improvement(desktop): Electron E2E for desktop tool lifetimes against a live local Sim

Runs the real Electron app against a local Sim (Postgres, Redis, realtime) with a
recording proxy and a scripted stand-in worker, covering chat switches, Stop,
sign-out, approval-gated and stopped claims, and the flag-off foreground round trip.
The spec skips unless a live Sim is configured; the http-e2e job provides one.

Author: waleedlatif1

.github/workflows/test-build.yml

@@ -123,8 +123,8 @@ jobs:
   http-e2e:
     name: End-to-end over real HTTP
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
-    # Four suites, each starting its own dev app, run in sequence.
-    timeout-minutes: 30
+    # Five suites, each starting its own dev app, run in sequence.
+    timeout-minutes: 45
     services:
       postgres:
         image: pgvector/pgvector:pg17
@@ -433,6 +433,63 @@ jobs:
           DESKTOP_INBOX_E2E_REPORT_PATH="$report_dir/desktop-inbox-http-report.json" \
             bun run test:desktop-inbox:e2e
 
+      # Desktop tools in the real Electron app against a local app with Redis and its realtime
+      # server: chat switches, Stop, sign-out, approval and the flag-off foreground round trip.
+      # The spec runs the recording proxy (the app's public origin) and the stand-in worker.
+      - name: Verify desktop tools in the Electron app against a local app
+        env:
+          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3020
+          BETTER_AUTH_URL: http://127.0.0.1:3020
+          REDIS_URL: redis://127.0.0.1:6379
+          SIM_AGENT_API_URL: http://127.0.0.1:3022
+          NEXT_PUBLIC_SOCKET_URL: http://127.0.0.1:3023
+          SOCKET_SERVER_URL: http://127.0.0.1:3023
+          NEXT_PUBLIC_FORCE_HOSTED: 'false'
+          COPILOT_API_KEY: desktop-tools-e2e-ci-local-copilot-key
+          COPILOT_TOOL_PERMISSIONS_ENABLED: 'true'
+          MOTHERSHIP_SIM_TRANSPORT: direct
+          INTERNAL_API_SECRET: desktop-tools-e2e-ci-local-secret-at-least-32-characters
+          DISABLE_TELEMETRY: 'true'
+          NEXT_TELEMETRY_DISABLED: '1'
+          READY_TIMEOUT_SECONDS: 300
+        run: |
+          report_dir="$RUNNER_TEMP/e2e"
+          mkdir -p "$report_dir"
+          sudo apt-get update -q
+          sudo apt-get install -yq xvfb libgtk-3-0t64 libnss3 libasound2t64 libgbm1 libxss1 \
+            libxtst6 libatk-bridge2.0-0t64 libxkbcommon0 > /dev/null
+          # Electron's Chromium sandbox needs unprivileged user namespaces, which Ubuntu 24.04 restricts.
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+          (cd apps/desktop && bun run build)
+          (cd apps/realtime && PORT=3023 SIM_DB_ROLE=realtime ALLOWED_ORIGINS="$NEXT_PUBLIC_APP_URL" \
+            exec bun src/index.ts > "$report_dir/desktop-tools-realtime.log" 2>&1) &
+          realtime_pid=$!
+          (cd apps/sim && exec node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 \
+            --port 3021 > "$report_dir/desktop-tools-next.log" 2>&1) &
+          server_pid=$!
+          finish() {
+            kill "$server_pid" "$realtime_pid" 2>/dev/null || true
+            wait "$server_pid" "$realtime_pid" 2>/dev/null || true
+          }
+          trap finish EXIT
+          started=$SECONDS
+          until curl --fail --silent --max-time 10 http://127.0.0.1:3021/api/health > /dev/null &&
+            curl --fail --silent --max-time 10 http://127.0.0.1:3023/health > /dev/null; do
+            kill -0 "$server_pid" 2>/dev/null || { tail -n 200 "$report_dir/desktop-tools-next.log"; exit 1; }
+            kill -0 "$realtime_pid" 2>/dev/null || { tail -n 200 "$report_dir/desktop-tools-realtime.log"; exit 1; }
+            [ $((SECONDS - started)) -lt "$READY_TIMEOUT_SECONDS" ] || { echo '::error::Local app did not become ready'; exit 1; }
+            sleep 2
+          done
+          cd apps/desktop
+          SIM_DESKTOP_E2E_SIM_URL=http://127.0.0.1:3021 \
+          SIM_DESKTOP_E2E_PROXY_PORT=3020 \
+          SIM_DESKTOP_E2E_AGENT_PORT=3022 \
+          SIM_DESKTOP_E2E_DATABASE_URL="$DATABASE_URL" \
+          SIM_DESKTOP_E2E_REDIS_URL="$REDIS_URL" \
+          SIM_DESKTOP_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+            xvfb-run -a -s '-screen 0 1920x1200x24' bunx playwright test e2e/desktop-tools-live-sim.spec.ts \
+            --output "$report_dir/desktop-tools-results"
+
       - name: Upload end-to-end reports and server logs
         if: failure()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4