fix(desktop): paste from main, and stop a reclaimed run dir printing into tmux

Fixes the two behavioural regressions rather than shipping them documented.

The context-menu paste could be silently dropped. It read the clipboard with
`await navigator.clipboard.readText()` and then wrote the text, so the write
landed after an await — and if that read outran the input-recency window (a
permission prompt, a slow read) the terminal-write gate refused it with no error
and no log, on an action the user had just asked for.

Reading in main removes the window entirely, and is the direction Electron
itself took: the `clipboard` module was removed from renderers under RFC 0019 so
page content cannot reach the clipboard, and the documented pattern is to use it
in the main process behind a narrow contextBridge method. So `terminal:paste` is
a gated invoke channel that reads the clipboard itself. It needs a real gesture
(the Paste click), but not the write gate — the bytes are the user's clipboard
rather than the caller's, so a compromised renderer can only replay what was
already copied instead of choosing it. `paste` is optional on the bridge and the
renderer falls back to the old path, so a shell that predates it is unaffected.

The tmux status write is silenced. Closing a terminal tab reclaims the run's
temp dir while the command keeps going in tmux. `tee` is unaffected — POSIX lets
it write on to the unlinked inode, and the space is reclaimed when it exits — but
the command's trailing `printf > .../status` then failed into the pipeline and
printed `No such file or directory` into the user's own tmux window, minutes
after they closed the tab. `2>/dev/null` on that one redirect keeps the reclaim
and drops the noise.

Author: waleedlatif1

apps/desktop/src/main/ipc.test.ts

@@ -59,7 +59,7 @@ vi.mock('@/main/browser-agent/registry', () => ({
 }))
 
 import type { WebContents } from 'electron'
-import { ipcMain, shell } from 'electron'
+import { clipboard, ipcMain, shell } from 'electron'
 import {
   copyCredential,
   credentialsAvailable,
@@ -833,6 +833,29 @@ describe('registerIpcHandlers', () => {
     expect(write).toHaveBeenCalledTimes(replies.length)
   })
 
+  it('pastes the clipboard from main rather than taking bytes from the caller', async () => {
+    const { invoke } = collectHandlers()
+    const write = vi.spyOn(deps.terminal, 'write').mockImplementation(() => {})
+    vi.mocked(clipboard.readText).mockReturnValue('echo hi')
+
+    await expect(invoke.get('terminal:paste')?.(activeAppEvent, 't1')).resolves.toBe(true)
+
+    expect(write).toHaveBeenCalledWith('t1', 'echo hi')
+  })
+
+  it('refuses a paste with no gesture behind it, and reports an empty clipboard', async () => {
+    const { invoke } = collectHandlers()
+    const write = vi.spyOn(deps.terminal, 'write').mockImplementation(() => {})
+    vi.mocked(clipboard.readText).mockReturnValue('echo hi')
+
+    expect(await invoke.get('terminal:paste')?.(inactiveAppEvent, 't1')).toBe(false)
+    expect(write).not.toHaveBeenCalled()
+
+    vi.mocked(clipboard.readText).mockReturnValue('')
+    expect(await invoke.get('terminal:paste')?.(activeAppEvent, 't1')).toBe(false)
+    expect(write).not.toHaveBeenCalled()
+  })
+
   it('gates a command smuggled inside a fake OSC or DCS reply', () => {
     const { on } = collectHandlers()
     const write = vi.spyOn(deps.terminal, 'write').mockImplementation(() => {})

apps/desktop/src/main/ipc.ts

@@ -17,7 +17,7 @@ import {
 } from '@sim/terminal-protocol'
 import { isRecordLike } from '@sim/utils/object'
 import type { BrowserWindow, IpcMainEvent, IpcMainInvokeEvent, WebContents } from 'electron'
-import { ipcMain } from 'electron'
+import { clipboard, ipcMain } from 'electron'
 import {
   clearBrowsingData,
   executeTool,
@@ -921,6 +921,24 @@ export function registerIpcHandlers(deps: IpcDeps): void {
       handler: (sender, focused) =>
         deps.terminal.setPanelFocused(focused === true, sender as WebContents),
     },
+    'terminal:paste': {
+      kind: 'invoke',
+      gate: 'app-origin',
+      requires: 'terminal',
+      denied: false,
+      // The bytes come from the clipboard here, not from the caller, so this
+      // does not need the write gate: a compromised renderer can only replay
+      // what the user already copied. It still needs a real gesture, because
+      // the legitimate caller is a Paste click or ⌘V.
+      needsUserActivation: true,
+      handler: (terminalId) => {
+        if (typeof terminalId !== 'string') return false
+        const text = clipboard.readText()
+        if (!text) return false
+        deps.terminal.write(terminalId, text)
+        return true
+      },
+    },
     'terminal:scrollback': {
       kind: 'invoke',
       gate: 'app-origin',

apps/desktop/src/main/terminal/tmux.ts

@@ -337,7 +337,13 @@ export async function startRun(
   // PIPESTATUS keeps the command's own exit code rather than tee's, which is
   // always 0. bash rather than the user's shell because PIPESTATUS is not
   // portable and this wrapper is ours, not something they have to read.
-  const script = `${command}\nprintf %s "\${PIPESTATUS[0]}" > ${JSON.stringify(statusPath)}`
+  // The status write is silenced because its directory may be gone by the time
+  // it runs: closing the terminal tab reclaims the run's temp dir while the
+  // command keeps going in tmux. `tee` is unaffected — POSIX lets it keep
+  // writing to the unlinked inode — but an unredirected `printf` would fail
+  // into the pipeline and print `No such file or directory` into the user's own
+  // tmux window, minutes after they closed the tab.
+  const script = `${command}\nprintf %s "\${PIPESTATUS[0]}" > ${JSON.stringify(statusPath)} 2>/dev/null`
   const wrapper = `bash -lc ${JSON.stringify(`{ ${script}; } 2>&1 | tee ${JSON.stringify(outPath)}`)}`
 
   const args = ['new-window', '-d', '-P', '-F', '#{window_id}', '-t', session, '-n', 'sim-run']

apps/desktop/src/preload/index.ts

@@ -303,6 +303,8 @@ const api: SimDesktopApi = {
     write: (terminalId: string, data: string): void => {
       ipcRenderer.send('terminal:write', terminalId, data)
     },
+    paste: (terminalId: string): Promise<boolean> =>
+      ipcRenderer.invoke('terminal:paste', terminalId),
     resize: (terminalId: string, cols: number, rows: number): void => {
       ipcRenderer.send('terminal:resize', terminalId, cols, rows)
     },

apps/desktop/src/test/electron-mock.ts

@@ -53,6 +53,7 @@ export const safeStorage = {
 
 export const clipboard = {
   writeText: vi.fn(),
+  readText: vi.fn(() => ''),
 }
 
 export const nativeTheme = {

apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-content/components/terminal-session/terminal-session.tsx

@@ -29,6 +29,7 @@ import {
   getTerminalScrollback,
   onTerminalData,
   openTerminal,
+  pasteIntoTerminal,
   reportTerminalFocused,
   resizeTerminal,
   startTerminalSession,
@@ -508,20 +509,27 @@ const TerminalView = memo(function TerminalView({
   }, [])
 
   const pasteClipboard = useCallback(() => {
-    void navigator.clipboard
-      .readText()
-      .then((text) => {
+    void (async () => {
+      // Main-side first: it reads the clipboard synchronously, so the paste
+      // cannot be refused for want of a recent gesture the way an awaited
+      // renderer read can.
+      if (await pasteIntoTerminal(terminalId)) {
+        terminalRef.current?.focus()
+        return
+      }
+      try {
+        const text = await navigator.clipboard.readText()
         if (!text) return
         // Straight to the PTY: the shell echoes it, exactly like a real paste.
         writeToTerminal(terminalId, text)
         terminalRef.current?.focus()
-      })
-      .catch(() => {
+      } catch {
         // Reading the clipboard needs a permission the shell grants to its own
         // origin; an older shell that predates that grant denies it. Keyboard
         // paste is a native paste event and keeps working either way.
         toast.error('Could not read the clipboard. Press ⌘V to paste.')
-      })
+      }
+    })()
   }, [terminalId])
 
   const clearScreen = useCallback(() => {

apps/sim/lib/terminal/transport.ts

@@ -125,6 +125,23 @@ export function writeToTerminal(terminalId: string, data: string): void {
   bridge()?.write(terminalId, data)
 }
 
+/**
+ * Pastes the system clipboard into a terminal, reading it in the main process
+ * when the shell can.
+ *
+ * Returns false when this shell predates `paste`, so the caller can fall back to
+ * reading the clipboard itself. Main-side is preferred for two reasons: the read
+ * is synchronous there, so there is no window in which the paste can be refused
+ * for want of a recent gesture, and the renderer never touches the clipboard —
+ * which is the direction Electron itself took when it removed the `clipboard`
+ * module from renderers.
+ */
+export async function pasteIntoTerminal(terminalId: string): Promise<boolean> {
+  const paste = bridge()?.paste
+  if (!paste) return false
+  return paste(terminalId)
+}
+
 export function resizeTerminal(terminalId: string, cols: number, rows: number): void {
   bridge()?.resize(terminalId, cols, rows)
 }

packages/desktop-bridge/src/index.ts

@@ -52,6 +52,19 @@ export interface SimDesktopTerminalApi {
   ): Promise<TerminalToolResponse>
   /** Forward the user's keystrokes to one terminal's PTY. */
   write(terminalId: string, data: string): void
+  /**
+   * Paste the system clipboard into one terminal's PTY.
+   *
+   * The text is read in the main process rather than handed over by the caller:
+   * Electron removed the `clipboard` module from renderers precisely so page
+   * content cannot reach the clipboard, and it means a compromised renderer can
+   * only replay what the user already copied instead of choosing the bytes.
+   * Resolves false when the clipboard held nothing to paste.
+   *
+   * Optional: shells that predate it fall back to reading the clipboard in the
+   * renderer.
+   */
+  paste?(terminalId: string): Promise<boolean>
   resize(terminalId: string, cols: number, rows: number): void
   /** Open an additional terminal and make it active. */
   openTerminal(cwd?: string): Promise<TerminalTabsState>