chore(extension): bring the main extension hotfix into staging (#9568)

* chore(ci): give the Trigger.dev upload job room for a slow image push (#8115)

(cherry picked from commit 43c9f6c)

* improvement(extension): document browser data handling and limited use

* fix(extension): attach Sim pages and streamline composer controls (#9560)

* fix(extension): attach Sim pages and streamline composer controls

* fix(extension): normalize Sim paths before capture

* fix(extension): exclude revealed secrets and keep large composers usable

* fix(extension): disclose link handling and keep gesture checks passive

---------

Co-authored-by: Siddharth Ganesan <33737564+Sg312@users.noreply.github.com>
Co-authored-by: Vikhyath Mondreti <vikhyathvikku@gmail.com>
Co-authored-by: Theodore Li <theo@sim.ai>

Author: 4 people

apps/extension/scripts/test-e2e.ts

@@ -659,8 +659,17 @@ try {
         expression: `parent.postMessage(${JSON.stringify(action)}, ${JSON.stringify(`chrome-extension://${extensionId}`)})`,
         userGesture: false,
       })
-      await expect(panel.locator('body')).toHaveAttribute('data-observed-actions', '1')
-      await expect(panel.locator('body')).toHaveAttribute('data-action-queries', '0')
+      await expect
+        .poll(async () => {
+          const { result } = await parentCdp.send('Runtime.evaluate', {
+            expression:
+              '[document.body.dataset.observedActions, document.body.dataset.actionQueries]',
+            returnByValue: true,
+            userGesture: false,
+          })
+          return result.value
+        })
+        .toEqual(['1', '0'])
       assert((await snapshots()).length === before, 'Captured without a user gesture')
       await app.evaluate(({ action, targetOrigin }) => parent.postMessage(action, targetOrigin), {
         action: { ...action, sessionId: generateId() },

apps/sim/app/(landing)/privacy/privacy-content.tsx

@@ -44,7 +44,7 @@ function richText(content: string): ReactNode {
 export const PRIVACY_CONFIG: LegalPageConfig = {
   title: 'Privacy Policy',
   description: 'Sim Studio, Inc. · Operating the Sim platform (sim.ai)',
-  lastUpdated: 'October 31, 2026',
+  lastUpdated: 'November 2, 2026',
   intro: [
     {
       kind: 'paragraph',
@@ -833,6 +833,12 @@ export const PRIVACY_CONFIG: LegalPageConfig = {
             'The hosted chat uses Your normal Sim Account and authenticated session, together with the operational diagnostics and consent controls described in this Privacy Policy. The extension document and its page attachments are excluded from session replay. Captured page content is not used for advertising.'
           ),
         },
+        {
+          kind: 'paragraph',
+          content: richText(
+            'When You use the sim address-bar keyword, the extension sends the typed link name, before any path values or query, to Sim with Your authenticated session to suggest Your organization’s links. Suggestions are cached in memory and are not written to extension storage. Opening a sim/ shortcut sends its path and query to Sim to resolve the destination, then opens that destination. Sim records each link’s visit count and last-visited time. These requests also use the operational diagnostics described in this Privacy Policy. The extension does not read Your browser history or unrelated address-bar input.'
+          ),
+        },
         {
           kind: 'subheading',
           text: 'Chrome Web Store Limited Use',