feat(setup): setup wizard with browser-based Chat key handoff

README.md

@@ -75,71 +75,42 @@ Docker must be installed and running. Use `-p, --port <port>` to run Sim on a di
 
 ## Self-hosting
 
-### Docker Compose
+**Requirements:** [Bun](https://bun.sh/) and [Docker](https://www.docker.com/).
 
 ```bash
 git clone https://github.com/simstudioai/sim.git && cd sim
-docker compose -f docker-compose.prod.yml up -d
-```
-
-Open [http://localhost:3000](http://localhost:3000)
-
-Sim also supports local models via [Ollama](https://ollama.ai) and [vLLM](https://docs.vllm.ai/). See the [Docker self-hosting docs](https://docs.sim.ai/self-hosting/docker) for setup details.
-
-### Manual Setup
-
-**Requirements:** [Bun](https://bun.sh/), [Node.js](https://nodejs.org/) v20+, PostgreSQL 12+ with [pgvector](https://github.com/pgvector/pgvector)
-
-1. Clone and install:
-
-```bash
-git clone https://github.com/simstudioai/sim.git
-cd sim
 bun install
-bun run prepare # Set up pre-commit hooks
+bun run setup
 ```
 
-2. Set up PostgreSQL with pgvector:
+`bun run setup` is an interactive wizard: it provisions the database, generates secrets, writes your `.env` files, connects a Chat API key, and starts Sim the way you choose:
 
-```bash
-docker run --name simstudio-db -e POSTGRES_PASSWORD=your_password -e POSTGRES_DB=simstudio -p 5432:5432 -d pgvector/pgvector:pg17
-```
+- **Local dev** — run from source to contribute or hack on Sim
+- **Docker Compose** — a self-contained instance for testing self-hosting
+- **Kubernetes (Helm)** — deploy to a local cluster
 
-Or install manually via the [pgvector guide](https://github.com/pgvector/pgvector#installation).
+When it finishes, open [http://localhost:3000](http://localhost:3000).
 
-3. Configure environment:
+Manage your install with `bun run sim`:
 
 ```bash
-cp apps/sim/.env.example apps/sim/.env
-# Create your secrets
-perl -i -pe "s/your_encryption_key/$(openssl rand -hex 32)/" apps/sim/.env
-perl -i -pe "s/your_internal_api_secret/$(openssl rand -hex 32)/" apps/sim/.env
-perl -i -pe "s/your_api_encryption_key/$(openssl rand -hex 32)/" apps/sim/.env
-# DB configs for migration
-cp packages/db/.env.example packages/db/.env
-# Edit both .env files to set DATABASE_URL="postgresql://postgres:your_password@localhost:5432/simstudio"
+bun run sim start | stop | restart # bring your install up / down / cycle
+bun run sim status # what's installed and healthy
+bun run sim logs # follow logs
+bun run sim doctor # diagnose configuration problems
+bun run sim down # remove containers (data kept)
+bun run sim reset # archive .env and wipe managed data
 ```
 
-4. Run migrations:
+`sim` detects how you're running (Docker Compose, local dev, or Kubernetes) and acts accordingly.
 
-```bash
-cd packages/db && bun run db:migrate
-```
+Prefer a bare `sim`? Run `bun link` once — but note `sim` lands in `~/.bun/bin`, which Homebrew's bun doesn't add to your PATH, so you may need `export PATH="$HOME/.bun/bin:$PATH"` in your shell profile.
 
-5. Start development servers:
-
-```bash
-bun run dev:full # Starts Next.js app and realtime socket server
-```
-
-Or run separately: `bun run dev` (Next.js) and `cd apps/sim && bun run dev:sockets` (realtime).
+Sim also supports local models via [Ollama](https://ollama.ai) and [vLLM](https://docs.vllm.ai/). See the [self-hosting docs](https://docs.sim.ai/self-hosting/docker) for details.
 
 ## Chat API Keys
 
-Chat is a Sim-managed service. To use Chat on a self-hosted instance:
-
-- Go to https://sim.ai → Settings → Chat keys and generate a Chat API key
-- Set `COPILOT_API_KEY` environment variable in your self-hosted apps/sim/.env file to that value
+Chat is a Sim-managed service. `bun run setup` connects a Chat API key for you — sign in when it opens your browser and the key is stored automatically. To view, create, or revoke keys later, go to [sim.ai/account/settings/chat-keys](https://sim.ai/account/settings/chat-keys).
 
 ## Environment Variables
 

apps/sim/app/(auth)/auth-redirect.ts

@@ -0,0 +1,30 @@
+/**
+ * Where the user goes once authentication finishes, carried across the login →
+ * signup → verify hops. Written only after `validateCallbackUrl` accepts it, and
+ * re-validated on read.
+ */
+export const POST_AUTH_REDIRECT_STORAGE_KEY = 'postAuthRedirectUrl'
+
+interface AuthCrossLinkParams {
+ /** Validated post-auth destination to carry over, or null to drop it. */
+ callbackUrl: string | null
+ isInviteFlow: boolean
+}
+
+/**
+ * Builds the login ⇄ signup cross-link, preserving the post-auth destination so
+ * a visitor who signs up instead of signing in still lands where they were
+ * headed. `URLSearchParams` does the encoding — a destination that carries its
+ * own query string (`/cli/auth?callback=…&state=…`) must survive intact.
+ */
+export function buildAuthCrossLink(
+ path: '/login' | '/signup',
+ { callbackUrl, isInviteFlow }: AuthCrossLinkParams
+): string {
+ const params = new URLSearchParams()
+ if (isInviteFlow) params.set('invite_flow', 'true')
+ if (callbackUrl) params.set('callbackUrl', callbackUrl)
+
+ const query = params.toString()
+ return query ? `${path}?${query}` : path
+}

apps/sim/app/(auth)/login/login-form.tsx

@@ -21,6 +21,7 @@ import { validateCallbackUrl } from '@/lib/core/security/input-validation'
 import { getBaseUrl } from '@/lib/core/utils/urls'
 import { quickValidateEmail } from '@/lib/messaging/email/validation'
 import { captureClientEvent } from '@/lib/posthog/client'
+import { buildAuthCrossLink } from '@/app/(auth)/auth-redirect'
 import {
  AuthDivider,
  AuthField,
@@ -107,6 +108,10 @@ export default function LoginPage({
  }
  const callbackUrl = isValidCallbackUrl ? callbackUrlParam! : '/workspace'
  const isInviteFlow = searchParams?.get('invite_flow') === 'true'
+ const signupHref = buildAuthCrossLink('/signup', {
+ callbackUrl: isValidCallbackUrl ? callbackUrl : null,
+ isInviteFlow,
+ })
 
  const [forgotPasswordOpen, setForgotPasswordOpen] = useState(false)
  const [forgotPasswordEmail, setForgotPasswordEmail] = useState('')
@@ -431,11 +436,7 @@ export default function LoginPage({
  )}
 
  {emailEnabled && (
- <AuthNavPrompt
- prompt="Don't have an account?"
- href={isInviteFlow ? `/signup?invite_flow=true&callbackUrl=${callbackUrl}` : '/signup'}
- linkLabel='Sign up'
- />
+ <AuthNavPrompt prompt="Don't have an account?" href={signupHref} linkLabel='Sign up' />
  )}
 
  <AuthLegalFooter action='signing in' />

apps/sim/app/(auth)/signup/signup-form.tsx

@@ -10,6 +10,7 @@ import { getEnv, isFalsy, isTruthy } from '@/lib/core/config/env'
 import { validateCallbackUrl } from '@/lib/core/security/input-validation'
 import { quickValidateEmail } from '@/lib/messaging/email/validation'
 import { captureClientEvent, captureEvent } from '@/lib/posthog/client'
+import { buildAuthCrossLink, POST_AUTH_REDIRECT_STORAGE_KEY } from '@/app/(auth)/auth-redirect'
 import {
  AuthDivider,
  AuthField,
@@ -343,9 +344,12 @@ function SignupFormContent({
 
  if (typeof window !== 'undefined') {
  sessionStorage.setItem('verificationEmail', emailValue)
- if (isInviteFlow && redirectUrl) {
- sessionStorage.setItem('inviteRedirectUrl', redirectUrl)
- sessionStorage.setItem('isInviteFlow', 'true')
+ if (redirectUrl) {
+ sessionStorage.setItem(POST_AUTH_REDIRECT_STORAGE_KEY, redirectUrl)
+ } else {
+ // Clear any leftover from an earlier signup in this tab — otherwise a
+ // signup with no callbackUrl inherits the previous CLI/invite destination.
+ sessionStorage.removeItem(POST_AUTH_REDIRECT_STORAGE_KEY)
  }
  }
 
@@ -468,7 +472,7 @@ function SignupFormContent({
 
  <AuthNavPrompt
  prompt='Already have an account?'
- href={isInviteFlow ? `/login?invite_flow=true&callbackUrl=${redirectUrl}` : '/login'}
+ href={buildAuthCrossLink('/login', { callbackUrl: redirectUrl || null, isInviteFlow })}
  linkLabel='Sign in'
  />
 

apps/sim/app/(auth)/verify/use-verification.ts

@@ -6,9 +6,39 @@ import { normalizeEmail } from '@sim/utils/string'
 import { useRouter, useSearchParams } from 'next/navigation'
 import { client, useSession } from '@/lib/auth/auth-client'
 import { validateCallbackUrl } from '@/lib/core/security/input-validation'
+import { POST_AUTH_REDIRECT_STORAGE_KEY } from '@/app/(auth)/auth-redirect'
 
 const logger = createLogger('useVerification')
 
+/**
+ * Resolves the post-auth destination at the moment of redirect rather than
+ * caching it in state.
+ *
+ * Both redirect sites run in the same commit as the effect that reads session
+ * storage, so a cached value is still `null` when they fire and the stored
+ * destination is silently replaced by `/workspace`. Reading here removes that
+ * race. `redirectAfter` wins over the stored URL; anything failing callback
+ * validation is discarded, and an unsafe stored value is evicted.
+ */
+function resolveRedirectUrl(redirectParam: string | null): string | null {
+ let resolved: string | null = null
+
+ const stored = sessionStorage.getItem(POST_AUTH_REDIRECT_STORAGE_KEY)
+ if (stored && validateCallbackUrl(stored)) {
+ resolved = stored
+ } else if (stored) {
+ logger.warn('Ignoring unsafe stored post-auth redirect URL', { url: stored })
+ sessionStorage.removeItem(POST_AUTH_REDIRECT_STORAGE_KEY)
+ }
+
+ if (redirectParam) {
+ if (validateCallbackUrl(redirectParam)) resolved = redirectParam
+ else logger.warn('Ignoring unsafe redirectAfter parameter', { url: redirectParam })
+ }
+
+ return resolved
+}
+
 /**
  * Mutually-exclusive phases of the email-OTP verification machine.
  * - `idle`: awaiting input
@@ -53,44 +83,11 @@ export function useVerification({
  const [isResending, setIsResending] = useState(false)
  const [isSendingInitialOtp, setIsSendingInitialOtp] = useState(false)
  const [errorMessage, setErrorMessage] = useState('')
- const [redirectUrl, setRedirectUrl] = useState<string | null>(null)
- const [isInviteFlow, setIsInviteFlow] = useState(false)
 
  useEffect(() => {
- if (typeof window !== 'undefined') {
- const storedEmail = sessionStorage.getItem('verificationEmail')
- if (storedEmail) {
- setEmail(storedEmail)
- }
-
- const storedRedirectUrl = sessionStorage.getItem('inviteRedirectUrl')
- if (storedRedirectUrl && validateCallbackUrl(storedRedirectUrl)) {
- setRedirectUrl(storedRedirectUrl)
- } else if (storedRedirectUrl) {
- logger.warn('Ignoring unsafe stored invite redirect URL', { url: storedRedirectUrl })
- sessionStorage.removeItem('inviteRedirectUrl')
- }
-
- const storedIsInviteFlow = sessionStorage.getItem('isInviteFlow')
- if (storedIsInviteFlow === 'true') {
- setIsInviteFlow(true)
- }
- }
-
- const redirectParam = searchParams.get('redirectAfter')
- if (redirectParam) {
- if (validateCallbackUrl(redirectParam)) {
- setRedirectUrl(redirectParam)
- } else {
- logger.warn('Ignoring unsafe redirectAfter parameter', { url: redirectParam })
- }
- }
-
- const inviteFlowParam = searchParams.get('invite_flow')
- if (inviteFlowParam === 'true') {
- setIsInviteFlow(true)
- }
- }, [searchParams])
+ const storedEmail = sessionStorage.getItem('verificationEmail')
+ if (storedEmail) setEmail(storedEmail)
+ }, [])
 
  useEffect(() => {
  if (email && !isSendingInitialOtp && hasEmailService) {
@@ -122,21 +119,12 @@ export function useVerification({
  logger.warn('Failed to refetch session after verification', e)
  }
 
- if (typeof window !== 'undefined') {
- sessionStorage.removeItem('verificationEmail')
-
- if (isInviteFlow) {
- sessionStorage.removeItem('inviteRedirectUrl')
- sessionStorage.removeItem('isInviteFlow')
- }
- }
+ const destination = resolveRedirectUrl(searchParams.get('redirectAfter')) ?? '/workspace'
+ sessionStorage.removeItem('verificationEmail')
+ sessionStorage.removeItem(POST_AUTH_REDIRECT_STORAGE_KEY)
 
  setTimeout(() => {
- if (isInviteFlow && redirectUrl) {
- window.location.href = redirectUrl
- } else {
- window.location.href = '/workspace'
- }
+ window.location.href = destination
  }, 1000)
  } else {
  logger.info('Setting invalid OTP state - API error response')
@@ -217,28 +205,31 @@ export function useVerification({
  }, [otp, email, status, isResending])
 
  useEffect(() => {
- if (typeof window !== 'undefined') {
- if (!isEmailVerificationEnabled) {
- setStatus('verified')
+ if (isEmailVerificationEnabled) return
 
- const handleRedirect = async () => {
- try {
- await refetchSession()
- } catch (error) {
- logger.warn('Failed to refetch session during verification skip:', error)
- }
-
- if (isInviteFlow && redirectUrl) {
- window.location.href = redirectUrl
- } else {
- router.push('/workspace')
- }
- }
+ setStatus('verified')
 
- handleRedirect()
+ const destination = resolveRedirectUrl(searchParams.get('redirectAfter'))
+ // Single-use: consume the stored destination here too, or it survives this
+ // flow and reapplies to a later sign-in in the same tab.
+ sessionStorage.removeItem(POST_AUTH_REDIRECT_STORAGE_KEY)
+
+ const handleRedirect = async () => {
+ try {
+ await refetchSession()
+ } catch (error) {
+ logger.warn('Failed to refetch session during verification skip:', error)
+ }
+
+ if (destination) {
+ window.location.href = destination
+ } else {
+ router.push('/workspace')
  }
  }
- }, [isEmailVerificationEnabled, router, isInviteFlow, redirectUrl])
+
+ handleRedirect()
+ }, [isEmailVerificationEnabled, router, searchParams])
 
  return {
  otp,

apps/sim/app/(auth)/verify/verify-content.tsx

@@ -2,6 +2,7 @@
 
 import { Suspense, useEffect, useState } from 'react'
 import { cn, InputOTP, InputOTPGroup, InputOTPSlot } from '@sim/emcn'
+import { POST_AUTH_REDIRECT_STORAGE_KEY } from '@/app/(auth)/auth-redirect'
 import {
  AuthFormMessage,
  AuthHeader,
@@ -140,8 +141,7 @@ function VerificationForm({
  onNavigate={() => {
  if (typeof window !== 'undefined') {
  sessionStorage.removeItem('verificationEmail')
- sessionStorage.removeItem('inviteRedirectUrl')
- sessionStorage.removeItem('isInviteFlow')
+ sessionStorage.removeItem(POST_AUTH_REDIRECT_STORAGE_KEY)
  }
  }}
  />

apps/sim/app/account/settings/[section]/page.tsx

@@ -10,7 +10,7 @@ import {
  parseSettingsPathSection,
 } from '@/components/settings/navigation'
 import { getSession } from '@/lib/auth'
-import { isBillingEnabled, isHosted } from '@/lib/core/config/env-flags'
+import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import { isPlatformAdmin } from '@/lib/permissions/super-user'
 
 interface AccountSettingsSectionPageProps {
@@ -46,7 +46,6 @@ export default async function AccountSettingsSectionPage({
  })
  if (!parsed) notFound()
  if (parsed === 'billing' && !isBillingEnabled) redirect(getAccountSettingsHref('general'))
- if (parsed === 'copilot' && !isHosted) redirect(getAccountSettingsHref('general'))
  if (parsed === 'admin' || parsed === 'mothership') {
  const isSuperUser = await isPlatformAdmin(session.user.id)
  if (!isSuperUser) notFound()