:
           PLAYWRIGHT_JSON_OUTPUT_FILE: test-results/desktop-smoke.json
           BACKGROUND_EXECUTOR_REPORT_PATH: test-results/background-executor-report.json
           TERMINAL_CANCEL_REPORT_PATH: test-results/terminal-cancel-report.json
+          CONTINUE_SIGN_IN_REPORT_PATH: test-results/continue-sign-in-report.json
 
       - name: Upload test results
         if: failure()
@@ -192,6 +193,7 @@ jobs:
         env:
           BACKGROUND_EXECUTOR_REPORT_PATH: test-results/background-executor-report.json
           TERMINAL_CANCEL_REPORT_PATH: test-results/terminal-cancel-report.json
+          CONTINUE_SIGN_IN_REPORT_PATH: test-results/continue-sign-in-report.json
 
       - name: Upload test results
         if: failure()

.github/workflows/docs-negotiation.yml

@@ -226,9 +226,16 @@ jobs:
         if: always() && steps.build.outcome == 'success'
         run: |
           mkdir -p apps/docs/test-results
+          FEEDBACK_TLS_DIR=$(mktemp -d)
+          export DOCS_FEEDBACK_TEST_CERT="$FEEDBACK_TLS_DIR/cert.pem"
+          export DOCS_FEEDBACK_TEST_KEY="$FEEDBACK_TLS_DIR/key.pem"
+          openssl req -x509 -newkey rsa:2048 -nodes -days 1 -subj '/CN=127.0.0.1' -addext 'subjectAltName=IP:127.0.0.1' -keyout "$DOCS_FEEDBACK_TEST_KEY" -out "$DOCS_FEEDBACK_TEST_CERT" 2>/dev/null
+          export NODE_EXTRA_CA_CERTS="$DOCS_FEEDBACK_TEST_CERT"
+          export DOCS_FEEDBACK_WEBHOOK_URL=https://127.0.0.1:3443/feedback
+          export DOCS_FEEDBACK_WEBHOOK_TOKEN=$(openssl rand -hex 32)
           bun run --cwd apps/docs start --port 3001 >apps/docs/test-results/docs-server.log 2>&1 &
           DOCS_SERVER_PID=$!
-          trap 'kill "$DOCS_SERVER_PID" 2>/dev/null || true' EXIT
+          trap 'kill "$DOCS_SERVER_PID" 2>/dev/null || true; rm -rf "$FEEDBACK_TLS_DIR"' EXIT
           STATUS=0
           bun run --cwd apps/docs test:negotiation:e2e || STATUS=1
           bun run --cwd apps/docs scripts/test-docs-interfaces-e2e.ts || STATUS=1

.github/workflows/docs.yml

@@ -7,6 +7,10 @@ on:
         required: false
       OPENAI_API_KEY:
         required: false
+      TS_OAUTH_CLIENT_ID:
+        required: false
+      TS_AUDIENCE:
+        required: false
   workflow_dispatch:
     inputs:
       publish:
@@ -40,6 +44,10 @@ jobs:
     concurrency:
       group: docs-search-index-production
       cancel-in-progress: false
+    permissions:
+      contents: read
+      # Tailscale workload identity federation exchanges this job's OIDC token.
+      id-token: write
 
     steps:
       - name: Record verified deployment and backup
@@ -68,6 +76,15 @@ jobs:
           provider: ${{ vars.CI_PROVIDER }}
           node-version: '24'
 
+      # Database IP restrictions admit the tailnet's app connector; see migrate.yml.
+      - name: Join the tailnet
+        if: vars.CI_DB_TAILNET == 'true'
+        uses: tailscale/github-action@d1b6cd204f8dceda5b3eaad7f1f767be390056cd # v4.2.0
+        with:
+          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+          audience: ${{ secrets.TS_AUDIENCE }}
+          tags: tag:ci
+
       - name: Process docs embeddings
         working-directory: ./apps/docs
         env:

.github/workflows/migrate.yml

@@ -18,6 +18,10 @@ on:
         required: false
       STAGING_MIGRATION_DATABASE_URL:
         required: false
+      TS_OAUTH_CLIENT_ID:
+        required: false
+      TS_AUDIENCE:
+        required: false
   workflow_dispatch:
     inputs:
       environment:
@@ -46,6 +50,10 @@ jobs:
     concurrency:
       group: migrate-${{ inputs.environment }}
       cancel-in-progress: false
+    permissions:
+      contents: read
+      # Tailscale workload identity federation exchanges this job's OIDC token.
+      id-token: write
 
     steps:
       # An environment only migrates from its own branch, so a manual dispatch
@@ -73,6 +81,18 @@ jobs:
             exit 1
           fi
 
+      # Database IP restrictions admit the tailnet's app connector, never a
+      # runner's address. The action already passes --accept-routes, which
+      # Linux nodes need to use app connector routes; repeating it in args
+      # makes `tailscale up` reject the duplicate flag.
+      - name: Join the tailnet
+        if: vars.CI_DB_TAILNET == 'true'
+        uses: tailscale/github-action@d1b6cd204f8dceda5b3eaad7f1f767be390056cd # v4.2.0
+        with:
+          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+          audience: ${{ secrets.TS_AUDIENCE }}
+          tags: tag:ci
+
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:

apps/desktop/README.md

@@ -171,6 +171,11 @@ tabs and popups select their session from the destination origin. Sign-out and a
 or server changes use the existing browser teardown. Browser views retain their own
 permission/download policy, SSRF guards, and minimal preload with no `simDesktop` API.
 
+**Continue in Chrome** (browser menu, plus a hint on known sign-in hosts) opens the active
+https tab in a chosen Chromium-family profile and **Bring session back** imports only that
+page's registrable-domain cookies from it; the rationale and gating live on
+`SimDesktopBrowserImportApi.continueSignIn` in `@sim/desktop-bridge`.
+
 Generated HTML remains inside its `allow-scripts` sandbox. The driver can inspect and
 interact with inline frames through isolated Chromium worlds, including out-of-process
 frames; it does not grant those pages access to the parent app. These shell changes

apps/desktop/build/entitlements.mac.plist

@@ -14,10 +14,5 @@
          Hardened Runtime denies the camera no matter what the user allowed. -->
     <key>com.apple.security.device.camera</key>
     <true/>
-    <!-- WebAuthn hybrid transport (passkey on the user's phone via QR) rides
-         Bluetooth proximity; without this the QR option silently never
-         completes in signed builds. -->
-    <key>com.apple.security.device.bluetooth</key>
-    <true/>
   </dict>
 </plist>

apps/desktop/e2e-durations.json

@@ -7,6 +7,7 @@
   "chat-panel.spec.ts": 31.08,
   "check-report.spec.ts": 3.78,
   "computer-use.spec.ts": 2.07,
+  "continue-sign-in.spec.ts": 5.8,
   "desktop-tools-live-sim.spec.ts": 0.0,
   "local-files.spec.ts": 27.68,
   "packaged-smoke.spec.ts": 0.0,