feat(desktop): update the desktop app on remote Macs from the Update button

[t3dotgg]

Remote desktop-managed servers could not update their desktop app.

This change uses a two-phase handoff. Desktop checks and downloads first, then reports a short-lived token while the backend stays connected. The client sends a commit RPC after it receives the token. It accepts success only after reconnecting to the exact prepared version, and retries a lost commit with the same token.

Preparations expire, support early cancellation, and wait up to 90 seconds for a background check. Tokens bind the downloaded version. Duplicate commits cannot start a second install. Desktop keeps windows open until Electron starts updater-controlled quit. Install failures hold a recovery reservation while stopped backends restart, and retained failures replay after restart. Tokenless desktop updates must prove the target version before the client accepts success.

Verification passed 205 focused tests and scoped typechecks across all affected packages. A child-process test passed through the real fd3/fd4 transport with the update services and telemetry services. It covered child restart, failure replay, and duplicate commits. Packaged Mac installation is not yet verified.

Failure recovery adapts #8429 without merging or closing it. Original work by Theo with Claude Code. Protocol and recovery by GPT-5.6 Sol with Codex. Failure recovery commits by Adolanium.

Note

Add server-triggered desktop app updates via server.commitDesktopUpdate RPC

• Adds a telemetry control channel for server-to-desktop update request, commit, and cancel messages, and a DesktopRemoteUpdates listener that mirrors updater state to the server through DesktopUpdateStatusReport
• Adds the server-side DesktopAppUpdate service that correlates status reports by request ID, maps progress stages, and returns a desktop-app self-update result with a commit token when the desktop reports ready-to-install
• Extends DesktopUpdates with install recovery that restarts backends on installer failure, version-checked installPrepared, and a bounded state-change stream via subscribe
• Web UI renders an Update button with confirmation for desktop-managed servers advertising the desktopAppUpdate capability; unsupported servers retain manual instructions
• Adds reconnect-observer logic so a desktop commit lost during transport handoff waits for reconnection and retries up to three ready events before failing with ServerUpdateTerminalError
• Behavioral Change: updater-controlled quit now destroys windows synchronously inside the before-quit-for-update listener instead of forking an async effect; ServerEnvironment advertises desktopAppUpdate: true only for desktop-managed servers with a desktopTelemetryControlFd, and serverCommitDesktopUpdate requires AuthOrchestrationOperateScope

^{Macroscope summarized 3eacbbb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 370c51d2-3573-4944-9650-f5f3100b931b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Effect service conventions: one finding — Effect.catchTag used in the new DesktopAppUpdate service; the repo convention is Effect.catchTags({ ... }) even for a single tag. Everything else in the new service/layer code (namespace subpath imports, inline Context.Service interface, make + layer exports, Foo["Service"] typing, environment-acquired dependencies, no runtime escapes) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.1 KiB	13.3 KiB	+164 B (+1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.2 KiB	6.4 KiB	+166 B (+2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	54.7 KiB	55.6 KiB	+910 B (+1.6%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−158 B (−1.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.4 KiB	−161 B (−2.4%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.8 KiB	56.4 KiB	−1.4 KiB (−2.5%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: 8efd4e9 · PR result: 3eacbbb · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This cross-layer feature adds an authenticated remote desktop-update protocol and a two-phase workflow that can download, install, quit, relaunch, and recover the desktop app. It introduces substantial production behavior across the desktop, server, client runtime, UI, and contracts, including a sensitive authorization change, so the side effects require human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

macOS preview

The preview download was removed because this PR closed or the preview label was removed.

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

Fixed and pushed in cb96a8e268b5acc0d7f40017a5b0b30fff582af8. Remote commit now joins only when the exact downloaded version still matches and the updater's install reservation is active. Ordinary quit and relaunch no longer count as an install handoff. Tests use a real competing local install and cover normal quit separately. The coordination hold is cleared, subject to normal CI and review.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0fc8f4a. Configure here.}

[t3dotgg]

Remote desktop-managed servers could not update their desktop app.

This change uses a two-phase handoff. Desktop checks and downloads first, then reports a short-lived token while the backend stays connected. The client sends a commit RPC after it receives the token. It accepts success only after reconnecting to the exact prepared version, and retries a lost commit with the same token.

Preparations expire, support early cancellation, and wait up to 90 seconds for a background check. Tokens bind the downloaded version. Duplicate commits cannot start a second install. Desktop keeps windows open until Electron starts updater-controlled quit. Install failures hold a recovery reservation while stopped backends restart, and retained failures replay after restart. Tokenless desktop updates must prove the target version before the client accepts success.

Verification passed 205 focused tests and scoped typechecks across all affected packages. A child-process test passed through the real fd3/fd4 transport with the update services and telemetry services. It covered child restart, failure replay, and duplicate commits. Packaged Mac installation is not yet verified.

Failure recovery adapts #8429 without merging or closing it. Original work by Theo with Claude Code. Protocol and recovery by GPT-5.6 Sol with Codex. Failure recovery commits by Adolanium.

Note

Add server-triggered desktop app updates via server.commitDesktopUpdate RPC

• Adds a telemetry control channel for server-to-desktop update request, commit, and cancel messages, and a DesktopRemoteUpdates listener that mirrors updater state to the server through DesktopUpdateStatusReport
• Adds the server-side DesktopAppUpdate service that correlates status reports by request ID, maps progress stages, and returns a desktop-app self-update result with a commit token when the desktop reports ready-to-install
• Extends DesktopUpdates with install recovery that restarts backends on installer failure, version-checked installPrepared, and a bounded state-change stream via subscribe
• Web UI renders an Update button with confirmation for desktop-managed servers advertising the desktopAppUpdate capability; unsupported servers retain manual instructions
• Adds reconnect-observer logic so a desktop commit lost during transport handoff waits for reconnection and retries up to three ready events before failing with ServerUpdateTerminalError
• Behavioral Change: updater-controlled quit now destroys windows synchronously inside the before-quit-for-update listener instead of forking an async effect; ServerEnvironment advertises desktopAppUpdate: true only for desktop-managed servers with a desktopTelemetryControlFd, and serverCommitDesktopUpdate requires AuthOrchestrationOperateScope

^{Macroscope summarized 3eacbbb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 370c51d2-3573-4944-9650-f5f3100b931b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Effect service conventions: one finding — Effect.catchTag used in the new DesktopAppUpdate service; the repo convention is Effect.catchTags({ ... }) even for a single tag. Everything else in the new service/layer code (namespace subpath imports, inline Context.Service interface, make + layer exports, Foo["Service"] typing, environment-acquired dependencies, no runtime escapes) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.1 KiB	13.3 KiB	+164 B (+1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.2 KiB	6.4 KiB	+166 B (+2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	54.7 KiB	55.6 KiB	+910 B (+1.6%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−158 B (−1.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.4 KiB	−161 B (−2.4%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.8 KiB	56.4 KiB	−1.4 KiB (−2.5%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: 8efd4e9 · PR result: 3eacbbb · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This cross-layer feature adds an authenticated remote desktop-update protocol and a two-phase workflow that can download, install, quit, relaunch, and recover the desktop app. It introduces substantial production behavior across the desktop, server, client runtime, UI, and contracts, including a sensitive authorization change, so the side effects require human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

macOS preview

The preview download was removed because this PR closed or the preview label was removed.

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

Fixed and pushed in cb96a8e268b5acc0d7f40017a5b0b30fff582af8. Remote commit now joins only when the exact downloaded version still matches and the updater's install reservation is active. Ordinary quit and relaunch no longer count as an install handoff. Tests use a real competing local install and cover normal quit separately. The coordination hold is cleared, subject to normal CI and review.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0fc8f4a. Configure here.}

[t3dotgg]

Remote desktop-managed servers could not update their desktop app.

This change uses a two-phase handoff. Desktop checks and downloads first, then reports a short-lived token while the backend stays connected. The client sends a commit RPC after it receives the token. It accepts success only after reconnecting to the exact prepared version, and retries a lost commit with the same token.

Preparations expire, support early cancellation, and wait up to 90 seconds for a background check. Tokens bind the downloaded version. Duplicate commits cannot start a second install. Desktop keeps windows open until Electron starts updater-controlled quit. Install failures hold a recovery reservation while stopped backends restart, and retained failures replay after restart. Tokenless desktop updates must prove the target version before the client accepts success.

Verification passed 205 focused tests and scoped typechecks across all affected packages. A child-process test passed through the real fd3/fd4 transport with the update services and telemetry services. It covered child restart, failure replay, and duplicate commits. Packaged Mac installation is not yet verified.

Failure recovery adapts #8429 without merging or closing it. Original work by Theo with Claude Code. Protocol and recovery by GPT-5.6 Sol with Codex. Failure recovery commits by Adolanium.

Note

Add server-triggered desktop app updates via server.commitDesktopUpdate RPC

• Adds a telemetry control channel for server-to-desktop update request, commit, and cancel messages, and a DesktopRemoteUpdates listener that mirrors updater state to the server through DesktopUpdateStatusReport
• Adds the server-side DesktopAppUpdate service that correlates status reports by request ID, maps progress stages, and returns a desktop-app self-update result with a commit token when the desktop reports ready-to-install
• Extends DesktopUpdates with install recovery that restarts backends on installer failure, version-checked installPrepared, and a bounded state-change stream via subscribe
• Web UI renders an Update button with confirmation for desktop-managed servers advertising the desktopAppUpdate capability; unsupported servers retain manual instructions
• Adds reconnect-observer logic so a desktop commit lost during transport handoff waits for reconnection and retries up to three ready events before failing with ServerUpdateTerminalError
• Behavioral Change: updater-controlled quit now destroys windows synchronously inside the before-quit-for-update listener instead of forking an async effect; ServerEnvironment advertises desktopAppUpdate: true only for desktop-managed servers with a desktopTelemetryControlFd, and serverCommitDesktopUpdate requires AuthOrchestrationOperateScope

^{Macroscope summarized 3eacbbb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 370c51d2-3573-4944-9650-f5f3100b931b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Effect service conventions: one finding — Effect.catchTag used in the new DesktopAppUpdate service; the repo convention is Effect.catchTags({ ... }) even for a single tag. Everything else in the new service/layer code (namespace subpath imports, inline Context.Service interface, make + layer exports, Foo["Service"] typing, environment-acquired dependencies, no runtime escapes) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.1 KiB	13.3 KiB	+164 B (+1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.2 KiB	6.4 KiB	+166 B (+2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	54.7 KiB	55.6 KiB	+910 B (+1.6%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−158 B (−1.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.4 KiB	−161 B (−2.4%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.8 KiB	56.4 KiB	−1.4 KiB (−2.5%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: 8efd4e9 · PR result: 3eacbbb · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This cross-layer feature adds an authenticated remote desktop-update protocol and a two-phase workflow that can download, install, quit, relaunch, and recover the desktop app. It introduces substantial production behavior across the desktop, server, client runtime, UI, and contracts, including a sensitive authorization change, so the side effects require human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

macOS preview

The preview download was removed because this PR closed or the preview label was removed.

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

Fixed and pushed in cb96a8e268b5acc0d7f40017a5b0b30fff582af8. Remote commit now joins only when the exact downloaded version still matches and the updater's install reservation is active. Ordinary quit and relaunch no longer count as an install handoff. Tests use a real competing local install and cover normal quit separately. The coordination hold is cleared, subject to normal CI and review.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0fc8f4a. Configure here.}

[t3dotgg]

Remote desktop-managed servers could not update their desktop app.

This change uses a two-phase handoff. Desktop checks and downloads first, then reports a short-lived token while the backend stays connected. The client sends a commit RPC after it receives the token. It accepts success only after reconnecting to the exact prepared version, and retries a lost commit with the same token.

Preparations expire, support early cancellation, and wait up to 90 seconds for a background check. Tokens bind the downloaded version. Duplicate commits cannot start a second install. Desktop keeps windows open until Electron starts updater-controlled quit. Install failures hold a recovery reservation while stopped backends restart, and retained failures replay after restart. Tokenless desktop updates must prove the target version before the client accepts success.

Verification passed 205 focused tests and scoped typechecks across all affected packages. A child-process test passed through the real fd3/fd4 transport with the update services and telemetry services. It covered child restart, failure replay, and duplicate commits. Packaged Mac installation is not yet verified.

Failure recovery adapts #8429 without merging or closing it. Original work by Theo with Claude Code. Protocol and recovery by GPT-5.6 Sol with Codex. Failure recovery commits by Adolanium.

Note

Add server-triggered desktop app updates via server.commitDesktopUpdate RPC

• Adds a telemetry control channel for server-to-desktop update request, commit, and cancel messages, and a DesktopRemoteUpdates listener that mirrors updater state to the server through DesktopUpdateStatusReport
• Adds the server-side DesktopAppUpdate service that correlates status reports by request ID, maps progress stages, and returns a desktop-app self-update result with a commit token when the desktop reports ready-to-install
• Extends DesktopUpdates with install recovery that restarts backends on installer failure, version-checked installPrepared, and a bounded state-change stream via subscribe
• Web UI renders an Update button with confirmation for desktop-managed servers advertising the desktopAppUpdate capability; unsupported servers retain manual instructions
• Adds reconnect-observer logic so a desktop commit lost during transport handoff waits for reconnection and retries up to three ready events before failing with ServerUpdateTerminalError
• Behavioral Change: updater-controlled quit now destroys windows synchronously inside the before-quit-for-update listener instead of forking an async effect; ServerEnvironment advertises desktopAppUpdate: true only for desktop-managed servers with a desktopTelemetryControlFd, and serverCommitDesktopUpdate requires AuthOrchestrationOperateScope

^{Macroscope summarized 3eacbbb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 370c51d2-3573-4944-9650-f5f3100b931b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Effect service conventions: one finding — Effect.catchTag used in the new DesktopAppUpdate service; the repo convention is Effect.catchTags({ ... }) even for a single tag. Everything else in the new service/layer code (namespace subpath imports, inline Context.Service interface, make + layer exports, Foo["Service"] typing, environment-acquired dependencies, no runtime escapes) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.1 KiB	13.3 KiB	+164 B (+1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.2 KiB	6.4 KiB	+166 B (+2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	54.7 KiB	55.6 KiB	+910 B (+1.6%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−158 B (−1.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.4 KiB	−161 B (−2.4%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.8 KiB	56.4 KiB	−1.4 KiB (−2.5%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: 8efd4e9 · PR result: 3eacbbb · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This cross-layer feature adds an authenticated remote desktop-update protocol and a two-phase workflow that can download, install, quit, relaunch, and recover the desktop app. It introduces substantial production behavior across the desktop, server, client runtime, UI, and contracts, including a sensitive authorization change, so the side effects require human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

macOS preview

The preview download was removed because this PR closed or the preview label was removed.

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

Fixed and pushed in cb96a8e268b5acc0d7f40017a5b0b30fff582af8. Remote commit now joins only when the exact downloaded version still matches and the updater's install reservation is active. Ordinary quit and relaunch no longer count as an install handoff. Tests use a real competing local install and cover normal quit separately. The coordination hold is cleared, subject to normal CI and review.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0fc8f4a. Configure here.}

[t3dotgg]

Remote desktop-managed servers could not update their desktop app.

This change uses a two-phase handoff. Desktop checks and downloads first, then reports a short-lived token while the backend stays connected. The client sends a commit RPC after it receives the token. It accepts success only after reconnecting to the exact prepared version, and retries a lost commit with the same token.

Preparations expire, support early cancellation, and wait up to 90 seconds for a background check. Tokens bind the downloaded version. Duplicate commits cannot start a second install. Desktop keeps windows open until Electron starts updater-controlled quit. Install failures hold a recovery reservation while stopped backends restart, and retained failures replay after restart. Tokenless desktop updates must prove the target version before the client accepts success.

Verification passed 205 focused tests and scoped typechecks across all affected packages. A child-process test passed through the real fd3/fd4 transport with the update services and telemetry services. It covered child restart, failure replay, and duplicate commits. Packaged Mac installation is not yet verified.

Failure recovery adapts #8429 without merging or closing it. Original work by Theo with Claude Code. Protocol and recovery by GPT-5.6 Sol with Codex. Failure recovery commits by Adolanium.

Note

Add server-triggered desktop app updates via server.commitDesktopUpdate RPC

• Adds a telemetry control channel for server-to-desktop update request, commit, and cancel messages, and a DesktopRemoteUpdates listener that mirrors updater state to the server through DesktopUpdateStatusReport
• Adds the server-side DesktopAppUpdate service that correlates status reports by request ID, maps progress stages, and returns a desktop-app self-update result with a commit token when the desktop reports ready-to-install
• Extends DesktopUpdates with install recovery that restarts backends on installer failure, version-checked installPrepared, and a bounded state-change stream via subscribe
• Web UI renders an Update button with confirmation for desktop-managed servers advertising the desktopAppUpdate capability; unsupported servers retain manual instructions
• Adds reconnect-observer logic so a desktop commit lost during transport handoff waits for reconnection and retries up to three ready events before failing with ServerUpdateTerminalError
• Behavioral Change: updater-controlled quit now destroys windows synchronously inside the before-quit-for-update listener instead of forking an async effect; ServerEnvironment advertises desktopAppUpdate: true only for desktop-managed servers with a desktopTelemetryControlFd, and serverCommitDesktopUpdate requires AuthOrchestrationOperateScope

^{Macroscope summarized 3eacbbb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 370c51d2-3573-4944-9650-f5f3100b931b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Effect service conventions: one finding — Effect.catchTag used in the new DesktopAppUpdate service; the repo convention is Effect.catchTags({ ... }) even for a single tag. Everything else in the new service/layer code (namespace subpath imports, inline Context.Service interface, make + layer exports, Foo["Service"] typing, environment-acquired dependencies, no runtime escapes) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.1 KiB	13.3 KiB	+164 B (+1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.2 KiB	6.4 KiB	+166 B (+2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	54.7 KiB	55.6 KiB	+910 B (+1.6%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−158 B (−1.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.4 KiB	−161 B (−2.4%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.8 KiB	56.4 KiB	−1.4 KiB (−2.5%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: 8efd4e9 · PR result: 3eacbbb · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This cross-layer feature adds an authenticated remote desktop-update protocol and a two-phase workflow that can download, install, quit, relaunch, and recover the desktop app. It introduces substantial production behavior across the desktop, server, client runtime, UI, and contracts, including a sensitive authorization change, so the side effects require human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

macOS preview

The preview download was removed because this PR closed or the preview label was removed.

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

Fixed and pushed in cb96a8e268b5acc0d7f40017a5b0b30fff582af8. Remote commit now joins only when the exact downloaded version still matches and the updater's install reservation is active. Ordinary quit and relaunch no longer count as an install handoff. Tests use a real competing local install and cover normal quit separately. The coordination hold is cleared, subject to normal CI and review.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0fc8f4a. Configure here.}

[t3dotgg]

Remote desktop-managed servers could not update their desktop app.

This change uses a two-phase handoff. Desktop checks and downloads first, then reports a short-lived token while the backend stays connected. The client sends a commit RPC after it receives the token. It accepts success only after reconnecting to the exact prepared version, and retries a lost commit with the same token.

Preparations expire, support early cancellation, and wait up to 90 seconds for a background check. Tokens bind the downloaded version. Duplicate commits cannot start a second install. Desktop keeps windows open until Electron starts updater-controlled quit. Install failures hold a recovery reservation while stopped backends restart, and retained failures replay after restart. Tokenless desktop updates must prove the target version before the client accepts success.

Verification passed 205 focused tests and scoped typechecks across all affected packages. A child-process test passed through the real fd3/fd4 transport with the update services and telemetry services. It covered child restart, failure replay, and duplicate commits. Packaged Mac installation is not yet verified.

Failure recovery adapts #8429 without merging or closing it. Original work by Theo with Claude Code. Protocol and recovery by GPT-5.6 Sol with Codex. Failure recovery commits by Adolanium.

Note

Add server-triggered desktop app updates via server.commitDesktopUpdate RPC

• Adds a telemetry control channel for server-to-desktop update request, commit, and cancel messages, and a DesktopRemoteUpdates listener that mirrors updater state to the server through DesktopUpdateStatusReport
• Adds the server-side DesktopAppUpdate service that correlates status reports by request ID, maps progress stages, and returns a desktop-app self-update result with a commit token when the desktop reports ready-to-install
• Extends DesktopUpdates with install recovery that restarts backends on installer failure, version-checked installPrepared, and a bounded state-change stream via subscribe
• Web UI renders an Update button with confirmation for desktop-managed servers advertising the desktopAppUpdate capability; unsupported servers retain manual instructions
• Adds reconnect-observer logic so a desktop commit lost during transport handoff waits for reconnection and retries up to three ready events before failing with ServerUpdateTerminalError
• Behavioral Change: updater-controlled quit now destroys windows synchronously inside the before-quit-for-update listener instead of forking an async effect; ServerEnvironment advertises desktopAppUpdate: true only for desktop-managed servers with a desktopTelemetryControlFd, and serverCommitDesktopUpdate requires AuthOrchestrationOperateScope

^{Macroscope summarized 3eacbbb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 370c51d2-3573-4944-9650-f5f3100b931b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Effect service conventions: one finding — Effect.catchTag used in the new DesktopAppUpdate service; the repo convention is Effect.catchTags({ ... }) even for a single tag. Everything else in the new service/layer code (namespace subpath imports, inline Context.Service interface, make + layer exports, Foo["Service"] typing, environment-acquired dependencies, no runtime escapes) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.1 KiB	13.3 KiB	+164 B (+1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.2 KiB	6.4 KiB	+166 B (+2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	54.7 KiB	55.6 KiB	+910 B (+1.6%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−158 B (−1.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.4 KiB	−161 B (−2.4%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.8 KiB	56.4 KiB	−1.4 KiB (−2.5%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: 8efd4e9 · PR result: 3eacbbb · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This cross-layer feature adds an authenticated remote desktop-update protocol and a two-phase workflow that can download, install, quit, relaunch, and recover the desktop app. It introduces substantial production behavior across the desktop, server, client runtime, UI, and contracts, including a sensitive authorization change, so the side effects require human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

macOS preview

The preview download was removed because this PR closed or the preview label was removed.

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

Fixed and pushed in cb96a8e268b5acc0d7f40017a5b0b30fff582af8. Remote commit now joins only when the exact downloaded version still matches and the updater's install reservation is active. Ordinary quit and relaunch no longer count as an install handoff. Tests use a real competing local install and cover normal quit separately. The coordination hold is cleared, subject to normal CI and review.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0fc8f4a. Configure here.}

[t3dotgg]

Remote desktop-managed servers could not update their desktop app.

This change uses a two-phase handoff. Desktop checks and downloads first, then reports a short-lived token while the backend stays connected. The client sends a commit RPC after it receives the token. It accepts success only after reconnecting to the exact prepared version, and retries a lost commit with the same token.

Preparations expire, support early cancellation, and wait up to 90 seconds for a background check. Tokens bind the downloaded version. Duplicate commits cannot start a second install. Desktop keeps windows open until Electron starts updater-controlled quit. Install failures hold a recovery reservation while stopped backends restart, and retained failures replay after restart. Tokenless desktop updates must prove the target version before the client accepts success.

Verification passed 205 focused tests and scoped typechecks across all affected packages. A child-process test passed through the real fd3/fd4 transport with the update services and telemetry services. It covered child restart, failure replay, and duplicate commits. Packaged Mac installation is not yet verified.

Failure recovery adapts #8429 without merging or closing it. Original work by Theo with Claude Code. Protocol and recovery by GPT-5.6 Sol with Codex. Failure recovery commits by Adolanium.

Note

Add server-triggered desktop app updates via server.commitDesktopUpdate RPC

• Adds a telemetry control channel for server-to-desktop update request, commit, and cancel messages, and a DesktopRemoteUpdates listener that mirrors updater state to the server through DesktopUpdateStatusReport
• Adds the server-side DesktopAppUpdate service that correlates status reports by request ID, maps progress stages, and returns a desktop-app self-update result with a commit token when the desktop reports ready-to-install
• Extends DesktopUpdates with install recovery that restarts backends on installer failure, version-checked installPrepared, and a bounded state-change stream via subscribe
• Web UI renders an Update button with confirmation for desktop-managed servers advertising the desktopAppUpdate capability; unsupported servers retain manual instructions
• Adds reconnect-observer logic so a desktop commit lost during transport handoff waits for reconnection and retries up to three ready events before failing with ServerUpdateTerminalError
• Behavioral Change: updater-controlled quit now destroys windows synchronously inside the before-quit-for-update listener instead of forking an async effect; ServerEnvironment advertises desktopAppUpdate: true only for desktop-managed servers with a desktopTelemetryControlFd, and serverCommitDesktopUpdate requires AuthOrchestrationOperateScope

^{Macroscope summarized 3eacbbb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 370c51d2-3573-4944-9650-f5f3100b931b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Effect service conventions: one finding — Effect.catchTag used in the new DesktopAppUpdate service; the repo convention is Effect.catchTags({ ... }) even for a single tag. Everything else in the new service/layer code (namespace subpath imports, inline Context.Service interface, make + layer exports, Foo["Service"] typing, environment-acquired dependencies, no runtime escapes) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.1 KiB	13.3 KiB	+164 B (+1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.2 KiB	6.4 KiB	+166 B (+2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	54.7 KiB	55.6 KiB	+910 B (+1.6%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−158 B (−1.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.4 KiB	−161 B (−2.4%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.8 KiB	56.4 KiB	−1.4 KiB (−2.5%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: 8efd4e9 · PR result: 3eacbbb · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This cross-layer feature adds an authenticated remote desktop-update protocol and a two-phase workflow that can download, install, quit, relaunch, and recover the desktop app. It introduces substantial production behavior across the desktop, server, client runtime, UI, and contracts, including a sensitive authorization change, so the side effects require human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

macOS preview

The preview download was removed because this PR closed or the preview label was removed.

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

Fixed and pushed in cb96a8e268b5acc0d7f40017a5b0b30fff582af8. Remote commit now joins only when the exact downloaded version still matches and the updater's install reservation is active. Ordinary quit and relaunch no longer count as an install handoff. Tests use a real competing local install and cover normal quit separately. The coordination hold is cleared, subject to normal CI and review.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0fc8f4a. Configure here.}

[t3dotgg]

Remote desktop-managed servers could not update their desktop app.

This change uses a two-phase handoff. Desktop checks and downloads first, then reports a short-lived token while the backend stays connected. The client sends a commit RPC after it receives the token. It accepts success only after reconnecting to the exact prepared version, and retries a lost commit with the same token.

Preparations expire, support early cancellation, and wait up to 90 seconds for a background check. Tokens bind the downloaded version. Duplicate commits cannot start a second install. Desktop keeps windows open until Electron starts updater-controlled quit. Install failures hold a recovery reservation while stopped backends restart, and retained failures replay after restart. Tokenless desktop updates must prove the target version before the client accepts success.

Verification passed 205 focused tests and scoped typechecks across all affected packages. A child-process test passed through the real fd3/fd4 transport with the update services and telemetry services. It covered child restart, failure replay, and duplicate commits. Packaged Mac installation is not yet verified.

Failure recovery adapts #8429 without merging or closing it. Original work by Theo with Claude Code. Protocol and recovery by GPT-5.6 Sol with Codex. Failure recovery commits by Adolanium.

Note

Add server-triggered desktop app updates via server.commitDesktopUpdate RPC

• Adds a telemetry control channel for server-to-desktop update request, commit, and cancel messages, and a DesktopRemoteUpdates listener that mirrors updater state to the server through DesktopUpdateStatusReport
• Adds the server-side DesktopAppUpdate service that correlates status reports by request ID, maps progress stages, and returns a desktop-app self-update result with a commit token when the desktop reports ready-to-install
• Extends DesktopUpdates with install recovery that restarts backends on installer failure, version-checked installPrepared, and a bounded state-change stream via subscribe
• Web UI renders an Update button with confirmation for desktop-managed servers advertising the desktopAppUpdate capability; unsupported servers retain manual instructions
• Adds reconnect-observer logic so a desktop commit lost during transport handoff waits for reconnection and retries up to three ready events before failing with ServerUpdateTerminalError
• Behavioral Change: updater-controlled quit now destroys windows synchronously inside the before-quit-for-update listener instead of forking an async effect; ServerEnvironment advertises desktopAppUpdate: true only for desktop-managed servers with a desktopTelemetryControlFd, and serverCommitDesktopUpdate requires AuthOrchestrationOperateScope

^{Macroscope summarized 3eacbbb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 370c51d2-3573-4944-9650-f5f3100b931b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Effect service conventions: one finding — Effect.catchTag used in the new DesktopAppUpdate service; the repo convention is Effect.catchTags({ ... }) even for a single tag. Everything else in the new service/layer code (namespace subpath imports, inline Context.Service interface, make + layer exports, Foo["Service"] typing, environment-acquired dependencies, no runtime escapes) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.1 KiB	13.3 KiB	+164 B (+1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.2 KiB	6.4 KiB	+166 B (+2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	54.7 KiB	55.6 KiB	+910 B (+1.6%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.3 KiB	−158 B (−1.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.4 KiB	−161 B (−2.4%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.8 KiB	56.4 KiB	−1.4 KiB (−2.5%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: 8efd4e9 · PR result: 3eacbbb · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This cross-layer feature adds an authenticated remote desktop-update protocol and a two-phase workflow that can download, install, quit, relaunch, and recover the desktop app. It introduces substantial production behavior across the desktop, server, client runtime, UI, and contracts, including a sensitive authorization change, so the side effects require human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

macOS preview

The preview download was removed because this PR closed or the preview label was removed.

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

Fixed and pushed in cb96a8e268b5acc0d7f40017a5b0b30fff582af8. Remote commit now joins only when the exact downloaded version still matches and the updater's install reservation is active. Ordinary quit and relaunch no longer count as an install handoff. Tests use a real competing local install and cover normal quit separately. The coordination hold is cleared, subject to normal CI and review.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0fc8f4a. Configure here.}