v0.8.23: bun upgrade, infra resilience improvements, gpt-6, browser use improvements, file editor fixes, aws integrations

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM oven/bun:1.3.14-alpine
+FROM oven/bun:1.4.1-alpine
 
 # Install necessary packages for development
 RUN apk add --no-cache \

.github/workflows/ci.yml

@@ -240,7 +240,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.1
 
       - name: Cache Bun dependencies
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
@@ -960,7 +960,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.1
 
       - name: Install dependencies
         run: bun install --frozen-lockfile --ignore-scripts

.github/workflows/desktop-e2e.yml

@@ -43,7 +43,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.1
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -76,7 +76,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.1
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -112,7 +112,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.1
 
       - name: Setup Node
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4

.github/workflows/desktop-release.yml

@@ -128,7 +128,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.1
 
       - name: Setup Node
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4

.github/workflows/docs-embeddings.yml

@@ -22,7 +22,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.1
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/helm.yml

@@ -43,7 +43,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.1
 
       # Docker Compose and Kubernetes must run the same background jobs on the
       # same schedules; this fails the build if the two drift apart. The script

.github/workflows/migrations.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.1
 
       - name: Cache Bun dependencies
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5

.github/workflows/publish-cli.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.1
 
       - name: Setup Node.js for npm publishing
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/publish-sim-cli.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.1
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/publish-sim-setup.yml

@@ -29,7 +29,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.1
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/publish-ts-sdk.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.1
 
       - name: Setup Node.js for npm publishing
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

.github/workflows/stickydisk-gc.yml

@@ -0,0 +1,183 @@
+name: Sticky Disk GC
+
+# node_modules sticky disks are keyed on hashFiles('bun.lock') by design — see the
+# "Mount node_modules" comment in test-build.yml. A sticky disk is a mutable volume
+# and `bun install --frozen-lockfile` adds what the lockfile needs without pruning
+# what it dropped, so branches on different lockfiles must not share one. That
+# design is correct and is preserved here.
+#
+# Its cost is a fresh ~13.7 GB disk per lockfile hash per event class, created at
+# ~6.3/day. Blacksmith evicts a sticky disk after 7 days of inactivity, so this is
+# not a leak — it is a retention window far too generous for a key that churns
+# this fast. Steady state is (new disks/day x GB/disk x retention days), which at
+# 7 days predicts 606 GB against 601 GB actually observed.
+#
+# Age-based on purpose. The key contains NO PR identifier, so every open PR whose
+# checkout has the same bun.lock mounts the SAME disk — there are far more open
+# PRs than distinct lockfile hashes, so sharing is the common case, not an edge
+# case. Deleting on PR close would destroy a disk many other open PRs are using.
+# Never add a pull_request or pull_request_target trigger here.
+
+on:
+  schedule:
+    - cron: '17 9 * * *'
+  workflow_dispatch:
+    inputs:
+      retention_days:
+        description: Delete node_modules disks unused for more than this many days.
+        required: false
+        default: '3'
+      dry_run:
+        description: List what would be deleted without deleting it.
+        type: boolean
+        required: false
+        default: false
+
+# Nothing in this job reads the repository.
+permissions: {}
+
+concurrency:
+  group: stickydisk-gc
+  cancel-in-progress: false
+
+jobs:
+  gc:
+    name: Reclaim idle node_modules sticky disks
+    # GitHub-hosted on purpose, not a Blacksmith runner: the CLI is a pure API
+    # client, and collection has to keep working during a Blacksmith outage or a
+    # CI_PROVIDER break-glass switch — exactly when disks sit idle and still bill.
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      # Pinned binary + checksum rather than `curl https://get.blacksmith.sh | sh`:
+      # this job holds an org-wide token, so it must not execute unpinned remote
+      # shell. The vendor publishes a .sha256 sidecar next to each binary; check a
+      # new version against it and bump both values together.
+      BLACKSMITH_CLI_VERSION: v0.4.58
+      BLACKSMITH_CLI_SHA256: 0b54a4398e9b35344d8fb32891703d8a393343f5001914d7482f93d068c76822
+      # The CLI self-updates in the background on every invocation, which would
+      # silently defeat the pin above.
+      BLACKSMITH_DISABLE_AUTO_UPDATE: '1'
+      BLACKSMITH_ORG: simstudioai
+      TARGET_REPO: ${{ github.repository }}
+      RETENTION_DAYS: ${{ inputs.retention_days || '3' }}
+      DRY_RUN: ${{ inputs.dry_run || 'false' }}
+
+    steps:
+      - name: Install Blacksmith CLI
+        run: |
+          set -euo pipefail
+          url="https://clireleases.blacksmith.sh/cli/${BLACKSMITH_CLI_VERSION}/linux/amd64/blacksmith"
+          curl -fsSL "$url" -o /usr/local/bin/blacksmith
+          echo "${BLACKSMITH_CLI_SHA256}  /usr/local/bin/blacksmith" | sha256sum -c -
+          chmod +x /usr/local/bin/blacksmith
+
+      - name: Authenticate
+        env:
+          BLACKSMITH_CLI_TOKEN: ${{ secrets.BLACKSMITH_CLI_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ -z "${BLACKSMITH_CLI_TOKEN:-}" ]; then
+            echo "::error::BLACKSMITH_CLI_TOKEN is not set. Mint one with 'blacksmith org-token create' and add it as a repository secret."
+            exit 1
+          fi
+          printf '%s' "$BLACKSMITH_CLI_TOKEN" \
+            | blacksmith auth login --api-token - --non-interactive --organization "$BLACKSMITH_ORG"
+
+      - name: Delete node_modules disks idle beyond the retention window
+        run: |
+          set -euo pipefail
+
+          case "$RETENTION_DAYS" in
+            ''|*[!0-9]*)
+              echo "::error::retention_days must be a whole number of days, got '${RETENTION_DAYS}'"
+              exit 1
+              ;;
+          esac
+          if [ "$RETENTION_DAYS" -lt 1 ]; then
+            echo "::error::retention_days must be at least 1; 0 would delete disks a running job is using"
+            exit 1
+          fi
+
+          blacksmith stickydisk list \
+            --repo "$TARGET_REPO" \
+            --search '-node-modules-' \
+            --per-page 100 \
+            --format json > disks.json
+
+          # Reduce the listing to the deletable set ONCE, so the staleness test and
+          # the bulk-delete guard below both count the same things. Deriving the
+          # guard's denominator from the raw entries instead would double-count
+          # architecture variants (which are deliberately grouped into one key) and
+          # would also count entries the regex rejected, so the guard could never
+          # fire.
+          #
+          # Two independent filters, because the blast radius of a wrong key is a
+          # cache every CI job depends on:
+          #   1. --search narrows server-side to the node_modules family.
+          #   2. The regex re-proves each key's full shape locally.
+          # The event segment is [a-z_]+ rather than an enumerated push|pull_request
+          # because the key interpolates ${{ github.event_name }} and a
+          # workflow_dispatch disk already exists that an enumerated list would have
+          # skipped forever. `-fork` is a separate optional segment rather than part
+          # of that class: test-build.yml appends it after the event name, so a fork
+          # key reads `pull_request-fork` and a character class cannot span the
+          # hyphen. Without it, fork disks would never be collected.
+          #
+          # Grouped by key because `delete` without --arch removes every
+          # architecture variant, so a key may only go when its NEWEST variant is
+          # stale.
+          jq --arg repo "$TARGET_REPO" '
+            .entries
+            | map(select(.type == "stickydisk"))
+            | map(select(.key | test("^" + ($repo | gsub("/"; "\\/")) + "-node-modules-[a-z_]+(-fork)?-[0-9a-f]{64}$")))
+            | group_by(.key)
+            | map({
+                key: .[0].key,
+                gb: (map(.size_bytes) | add / 1000000000 * 100 | round / 100),
+                last_used: (map(.last_used_at | sub("\\.[0-9]+Z$"; "Z") | fromdateiso8601) | max)
+              })
+          ' disks.json > eligible.json
+
+          jq -r --argjson days "$RETENTION_DAYS" '
+            (now - ($days * 86400)) as $cutoff
+            | map(select(.last_used < $cutoff))
+            | .[] | "\(.key)\t\(.gb)"
+          ' eligible.json > stale.tsv
+
+          total=$(jq 'length' eligible.json)
+          count=$(wc -l < stale.tsv | tr -d ' ')
+          reclaimed=$(awk -F'\t' '{s+=$2} END {printf "%.1f", s+0}' stale.tsv)
+          {
+            echo "### Sticky disk GC"
+            echo ""
+            echo "Retention **${RETENTION_DAYS}d** · dry run **${DRY_RUN}** · **${count}** of ${total} node_modules disks idle (**${reclaimed} GB**)"
+            echo ""
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          # A run that would delete everything means the listing or the clock is
+          # wrong, not that every disk went idle at once. Refuse rather than wipe
+          # the caches every CI job depends on.
+          if [ "$count" -gt 0 ] && [ "$count" -eq "$total" ]; then
+            echo "::error::Refusing to delete all ${total} node_modules disks — that indicates a listing or clock fault, not genuine idleness."
+            exit 1
+          fi
+
+          failed=0
+          while IFS=$'\t' read -r key gb; do
+            [ -n "$key" ] || continue
+            if [ "$DRY_RUN" = "true" ]; then
+              echo "- would delete \`${key}\` (${gb} GB)" >> "$GITHUB_STEP_SUMMARY"
+              continue
+            fi
+            if blacksmith stickydisk delete --repo "$TARGET_REPO" --key "$key" --yes; then
+              echo "- deleted \`${key}\` (${gb} GB)" >> "$GITHUB_STEP_SUMMARY"
+            else
+              echo "- FAILED \`${key}\`" >> "$GITHUB_STEP_SUMMARY"
+              failed=1
+            fi
+          done < stale.tsv
+
+          # Fail loudly rather than continue-on-error: a revoked token or a changed
+          # CLI JSON shape would otherwise silently revert us to 7-day billing.
+          exit "$failed"

.github/workflows/test-build.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.1
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -230,7 +230,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.1
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -303,7 +303,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.3.14
+          bun-version: 1.4.1
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

README.md

@@ -32,6 +32,12 @@ npx sim-setup
 
 Open [http://localhost:3000](http://localhost:3000)
 
+### Desktop: [macOS](https://sim.ai/api/desktop/update/download)
+
+<a href="https://sim.ai/api/desktop/update/download" target="_blank" rel="noopener noreferrer"><img src="https://img.shields.io/badge/Download-macOS-3B3B3B?logo=apple&logoColor=white&labelColor=1A1A1A" alt="Download Sim for macOS"></a>
+
+macOS 12+, Apple Silicon and Intel. See the [desktop docs](https://docs.sim.ai/desktop) to point it at a self-hosted deployment.
+
 <p align="center">
   <img src="apps/sim/public/static/readme-platform.png" alt="The Sim platform — chat on the left, the visual workflow builder on the right" width="100%"/>
 </p>
@@ -46,7 +52,7 @@ Open [http://localhost:3000](http://localhost:3000)
 
 ## One workspace, every surface
 
-<p align="center">Chat and workflows are just the start — tables, files, and knowledge all live in the same workspace.</p>
+<p align="center">Chat and workflows are just the start — tables, files, and knowledge all live in the same workspace, in the browser or on your desktop.</p>
 
 <table>
   <tr>
@@ -64,7 +70,10 @@ Open [http://localhost:3000](http://localhost:3000)
       <img src="apps/sim/public/static/readme-knowledge.png" alt="Knowledge bases in Sim — synced docs your agents can search" width="100%"/>
       <p align="center"><b>Knowledge</b> — your agents' memory</p>
     </td>
-    <td width="50%" valign="top"></td>
+    <td width="50%" valign="top">
+      <img src="apps/sim/public/static/readme-desktop.png" alt="Sim Desktop — Chat on the left, the built-in browser on the right" width="100%"/>
+      <p align="center"><b>Desktop</b> — Sim on your Mac, browser and terminal included</p>
+    </td>
   </tr>
 </table>
 

apps/desktop/package.json

@@ -9,7 +9,7 @@
   "type": "module",
   "main": "dist/main.cjs",
   "engines": {
-    "bun": ">=1.3.14",
+    "bun": ">=1.4.1",
     "node": ">=20.0.0"
   },
   "scripts": {