fix(desktop): close Windows clipboard and file-name gaps in the agent…

… browser The agent's clipboard guard also refuses Blink's Shift+Insert, Ctrl+Insert, and Shift+Delete bindings off macOS, and a Cmd editing shortcut becomes Ctrl there instead of the Windows key. Staged uploads and downloads get NTFS-safe names on Windows. Password copy refuses in main as well as at the bridge, and the credential storage comments describe DPAPI and the confirmation fallback alongside Keychain and Touch ID.
waleedlatif1 · Oct 31, 2026 · Oct 31, 2026 · Oct 31, 2026 · Oct 31, 2026 · Oct 31, 2026
commit bafbdaeba9cf44d039f5ebe8660ffa4e53e3569c
diff --git a/apps/desktop/src/main/browser-agent/file-transfer.ts b/apps/desktop/src/main/browser-agent/file-transfer.ts
@@ -18,6 +18,7 @@ import { getErrorMessage } from '@sim/utils/errors'
 import { app } from 'electron'
 import { ToolError } from '@/main/browser-agent/errors'
 import type { BrowserAppSession } from '@/main/browser-agent/session'
+import { toWin32SafeFileName } from '@/main/win32-path'
 
 /** Granted local folders; the caller owns and must close each returned file handle. */
 export interface LocalFileSource {
@@ -39,12 +40,14 @@ function directoryName(value: string): string {
   return encodeURIComponent(value).replaceAll('.', '%2E')
 }
 
-/** A file name that cannot leave the staging directory. */
-function stagedFileName(name: string): string {
+/** A file name that cannot leave the staging directory, and that Windows stores as spelled. */
+function stagedFileName(name: string, platform: NodeJS.Platform = process.platform): string {
   const base = basename(name)
     .replace(/[\x00-\x1f\x7f]/g, '')
     .trim()
-  return base && base !== '.' && base !== '..' ? base.slice(0, 200) : 'upload'
+    .slice(0, 200)
+  const safe = platform === 'win32' ? toWin32SafeFileName(base) : base
+  return safe && safe !== '.' && safe !== '..' ? safe : 'upload'
 }
 
 function filenameFromDisposition(header: string | null): string | null {

diff --git a/apps/desktop/src/main/browser-agent/keyboard.test.ts b/apps/desktop/src/main/browser-agent/keyboard.test.ts
@@ -5,6 +5,7 @@ vi.mock('electron', () => import('@/test/electron-mock'))
 import { WebContentsView } from 'electron'
 import {
   buildKeyDispatchPlan,
+  comboTouchesClipboard,
   dispatchKeyCombo,
   KeyDispatchError,
   modifierKeyEvents,
@@ -101,6 +102,12 @@ describe('buildKeyDispatchPlan', () => {
     expect(linuxDown.commands).toBeUndefined()
   })
 
+  it('sends a Cmd editing shortcut as Ctrl on Windows instead of the Windows key', () => {
+    const [down] = buildKeyDispatchPlan(parseKeyCombo('Cmd+Z', 'win32'), 'win32')
+    expect(down.modifiers).toBe(2)
+    expect(down.commands).toBeUndefined()
+  })
+
   it('encodes the CDP modifier bitmask (Alt=1 Ctrl=2 Meta=4 Shift=8)', () => {
     const [down] = buildKeyDispatchPlan(parseKeyCombo('Control+Shift+K'), 'linux')
     expect(down.modifiers).toBe(2 | 8)
@@ -110,6 +117,19 @@ describe('buildKeyDispatchPlan', () => {
   })
 })
 
+describe('comboTouchesClipboard', () => {
+  it.each(['Shift+Insert', 'Control+Insert', 'Shift+Delete'])(
+    'refuses %s on Windows, where Blink binds it to paste, copy, or cut',
+    (key) => {
+      expect(comboTouchesClipboard(parseKeyCombo(key, 'win32'), 'win32')).toBe(true)
+    }
+  )
+
+  it.each(['Insert', 'Delete', 'Control+Delete'])('leaves %s alone on Windows', (key) => {
+    expect(comboTouchesClipboard(parseKeyCombo(key, 'win32'), 'win32')).toBe(false)
+  })
+})
+
 describe('modifierKeyEvents', () => {
   it('presses each chord modifier in order and releases them in reverse', () => {
     const { downs, ups } = modifierKeyEvents(parseKeyCombo('Control+Shift+Y', 'linux'), 'linux')

diff --git a/apps/desktop/src/main/browser-agent/keyboard.ts b/apps/desktop/src/main/browser-agent/keyboard.ts
@@ -251,9 +251,18 @@ function editingCommandFor(combo: ParsedCombo): string | null {
 /**
  * Whether a combo would drive the system clipboard. Checked before dispatch
  * rather than by withholding the CDP `commands` array: off macOS these are
- * Blink-native, so a key event alone still performs them.
+ * Blink-native, so a key event alone still performs them. That includes
+ * Blink's legacy bindings there: Shift+Insert pastes, Ctrl+Insert copies,
+ * and Shift+Delete cuts.
  */
-export function comboTouchesClipboard(combo: ParsedCombo): boolean {
+export function comboTouchesClipboard(
+  combo: ParsedCombo,
+  platform: NodeJS.Platform = process.platform
+): boolean {
+  if (platform !== 'darwin') {
+    if (combo.key === 'Insert' && (combo.shift || combo.ctrl)) return true
+    if (combo.key === 'Delete' && combo.shift) return true
+  }
   if (!combo.ctrl && !combo.meta) return false
   const key = combo.key.toLowerCase()
   return key === 'v' || key === 'c' || key === 'x'
@@ -265,13 +274,13 @@ export function comboTouchesClipboard(combo: ParsedCombo): boolean {
  * explicitly (same technique as Puppeteer/Playwright). The model doesn't know
  * the host OS and often says "Control+A", so on macOS Ctrl is treated as Cmd
  * for these shortcuts: both must select all, not silently no-op. On other
- * platforms Ctrl+key is handled inside Blink and needs no help.
+ * platforms Ctrl+key is handled inside Blink and needs no help, so a Cmd+A
+ * the model meant for a Mac becomes Ctrl+A there instead of the Windows key.
  */
 function normalizeComboForPlatform(combo: ParsedCombo, platform: NodeJS.Platform): ParsedCombo {
-  if (platform !== 'darwin' || !combo.ctrl || combo.meta || editingCommandFor(combo) === null) {
-    return combo
-  }
-  return { ...combo, ctrl: false, meta: true }
+  if (editingCommandFor(combo) === null || combo.ctrl === combo.meta) return combo
+  if (platform === 'darwin') return combo.ctrl ? { ...combo, ctrl: false, meta: true } : combo
+  return combo.meta ? { ...combo, ctrl: true, meta: false } : combo
 }
 
 function macEditingCommands(combo: ParsedCombo, platform: NodeJS.Platform): string[] {

diff --git a/apps/desktop/src/main/browser-credentials/index.ts b/apps/desktop/src/main/browser-credentials/index.ts
@@ -8,6 +8,7 @@ import { FillCoordinator, type FillCoordinatorDeps } from '@/main/browser-creden
 import { authorizeForSecret, revokeSecretAuthorization } from '@/main/browser-credentials/os-auth'
 import { CredentialVault } from '@/main/browser-credentials/vault'
 import { clearSites } from '@/main/browser-sites'
+import { desktopFeatures } from '@/shared/platform-features'
 
 /** How long a copied password may sit on the clipboard before Sim clears it. */
 const CLIPBOARD_CLEAR_MS = 30_000
@@ -104,8 +105,10 @@ export async function revealCredential(id: string): Promise<string | null> {
  *
  * The clipboard is only cleared if it still holds this password — overwriting
  * whatever the user copied in the meantime would be its own small betrayal.
+ * Refused where clearing cannot reach every copy (`DesktopFeatures.passwordCopy`).
  */
 export async function copyCredential(id: string): Promise<boolean> {
+  if (!desktopFeatures(process.platform).passwordCopy) return false
   const authorized = await authorizeForSecret({
     credentialId: id,
     operation: 'copy',

diff --git a/apps/desktop/src/main/browser-credentials/os-auth.ts b/apps/desktop/src/main/browser-credentials/os-auth.ts
@@ -22,9 +22,11 @@ const AUTH_GRACE_MS = 30_000
  *
  * Neither operation dominates the other, so a grant satisfies only its own.
  * `reveal` hands the plaintext to the Sim renderer; `copy` publishes it to the
- * macOS pasteboard, which every process on the machine can read, which
+ * system clipboard, which every process on the machine can read, which
  * clipboard managers persist to disk beyond the 30s `clipboard.clear()`, and
- * which Universal Clipboard syncs to the user's other devices. Ordering them
+ * which Universal Clipboard syncs to the user's other devices. (Windows keeps
+ * the same text in Clipboard History and the cloud clipboard, which is why
+ * copy is not offered there at all.) Ordering them
  * either way lets one consent authorize an exposure the prompt never described.
  */
 export type SecretOperation = 'reveal' | 'copy'
@@ -96,8 +98,8 @@ export function revokeSecretAuthorization(credentialId?: string): void {
  * renderer cannot drive or fake.
  *
  * Touch ID is used when the machine has it. Where it does not (a Mac mini
- * without a Touch ID keyboard, or a user who has not enrolled), the fallback
- * is a native modal that the main process owns. That is genuinely weaker than
+ * without a Touch ID keyboard, a user who has not enrolled, or any Windows
+ * machine), the fallback is a native modal that the main process owns. That is genuinely weaker than
  * biometric auth — it proves presence, not identity — so it is a deliberate,
  * documented trade rather than a silent one, and it still cannot be triggered
  * without a real click in the page.

diff --git a/apps/desktop/src/main/browser-credentials/vault.ts b/apps/desktop/src/main/browser-credentials/vault.ts
@@ -14,8 +14,8 @@ import { normalizeOrigin, normalizeUsername } from '@/main/browser-credentials/o
  * The encrypted credential store.
  *
  * The whole record set is encrypted as one blob with Electron `safeStorage`
- * (Keychain on macOS), written atomically with restrictive permissions. There
- * is no plaintext fallback: when OS-backed encryption is unavailable the vault
+ * (Keychain on macOS, DPAPI on Windows), written atomically with restrictive
+ * permissions. There is no plaintext fallback: when OS-backed encryption is unavailable the vault
  * reports itself unavailable and refuses to store anything, because a password
  * file Sim cannot encrypt is worse than a feature the user does not get.
  *

diff --git a/apps/desktop/src/main/browser-sites/directory.ts b/apps/desktop/src/main/browser-sites/directory.ts
@@ -17,10 +17,10 @@ import {
  * anyway. It is a name and an icon per host — never a visit log, never a URL
  * beyond the host itself.
  *
- * Encrypted with the same OS-backed key as the credential vault. The hostnames
- * in here include ones only a saved password knows about, and those live in an
- * encrypted vault today; writing them to a plaintext file beside it would
- * quietly undo that.
+ * Encrypted with the same OS-backed `safeStorage` key as the credential vault
+ * (Keychain on macOS, DPAPI on Windows). The hostnames in here include ones
+ * only a saved password knows about, and those live in an encrypted vault
+ * today; writing them to a plaintext file beside it would quietly undo that.
  */
 
 /**

diff --git a/apps/desktop/src/main/downloads.ts b/apps/desktop/src/main/downloads.ts
@@ -6,6 +6,7 @@ import type { Session } from 'electron'
 import { app } from 'electron'
 import { isAgentWebContents } from '@/main/browser-agent/registry'
 import type { EventRecorder } from '@/main/observability'
+import { toWin32SafeFileName } from '@/main/win32-path'
 
 const logger = createLogger('DesktopDownloads')
 
@@ -27,15 +28,20 @@ const MIME_EXTENSIONS: Record<string, string> = {
 
 /**
  * Strips path separators and control characters from a server- or
- * blob-suggested filename so it can never escape the chosen directory.
+ * blob-suggested filename so it can never escape the chosen directory. On
+ * Windows it also becomes a name NTFS stores exactly as spelled.
  */
-export function sanitizeFilename(name: string): string {
+export function sanitizeFilename(
+  name: string,
+  platform: NodeJS.Platform = process.platform
+): string {
   const cleaned = name
     .replace(/[/\\]/g, '_')
     .replace(/[\u0000-\u001f]/g, '')
     .replace(/^\.+/, '')
     .trim()
-  return cleaned.slice(0, MAX_FILENAME_LENGTH)
+    .slice(0, MAX_FILENAME_LENGTH)
+  return platform === 'win32' ? toWin32SafeFileName(cleaned) : cleaned
 }
 
 /**

diff --git a/apps/desktop/src/main/win32-path.test.ts b/apps/desktop/src/main/win32-path.test.ts
@@ -0,0 +1,54 @@
+import { describe, expect, it } from 'vitest'
+import { isWin32SafeSegment, toWin32SafeFileName } from '@/main/win32-path'
+
+describe('isWin32SafeSegment', () => {
+  it.each(['CON', 'con', 'Nul.txt', 'COM1', 'lpt9.log', 'CON .txt', 'COM¹'])(
+    'refuses the reserved device name %s',
+    (segment) => {
+      expect(isWin32SafeSegment(segment)).toBe(false)
+    }
+  )
+
+  it.each(['file.txt:stream', 'a<b', 'a>b', 'a"b', 'a|b', 'a?b', 'a*b', 'a\\b', 'a/b', 'a\tb'])(
+    'refuses %s, which holds a character NTFS rejects or reads as a stream',
+    (segment) => {
+      expect(isWin32SafeSegment(segment)).toBe(false)
+    }
+  )
+
+  it.each(['file.', 'file ', '...'])('refuses %s, which Windows would silently trim', (segment) => {
+    expect(isWin32SafeSegment(segment)).toBe(false)
+  })
+
+  it.each(['notes.txt', 'CONFIG', 'console.log', 'com10', '.env'])('accepts %s', (segment) => {
+    expect(isWin32SafeSegment(segment)).toBe(true)
+  })
+})
+
+describe('toWin32SafeFileName', () => {
+  it('replaces characters NTFS rejects', () => {
+    expect(toWin32SafeFileName('Q3: plan <draft>|"final"?*.pdf')).toBe(
+      'Q3_ plan _draft___final___.pdf'
+    )
+  })
+
+  it('drops the trailing dots and spaces Windows would strip', () => {
+    expect(toWin32SafeFileName('report. . ')).toBe('report')
+  })
+
+  it('keeps a reserved device stem from opening the device', () => {
+    expect(toWin32SafeFileName('nul.txt')).toBe('_nul.txt')
+    expect(toWin32SafeFileName('AUX')).toBe('_AUX')
+  })
+
+  it('leaves an ordinary name alone', () => {
+    expect(toWin32SafeFileName('Q3 plan.pdf')).toBe('Q3 plan.pdf')
+  })
+
+  it('produces a name that passes the segment check', () => {
+    for (const name of ['CON:x.', 'a*b ', 'lpt1', 'x|y.']) {
+      const safe = toWin32SafeFileName(name)
+      expect(isWin32SafeSegment(safe)).toBe(true)
+    }
+  })
+})