sim-setup 1.0.2 → 1.0.3-preview.50.1

package/README.md

@@ -1,17 +1,288 @@
-# sim-setup
+# Sim Setup
 
-Set up and manage a self-hosted Sim installation.
+`sim-setup` is the installer and management tool for a self-hosted
+[Sim](https://sim.ai) deployment. Sim is a workspace for building, deploying,
+and managing AI agents and workflows.
+
+For an npm user, `sim-setup` creates a Docker Compose installation from published
+Sim images. It generates the required secrets, writes the deployment files,
+starts the containers, runs database migrations, and checks that the application
+is healthy. It does not clone the Sim repository.
+
+This package installs the Sim server. To manage workflows, tables, files, and
+other resources in a running Sim workspace, use the separate
+[`sim` CLI](https://www.npmjs.com/package/sim).
+
+## Requirements
+
+- Node.js 20 or newer
+- Docker with the Compose plugin
+- Ports `3000`, `3002`, and, by default, `5432` available
+- At least 12 GB of system memory and 20 GB of free disk for a small installation
+
+Allocate at least 8 GB of memory to Docker for reliable workflow execution.
+Docker Desktop, OrbStack, Colima, and Docker Engine are supported as long as the
+`docker` command can reach the daemon.
+
+## Install and run
+
+You normally do not need to install the package globally:
 
 ```bash
 npx sim-setup
 ```
 
-Outside a Sim source checkout, the command creates a Docker Compose installation using published
-images. Inside a Sim source checkout, use `bun run sim-setup` to expose the complete development
-and deployment wizard.
+To install it globally instead:
+
+```bash
+npm install --global sim-setup
+sim-setup
+```
+
+The examples below use `npx`; omit it if you installed the package globally.
+
+The default standalone setup creates a `sim` directory under the current
+directory:
+
+```text
+sim/
+├── .env
+├── .sim-setup.json
+└── docker-compose.prod.yml
+```
+
+Use `--dir` to choose an explicit location:
+
+```bash
+npx sim-setup --dir /srv/sim
+```
+
+When setup finishes, open [http://localhost:3000](http://localhost:3000) and
+create the first account.
+
+## What the setup wizard does
+
+The wizard:
+
+1. checks Docker, available ports, memory, and disk space
+2. creates or reuses the installation directory
+3. generates authentication, encryption, internal API, and scheduler secrets
+4. optionally connects Sim Chat and model providers
+5. writes `.env` and the managed production Compose file
+6. starts PostgreSQL, Redis, the Sim application, realtime, and scheduled jobs
+7. runs migrations and waits for the health checks to pass
+
+Choose **Quick** for sensible defaults and the fewest questions. Choose
+**Custom** to configure additional options such as object storage, email,
+sign-in providers, security settings, and self-hosted feature flags. Skip the
+prompt with:
+
+```bash
+npx sim-setup --quick
+```
+
+The wizard detects an existing installation. Re-running it lets you keep and
+check the current configuration, review and update it, or archive the current
+`.env` and build a new configuration. If setup fails partway through, fix the
+reported problem and run the same command again; completed configuration is
+preserved.
+
+## Chat and model access
+
+Sim can run without the optional Chat API key. If you skip Chat setup, the
+wizard hides the Chat module instead of leaving it enabled but unusable. Connect
+or replace the key later with:
+
+```bash
+npx sim-setup add chat
+npx sim-setup start
+```
+
+Agent blocks also need access to a model provider. Configure provider keys in a
+workspace in the Sim UI, pass supported keys such as `OPENAI_API_KEY` or
+`ANTHROPIC_API_KEY` into the setup environment, or add deployment-wide model
+configuration later:
+
+```bash
+npx sim-setup add llm
+npx sim-setup start
+```
+
+For Docker Compose installations, `add` updates `.env` but does not recreate the
+application container. Run `npx sim-setup start` afterward to apply the changed
+environment. `restart` only restarts containers with their current configuration.
+
+## Manage the installation
+
+Run commands from the installation directory or pass `--dir <path>` to target a
+specific installation.
+
+| Command | What it does |
+| --- | --- |
+| `npx sim-setup status` | Show detected installations, container state, and app health |
+| `npx sim-setup logs` | Follow the last 100 lines of Docker Compose logs |
+| `npx sim-setup start` | Start or reconcile the containers; data is kept |
+| `npx sim-setup stop` | Stop containers without removing them |
+| `npx sim-setup restart` | Restart the current containers |
+| `npx sim-setup update` | Refresh the managed Compose file, pull images, recreate services, and run migrations |
+| `npx sim-setup down` | Remove containers but keep data volumes |
+| `npx sim-setup reset` | Archive `.env`, remove containers, and delete managed data volumes |
+
+`down` and `reset` are deliberately different. Use `down` when you want to
+remove containers and bring the same installation back later. `reset` is a
+destructive fresh start and asks for confirmation before deleting data.
+
+### Check configuration
+
+`config` reports which effective configuration sources, capabilities, and OAuth
+integrations were detected. It does not print secret values:
+
+```bash
+npx sim-setup config
+```
+
+`doctor` validates environment files, required values, cross-service
+consistency, and live dependencies:
 
-To connect or replace the Chat API key without rerunning the full wizard:
+```bash
+npx sim-setup doctor
+npx sim-setup doctor --fix
+npx sim-setup doctor --json
+```
+
+Use `config` to answer “what is configured?” and `status` to answer “what is
+running and healthy?”
+
+### Install the desktop app
+
+`desktop` resolves the macOS installer from your own deployment and prints the
+server URL to enter in the app:
+
+```bash
+npx sim-setup desktop
+npx sim-setup desktop --url https://sim.example.com
+npx sim-setup desktop --no-open
+```
+
+The desktop app is not tied to sim.ai — it bakes in only a default server, and
+every Sim deployment already serves `/api/desktop/update/download` and the
+update feed installed apps poll. Install the signed build, then point it at your
+deployment with **Sim → Server…**. Nothing has to be built or signed by you.
+
+### Add or change capabilities
+
+Configure one capability without walking through the complete wizard:
 
 ```bash
+npx sim-setup add email
+npx sim-setup add storage
+npx sim-setup add sandbox
+npx sim-setup add jobs
+npx sim-setup add cache
+npx sim-setup add knowledge
+npx sim-setup add knowledge-embeddings
 npx sim-setup add chat
+npx sim-setup add llm
+npx sim-setup add integration slack
+```
+
+Run `npx sim-setup start` after changing a Docker Compose capability so the app
+container receives the new environment.
+
+## Updating
+
+Update a Docker Compose installation with:
+
+```bash
+npx sim-setup update
+npx sim-setup status
+```
+
+The update command keeps Docker volumes, applies the current managed Compose
+file, pulls the version selected by `SIM_VERSION`, and runs migrations. If
+`SIM_VERSION` is unset, the deployment tracks `latest`.
+
+For production, pin an explicit version, back up the database first, and read
+the [upgrade guide](https://docs.sim.ai/platform/self-hosting/upgrades). Docker
+Compose updates briefly interrupt the application because Compose does not
+provide rolling deployments.
+
+## Files, secrets, and data
+
+The generated `.env` contains credentials and encryption keys. It is written
+with owner-only permissions and must not be committed to source control.
+
+Back up `.env` securely outside the server before using the deployment for real
+data. In particular, `ENCRYPTION_KEY` and `API_ENCRYPTION_KEY` protect stored
+credentials and API keys. A database backup restored without the matching keys
+contains data that Sim cannot decrypt.
+
+PostgreSQL data lives in a Docker volume. These commands preserve it:
+
+- `start`
+- `stop`
+- `restart`
+- `update`
+- `down`
+
+`reset` deletes managed volumes. It archives `.env` beside the installation
+before doing so, but that local archive is not a substitute for an off-machine
+backup.
+
+The default local file-storage fallback is different: uploaded files live inside
+the application container, not in a managed volume. They can be lost when the
+container is removed or recreated, including during `down` or `update`.
+Configure object storage before keeping files you care about.
+
+## Production deployments
+
+The generated Compose installation is suitable for local evaluation and a
+single-node deployment. Before exposing it publicly, configure at least:
+
+- a public application URL and TLS reverse proxy
+- database and `.env` backups
+- durable object storage for uploaded files
+- email delivery for invitations and email-based authentication
+- OAuth applications for integrations you plan to use
+- a pinned Sim version and an upgrade procedure
+
+See the [Docker deployment guide](https://docs.sim.ai/platform/self-hosting/docker)
+and the complete [self-hosting documentation](https://docs.sim.ai/platform/self-hosting).
+
+## Working from the Sim source repository
+
+Inside a cloned Sim repository, use:
+
+```bash
+bun run sim-setup
+```
+
+The source checkout adds local development and Kubernetes modes:
+
+```bash
+bun run sim-setup --mode dev
+bun run sim-setup --mode k8s
+```
+
+Standalone npm use supports Docker Compose mode only. Development and Kubernetes
+modes need source-only files and are rejected outside a complete checkout.
+
+## Help
+
+```bash
+npx sim-setup --help
+npx sim-setup --version
 ```
+
+Further documentation:
+
+- [Self-hosting overview](https://docs.sim.ai/platform/self-hosting)
+- [Docker Compose](https://docs.sim.ai/platform/self-hosting/docker)
+- [Environment variables](https://docs.sim.ai/platform/self-hosting/environment-variables)
+- [Upgrades](https://docs.sim.ai/platform/self-hosting/upgrades)
+- [Troubleshooting](https://docs.sim.ai/platform/self-hosting/troubleshooting)
+- [Verification checklist](https://docs.sim.ai/platform/self-hosting/verify)
+
+## License
+
+Apache-2.0

package/dist/index.js

@@ -1561,7 +1561,8 @@ var init_env_capabilities = __esm(() => {
     "microsoft-dataverse",
     "microsoft-excel",
     "microsoft-teams",
-    "microsoft-planner"
+    "microsoft-planner",
+    "microsoft-word"
   ]);
 });
 
@@ -1569,7 +1570,7 @@ var init_env_capabilities = __esm(() => {
 var integrations_default;
 var init_integrations = __esm(() => {
   integrations_default = {
-    updatedAt: "2026-08-21",
+    updatedAt: "2026-08-26",
     integrations: [
       {
         type: "onepassword",
@@ -8988,11 +8989,11 @@ var init_integrations = __esm(() => {
         operations: [
           {
             name: "Find Email",
-            description: "Find a verified B2B email address from a full name and company domain or name. Uses the Enrow async finder — submits a search and polls until the result is ready. Costs 1 credit per valid email found. (https://enrow.readme.io/reference/find-single-email)"
+            description: "Find a verified B2B email address from a full name and company domain or name. Uses the Enrow async finder — submits a search and polls until the result is ready. Costs 1 credit per valid email found. (https://docs.enrow.io/api-reference/email-finder/find-single)"
           },
           {
             name: "Verify Email",
-            description: "Verify the deliverability of an email address using the Enrow async verifier. Submits a verification request and polls until the result is ready. Costs 0.25 credits per verification. (https://enrow.readme.io/reference/verify-single-email)"
+            description: "Verify the deliverability of an email address using the Enrow async verifier. Submits a verification request and polls until the result is ready. Costs 0.25 credits per verification. (https://docs.enrow.io/api-reference/email-verifier/verify-single)"
           }
         ],
         operationCount: 2,
@@ -16126,6 +16127,58 @@ var init_integrations = __esm(() => {
         integrationType: "communication",
         tags: ["messaging", "microsoft-365"]
       },
+      {
+        type: "microsoft_word",
+        slug: "microsoft-word",
+        name: "Microsoft Word",
+        description: "Create, fill, read, edit, and export Word documents",
+        longDescription: "Integrate Microsoft Word into the workflow. Create .docx documents from text, fill a formatted template by substituting its placeholders, read a document back as text, replace or append content, find and replace text across the body plus headers and footers, list and search documents in OneDrive or SharePoint, and export a document as PDF.",
+        bgColor: "#FFFFFF",
+        iconName: "MicrosoftWordIcon",
+        docsUrl: "https://docs.sim.ai/integrations/microsoft_word",
+        operations: [
+          {
+            name: "Read Document",
+            description: "Read the text content of a Microsoft Word (.docx) document stored in OneDrive or SharePoint."
+          },
+          {
+            name: "Create Document",
+            description: "Create a new Microsoft Word (.docx) document in OneDrive or SharePoint from text content. Supports Markdown headings (# ## ###), bullets (-), and inline **bold** / *italic*. An existing document with the same name is never overwritten — the new one is given a unique name instead."
+          },
+          {
+            name: "Create from Template",
+            description: "Copy an existing Microsoft Word (.docx) template to a new document and fill its placeholders. The template keeps all of its formatting, styles, headers, and footers, and is never modified. An existing document with the same name is never overwritten — the new one is given a unique name instead."
+          },
+          {
+            name: "Replace Content",
+            description: "Replace the entire contents of an existing Microsoft Word (.docx) document with new text. The previous content and its formatting are discarded — use Append to add to a document instead."
+          },
+          {
+            name: "Append Content",
+            description: "Append plain-text paragraphs to the end of an existing Microsoft Word (.docx) document, leaving the existing content and formatting intact. Fails rather than overwriting if someone else changed the document while the edit was in flight."
+          },
+          {
+            name: "Find and Replace Text",
+            description: "Find and replace text throughout a Microsoft Word (.docx) document, including its headers and footers. Use this to fill placeholders in a template document. Fails rather than overwriting if someone else changed the document while the edit was in flight."
+          },
+          {
+            name: "List Documents",
+            description: "List or search Microsoft Word (.docx) documents in OneDrive or SharePoint. Non-Word items are filtered out of the results."
+          },
+          {
+            name: "Export as PDF",
+            description: "Convert a Microsoft Word (.docx) document to PDF using Microsoft Graph and return it as a file."
+          }
+        ],
+        operationCount: 8,
+        triggers: [],
+        triggerCount: 0,
+        authType: "oauth",
+        oauthServiceId: "microsoft-word",
+        category: "tools",
+        integrationType: "documents",
+        tags: ["microsoft-365", "document-processing", "cloud"]
+      },
       {
         type: "millionverifier",
         slug: "millionverifier",
@@ -21246,6 +21299,201 @@ var init_integrations = __esm(() => {
         integrationType: "hr",
         tags: ["automation"]
       },
+      {
+        type: "semrush",
+        slug: "semrush",
+        name: "Semrush",
+        description: "Research SEO and paid search data with Semrush",
+        longDescription: "Query the Semrush SEO API for domain, subdomain, and URL traffic overviews, organic and paid keywords, ad and product listing creatives, competitor sets, keyword research, and backlink profiles. Requires a Semrush subscription with API units.",
+        bgColor: "#FFFFFF",
+        iconName: "SemrushIcon",
+        docsUrl: "https://docs.sim.ai/integrations/semrush",
+        operations: [
+          {
+            name: "Domain Overview",
+            description: "Get the Semrush rank plus organic and paid search totals for a domain in one regional database."
+          },
+          {
+            name: "Domain Overview (All Databases)",
+            description: "Get organic and paid search totals for a domain across every regional Semrush database."
+          },
+          {
+            name: "Domain Overview History",
+            description: "Get the historical trend of a domain rank plus its organic and paid search totals."
+          },
+          {
+            name: "Domain Organic Keywords",
+            description: "List the keywords a domain ranks for in Google organic search, with position, volume, and traffic share."
+          },
+          {
+            name: "Domain Paid Keywords",
+            description: "List the keywords a domain buys in Google Ads, with ad position, copy, and traffic share."
+          },
+          {
+            name: "Domain Ad Copies",
+            description: "List the unique Google Ads creatives a domain runs, with title, description, and keyword count."
+          },
+          {
+            name: "Domain Ad History",
+            description: "List a domain past Google Ads placements month by month, with the copy used each time."
+          },
+          {
+            name: "Organic Competitors",
+            description: "List the domains competing with a target domain in Google organic search results."
+          },
+          {
+            name: "Paid Competitors",
+            description: "List the domains competing with a target domain in Google paid search results."
+          },
+          {
+            name: "Domain PLA Keywords",
+            description: "List the keywords that trigger a domain product listing ads, with the promoted product and price."
+          },
+          {
+            name: "Domain PLA Copies",
+            description: "List the unique product listing ads a domain runs, with product title, price, and shop name."
+          },
+          {
+            name: "Domain vs. Domain",
+            description: "Compare up to five domains on the keywords they rank for, returning each domain position side by side."
+          },
+          {
+            name: "Subdomain Overview",
+            description: "Get the organic and paid search totals for a subdomain in one regional database."
+          },
+          {
+            name: "Subdomain Overview (All Databases)",
+            description: "Get organic and paid search totals for a subdomain across every regional Semrush database."
+          },
+          {
+            name: "Subdomain Overview History",
+            description: "Get the historical trend of a subdomain organic and paid search totals."
+          },
+          {
+            name: "Subdomain Organic Keywords",
+            description: "List the keywords a subdomain ranks for in Google organic search."
+          },
+          {
+            name: "Subdomain Paid Keywords",
+            description: "List the keywords a subdomain buys in Google Ads."
+          },
+          {
+            name: "Subdomain Ad Copies",
+            description: "List the unique Google Ads creatives a subdomain runs."
+          },
+          {
+            name: "URL Overview",
+            description: "Get the organic and paid search totals for a single URL in one regional database."
+          },
+          {
+            name: "URL Overview (All Databases)",
+            description: "Get organic and paid search totals for a single URL across every regional Semrush database."
+          },
+          {
+            name: "URL Overview History",
+            description: "Get the historical trend of a URL organic and paid search totals."
+          },
+          {
+            name: "URL Organic Keywords",
+            description: "List the keywords a single URL ranks for in Google organic search."
+          },
+          {
+            name: "URL Paid Keywords",
+            description: "List the keywords a single URL is advertised on in Google Ads, with the ad copy used."
+          },
+          {
+            name: "Keyword Overview",
+            description: "Get search volume, CPC, competition, difficulty, and intent for a single keyword."
+          },
+          {
+            name: "Keyword Overview (All Databases)",
+            description: "Get search volume, CPC, and competition for a keyword across every regional Semrush database."
+          },
+          {
+            name: "Batch Keyword Overview",
+            description: "Get search volume, CPC, competition, difficulty, and intent for up to 100 keywords at once."
+          },
+          {
+            name: "Keyword Difficulty",
+            description: "Get the Keyword Difficulty Index for up to 100 keywords at once."
+          },
+          {
+            name: "Related Keywords",
+            description: "Find keywords semantically related to a seed keyword, with volume, difficulty, and relevance."
+          },
+          {
+            name: "Broad Match Keywords",
+            description: "Find broad-match and phrase-match variations of a seed keyword, with volume and difficulty."
+          },
+          {
+            name: "Keyword Questions",
+            description: "Find question-form keywords containing a seed keyword, with volume and difficulty."
+          },
+          {
+            name: "Organic Results",
+            description: "List the domains and URLs ranking in Google organic search results for a keyword."
+          },
+          {
+            name: "Paid Results",
+            description: "List the domains and URLs advertising on a keyword in Google paid search results."
+          },
+          {
+            name: "Keyword Ad History",
+            description: "List which domains advertised on a keyword month by month, with the copy each one used."
+          },
+          {
+            name: "Winners and Losers",
+            description: "List the domains that gained or lost the most organic and paid search visibility in a database."
+          },
+          {
+            name: "Top Domains",
+            description: "List the highest-ranked domains in a regional database by Semrush rank."
+          },
+          {
+            name: "Backlinks Overview",
+            description: "Get the Authority Score and backlink profile totals for a domain, subdomain, or URL."
+          },
+          {
+            name: "Backlinks",
+            description: "List the backlinks pointing at a domain, subdomain, or URL, with source page, anchor, and authority."
+          },
+          {
+            name: "Referring Domains",
+            description: "List the domains linking to a target, with Authority Score, backlink count, and country."
+          },
+          {
+            name: "Referring IPs",
+            description: "List the IP addresses linking to a target, with the domain and backlink counts behind each one."
+          },
+          {
+            name: "Backlink TLD Distribution",
+            description: "Break a target backlink profile down by the top-level domain of its referring domains."
+          },
+          {
+            name: "Backlink Country Distribution",
+            description: "Break a target backlink profile down by the country of its referring domains."
+          },
+          {
+            name: "Backlink Anchors",
+            description: "List the anchor texts used in backlinks to a target, with domain and backlink counts."
+          },
+          {
+            name: "Indexed Pages",
+            description: "List the pages of a target that attract backlinks, with response code and link counts."
+          },
+          {
+            name: "Backlink Competitors",
+            description: "List domains with a backlink profile similar to the target, ranked by shared referring domains."
+          }
+        ],
+        operationCount: 44,
+        triggers: [],
+        triggerCount: 0,
+        authType: "api-key",
+        category: "tools",
+        integrationType: "analytics",
+        tags: ["seo", "marketing", "data-analytics"]
+      },
       {
         type: "sendblue",
         slug: "sendblue",
@@ -21989,7 +22237,7 @@ var init_integrations = __esm(() => {
         tags: ["enrichment", "sales-engagement"]
       },
       {
-        type: "slack",
+        type: "slack_v2",
         slug: "slack",
         name: "Slack",
         description: "Send, update, delete messages, manage views and modals, add or remove reactions, manage canvases, get channel info and user presence in Slack",
@@ -22170,9 +22418,9 @@ var init_integrations = __esm(() => {
         operationCount: 42,
         triggers: [
           {
-            id: "slack_webhook",
-            name: "Slack Webhook",
-            description: "Trigger workflow from Slack events like mentions, messages, and reactions"
+            id: "slack_oauth",
+            name: "Slack",
+            description: "Trigger from Slack events (mentions, messages, reactions)"
           }
         ],
         triggerCount: 1,
@@ -27115,7 +27363,6 @@ var DEPLOYMENT_REQUIREMENT_BY_OAUTH_SERVICE_ID, SERVICE_ACCOUNT_METADATA_BY_OAUT
 var init_service_account_metadata = __esm(() => {
   init_service_account_providers_generated();
   DEPLOYMENT_REQUIREMENT_BY_OAUTH_SERVICE_ID = {
-    slack: "preview-gated",
     trello: "oauth-client"
   };
   SERVICE_ACCOUNT_METADATA_BY_OAUTH_SERVICE_ID = buildServiceAccountMetadata();
@@ -30843,6 +31090,7 @@ var init_twins = __esm(() => {
     { server: "ORGANIZATIONS_ENABLED", client: "NEXT_PUBLIC_ORGANIZATIONS_ENABLED" },
     { server: "WHITELABELING_ENABLED", client: "NEXT_PUBLIC_WHITELABELING_ENABLED" },
     { server: "AUDIT_LOGS_ENABLED", client: "NEXT_PUBLIC_AUDIT_LOGS_ENABLED" },
+    { server: "CUSTOM_BLOCKS_ENABLED", client: "NEXT_PUBLIC_CUSTOM_BLOCKS_ENABLED" },
     { server: "DATA_RETENTION_ENABLED", client: "NEXT_PUBLIC_DATA_RETENTION_ENABLED" },
     { server: "SESSION_POLICIES_ENABLED", client: "NEXT_PUBLIC_SESSION_POLICIES_ENABLED" },
     { server: "DATA_DRAINS_ENABLED", client: "NEXT_PUBLIC_DATA_DRAINS_ENABLED" },
@@ -30853,7 +31101,7 @@ var init_twins = __esm(() => {
     { server: "SSO_ENABLED", client: "NEXT_PUBLIC_SSO_ENABLED" },
     { server: "EMAIL_PASSWORD_SIGNUP_ENABLED", client: "NEXT_PUBLIC_EMAIL_PASSWORD_SIGNUP_ENABLED" },
     { server: "E2B_ENABLED", client: "NEXT_PUBLIC_E2B_ENABLED" },
-    { server: "DEPLOY_AS_BLOCK", client: "NEXT_PUBLIC_CUSTOM_BLOCKS_ENABLED" }
+    { server: "SLACK_EXTENDED_SCOPES", client: "NEXT_PUBLIC_SLACK_EXTENDED_SCOPES" }
   ];
   SELF_HOST_UNLOCKS = [
     {
@@ -30868,17 +31116,13 @@ var init_twins = __esm(() => {
     },
     { server: "ORGANIZATIONS_ENABLED", label: "Organizations", hint: "multi-workspace orgs" },
     { server: "AUDIT_LOGS_ENABLED", label: "Audit logs", hint: "" },
+    { server: "CUSTOM_BLOCKS_ENABLED", label: "Custom blocks", hint: "reusable org-wide blocks" },
     { server: "DATA_RETENTION_ENABLED", label: "Data retention", hint: "deletes expired data" },
     { server: "SESSION_POLICIES_ENABLED", label: "Session policies", hint: "session lifetime caps" },
     { server: "DATA_DRAINS_ENABLED", label: "Data drains", hint: "export streams" },
     { server: "FORKING_ENABLED", label: "Workflow forking", hint: "" },
     { server: "INBOX_ENABLED", label: "Inbox", hint: "" },
-    { server: "WHITELABELING_ENABLED", label: "Whitelabeling", hint: "custom branding" },
-    {
-      server: "DEPLOY_AS_BLOCK",
-      label: "Deploy as block",
-      hint: "publish workflows as reusable blocks"
-    }
+    { server: "WHITELABELING_ENABLED", label: "Whitelabeling", hint: "custom branding" }
   ];
   LOGIN_PROVIDERS = [
     { id: "google", label: "Google", idKey: "GOOGLE_CLIENT_ID", secretKey: "GOOGLE_CLIENT_SECRET" },
@@ -31249,14 +31493,6 @@ function checkCoherence(ctx) {
       });
     }
   }
-  if (isTruthy(sim.vars.get("PII_GRANULAR_REDACTION")) && !isTruthy(sim.vars.get("PII_REDACTION"))) {
-    findings.push({
-      group: "coherence",
-      status: "warn",
-      message: "PII_GRANULAR_REDACTION is on but PII_REDACTION is off — the granular flag is inert without it",
-      fix: "set PII_REDACTION=true or remove PII_GRANULAR_REDACTION"
-    });
-  }
   if (Boolean(sim.vars.get("TURNSTILE_SECRET_KEY")) !== Boolean(sim.vars.get("NEXT_PUBLIC_TURNSTILE_SITE_KEY"))) {
     findings.push({
       group: "coherence",
@@ -35870,6 +36106,178 @@ var init_feature_setup = __esm(() => {
   init_theme();
 });
 
+// src/urls.ts
+var APP_URL = "http://localhost:3000", APP_SIGNUP_URL;
+var init_urls = __esm(() => {
+  APP_SIGNUP_URL = `${APP_URL}/signup`;
+});
+
+// src/desktop.ts
+var exports_desktop = {};
+__export(exports_desktop, {
+  sanitizeForTerminal: () => sanitizeForTerminal,
+  runDesktop: () => runDesktop,
+  resolveDeploymentUrl: () => resolveDeploymentUrl,
+  probeDownload: () => probeDownload,
+  describeProbe: () => describeProbe
+});
+function deploymentKey(value) {
+  try {
+    return new URL(value).origin.toLowerCase();
+  } catch {
+    return value;
+  }
+}
+function sanitizeForTerminal(value) {
+  const printable = value.replace(/\p{C}/gu, "").replace(/\p{Z}/gu, " ").replace(/ {2,}/g, " ").trim();
+  return truncate(printable, MAX_INSTALLER_NAME);
+}
+function resolveDeploymentUrl(sources, override) {
+  const discovered = sources.flatMap((source) => {
+    const value = source.values?.get(APP_URL_KEY)?.trim();
+    return value ? [{ label: source.label ?? "configuration", value }] : [];
+  });
+  const byDeployment = new Map;
+  for (const { value } of discovered) {
+    byDeployment.set(deploymentKey(value), value);
+  }
+  if (!override && byDeployment.size > 1) {
+    throw new SetupError(`Found ${byDeployment.size} configurations naming different ${APP_URL_KEY} values.`, [
+      ...discovered.map(({ label, value }) => `${label}: ${value}`),
+      "Re-run with --url <deployment url> to say which one the desktop app should use."
+    ]);
+  }
+  const raw = override ?? byDeployment.values().next().value;
+  if (!raw) {
+    return APP_URL;
+  }
+  let url;
+  try {
+    url = new URL(raw.trim());
+  } catch {
+    throw new SetupError(`${APP_URL_KEY} is not a valid URL: ${raw}`, [
+      "Set it to the origin browsers use to reach Sim, e.g. https://sim.example.com"
+    ]);
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new SetupError(`${APP_URL_KEY} must be an http(s) URL: ${raw}`);
+  }
+  return url.origin;
+}
+async function probeDownload(downloadUrl, fetchImpl = fetch) {
+  let response;
+  try {
+    response = await fetchImpl(downloadUrl, {
+      redirect: "manual",
+      signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
+    });
+  } catch (error) {
+    return { status: "unreachable", error: getErrorMessage(error, "request failed") };
+  }
+  if (REDIRECT_STATUSES.has(response.status)) {
+    const location = response.headers.get("location");
+    if (!location)
+      return { status: "unexpected", code: response.status };
+    let name = location;
+    try {
+      name = decodeURIComponent(new URL(location).pathname.split("/").pop() ?? location);
+    } catch {}
+    return { status: "ok", installerUrl: location, installerName: sanitizeForTerminal(name) };
+  }
+  if (response.status === 404)
+    return { status: "no-release" };
+  if (response.status === 502)
+    return { status: "feed-unavailable" };
+  return { status: "unexpected", code: response.status };
+}
+function describeProbe(probe, appUrl) {
+  switch (probe.status) {
+    case "ok":
+      return { headline: `${glyph.pass} Installer resolved: ${probe.installerName}`, hints: [] };
+    case "no-release":
+      return {
+        headline: `${glyph.fail} This deployment reports no desktop release for its channel.`,
+        hints: [
+          "Stable desktop builds are published on GitHub releases of simstudioai/sim.",
+          "A brand-new fork with no releases of its own will report this."
+        ]
+      };
+    case "feed-unavailable":
+      return {
+        headline: `${glyph.fail} The deployment could not reach the GitHub release feed.`,
+        hints: [
+          "The Sim server needs outbound access to api.github.com and github.com.",
+          "Unauthenticated GitHub API calls are capped at 60/hour per IP — set GITHUB_TOKEN on the Sim server to raise it to 5000/hour."
+        ]
+      };
+    case "unreachable":
+      return {
+        headline: `${glyph.fail} Could not reach ${appUrl} — ${probe.error}`,
+        hints: [
+          `Check that Sim is running and reachable at ${appUrl} (npx sim-setup status).`,
+          "Pass --url if this machine reaches Sim at a different address."
+        ]
+      };
+    case "unexpected":
+      return { headline: `${glyph.fail} The download endpoint answered ${probe.code}.`, hints: [] };
+  }
+}
+async function runDesktop(flags) {
+  const appUrl = resolveDeploymentUrl(flags.url ? [] : discoverConfigurationSources(), flags.url);
+  const downloadUrl = `${appUrl}${DOWNLOAD_PATH}`;
+  log2.step(`Deployment: ${theme.accent(appUrl)}`);
+  const spin = spinner2();
+  spin.start("Resolving the desktop installer…");
+  const [probe, feedOk] = await Promise.all([
+    probeDownload(downloadUrl),
+    httpHealth(`${appUrl}${FEED_PATH}`, PROBE_TIMEOUT_MS)
+  ]);
+  const { headline, hints } = describeProbe(probe, appUrl);
+  spin.stop(headline);
+  if (probe.status !== "ok") {
+    for (const hint of hints) {
+      log2.info(hint);
+    }
+    outro2(theme.error("The desktop installer could not be resolved."));
+    return 1;
+  }
+  if (!feedOk) {
+    log2.warn(`${FEED_PATH} did not resolve — the app will install but will not auto-update from this deployment.`);
+  }
+  note2([
+    `1. Download and install Sim:`,
+    `   ${theme.accent(downloadUrl)}`,
+    "",
+    `2. Open Sim, then choose ${theme.command("Sim → Server…")} in the menu bar.`,
+    "",
+    `3. Enter your server URL and press Connect:`,
+    `   ${theme.accent(appUrl)}`,
+    "",
+    theme.muted("Sim relaunches against your deployment and updates from it from then on."),
+    theme.muted("The desktop app is macOS-only today; the web app works everywhere.")
+  ].join(`
+`), "Connect the desktop app");
+  if (!flags.noOpen) {
+    if (await confirm2({ message: "Download it now?", initialValue: true })) {
+      openBrowser(downloadUrl);
+    }
+  }
+  outro2(theme.accent("Ready."));
+  return 0;
+}
+var DOWNLOAD_PATH = "/api/desktop/update/download", FEED_PATH = "/api/desktop/update/latest-mac.yml", PROBE_TIMEOUT_MS = 15000, REDIRECT_STATUSES, APP_URL_KEY = "NEXT_PUBLIC_APP_URL", MAX_INSTALLER_NAME = 120;
+var init_desktop = __esm(() => {
+  init_string();
+  init_cli_auth();
+  init_configuration_sources();
+  init_errors();
+  init_probes();
+  init_prompter();
+  init_theme();
+  init_urls();
+  REDIRECT_STATUSES = new Set([301, 302, 307, 308]);
+});
+
 // src/doctor.ts
 var exports_doctor = {};
 __export(exports_doctor, {
@@ -36131,12 +36539,6 @@ var init_docker = __esm(() => {
   APP_DIRS = ["/Applications", join(homedir(), "Applications")];
 });
 
-// src/urls.ts
-var APP_URL = "http://localhost:3000", APP_SIGNUP_URL;
-var init_urls = __esm(() => {
-  APP_SIGNUP_URL = `${APP_URL}/signup`;
-});
-
 // src/modes/k8s.ts
 import { spawn, spawnSync as spawnSync6 } from "node:child_process";
 function run(command, args, failMessage, input) {
@@ -38024,24 +38426,31 @@ function oneFlag(args, flag) {
     fail(`${flag} may only be provided once`);
   return count === 1;
 }
-function parseMode(args) {
-  let mode;
+function parseValueOption(args, flag, requirement) {
+  let value;
   const remaining = [];
+  const prefix = `${flag}=`;
   for (let index = 0;index < args.length; index += 1) {
     const arg = args[index];
-    if (arg !== "--mode" && !arg.startsWith("--mode=")) {
+    if (arg !== flag && !arg.startsWith(prefix)) {
       remaining.push(arg);
       continue;
     }
-    if (mode)
-      fail("--mode may only be provided once");
-    const value = arg === "--mode" ? args[++index] : arg.slice("--mode=".length);
-    if (value !== "compose" && value !== "dev" && value !== "k8s") {
-      fail(`invalid --mode "${value ?? ""}" — expected compose, dev, or k8s`);
-    }
-    mode = value;
+    if (value !== undefined)
+      fail(`${flag} may only be provided once`);
+    const candidate = arg === flag ? args[++index] : arg.slice(prefix.length);
+    if (!candidate || candidate.startsWith("-"))
+      fail(requirement);
+    value = candidate;
   }
-  return { mode, remaining };
+  return { value, remaining };
+}
+function parseMode(args) {
+  const { value, remaining } = parseValueOption(args, "--mode", "--mode requires a value");
+  if (value !== undefined && value !== "compose" && value !== "dev" && value !== "k8s") {
+    fail(`invalid --mode "${value}" — expected compose, dev, or k8s`);
+  }
+  return { mode: value, remaining };
 }
 function expectNoArguments(command, args) {
   if (args.length > 0)
@@ -38084,6 +38493,13 @@ function parseCore(args, helpRequested) {
     }
     return { kind: "add", feature, args: featureArgs };
   }
+  if (command === "desktop") {
+    const noOpen = oneFlag(commandArgs, "--no-open");
+    const { value: url, remaining } = parseValueOption(commandArgs.filter((arg) => arg !== "--no-open"), "--url", "--url requires a deployment URL");
+    if (remaining.length > 0)
+      fail(`Unknown desktop option: ${remaining[0]}`);
+    return { kind: "desktop", noOpen, ...url ? { url } : {} };
+  }
   if (command === "doctor") {
     const fix = oneFlag(commandArgs, "--fix");
     const json = oneFlag(commandArgs, "--json");
@@ -38128,6 +38544,7 @@ var USAGE = `Usage:
   sim-setup [--quick] [--dir <path>] [--mode compose|dev|k8s]
   sim-setup config                         show configured capabilities and integrations
   sim-setup add <feature>                  configure ${SETUP_FEATURES2}
+  sim-setup desktop [--url <url>]          install the macOS desktop app against this deployment
   sim-setup doctor [--fix] [--json]        check your setup
   sim-setup start | stop | restart         bring your install up / down / cycle
   sim-setup update                         pull/rebuild and apply Compose images
@@ -38158,6 +38575,11 @@ async function main() {
     await runFeatureSetup2(invocation.feature, invocation.args);
     return;
   }
+  if (invocation.kind === "desktop") {
+    const { runDesktop: runDesktop2 } = await Promise.resolve().then(() => (init_desktop(), exports_desktop));
+    process.exitCode = await runDesktop2({ url: invocation.url, noOpen: invocation.noOpen });
+    return;
+  }
   if (invocation.kind === "doctor") {
     const { runDoctor: runDoctor2 } = await Promise.resolve().then(() => (init_doctor(), exports_doctor));
     process.exitCode = await runDoctor2({ fix: invocation.fix, json: invocation.json });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sim-setup",
-  "version": "1.0.2",
+  "version": "1.0.3-preview.50.1",
   "description": "Set up and manage a self-hosted Sim installation",
   "type": "module",
   "bin": {