Fix update check

Sg312 · Aug 12, 2026 · Aug 12, 2026 · Aug 12, 2026 · Aug 12, 2026 · Aug 12, 2026
commit 1ee4d14ff29bdcb5e8e75fe9e6946de14bc6af09
diff --git a/apps/sim/app/api/desktop/update/latest-mac.yml/route.test.ts b/apps/sim/app/api/desktop/update/latest-mac.yml/route.test.ts
@@ -27,8 +27,11 @@ function manifest(version: string) {
   return [`version: ${version}`, 'files:', `  - url: Sim-${version}-universal-mac.zip`].join('\n')
 }
 
-async function getFeed(hostname: string): Promise<Response> {
-  return GET(new NextRequest(`https://${hostname}/api/desktop/update/latest-mac.yml`), undefined)
+async function getFeed(hostname: string, headers?: HeadersInit): Promise<Response> {
+  return GET(
+    new NextRequest(`https://${hostname}/api/desktop/update/latest-mac.yml`, { headers }),
+    undefined
+  )
 }
 
 describe('desktop update manifest route', () => {
@@ -74,6 +77,28 @@ describe('desktop update manifest route', () => {
     )
   })
 
+  it('uses the forwarded public hostname behind a reverse proxy', async () => {
+    fetchMock.mockImplementation(async (input: string | URL | Request) => {
+      const url = String(input)
+      if (url === RELEASES_URL) {
+        return Response.json([release('v1.2.0-staging.5'), release('v1.1.0')])
+      }
+      if (url === `https://downloads.example/v1.2.0-staging.5/${MANIFEST_ASSET_NAME}`) {
+        return new Response(manifest('1.2.0-staging.5'))
+      }
+      return new Response(null, { status: 404 })
+    })
+
+    const response = await getFeed('internal.service.local', {
+      'x-forwarded-host': 'www.staging.sim.ai:443, internal.service.local',
+    })
+    const body = await response.text()
+
+    expect(response.status).toBe(200)
+    expect(response.headers.get(FEED_STATUS_HEADER)).toBe('release')
+    expect(body).toContain('version: 1.2.0-staging.5')
+  })
+
   it('reports an authoritative no-release result for production with only prereleases', async () => {
     fetchMock.mockResolvedValueOnce(
       Response.json([release('v1.2.0-dev.4'), release('v1.2.0-staging.5')])

diff --git a/apps/sim/app/api/desktop/update/latest-mac.yml/route.ts b/apps/sim/app/api/desktop/update/latest-mac.yml/route.ts
@@ -21,6 +21,19 @@ const FEED_STATUS_HEADER = 'x-sim-desktop-update-feed'
 
 const RELEASES_API_URL = `https://api.github.com/repos/${DESKTOP_RELEASE_REPO}/releases?per_page=30`
 
+/** Resolves the public hostname when Next.js is running behind a reverse proxy. */
+function hostnameForRequest(request: NextRequest): string {
+  const forwardedHost = request.headers.get('x-forwarded-host')?.split(',')[0]?.trim()
+  const host = forwardedHost || request.headers.get('host')
+  if (!host) return request.nextUrl.hostname
+
+  try {
+    return new URL(`http://${host}`).hostname
+  } catch {
+    return request.nextUrl.hostname
+  }
+}
+
 /**
  * The per-environment desktop update feed (see `lib/desktop/update-feed.ts`).
  *
@@ -30,11 +43,13 @@ const RELEASES_API_URL = `https://api.github.com/repos/${DESKTOP_RELEASE_REPO}/r
  * only describes public GitHub release artifacts.
  */
 export const GET = withRouteHandler(async (request: NextRequest): Promise<Response> => {
-  // The same deployment configuration can be promoted across environments, so
-  // its baked NEXT_PUBLIC_APP_URL is not authoritative for this public feed.
-  // The hostname the installed shell actually requested is the channel:
-  // dev -> dev, staging -> staging, and prod/self-hosted -> stable.
-  const channel = channelForHostname(request.nextUrl.hostname)
+  /**
+   * The same deployment configuration can be promoted across environments, so
+   * its baked NEXT_PUBLIC_APP_URL is not authoritative for this public feed.
+   * Reverse proxies replace the request URL's hostname with their internal
+   * origin, so use the forwarded public host to select the channel.
+   */
+  const channel = channelForHostname(hostnameForRequest(request))
 
   // A token raises the GitHub API quota from 60/h per NAT IP to 5000/h.
   // Optional: the repo is public, so the feed works without one.