Add client-only desktop backend mode

[colonelpanic8]

Consolidation update

This branch is rebased onto the latest main and now serves as the combined client/server-model stack:

• Merges feat(web): per-device provider settings #4479's complete per-device Providers settings UI and behavior: environment selection, environment-scoped reads/writes/refreshes/updates/instance creation, editable and read-only provider views, loading/offline/error states, and shared model-preference preservation.
• Folds the non-provider environment-scoped settings work from Target server settings by environment #4559.
• Folds Separate client and environment settings #4567's client-versus-environment settings ownership and navigation.
• Folds feat(web): select diagnostics environment #4486's diagnostics environment selection and connection-aware state.
• Does not replay Configure providers per environment #4548 separately because feat(web): per-device provider settings #4479 supersedes its provider-specific implementation. During integration, feat(web): per-device provider settings #4479's standalone Devices picker was replaced by Target server settings by environment #4559's shared settings-environment selector; its provider cards, dialogs, scoped commands, and permission-aware UI states remain.

What Changed

Let the desktop app run as a pure client for remote or independently managed backends, instead of always owning a local backend process.

• Add a persisted desktop backend mode with managed and client-only options, plus a launch-only --backend-mode override, exposed over IPC.
• In client-only, bootstrap skips the backend pool entirely and serves the renderer from packaged static assets (or the dev-server proxy), opens the window on renderer readiness rather than backend readiness, and skips backend shutdown on quit.
• ElectronProtocol now takes an explicit source: "proxy" | "static" (dropping the separate backendOrigin). Static serving adds path-safe file resolution with SPA fallback, MIME types, CSP, and HEAD support.
• Web routing treats client-only like hosted static, and local environment bootstraps are empty, so a client-only desktop is never stranded on a dead primary-backend state — it is routed to Connections instead.

Why

The desktop app should be usable as a pure client without stranding users who have no saved connections.

Scope note

This PR previously also contained Linux local t3 serve discovery. That half has been split into a separate PR so the two can be reviewed independently — the discovery work carries a distinct security surface (a live pairing credential on disk) and is Linux-only, whereas this change is cross-platform.

UI Changes

• Connections gains a Desktop application → Backend mode control.
• Client-only users with no connections are routed to Connections rather than a dead primary-backend state.
• Providers gains per-environment selection, scoped provider cards and controls, and explicit loading, offline, error, empty, editable, and read-only states from feat(web): per-device provider settings #4479.
• General, Source Control, Keybindings, and Diagnostics use the same selected-environment model; Diagnostics includes connection-aware refresh and failure states.
• Settings navigation distinguishes client-owned settings from environment-owned settings.

Packaged desktop evidence

Final privacy-reviewed evidence for this PR is pinned to immutable asset commit
d23321ea7d7200ef4d5e14f20dd2367997731706.

Capture context:

• PR head: bb2c567e6879cf762910a02a8d20943edc2689ce
• PR base: ece05087a70e94efcd57441337fa1249559362ba
• Synthetic combined-stack integration: 5ba3b7bd0995f401993706689105f41f51c16b02
• Exact GUI-tested package: /nix/store/86n9kxipsprgw6nbzyw7qhrw0wl4lfwx-t3code-0.0.29-patched-main-20260724

The packaged Electron app started with --backend-mode=client-only without
starting or owning a local backend, resolved its installed renderer assets,
and paired successfully to an independently started packaged t3 serve
backend. The saved environment then appeared online.

Client-only startup with no saved environment

Connections settings and active CLI override

Independent backend paired and online

Connected home state ·
capture manifest

After this GUI capture, the maintained stack advanced its upstream base to
41a430a88e8dde9c428f59d54dd328aa6a66a8fd. The intervening upstream delta
was isolated to #4472 model registration and did not overlap this desktop
change. The resulting final installed package
/nix/store/brp90sqhjxnnpczsnw9nmp1rlzi0qjgk-t3code-0.0.29-patched-main-20260724
built and activated successfully. The screenshots above remain specifically
attributable to the exact earlier package and synthetic integration listed
above; they are not represented as a GUI recapture of the later package.

Checklist

• corepack pnpm exec vp check (0 errors; 11 pre-existing unrelated warnings)
• corepack pnpm exec vp run --filter @t3tools/contracts --filter @t3tools/shared --filter t3 --filter @t3tools/desktop --filter @t3tools/web typecheck — clean
• CI=true vitest run apps/desktop/src apps/web/src/components/settings apps/web/src/environments apps/server/src/startupAccess.test.ts — 63 files, 437 tests
• Manually verified in an isolated Electron desktop: mode switch relaunches, client-only opens without a backend, packaged static renderer serves deep links, saved connections reconnect after restart

Note

Add client-only desktop backend mode that serves static assets without a local backend

• Introduces a client-only backend mode for the desktop app, selectable via the Connections settings page or --backend-mode CLI flag; in this mode the desktop app skips local backend startup entirely.
• Adds DesktopBackendMode service to parse, validate, and latch backend mode from settings and CLI; persists mode via DesktopAppSettings and triggers an app relaunch on change.
• Extends ElectronProtocol to serve packaged static assets (with SPA fallback, CSP, path traversal protection) when in client-only mode instead of proxying to a local backend.
• Exposes getBackendModeState (sync) and setBackendMode IPC methods via preload.ts so the renderer can read and change mode; the UI prevents switching to client-only without a saved remote environment.
• Refactors settings panels (General, Diagnostics, Keybindings, Source Control, Providers) to be environment-scoped, disabling server-backed controls when the selected environment is disconnected.
• Adds isDesktopClientOnlyMode detection in the web layer so routing, connection source selection, and sidebar/thread logic treat client-only the same as the hosted static app.
• Risk: switching backend mode triggers an app relaunch; if relaunch fails the settings change is reverted, but the UI will surface the error.

^{Macroscope summarized acb11a6.}

---

Note

High Risk
Touches Electron startup/shutdown, custom protocol static file serving (path traversal mitigations), and preload fail-closed behavior that can suppress local backend until IPC is ready; large cross-cutting desktop + web surface.

Overview
Introduces managed vs client-only desktop backend mode (persisted settings, --backend-mode CLI override, IPC get/set). In client-only, startup skips the backend pool, registers Electron protocol as static packaged assets or dev proxy, opens the main window on renderer readiness, and does not stop backends on quit.

ElectronProtocol now uses source: "proxy" | "static" (drops backendOrigin); static mode adds safe path resolution, SPA fallback, MIME/CSP, and GET/HEAD handling. Connections exposes backend mode switching (relaunch); preload fails closed to client-only if mode IPC is missing.

Web UI shifts from always using the primary server atom to environment-scoped config: Providers/Add Provider, Diagnostics (selector + connection-aware loading), keybindings editor keys, and sidebar/command palette grouping use useDefaultServerConfig, EnvironmentPresenceScope, and ownsLocalEnvironment so client-only desktops do not assume a local primary backend.

^{Reviewed by Cursor Bugbot for commit acb11a6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 76f5a485-2760-41bb-b19f-f63af805e9fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Diff is too large for automated approval analysis. A human reviewer should evaluate this PR.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2fbd1f5. Configure here.}

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

Closing this PR after an automated pass over open pull requests. Introduces an alternate client-only desktop architecture across 81 files.

[colonelpanic8]

Consolidation update

This branch is rebased onto the latest main and now serves as the combined client/server-model stack:

• Merges feat(web): per-device provider settings #4479's complete per-device Providers settings UI and behavior: environment selection, environment-scoped reads/writes/refreshes/updates/instance creation, editable and read-only provider views, loading/offline/error states, and shared model-preference preservation.
• Folds the non-provider environment-scoped settings work from Target server settings by environment #4559.
• Folds Separate client and environment settings #4567's client-versus-environment settings ownership and navigation.
• Folds feat(web): select diagnostics environment #4486's diagnostics environment selection and connection-aware state.
• Does not replay Configure providers per environment #4548 separately because feat(web): per-device provider settings #4479 supersedes its provider-specific implementation. During integration, feat(web): per-device provider settings #4479's standalone Devices picker was replaced by Target server settings by environment #4559's shared settings-environment selector; its provider cards, dialogs, scoped commands, and permission-aware UI states remain.

What Changed

Let the desktop app run as a pure client for remote or independently managed backends, instead of always owning a local backend process.

• Add a persisted desktop backend mode with managed and client-only options, plus a launch-only --backend-mode override, exposed over IPC.
• In client-only, bootstrap skips the backend pool entirely and serves the renderer from packaged static assets (or the dev-server proxy), opens the window on renderer readiness rather than backend readiness, and skips backend shutdown on quit.
• ElectronProtocol now takes an explicit source: "proxy" | "static" (dropping the separate backendOrigin). Static serving adds path-safe file resolution with SPA fallback, MIME types, CSP, and HEAD support.
• Web routing treats client-only like hosted static, and local environment bootstraps are empty, so a client-only desktop is never stranded on a dead primary-backend state — it is routed to Connections instead.

Why

The desktop app should be usable as a pure client without stranding users who have no saved connections.

Scope note

This PR previously also contained Linux local t3 serve discovery. That half has been split into a separate PR so the two can be reviewed independently — the discovery work carries a distinct security surface (a live pairing credential on disk) and is Linux-only, whereas this change is cross-platform.

UI Changes

• Connections gains a Desktop application → Backend mode control.
• Client-only users with no connections are routed to Connections rather than a dead primary-backend state.
• Providers gains per-environment selection, scoped provider cards and controls, and explicit loading, offline, error, empty, editable, and read-only states from feat(web): per-device provider settings #4479.
• General, Source Control, Keybindings, and Diagnostics use the same selected-environment model; Diagnostics includes connection-aware refresh and failure states.
• Settings navigation distinguishes client-owned settings from environment-owned settings.

Packaged desktop evidence

Final privacy-reviewed evidence for this PR is pinned to immutable asset commit
d23321ea7d7200ef4d5e14f20dd2367997731706.

Capture context:

• PR head: bb2c567e6879cf762910a02a8d20943edc2689ce
• PR base: ece05087a70e94efcd57441337fa1249559362ba
• Synthetic combined-stack integration: 5ba3b7bd0995f401993706689105f41f51c16b02
• Exact GUI-tested package: /nix/store/86n9kxipsprgw6nbzyw7qhrw0wl4lfwx-t3code-0.0.29-patched-main-20260724

The packaged Electron app started with --backend-mode=client-only without
starting or owning a local backend, resolved its installed renderer assets,
and paired successfully to an independently started packaged t3 serve
backend. The saved environment then appeared online.

Client-only startup with no saved environment

Connections settings and active CLI override

Independent backend paired and online

Connected home state ·
capture manifest

After this GUI capture, the maintained stack advanced its upstream base to
41a430a88e8dde9c428f59d54dd328aa6a66a8fd. The intervening upstream delta
was isolated to #4472 model registration and did not overlap this desktop
change. The resulting final installed package
/nix/store/brp90sqhjxnnpczsnw9nmp1rlzi0qjgk-t3code-0.0.29-patched-main-20260724
built and activated successfully. The screenshots above remain specifically
attributable to the exact earlier package and synthetic integration listed
above; they are not represented as a GUI recapture of the later package.

Checklist

• corepack pnpm exec vp check (0 errors; 11 pre-existing unrelated warnings)
• corepack pnpm exec vp run --filter @t3tools/contracts --filter @t3tools/shared --filter t3 --filter @t3tools/desktop --filter @t3tools/web typecheck — clean
• CI=true vitest run apps/desktop/src apps/web/src/components/settings apps/web/src/environments apps/server/src/startupAccess.test.ts — 63 files, 437 tests
• Manually verified in an isolated Electron desktop: mode switch relaunches, client-only opens without a backend, packaged static renderer serves deep links, saved connections reconnect after restart

Note

Add client-only desktop backend mode that serves static assets without a local backend

• Introduces a client-only backend mode for the desktop app, selectable via the Connections settings page or --backend-mode CLI flag; in this mode the desktop app skips local backend startup entirely.
• Adds DesktopBackendMode service to parse, validate, and latch backend mode from settings and CLI; persists mode via DesktopAppSettings and triggers an app relaunch on change.
• Extends ElectronProtocol to serve packaged static assets (with SPA fallback, CSP, path traversal protection) when in client-only mode instead of proxying to a local backend.
• Exposes getBackendModeState (sync) and setBackendMode IPC methods via preload.ts so the renderer can read and change mode; the UI prevents switching to client-only without a saved remote environment.
• Refactors settings panels (General, Diagnostics, Keybindings, Source Control, Providers) to be environment-scoped, disabling server-backed controls when the selected environment is disconnected.
• Adds isDesktopClientOnlyMode detection in the web layer so routing, connection source selection, and sidebar/thread logic treat client-only the same as the hosted static app.
• Risk: switching backend mode triggers an app relaunch; if relaunch fails the settings change is reverted, but the UI will surface the error.

^{Macroscope summarized acb11a6.}

---

Note

High Risk
Touches Electron startup/shutdown, custom protocol static file serving (path traversal mitigations), and preload fail-closed behavior that can suppress local backend until IPC is ready; large cross-cutting desktop + web surface.

Overview
Introduces managed vs client-only desktop backend mode (persisted settings, --backend-mode CLI override, IPC get/set). In client-only, startup skips the backend pool, registers Electron protocol as static packaged assets or dev proxy, opens the main window on renderer readiness, and does not stop backends on quit.

ElectronProtocol now uses source: "proxy" | "static" (drops backendOrigin); static mode adds safe path resolution, SPA fallback, MIME/CSP, and GET/HEAD handling. Connections exposes backend mode switching (relaunch); preload fails closed to client-only if mode IPC is missing.

Web UI shifts from always using the primary server atom to environment-scoped config: Providers/Add Provider, Diagnostics (selector + connection-aware loading), keybindings editor keys, and sidebar/command palette grouping use useDefaultServerConfig, EnvironmentPresenceScope, and ownsLocalEnvironment so client-only desktops do not assume a local primary backend.

^{Reviewed by Cursor Bugbot for commit acb11a6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 76f5a485-2760-41bb-b19f-f63af805e9fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Diff is too large for automated approval analysis. A human reviewer should evaluate this PR.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2fbd1f5. Configure here.}

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

Closing this PR after an automated pass over open pull requests. Introduces an alternate client-only desktop architecture across 81 files.

[colonelpanic8]

Consolidation update

This branch is rebased onto the latest main and now serves as the combined client/server-model stack:

• Merges feat(web): per-device provider settings #4479's complete per-device Providers settings UI and behavior: environment selection, environment-scoped reads/writes/refreshes/updates/instance creation, editable and read-only provider views, loading/offline/error states, and shared model-preference preservation.
• Folds the non-provider environment-scoped settings work from Target server settings by environment #4559.
• Folds Separate client and environment settings #4567's client-versus-environment settings ownership and navigation.
• Folds feat(web): select diagnostics environment #4486's diagnostics environment selection and connection-aware state.
• Does not replay Configure providers per environment #4548 separately because feat(web): per-device provider settings #4479 supersedes its provider-specific implementation. During integration, feat(web): per-device provider settings #4479's standalone Devices picker was replaced by Target server settings by environment #4559's shared settings-environment selector; its provider cards, dialogs, scoped commands, and permission-aware UI states remain.

What Changed

Let the desktop app run as a pure client for remote or independently managed backends, instead of always owning a local backend process.

• Add a persisted desktop backend mode with managed and client-only options, plus a launch-only --backend-mode override, exposed over IPC.
• In client-only, bootstrap skips the backend pool entirely and serves the renderer from packaged static assets (or the dev-server proxy), opens the window on renderer readiness rather than backend readiness, and skips backend shutdown on quit.
• ElectronProtocol now takes an explicit source: "proxy" | "static" (dropping the separate backendOrigin). Static serving adds path-safe file resolution with SPA fallback, MIME types, CSP, and HEAD support.
• Web routing treats client-only like hosted static, and local environment bootstraps are empty, so a client-only desktop is never stranded on a dead primary-backend state — it is routed to Connections instead.

Why

The desktop app should be usable as a pure client without stranding users who have no saved connections.

Scope note

This PR previously also contained Linux local t3 serve discovery. That half has been split into a separate PR so the two can be reviewed independently — the discovery work carries a distinct security surface (a live pairing credential on disk) and is Linux-only, whereas this change is cross-platform.

UI Changes

• Connections gains a Desktop application → Backend mode control.
• Client-only users with no connections are routed to Connections rather than a dead primary-backend state.
• Providers gains per-environment selection, scoped provider cards and controls, and explicit loading, offline, error, empty, editable, and read-only states from feat(web): per-device provider settings #4479.
• General, Source Control, Keybindings, and Diagnostics use the same selected-environment model; Diagnostics includes connection-aware refresh and failure states.
• Settings navigation distinguishes client-owned settings from environment-owned settings.

Packaged desktop evidence

Final privacy-reviewed evidence for this PR is pinned to immutable asset commit
d23321ea7d7200ef4d5e14f20dd2367997731706.

Capture context:

• PR head: bb2c567e6879cf762910a02a8d20943edc2689ce
• PR base: ece05087a70e94efcd57441337fa1249559362ba
• Synthetic combined-stack integration: 5ba3b7bd0995f401993706689105f41f51c16b02
• Exact GUI-tested package: /nix/store/86n9kxipsprgw6nbzyw7qhrw0wl4lfwx-t3code-0.0.29-patched-main-20260724

The packaged Electron app started with --backend-mode=client-only without
starting or owning a local backend, resolved its installed renderer assets,
and paired successfully to an independently started packaged t3 serve
backend. The saved environment then appeared online.

Client-only startup with no saved environment

Connections settings and active CLI override

Independent backend paired and online

Connected home state ·
capture manifest

After this GUI capture, the maintained stack advanced its upstream base to
41a430a88e8dde9c428f59d54dd328aa6a66a8fd. The intervening upstream delta
was isolated to #4472 model registration and did not overlap this desktop
change. The resulting final installed package
/nix/store/brp90sqhjxnnpczsnw9nmp1rlzi0qjgk-t3code-0.0.29-patched-main-20260724
built and activated successfully. The screenshots above remain specifically
attributable to the exact earlier package and synthetic integration listed
above; they are not represented as a GUI recapture of the later package.

Checklist

• corepack pnpm exec vp check (0 errors; 11 pre-existing unrelated warnings)
• corepack pnpm exec vp run --filter @t3tools/contracts --filter @t3tools/shared --filter t3 --filter @t3tools/desktop --filter @t3tools/web typecheck — clean
• CI=true vitest run apps/desktop/src apps/web/src/components/settings apps/web/src/environments apps/server/src/startupAccess.test.ts — 63 files, 437 tests
• Manually verified in an isolated Electron desktop: mode switch relaunches, client-only opens without a backend, packaged static renderer serves deep links, saved connections reconnect after restart

Note

Add client-only desktop backend mode that serves static assets without a local backend

• Introduces a client-only backend mode for the desktop app, selectable via the Connections settings page or --backend-mode CLI flag; in this mode the desktop app skips local backend startup entirely.
• Adds DesktopBackendMode service to parse, validate, and latch backend mode from settings and CLI; persists mode via DesktopAppSettings and triggers an app relaunch on change.
• Extends ElectronProtocol to serve packaged static assets (with SPA fallback, CSP, path traversal protection) when in client-only mode instead of proxying to a local backend.
• Exposes getBackendModeState (sync) and setBackendMode IPC methods via preload.ts so the renderer can read and change mode; the UI prevents switching to client-only without a saved remote environment.
• Refactors settings panels (General, Diagnostics, Keybindings, Source Control, Providers) to be environment-scoped, disabling server-backed controls when the selected environment is disconnected.
• Adds isDesktopClientOnlyMode detection in the web layer so routing, connection source selection, and sidebar/thread logic treat client-only the same as the hosted static app.
• Risk: switching backend mode triggers an app relaunch; if relaunch fails the settings change is reverted, but the UI will surface the error.

^{Macroscope summarized acb11a6.}

---

Note

High Risk
Touches Electron startup/shutdown, custom protocol static file serving (path traversal mitigations), and preload fail-closed behavior that can suppress local backend until IPC is ready; large cross-cutting desktop + web surface.

Overview
Introduces managed vs client-only desktop backend mode (persisted settings, --backend-mode CLI override, IPC get/set). In client-only, startup skips the backend pool, registers Electron protocol as static packaged assets or dev proxy, opens the main window on renderer readiness, and does not stop backends on quit.

ElectronProtocol now uses source: "proxy" | "static" (drops backendOrigin); static mode adds safe path resolution, SPA fallback, MIME/CSP, and GET/HEAD handling. Connections exposes backend mode switching (relaunch); preload fails closed to client-only if mode IPC is missing.

Web UI shifts from always using the primary server atom to environment-scoped config: Providers/Add Provider, Diagnostics (selector + connection-aware loading), keybindings editor keys, and sidebar/command palette grouping use useDefaultServerConfig, EnvironmentPresenceScope, and ownsLocalEnvironment so client-only desktops do not assume a local primary backend.

^{Reviewed by Cursor Bugbot for commit acb11a6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 76f5a485-2760-41bb-b19f-f63af805e9fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Diff is too large for automated approval analysis. A human reviewer should evaluate this PR.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2fbd1f5. Configure here.}

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

Closing this PR after an automated pass over open pull requests. Introduces an alternate client-only desktop architecture across 81 files.

[colonelpanic8]

Consolidation update

This branch is rebased onto the latest main and now serves as the combined client/server-model stack:

• Merges feat(web): per-device provider settings #4479's complete per-device Providers settings UI and behavior: environment selection, environment-scoped reads/writes/refreshes/updates/instance creation, editable and read-only provider views, loading/offline/error states, and shared model-preference preservation.
• Folds the non-provider environment-scoped settings work from Target server settings by environment #4559.
• Folds Separate client and environment settings #4567's client-versus-environment settings ownership and navigation.
• Folds feat(web): select diagnostics environment #4486's diagnostics environment selection and connection-aware state.
• Does not replay Configure providers per environment #4548 separately because feat(web): per-device provider settings #4479 supersedes its provider-specific implementation. During integration, feat(web): per-device provider settings #4479's standalone Devices picker was replaced by Target server settings by environment #4559's shared settings-environment selector; its provider cards, dialogs, scoped commands, and permission-aware UI states remain.

What Changed

Let the desktop app run as a pure client for remote or independently managed backends, instead of always owning a local backend process.

• Add a persisted desktop backend mode with managed and client-only options, plus a launch-only --backend-mode override, exposed over IPC.
• In client-only, bootstrap skips the backend pool entirely and serves the renderer from packaged static assets (or the dev-server proxy), opens the window on renderer readiness rather than backend readiness, and skips backend shutdown on quit.
• ElectronProtocol now takes an explicit source: "proxy" | "static" (dropping the separate backendOrigin). Static serving adds path-safe file resolution with SPA fallback, MIME types, CSP, and HEAD support.
• Web routing treats client-only like hosted static, and local environment bootstraps are empty, so a client-only desktop is never stranded on a dead primary-backend state — it is routed to Connections instead.

Why

The desktop app should be usable as a pure client without stranding users who have no saved connections.

Scope note

This PR previously also contained Linux local t3 serve discovery. That half has been split into a separate PR so the two can be reviewed independently — the discovery work carries a distinct security surface (a live pairing credential on disk) and is Linux-only, whereas this change is cross-platform.

UI Changes

• Connections gains a Desktop application → Backend mode control.
• Client-only users with no connections are routed to Connections rather than a dead primary-backend state.
• Providers gains per-environment selection, scoped provider cards and controls, and explicit loading, offline, error, empty, editable, and read-only states from feat(web): per-device provider settings #4479.
• General, Source Control, Keybindings, and Diagnostics use the same selected-environment model; Diagnostics includes connection-aware refresh and failure states.
• Settings navigation distinguishes client-owned settings from environment-owned settings.

Packaged desktop evidence

Final privacy-reviewed evidence for this PR is pinned to immutable asset commit
d23321ea7d7200ef4d5e14f20dd2367997731706.

Capture context:

• PR head: bb2c567e6879cf762910a02a8d20943edc2689ce
• PR base: ece05087a70e94efcd57441337fa1249559362ba
• Synthetic combined-stack integration: 5ba3b7bd0995f401993706689105f41f51c16b02
• Exact GUI-tested package: /nix/store/86n9kxipsprgw6nbzyw7qhrw0wl4lfwx-t3code-0.0.29-patched-main-20260724

The packaged Electron app started with --backend-mode=client-only without
starting or owning a local backend, resolved its installed renderer assets,
and paired successfully to an independently started packaged t3 serve
backend. The saved environment then appeared online.

Client-only startup with no saved environment

Connections settings and active CLI override

Independent backend paired and online

Connected home state ·
capture manifest

After this GUI capture, the maintained stack advanced its upstream base to
41a430a88e8dde9c428f59d54dd328aa6a66a8fd. The intervening upstream delta
was isolated to #4472 model registration and did not overlap this desktop
change. The resulting final installed package
/nix/store/brp90sqhjxnnpczsnw9nmp1rlzi0qjgk-t3code-0.0.29-patched-main-20260724
built and activated successfully. The screenshots above remain specifically
attributable to the exact earlier package and synthetic integration listed
above; they are not represented as a GUI recapture of the later package.

Checklist

• corepack pnpm exec vp check (0 errors; 11 pre-existing unrelated warnings)
• corepack pnpm exec vp run --filter @t3tools/contracts --filter @t3tools/shared --filter t3 --filter @t3tools/desktop --filter @t3tools/web typecheck — clean
• CI=true vitest run apps/desktop/src apps/web/src/components/settings apps/web/src/environments apps/server/src/startupAccess.test.ts — 63 files, 437 tests
• Manually verified in an isolated Electron desktop: mode switch relaunches, client-only opens without a backend, packaged static renderer serves deep links, saved connections reconnect after restart

Note

Add client-only desktop backend mode that serves static assets without a local backend

• Introduces a client-only backend mode for the desktop app, selectable via the Connections settings page or --backend-mode CLI flag; in this mode the desktop app skips local backend startup entirely.
• Adds DesktopBackendMode service to parse, validate, and latch backend mode from settings and CLI; persists mode via DesktopAppSettings and triggers an app relaunch on change.
• Extends ElectronProtocol to serve packaged static assets (with SPA fallback, CSP, path traversal protection) when in client-only mode instead of proxying to a local backend.
• Exposes getBackendModeState (sync) and setBackendMode IPC methods via preload.ts so the renderer can read and change mode; the UI prevents switching to client-only without a saved remote environment.
• Refactors settings panels (General, Diagnostics, Keybindings, Source Control, Providers) to be environment-scoped, disabling server-backed controls when the selected environment is disconnected.
• Adds isDesktopClientOnlyMode detection in the web layer so routing, connection source selection, and sidebar/thread logic treat client-only the same as the hosted static app.
• Risk: switching backend mode triggers an app relaunch; if relaunch fails the settings change is reverted, but the UI will surface the error.

^{Macroscope summarized acb11a6.}

---

Note

High Risk
Touches Electron startup/shutdown, custom protocol static file serving (path traversal mitigations), and preload fail-closed behavior that can suppress local backend until IPC is ready; large cross-cutting desktop + web surface.

Overview
Introduces managed vs client-only desktop backend mode (persisted settings, --backend-mode CLI override, IPC get/set). In client-only, startup skips the backend pool, registers Electron protocol as static packaged assets or dev proxy, opens the main window on renderer readiness, and does not stop backends on quit.

ElectronProtocol now uses source: "proxy" | "static" (drops backendOrigin); static mode adds safe path resolution, SPA fallback, MIME/CSP, and GET/HEAD handling. Connections exposes backend mode switching (relaunch); preload fails closed to client-only if mode IPC is missing.

Web UI shifts from always using the primary server atom to environment-scoped config: Providers/Add Provider, Diagnostics (selector + connection-aware loading), keybindings editor keys, and sidebar/command palette grouping use useDefaultServerConfig, EnvironmentPresenceScope, and ownsLocalEnvironment so client-only desktops do not assume a local primary backend.

^{Reviewed by Cursor Bugbot for commit acb11a6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 76f5a485-2760-41bb-b19f-f63af805e9fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Diff is too large for automated approval analysis. A human reviewer should evaluate this PR.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2fbd1f5. Configure here.}

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

Closing this PR after an automated pass over open pull requests. Introduces an alternate client-only desktop architecture across 81 files.

[colonelpanic8]

Consolidation update

This branch is rebased onto the latest main and now serves as the combined client/server-model stack:

• Merges feat(web): per-device provider settings #4479's complete per-device Providers settings UI and behavior: environment selection, environment-scoped reads/writes/refreshes/updates/instance creation, editable and read-only provider views, loading/offline/error states, and shared model-preference preservation.
• Folds the non-provider environment-scoped settings work from Target server settings by environment #4559.
• Folds Separate client and environment settings #4567's client-versus-environment settings ownership and navigation.
• Folds feat(web): select diagnostics environment #4486's diagnostics environment selection and connection-aware state.
• Does not replay Configure providers per environment #4548 separately because feat(web): per-device provider settings #4479 supersedes its provider-specific implementation. During integration, feat(web): per-device provider settings #4479's standalone Devices picker was replaced by Target server settings by environment #4559's shared settings-environment selector; its provider cards, dialogs, scoped commands, and permission-aware UI states remain.

What Changed

Let the desktop app run as a pure client for remote or independently managed backends, instead of always owning a local backend process.

• Add a persisted desktop backend mode with managed and client-only options, plus a launch-only --backend-mode override, exposed over IPC.
• In client-only, bootstrap skips the backend pool entirely and serves the renderer from packaged static assets (or the dev-server proxy), opens the window on renderer readiness rather than backend readiness, and skips backend shutdown on quit.
• ElectronProtocol now takes an explicit source: "proxy" | "static" (dropping the separate backendOrigin). Static serving adds path-safe file resolution with SPA fallback, MIME types, CSP, and HEAD support.
• Web routing treats client-only like hosted static, and local environment bootstraps are empty, so a client-only desktop is never stranded on a dead primary-backend state — it is routed to Connections instead.

Why

The desktop app should be usable as a pure client without stranding users who have no saved connections.

Scope note

This PR previously also contained Linux local t3 serve discovery. That half has been split into a separate PR so the two can be reviewed independently — the discovery work carries a distinct security surface (a live pairing credential on disk) and is Linux-only, whereas this change is cross-platform.

UI Changes

• Connections gains a Desktop application → Backend mode control.
• Client-only users with no connections are routed to Connections rather than a dead primary-backend state.
• Providers gains per-environment selection, scoped provider cards and controls, and explicit loading, offline, error, empty, editable, and read-only states from feat(web): per-device provider settings #4479.
• General, Source Control, Keybindings, and Diagnostics use the same selected-environment model; Diagnostics includes connection-aware refresh and failure states.
• Settings navigation distinguishes client-owned settings from environment-owned settings.

Packaged desktop evidence

Final privacy-reviewed evidence for this PR is pinned to immutable asset commit
d23321ea7d7200ef4d5e14f20dd2367997731706.

Capture context:

• PR head: bb2c567e6879cf762910a02a8d20943edc2689ce
• PR base: ece05087a70e94efcd57441337fa1249559362ba
• Synthetic combined-stack integration: 5ba3b7bd0995f401993706689105f41f51c16b02
• Exact GUI-tested package: /nix/store/86n9kxipsprgw6nbzyw7qhrw0wl4lfwx-t3code-0.0.29-patched-main-20260724

The packaged Electron app started with --backend-mode=client-only without
starting or owning a local backend, resolved its installed renderer assets,
and paired successfully to an independently started packaged t3 serve
backend. The saved environment then appeared online.

Client-only startup with no saved environment

Connections settings and active CLI override

Independent backend paired and online

Connected home state ·
capture manifest

After this GUI capture, the maintained stack advanced its upstream base to
41a430a88e8dde9c428f59d54dd328aa6a66a8fd. The intervening upstream delta
was isolated to #4472 model registration and did not overlap this desktop
change. The resulting final installed package
/nix/store/brp90sqhjxnnpczsnw9nmp1rlzi0qjgk-t3code-0.0.29-patched-main-20260724
built and activated successfully. The screenshots above remain specifically
attributable to the exact earlier package and synthetic integration listed
above; they are not represented as a GUI recapture of the later package.

Checklist

• corepack pnpm exec vp check (0 errors; 11 pre-existing unrelated warnings)
• corepack pnpm exec vp run --filter @t3tools/contracts --filter @t3tools/shared --filter t3 --filter @t3tools/desktop --filter @t3tools/web typecheck — clean
• CI=true vitest run apps/desktop/src apps/web/src/components/settings apps/web/src/environments apps/server/src/startupAccess.test.ts — 63 files, 437 tests
• Manually verified in an isolated Electron desktop: mode switch relaunches, client-only opens without a backend, packaged static renderer serves deep links, saved connections reconnect after restart

Note

Add client-only desktop backend mode that serves static assets without a local backend

• Introduces a client-only backend mode for the desktop app, selectable via the Connections settings page or --backend-mode CLI flag; in this mode the desktop app skips local backend startup entirely.
• Adds DesktopBackendMode service to parse, validate, and latch backend mode from settings and CLI; persists mode via DesktopAppSettings and triggers an app relaunch on change.
• Extends ElectronProtocol to serve packaged static assets (with SPA fallback, CSP, path traversal protection) when in client-only mode instead of proxying to a local backend.
• Exposes getBackendModeState (sync) and setBackendMode IPC methods via preload.ts so the renderer can read and change mode; the UI prevents switching to client-only without a saved remote environment.
• Refactors settings panels (General, Diagnostics, Keybindings, Source Control, Providers) to be environment-scoped, disabling server-backed controls when the selected environment is disconnected.
• Adds isDesktopClientOnlyMode detection in the web layer so routing, connection source selection, and sidebar/thread logic treat client-only the same as the hosted static app.
• Risk: switching backend mode triggers an app relaunch; if relaunch fails the settings change is reverted, but the UI will surface the error.

^{Macroscope summarized acb11a6.}

---

Note

High Risk
Touches Electron startup/shutdown, custom protocol static file serving (path traversal mitigations), and preload fail-closed behavior that can suppress local backend until IPC is ready; large cross-cutting desktop + web surface.

Overview
Introduces managed vs client-only desktop backend mode (persisted settings, --backend-mode CLI override, IPC get/set). In client-only, startup skips the backend pool, registers Electron protocol as static packaged assets or dev proxy, opens the main window on renderer readiness, and does not stop backends on quit.

ElectronProtocol now uses source: "proxy" | "static" (drops backendOrigin); static mode adds safe path resolution, SPA fallback, MIME/CSP, and GET/HEAD handling. Connections exposes backend mode switching (relaunch); preload fails closed to client-only if mode IPC is missing.

Web UI shifts from always using the primary server atom to environment-scoped config: Providers/Add Provider, Diagnostics (selector + connection-aware loading), keybindings editor keys, and sidebar/command palette grouping use useDefaultServerConfig, EnvironmentPresenceScope, and ownsLocalEnvironment so client-only desktops do not assume a local primary backend.

^{Reviewed by Cursor Bugbot for commit acb11a6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 76f5a485-2760-41bb-b19f-f63af805e9fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Diff is too large for automated approval analysis. A human reviewer should evaluate this PR.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2fbd1f5. Configure here.}

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

Closing this PR after an automated pass over open pull requests. Introduces an alternate client-only desktop architecture across 81 files.

[colonelpanic8]

Consolidation update

This branch is rebased onto the latest main and now serves as the combined client/server-model stack:

• Merges feat(web): per-device provider settings #4479's complete per-device Providers settings UI and behavior: environment selection, environment-scoped reads/writes/refreshes/updates/instance creation, editable and read-only provider views, loading/offline/error states, and shared model-preference preservation.
• Folds the non-provider environment-scoped settings work from Target server settings by environment #4559.
• Folds Separate client and environment settings #4567's client-versus-environment settings ownership and navigation.
• Folds feat(web): select diagnostics environment #4486's diagnostics environment selection and connection-aware state.
• Does not replay Configure providers per environment #4548 separately because feat(web): per-device provider settings #4479 supersedes its provider-specific implementation. During integration, feat(web): per-device provider settings #4479's standalone Devices picker was replaced by Target server settings by environment #4559's shared settings-environment selector; its provider cards, dialogs, scoped commands, and permission-aware UI states remain.

What Changed

Let the desktop app run as a pure client for remote or independently managed backends, instead of always owning a local backend process.

• Add a persisted desktop backend mode with managed and client-only options, plus a launch-only --backend-mode override, exposed over IPC.
• In client-only, bootstrap skips the backend pool entirely and serves the renderer from packaged static assets (or the dev-server proxy), opens the window on renderer readiness rather than backend readiness, and skips backend shutdown on quit.
• ElectronProtocol now takes an explicit source: "proxy" | "static" (dropping the separate backendOrigin). Static serving adds path-safe file resolution with SPA fallback, MIME types, CSP, and HEAD support.
• Web routing treats client-only like hosted static, and local environment bootstraps are empty, so a client-only desktop is never stranded on a dead primary-backend state — it is routed to Connections instead.

Why

The desktop app should be usable as a pure client without stranding users who have no saved connections.

Scope note

This PR previously also contained Linux local t3 serve discovery. That half has been split into a separate PR so the two can be reviewed independently — the discovery work carries a distinct security surface (a live pairing credential on disk) and is Linux-only, whereas this change is cross-platform.

UI Changes

• Connections gains a Desktop application → Backend mode control.
• Client-only users with no connections are routed to Connections rather than a dead primary-backend state.
• Providers gains per-environment selection, scoped provider cards and controls, and explicit loading, offline, error, empty, editable, and read-only states from feat(web): per-device provider settings #4479.
• General, Source Control, Keybindings, and Diagnostics use the same selected-environment model; Diagnostics includes connection-aware refresh and failure states.
• Settings navigation distinguishes client-owned settings from environment-owned settings.

Packaged desktop evidence

Final privacy-reviewed evidence for this PR is pinned to immutable asset commit
d23321ea7d7200ef4d5e14f20dd2367997731706.

Capture context:

• PR head: bb2c567e6879cf762910a02a8d20943edc2689ce
• PR base: ece05087a70e94efcd57441337fa1249559362ba
• Synthetic combined-stack integration: 5ba3b7bd0995f401993706689105f41f51c16b02
• Exact GUI-tested package: /nix/store/86n9kxipsprgw6nbzyw7qhrw0wl4lfwx-t3code-0.0.29-patched-main-20260724

The packaged Electron app started with --backend-mode=client-only without
starting or owning a local backend, resolved its installed renderer assets,
and paired successfully to an independently started packaged t3 serve
backend. The saved environment then appeared online.

Client-only startup with no saved environment

Connections settings and active CLI override

Independent backend paired and online

Connected home state ·
capture manifest

After this GUI capture, the maintained stack advanced its upstream base to
41a430a88e8dde9c428f59d54dd328aa6a66a8fd. The intervening upstream delta
was isolated to #4472 model registration and did not overlap this desktop
change. The resulting final installed package
/nix/store/brp90sqhjxnnpczsnw9nmp1rlzi0qjgk-t3code-0.0.29-patched-main-20260724
built and activated successfully. The screenshots above remain specifically
attributable to the exact earlier package and synthetic integration listed
above; they are not represented as a GUI recapture of the later package.

Checklist

• corepack pnpm exec vp check (0 errors; 11 pre-existing unrelated warnings)
• corepack pnpm exec vp run --filter @t3tools/contracts --filter @t3tools/shared --filter t3 --filter @t3tools/desktop --filter @t3tools/web typecheck — clean
• CI=true vitest run apps/desktop/src apps/web/src/components/settings apps/web/src/environments apps/server/src/startupAccess.test.ts — 63 files, 437 tests
• Manually verified in an isolated Electron desktop: mode switch relaunches, client-only opens without a backend, packaged static renderer serves deep links, saved connections reconnect after restart

Note

Add client-only desktop backend mode that serves static assets without a local backend

• Introduces a client-only backend mode for the desktop app, selectable via the Connections settings page or --backend-mode CLI flag; in this mode the desktop app skips local backend startup entirely.
• Adds DesktopBackendMode service to parse, validate, and latch backend mode from settings and CLI; persists mode via DesktopAppSettings and triggers an app relaunch on change.
• Extends ElectronProtocol to serve packaged static assets (with SPA fallback, CSP, path traversal protection) when in client-only mode instead of proxying to a local backend.
• Exposes getBackendModeState (sync) and setBackendMode IPC methods via preload.ts so the renderer can read and change mode; the UI prevents switching to client-only without a saved remote environment.
• Refactors settings panels (General, Diagnostics, Keybindings, Source Control, Providers) to be environment-scoped, disabling server-backed controls when the selected environment is disconnected.
• Adds isDesktopClientOnlyMode detection in the web layer so routing, connection source selection, and sidebar/thread logic treat client-only the same as the hosted static app.
• Risk: switching backend mode triggers an app relaunch; if relaunch fails the settings change is reverted, but the UI will surface the error.

^{Macroscope summarized acb11a6.}

---

Note

High Risk
Touches Electron startup/shutdown, custom protocol static file serving (path traversal mitigations), and preload fail-closed behavior that can suppress local backend until IPC is ready; large cross-cutting desktop + web surface.

Overview
Introduces managed vs client-only desktop backend mode (persisted settings, --backend-mode CLI override, IPC get/set). In client-only, startup skips the backend pool, registers Electron protocol as static packaged assets or dev proxy, opens the main window on renderer readiness, and does not stop backends on quit.

ElectronProtocol now uses source: "proxy" | "static" (drops backendOrigin); static mode adds safe path resolution, SPA fallback, MIME/CSP, and GET/HEAD handling. Connections exposes backend mode switching (relaunch); preload fails closed to client-only if mode IPC is missing.

Web UI shifts from always using the primary server atom to environment-scoped config: Providers/Add Provider, Diagnostics (selector + connection-aware loading), keybindings editor keys, and sidebar/command palette grouping use useDefaultServerConfig, EnvironmentPresenceScope, and ownsLocalEnvironment so client-only desktops do not assume a local primary backend.

^{Reviewed by Cursor Bugbot for commit acb11a6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 76f5a485-2760-41bb-b19f-f63af805e9fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Diff is too large for automated approval analysis. A human reviewer should evaluate this PR.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2fbd1f5. Configure here.}

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

Closing this PR after an automated pass over open pull requests. Introduces an alternate client-only desktop architecture across 81 files.

[colonelpanic8]

Consolidation update

This branch is rebased onto the latest main and now serves as the combined client/server-model stack:

• Merges feat(web): per-device provider settings #4479's complete per-device Providers settings UI and behavior: environment selection, environment-scoped reads/writes/refreshes/updates/instance creation, editable and read-only provider views, loading/offline/error states, and shared model-preference preservation.
• Folds the non-provider environment-scoped settings work from Target server settings by environment #4559.
• Folds Separate client and environment settings #4567's client-versus-environment settings ownership and navigation.
• Folds feat(web): select diagnostics environment #4486's diagnostics environment selection and connection-aware state.
• Does not replay Configure providers per environment #4548 separately because feat(web): per-device provider settings #4479 supersedes its provider-specific implementation. During integration, feat(web): per-device provider settings #4479's standalone Devices picker was replaced by Target server settings by environment #4559's shared settings-environment selector; its provider cards, dialogs, scoped commands, and permission-aware UI states remain.

What Changed

Let the desktop app run as a pure client for remote or independently managed backends, instead of always owning a local backend process.

• Add a persisted desktop backend mode with managed and client-only options, plus a launch-only --backend-mode override, exposed over IPC.
• In client-only, bootstrap skips the backend pool entirely and serves the renderer from packaged static assets (or the dev-server proxy), opens the window on renderer readiness rather than backend readiness, and skips backend shutdown on quit.
• ElectronProtocol now takes an explicit source: "proxy" | "static" (dropping the separate backendOrigin). Static serving adds path-safe file resolution with SPA fallback, MIME types, CSP, and HEAD support.
• Web routing treats client-only like hosted static, and local environment bootstraps are empty, so a client-only desktop is never stranded on a dead primary-backend state — it is routed to Connections instead.

Why

The desktop app should be usable as a pure client without stranding users who have no saved connections.

Scope note

This PR previously also contained Linux local t3 serve discovery. That half has been split into a separate PR so the two can be reviewed independently — the discovery work carries a distinct security surface (a live pairing credential on disk) and is Linux-only, whereas this change is cross-platform.

UI Changes

• Connections gains a Desktop application → Backend mode control.
• Client-only users with no connections are routed to Connections rather than a dead primary-backend state.
• Providers gains per-environment selection, scoped provider cards and controls, and explicit loading, offline, error, empty, editable, and read-only states from feat(web): per-device provider settings #4479.
• General, Source Control, Keybindings, and Diagnostics use the same selected-environment model; Diagnostics includes connection-aware refresh and failure states.
• Settings navigation distinguishes client-owned settings from environment-owned settings.

Packaged desktop evidence

Final privacy-reviewed evidence for this PR is pinned to immutable asset commit
d23321ea7d7200ef4d5e14f20dd2367997731706.

Capture context:

• PR head: bb2c567e6879cf762910a02a8d20943edc2689ce
• PR base: ece05087a70e94efcd57441337fa1249559362ba
• Synthetic combined-stack integration: 5ba3b7bd0995f401993706689105f41f51c16b02
• Exact GUI-tested package: /nix/store/86n9kxipsprgw6nbzyw7qhrw0wl4lfwx-t3code-0.0.29-patched-main-20260724

The packaged Electron app started with --backend-mode=client-only without
starting or owning a local backend, resolved its installed renderer assets,
and paired successfully to an independently started packaged t3 serve
backend. The saved environment then appeared online.

Client-only startup with no saved environment

Connections settings and active CLI override

Independent backend paired and online

Connected home state ·
capture manifest

After this GUI capture, the maintained stack advanced its upstream base to
41a430a88e8dde9c428f59d54dd328aa6a66a8fd. The intervening upstream delta
was isolated to #4472 model registration and did not overlap this desktop
change. The resulting final installed package
/nix/store/brp90sqhjxnnpczsnw9nmp1rlzi0qjgk-t3code-0.0.29-patched-main-20260724
built and activated successfully. The screenshots above remain specifically
attributable to the exact earlier package and synthetic integration listed
above; they are not represented as a GUI recapture of the later package.

Checklist

• corepack pnpm exec vp check (0 errors; 11 pre-existing unrelated warnings)
• corepack pnpm exec vp run --filter @t3tools/contracts --filter @t3tools/shared --filter t3 --filter @t3tools/desktop --filter @t3tools/web typecheck — clean
• CI=true vitest run apps/desktop/src apps/web/src/components/settings apps/web/src/environments apps/server/src/startupAccess.test.ts — 63 files, 437 tests
• Manually verified in an isolated Electron desktop: mode switch relaunches, client-only opens without a backend, packaged static renderer serves deep links, saved connections reconnect after restart

Note

Add client-only desktop backend mode that serves static assets without a local backend

• Introduces a client-only backend mode for the desktop app, selectable via the Connections settings page or --backend-mode CLI flag; in this mode the desktop app skips local backend startup entirely.
• Adds DesktopBackendMode service to parse, validate, and latch backend mode from settings and CLI; persists mode via DesktopAppSettings and triggers an app relaunch on change.
• Extends ElectronProtocol to serve packaged static assets (with SPA fallback, CSP, path traversal protection) when in client-only mode instead of proxying to a local backend.
• Exposes getBackendModeState (sync) and setBackendMode IPC methods via preload.ts so the renderer can read and change mode; the UI prevents switching to client-only without a saved remote environment.
• Refactors settings panels (General, Diagnostics, Keybindings, Source Control, Providers) to be environment-scoped, disabling server-backed controls when the selected environment is disconnected.
• Adds isDesktopClientOnlyMode detection in the web layer so routing, connection source selection, and sidebar/thread logic treat client-only the same as the hosted static app.
• Risk: switching backend mode triggers an app relaunch; if relaunch fails the settings change is reverted, but the UI will surface the error.

^{Macroscope summarized acb11a6.}

---

Note

High Risk
Touches Electron startup/shutdown, custom protocol static file serving (path traversal mitigations), and preload fail-closed behavior that can suppress local backend until IPC is ready; large cross-cutting desktop + web surface.

Overview
Introduces managed vs client-only desktop backend mode (persisted settings, --backend-mode CLI override, IPC get/set). In client-only, startup skips the backend pool, registers Electron protocol as static packaged assets or dev proxy, opens the main window on renderer readiness, and does not stop backends on quit.

ElectronProtocol now uses source: "proxy" | "static" (drops backendOrigin); static mode adds safe path resolution, SPA fallback, MIME/CSP, and GET/HEAD handling. Connections exposes backend mode switching (relaunch); preload fails closed to client-only if mode IPC is missing.

Web UI shifts from always using the primary server atom to environment-scoped config: Providers/Add Provider, Diagnostics (selector + connection-aware loading), keybindings editor keys, and sidebar/command palette grouping use useDefaultServerConfig, EnvironmentPresenceScope, and ownsLocalEnvironment so client-only desktops do not assume a local primary backend.

^{Reviewed by Cursor Bugbot for commit acb11a6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 76f5a485-2760-41bb-b19f-f63af805e9fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Diff is too large for automated approval analysis. A human reviewer should evaluate this PR.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2fbd1f5. Configure here.}

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

Closing this PR after an automated pass over open pull requests. Introduces an alternate client-only desktop architecture across 81 files.

[colonelpanic8]

Consolidation update

This branch is rebased onto the latest main and now serves as the combined client/server-model stack:

• Merges feat(web): per-device provider settings #4479's complete per-device Providers settings UI and behavior: environment selection, environment-scoped reads/writes/refreshes/updates/instance creation, editable and read-only provider views, loading/offline/error states, and shared model-preference preservation.
• Folds the non-provider environment-scoped settings work from Target server settings by environment #4559.
• Folds Separate client and environment settings #4567's client-versus-environment settings ownership and navigation.
• Folds feat(web): select diagnostics environment #4486's diagnostics environment selection and connection-aware state.
• Does not replay Configure providers per environment #4548 separately because feat(web): per-device provider settings #4479 supersedes its provider-specific implementation. During integration, feat(web): per-device provider settings #4479's standalone Devices picker was replaced by Target server settings by environment #4559's shared settings-environment selector; its provider cards, dialogs, scoped commands, and permission-aware UI states remain.

What Changed

Let the desktop app run as a pure client for remote or independently managed backends, instead of always owning a local backend process.

• Add a persisted desktop backend mode with managed and client-only options, plus a launch-only --backend-mode override, exposed over IPC.
• In client-only, bootstrap skips the backend pool entirely and serves the renderer from packaged static assets (or the dev-server proxy), opens the window on renderer readiness rather than backend readiness, and skips backend shutdown on quit.
• ElectronProtocol now takes an explicit source: "proxy" | "static" (dropping the separate backendOrigin). Static serving adds path-safe file resolution with SPA fallback, MIME types, CSP, and HEAD support.
• Web routing treats client-only like hosted static, and local environment bootstraps are empty, so a client-only desktop is never stranded on a dead primary-backend state — it is routed to Connections instead.

Why

The desktop app should be usable as a pure client without stranding users who have no saved connections.

Scope note

This PR previously also contained Linux local t3 serve discovery. That half has been split into a separate PR so the two can be reviewed independently — the discovery work carries a distinct security surface (a live pairing credential on disk) and is Linux-only, whereas this change is cross-platform.

UI Changes

• Connections gains a Desktop application → Backend mode control.
• Client-only users with no connections are routed to Connections rather than a dead primary-backend state.
• Providers gains per-environment selection, scoped provider cards and controls, and explicit loading, offline, error, empty, editable, and read-only states from feat(web): per-device provider settings #4479.
• General, Source Control, Keybindings, and Diagnostics use the same selected-environment model; Diagnostics includes connection-aware refresh and failure states.
• Settings navigation distinguishes client-owned settings from environment-owned settings.

Packaged desktop evidence

Final privacy-reviewed evidence for this PR is pinned to immutable asset commit
d23321ea7d7200ef4d5e14f20dd2367997731706.

Capture context:

• PR head: bb2c567e6879cf762910a02a8d20943edc2689ce
• PR base: ece05087a70e94efcd57441337fa1249559362ba
• Synthetic combined-stack integration: 5ba3b7bd0995f401993706689105f41f51c16b02
• Exact GUI-tested package: /nix/store/86n9kxipsprgw6nbzyw7qhrw0wl4lfwx-t3code-0.0.29-patched-main-20260724

The packaged Electron app started with --backend-mode=client-only without
starting or owning a local backend, resolved its installed renderer assets,
and paired successfully to an independently started packaged t3 serve
backend. The saved environment then appeared online.

Client-only startup with no saved environment

Connections settings and active CLI override

Independent backend paired and online

Connected home state ·
capture manifest

After this GUI capture, the maintained stack advanced its upstream base to
41a430a88e8dde9c428f59d54dd328aa6a66a8fd. The intervening upstream delta
was isolated to #4472 model registration and did not overlap this desktop
change. The resulting final installed package
/nix/store/brp90sqhjxnnpczsnw9nmp1rlzi0qjgk-t3code-0.0.29-patched-main-20260724
built and activated successfully. The screenshots above remain specifically
attributable to the exact earlier package and synthetic integration listed
above; they are not represented as a GUI recapture of the later package.

Checklist

• corepack pnpm exec vp check (0 errors; 11 pre-existing unrelated warnings)
• corepack pnpm exec vp run --filter @t3tools/contracts --filter @t3tools/shared --filter t3 --filter @t3tools/desktop --filter @t3tools/web typecheck — clean
• CI=true vitest run apps/desktop/src apps/web/src/components/settings apps/web/src/environments apps/server/src/startupAccess.test.ts — 63 files, 437 tests
• Manually verified in an isolated Electron desktop: mode switch relaunches, client-only opens without a backend, packaged static renderer serves deep links, saved connections reconnect after restart

Note

Add client-only desktop backend mode that serves static assets without a local backend

• Introduces a client-only backend mode for the desktop app, selectable via the Connections settings page or --backend-mode CLI flag; in this mode the desktop app skips local backend startup entirely.
• Adds DesktopBackendMode service to parse, validate, and latch backend mode from settings and CLI; persists mode via DesktopAppSettings and triggers an app relaunch on change.
• Extends ElectronProtocol to serve packaged static assets (with SPA fallback, CSP, path traversal protection) when in client-only mode instead of proxying to a local backend.
• Exposes getBackendModeState (sync) and setBackendMode IPC methods via preload.ts so the renderer can read and change mode; the UI prevents switching to client-only without a saved remote environment.
• Refactors settings panels (General, Diagnostics, Keybindings, Source Control, Providers) to be environment-scoped, disabling server-backed controls when the selected environment is disconnected.
• Adds isDesktopClientOnlyMode detection in the web layer so routing, connection source selection, and sidebar/thread logic treat client-only the same as the hosted static app.
• Risk: switching backend mode triggers an app relaunch; if relaunch fails the settings change is reverted, but the UI will surface the error.

^{Macroscope summarized acb11a6.}

---

Note

High Risk
Touches Electron startup/shutdown, custom protocol static file serving (path traversal mitigations), and preload fail-closed behavior that can suppress local backend until IPC is ready; large cross-cutting desktop + web surface.

Overview
Introduces managed vs client-only desktop backend mode (persisted settings, --backend-mode CLI override, IPC get/set). In client-only, startup skips the backend pool, registers Electron protocol as static packaged assets or dev proxy, opens the main window on renderer readiness, and does not stop backends on quit.

ElectronProtocol now uses source: "proxy" | "static" (drops backendOrigin); static mode adds safe path resolution, SPA fallback, MIME/CSP, and GET/HEAD handling. Connections exposes backend mode switching (relaunch); preload fails closed to client-only if mode IPC is missing.

Web UI shifts from always using the primary server atom to environment-scoped config: Providers/Add Provider, Diagnostics (selector + connection-aware loading), keybindings editor keys, and sidebar/command palette grouping use useDefaultServerConfig, EnvironmentPresenceScope, and ownsLocalEnvironment so client-only desktops do not assume a local primary backend.

^{Reviewed by Cursor Bugbot for commit acb11a6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 76f5a485-2760-41bb-b19f-f63af805e9fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

Diff is too large for automated approval analysis. A human reviewer should evaluate this PR.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2fbd1f5. Configure here.}

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

Closing this PR after an automated pass over open pull requests. Introduces an alternate client-only desktop architecture across 81 files.