feat(desktop): sign in through the browser, sharing the t3 connect credential

[t3dotgg]

Problem

Clerk inside Electron has been a constant source of auth bugs: passkey prompts firing on mount, hash-history redirect mangling, single-instance lock ordering, Linux AppImage scheme registration, and signed-build-only passkey testing on macOS.

Solution

The desktop app no longer runs any auth UI. Signing in opens the system browser through the bundled server, which runs the exact loopback PKCE flow npx t3 connect already uses and stores the same cloud-cli-oauth-token credential. Sign in from either the desktop app or the CLI and the other is signed in too.

• Relay: the DPoP token-exchange endpoint now accepts OAuth tokens as subject_token through the same verifyRelayClientBearerToken verifier the REST endpoints already used.
• Server: new /api/connect/auth/{state,login,logout,token} endpoints backed by CliTokenManager. beginBrowserLogin runs the loopback flow without a terminal. The stored credential gains an accountId (Clerk sub); legacy CLI credentials backfill it once via /oauth/userinfo.
• Web: one useT3ConnectAuth() session hook, backed by Clerk on the web and by the local server under Electron. All shared components (relay session, link controller, onboarding, sidebar) consume the hook. Electron gets a small "finish in your browser" dialog and a plain account menu over the existing relay-backed pages.
• Client runtime: DPoP token cache keys opaque OAuth tokens by their own value instead of bypassing the cache.
• Desktop: @clerk/electron is gone — the bridge, preload, passkey autofill hack, redirect hack, Clerk/Turnstile CSP entries, Linux URL handler, OS-level t3code:// registration, and macOS passkey entitlements/provisioning requirements all deleted. A small DesktopSingleInstance service takes over the single-instance lock the Clerk bridge used to hold.

Net: −1900/+1200 lines, two dependencies removed, and the release workflow no longer needs APPLE_TEAM_ID, MACOS_PROVISIONING_PROFILE, or CLERK_PASSKEY_RP_DOMAINS.

The Catch

Won't have the full auth view in desktop app anymore. You get this instead

I think it's a worthwhile compromise.

Deploy order: the relay must ship before (or with) the desktop release. A new desktop app against an old relay gets invalid_bearer on the DPoP exchange, so every relay feature dies; an old app against the new relay is unaffected. After deploying, set CLERK_CLI_OAUTH_CLIENT_ID in the relay environment so OAuth bearer tokens are pinned to the CLI/desktop OAuth application.

Rollout note: a signed-out browser needs the hosted app to carry #6285 (preserve CLI OAuth parameters through sign-in, on main since Aug 12, not in the v0.0.33 stable deploy). The next stable release deploys the hosted app and ships this change together, so the ordering resolves itself; only source-build testing against today's prod hosted app needs T3CODE_HOSTED_APP_URL=https://nightly.app.t3.codes or an already signed-in browser.

No Clerk dashboard changes are required to ship this; the Native API/allowed_origins/AASA setup just becomes unused.

Screenshots of the new desktop sign-in dialog and account menu to follow after an integrated pass.

---

Built by Claude Fable 5 via Claude Code.

---

Note

High Risk
Large auth architecture change on desktop plus shared credential and new token endpoints; relay must deploy with OAuth DPoP support and optional client pinning before desktop users rely on connect features.

Overview
Desktop auth is no longer in-app Clerk. The Electron app removes @clerk/electron, preload bridge, Linux t3code:// URL-handler registration, Clerk CSP allowances, and macOS passkey provisioning/release requirements. DesktopSingleInstance takes the single-instance lock the Clerk bridge used to hold; startup deletes legacy clerk-tokens.json.

Sign-in runs on the bundled environment server using the same loopback PKCE flow as npx t3 connect, persisting one cloud-cli-oauth-token for desktop and CLI. CliTokenManager adds beginBrowserLogin, submitBrowserLoginCode, and clientAuthState (with accountId and userinfo backfill for older credentials). New /api/connect/auth/* handlers expose state, login, code, logout, and token to the renderer.

Web/Electron share one session API:useT3ConnectAuth with ClerkConnectAuthProvider (browser) vs DesktopConnectAuthProvider (polls the local server). Desktop gets a “finish in your browser” dialog, optional pasted OOB code, and a non-Clerk account menu; cloud link/onboarding/sidebar use the hook instead of Clerk directly.

Relay optionally pins OAuth bearer tokens via CLERK_CLI_OAUTH_CLIENT_ID; tests cover rejecting tokens from other OAuth apps.

^{Reviewed by Cursor Bugbot for commit 627b8cb. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Sign in to T3 Connect on desktop via the browser, sharing the CLI OAuth credential

• Removes all Clerk Electron/passkey integration from the desktop app (dependencies, preload bridge, renderer provider, macOS signing/entitlements, protocol registration) and replaces it with a loopback PKCE browser sign-in flow handled by the bundled environment server.
• Adds DesktopSingleInstance service to manage single-instance locking; secondary launches quit and surface the primary window.
• Adds beginBrowserLogin, submitBrowserLoginCode, and clientAuthState to CloudCliTokenManager, including a loopback callback server with PKCE, timeout handling, and pending login state.
• Exposes five new HTTP endpoints under /api/connect/auth/ (state, login, code, logout, token) in the environment server, consumed by both the desktop renderer and the web UI via a new useT3ConnectAuth context.
• Opaque OAuth tokens (non-JWT) now participate in the DPoP credential cache in ManagedRelayClient, keyed by token value instead of bypassing the cache.
• Adds optional CLERK_CLI_OAUTH_CLIENT_ID to the relay to restrict accepted OAuth bearer tokens to the designated OAuth app.
• Risk: the desktop renderer no longer mounts Clerk at all; any feature that previously relied on Clerk in the Electron renderer will be broken.

^{Macroscope summarized 627b8cb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b6e705c3-95b7-4edd-8e19-db93198b235c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One finding in the changed web UI: the new desktop account dialog is the only DialogPopup in apps/web/src without an accessible name. Everything else in the diff (Menu/Dialog/Button composition, sidebar avatar parity with the Clerk UserButton trigger classes, the sign-in prompt dialog) follows the existing primitive contracts.

^{Posted via Macroscope — UI Consistency}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	12.6 KiB	+8 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+11 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	51.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	12.6 KiB	−24 B (−0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	−21 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	52.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 8bbbab5 · PR result: 1fab1f8 · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a major new authentication feature: replacing embedded Clerk desktop auth with browser-based OAuth shared with the CLI. It adds new credential endpoints, new auth providers, and new UI flows - significant architectural changes to security-sensitive authentication that warrant thorough review.

Notes:

• No code objects were reviewed. Approvability was decided on eligibility alone.

No code changes detected at 627b8cb. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

One finding on the new desktop account control; the previously reported missing dialog accessible name in the same file is still open and is not re-posted here.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the changed Effect service code (DesktopSingleInstance, CliTokenManager, connect HTTP handlers, managedRelay, contracts). Module/service structure, namespace imports, Context.Service + make + layer layout, and Effect.catchTags usage all follow the conventions, and the removed DesktopClerk/DesktopLinuxUrlHandler modules leave no re-export shims behind.

One finding: the single-instance behavior that moved out of DesktopClerk lost its test coverage even though the lock acquisition itself changed.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[cursor]

Signed-in UI with unusable tokens

Medium Severity

authState treats a stored credential as signed in even when refresh fails, while authToken uses getExisting and fails that same refresh. Desktop can keep showing a session and then getToken returns null, so every relay call dies until the user signs in again.

Additional Locations (1)

• apps/server/src/cloud/CliTokenManager.ts#L724-L766

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[cursor]

Legacy sign-in backfill is not retried

Medium Severity

Desktop treats a user as signed in only when accountId is present, but polling stops as soon as the first authState response arrives. A legacy CLI credential that still needs the userinfo backfill can land as authorized with a null accountId and stay stuck on the sign-in button until a later focus refresh happens to succeed.

Additional Locations (1)

• apps/server/src/cloud/CliTokenManager.ts#L741-L765

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[t3dotgg]

Problem

Clerk inside Electron has been a constant source of auth bugs: passkey prompts firing on mount, hash-history redirect mangling, single-instance lock ordering, Linux AppImage scheme registration, and signed-build-only passkey testing on macOS.

Solution

The desktop app no longer runs any auth UI. Signing in opens the system browser through the bundled server, which runs the exact loopback PKCE flow npx t3 connect already uses and stores the same cloud-cli-oauth-token credential. Sign in from either the desktop app or the CLI and the other is signed in too.

• Relay: the DPoP token-exchange endpoint now accepts OAuth tokens as subject_token through the same verifyRelayClientBearerToken verifier the REST endpoints already used.
• Server: new /api/connect/auth/{state,login,logout,token} endpoints backed by CliTokenManager. beginBrowserLogin runs the loopback flow without a terminal. The stored credential gains an accountId (Clerk sub); legacy CLI credentials backfill it once via /oauth/userinfo.
• Web: one useT3ConnectAuth() session hook, backed by Clerk on the web and by the local server under Electron. All shared components (relay session, link controller, onboarding, sidebar) consume the hook. Electron gets a small "finish in your browser" dialog and a plain account menu over the existing relay-backed pages.
• Client runtime: DPoP token cache keys opaque OAuth tokens by their own value instead of bypassing the cache.
• Desktop: @clerk/electron is gone — the bridge, preload, passkey autofill hack, redirect hack, Clerk/Turnstile CSP entries, Linux URL handler, OS-level t3code:// registration, and macOS passkey entitlements/provisioning requirements all deleted. A small DesktopSingleInstance service takes over the single-instance lock the Clerk bridge used to hold.

Net: −1900/+1200 lines, two dependencies removed, and the release workflow no longer needs APPLE_TEAM_ID, MACOS_PROVISIONING_PROFILE, or CLERK_PASSKEY_RP_DOMAINS.

The Catch

Won't have the full auth view in desktop app anymore. You get this instead

I think it's a worthwhile compromise.

Deploy order: the relay must ship before (or with) the desktop release. A new desktop app against an old relay gets invalid_bearer on the DPoP exchange, so every relay feature dies; an old app against the new relay is unaffected. After deploying, set CLERK_CLI_OAUTH_CLIENT_ID in the relay environment so OAuth bearer tokens are pinned to the CLI/desktop OAuth application.

Rollout note: a signed-out browser needs the hosted app to carry #6285 (preserve CLI OAuth parameters through sign-in, on main since Aug 12, not in the v0.0.33 stable deploy). The next stable release deploys the hosted app and ships this change together, so the ordering resolves itself; only source-build testing against today's prod hosted app needs T3CODE_HOSTED_APP_URL=https://nightly.app.t3.codes or an already signed-in browser.

No Clerk dashboard changes are required to ship this; the Native API/allowed_origins/AASA setup just becomes unused.

Screenshots of the new desktop sign-in dialog and account menu to follow after an integrated pass.

---

Built by Claude Fable 5 via Claude Code.

---

Note

High Risk
Large auth architecture change on desktop plus shared credential and new token endpoints; relay must deploy with OAuth DPoP support and optional client pinning before desktop users rely on connect features.

Overview
Desktop auth is no longer in-app Clerk. The Electron app removes @clerk/electron, preload bridge, Linux t3code:// URL-handler registration, Clerk CSP allowances, and macOS passkey provisioning/release requirements. DesktopSingleInstance takes the single-instance lock the Clerk bridge used to hold; startup deletes legacy clerk-tokens.json.

Sign-in runs on the bundled environment server using the same loopback PKCE flow as npx t3 connect, persisting one cloud-cli-oauth-token for desktop and CLI. CliTokenManager adds beginBrowserLogin, submitBrowserLoginCode, and clientAuthState (with accountId and userinfo backfill for older credentials). New /api/connect/auth/* handlers expose state, login, code, logout, and token to the renderer.

Web/Electron share one session API:useT3ConnectAuth with ClerkConnectAuthProvider (browser) vs DesktopConnectAuthProvider (polls the local server). Desktop gets a “finish in your browser” dialog, optional pasted OOB code, and a non-Clerk account menu; cloud link/onboarding/sidebar use the hook instead of Clerk directly.

Relay optionally pins OAuth bearer tokens via CLERK_CLI_OAUTH_CLIENT_ID; tests cover rejecting tokens from other OAuth apps.

^{Reviewed by Cursor Bugbot for commit 627b8cb. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Sign in to T3 Connect on desktop via the browser, sharing the CLI OAuth credential

• Removes all Clerk Electron/passkey integration from the desktop app (dependencies, preload bridge, renderer provider, macOS signing/entitlements, protocol registration) and replaces it with a loopback PKCE browser sign-in flow handled by the bundled environment server.
• Adds DesktopSingleInstance service to manage single-instance locking; secondary launches quit and surface the primary window.
• Adds beginBrowserLogin, submitBrowserLoginCode, and clientAuthState to CloudCliTokenManager, including a loopback callback server with PKCE, timeout handling, and pending login state.
• Exposes five new HTTP endpoints under /api/connect/auth/ (state, login, code, logout, token) in the environment server, consumed by both the desktop renderer and the web UI via a new useT3ConnectAuth context.
• Opaque OAuth tokens (non-JWT) now participate in the DPoP credential cache in ManagedRelayClient, keyed by token value instead of bypassing the cache.
• Adds optional CLERK_CLI_OAUTH_CLIENT_ID to the relay to restrict accepted OAuth bearer tokens to the designated OAuth app.
• Risk: the desktop renderer no longer mounts Clerk at all; any feature that previously relied on Clerk in the Electron renderer will be broken.

^{Macroscope summarized 627b8cb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b6e705c3-95b7-4edd-8e19-db93198b235c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One finding in the changed web UI: the new desktop account dialog is the only DialogPopup in apps/web/src without an accessible name. Everything else in the diff (Menu/Dialog/Button composition, sidebar avatar parity with the Clerk UserButton trigger classes, the sign-in prompt dialog) follows the existing primitive contracts.

^{Posted via Macroscope — UI Consistency}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	12.6 KiB	+8 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+11 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	51.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	12.6 KiB	−24 B (−0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	−21 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	52.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 8bbbab5 · PR result: 1fab1f8 · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a major new authentication feature: replacing embedded Clerk desktop auth with browser-based OAuth shared with the CLI. It adds new credential endpoints, new auth providers, and new UI flows - significant architectural changes to security-sensitive authentication that warrant thorough review.

Notes:

• No code objects were reviewed. Approvability was decided on eligibility alone.

No code changes detected at 627b8cb. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

One finding on the new desktop account control; the previously reported missing dialog accessible name in the same file is still open and is not re-posted here.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the changed Effect service code (DesktopSingleInstance, CliTokenManager, connect HTTP handlers, managedRelay, contracts). Module/service structure, namespace imports, Context.Service + make + layer layout, and Effect.catchTags usage all follow the conventions, and the removed DesktopClerk/DesktopLinuxUrlHandler modules leave no re-export shims behind.

One finding: the single-instance behavior that moved out of DesktopClerk lost its test coverage even though the lock acquisition itself changed.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[cursor]

Signed-in UI with unusable tokens

Medium Severity

authState treats a stored credential as signed in even when refresh fails, while authToken uses getExisting and fails that same refresh. Desktop can keep showing a session and then getToken returns null, so every relay call dies until the user signs in again.

Additional Locations (1)

• apps/server/src/cloud/CliTokenManager.ts#L724-L766

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[cursor]

Legacy sign-in backfill is not retried

Medium Severity

Desktop treats a user as signed in only when accountId is present, but polling stops as soon as the first authState response arrives. A legacy CLI credential that still needs the userinfo backfill can land as authorized with a null accountId and stay stuck on the sign-in button until a later focus refresh happens to succeed.

Additional Locations (1)

• apps/server/src/cloud/CliTokenManager.ts#L741-L765

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[t3dotgg]

Problem

Clerk inside Electron has been a constant source of auth bugs: passkey prompts firing on mount, hash-history redirect mangling, single-instance lock ordering, Linux AppImage scheme registration, and signed-build-only passkey testing on macOS.

Solution

The desktop app no longer runs any auth UI. Signing in opens the system browser through the bundled server, which runs the exact loopback PKCE flow npx t3 connect already uses and stores the same cloud-cli-oauth-token credential. Sign in from either the desktop app or the CLI and the other is signed in too.

• Relay: the DPoP token-exchange endpoint now accepts OAuth tokens as subject_token through the same verifyRelayClientBearerToken verifier the REST endpoints already used.
• Server: new /api/connect/auth/{state,login,logout,token} endpoints backed by CliTokenManager. beginBrowserLogin runs the loopback flow without a terminal. The stored credential gains an accountId (Clerk sub); legacy CLI credentials backfill it once via /oauth/userinfo.
• Web: one useT3ConnectAuth() session hook, backed by Clerk on the web and by the local server under Electron. All shared components (relay session, link controller, onboarding, sidebar) consume the hook. Electron gets a small "finish in your browser" dialog and a plain account menu over the existing relay-backed pages.
• Client runtime: DPoP token cache keys opaque OAuth tokens by their own value instead of bypassing the cache.
• Desktop: @clerk/electron is gone — the bridge, preload, passkey autofill hack, redirect hack, Clerk/Turnstile CSP entries, Linux URL handler, OS-level t3code:// registration, and macOS passkey entitlements/provisioning requirements all deleted. A small DesktopSingleInstance service takes over the single-instance lock the Clerk bridge used to hold.

Net: −1900/+1200 lines, two dependencies removed, and the release workflow no longer needs APPLE_TEAM_ID, MACOS_PROVISIONING_PROFILE, or CLERK_PASSKEY_RP_DOMAINS.

The Catch

Won't have the full auth view in desktop app anymore. You get this instead

I think it's a worthwhile compromise.

Deploy order: the relay must ship before (or with) the desktop release. A new desktop app against an old relay gets invalid_bearer on the DPoP exchange, so every relay feature dies; an old app against the new relay is unaffected. After deploying, set CLERK_CLI_OAUTH_CLIENT_ID in the relay environment so OAuth bearer tokens are pinned to the CLI/desktop OAuth application.

Rollout note: a signed-out browser needs the hosted app to carry #6285 (preserve CLI OAuth parameters through sign-in, on main since Aug 12, not in the v0.0.33 stable deploy). The next stable release deploys the hosted app and ships this change together, so the ordering resolves itself; only source-build testing against today's prod hosted app needs T3CODE_HOSTED_APP_URL=https://nightly.app.t3.codes or an already signed-in browser.

No Clerk dashboard changes are required to ship this; the Native API/allowed_origins/AASA setup just becomes unused.

Screenshots of the new desktop sign-in dialog and account menu to follow after an integrated pass.

---

Built by Claude Fable 5 via Claude Code.

---

Note

High Risk
Large auth architecture change on desktop plus shared credential and new token endpoints; relay must deploy with OAuth DPoP support and optional client pinning before desktop users rely on connect features.

Overview
Desktop auth is no longer in-app Clerk. The Electron app removes @clerk/electron, preload bridge, Linux t3code:// URL-handler registration, Clerk CSP allowances, and macOS passkey provisioning/release requirements. DesktopSingleInstance takes the single-instance lock the Clerk bridge used to hold; startup deletes legacy clerk-tokens.json.

Sign-in runs on the bundled environment server using the same loopback PKCE flow as npx t3 connect, persisting one cloud-cli-oauth-token for desktop and CLI. CliTokenManager adds beginBrowserLogin, submitBrowserLoginCode, and clientAuthState (with accountId and userinfo backfill for older credentials). New /api/connect/auth/* handlers expose state, login, code, logout, and token to the renderer.

Web/Electron share one session API:useT3ConnectAuth with ClerkConnectAuthProvider (browser) vs DesktopConnectAuthProvider (polls the local server). Desktop gets a “finish in your browser” dialog, optional pasted OOB code, and a non-Clerk account menu; cloud link/onboarding/sidebar use the hook instead of Clerk directly.

Relay optionally pins OAuth bearer tokens via CLERK_CLI_OAUTH_CLIENT_ID; tests cover rejecting tokens from other OAuth apps.

^{Reviewed by Cursor Bugbot for commit 627b8cb. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Sign in to T3 Connect on desktop via the browser, sharing the CLI OAuth credential

• Removes all Clerk Electron/passkey integration from the desktop app (dependencies, preload bridge, renderer provider, macOS signing/entitlements, protocol registration) and replaces it with a loopback PKCE browser sign-in flow handled by the bundled environment server.
• Adds DesktopSingleInstance service to manage single-instance locking; secondary launches quit and surface the primary window.
• Adds beginBrowserLogin, submitBrowserLoginCode, and clientAuthState to CloudCliTokenManager, including a loopback callback server with PKCE, timeout handling, and pending login state.
• Exposes five new HTTP endpoints under /api/connect/auth/ (state, login, code, logout, token) in the environment server, consumed by both the desktop renderer and the web UI via a new useT3ConnectAuth context.
• Opaque OAuth tokens (non-JWT) now participate in the DPoP credential cache in ManagedRelayClient, keyed by token value instead of bypassing the cache.
• Adds optional CLERK_CLI_OAUTH_CLIENT_ID to the relay to restrict accepted OAuth bearer tokens to the designated OAuth app.
• Risk: the desktop renderer no longer mounts Clerk at all; any feature that previously relied on Clerk in the Electron renderer will be broken.

^{Macroscope summarized 627b8cb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b6e705c3-95b7-4edd-8e19-db93198b235c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One finding in the changed web UI: the new desktop account dialog is the only DialogPopup in apps/web/src without an accessible name. Everything else in the diff (Menu/Dialog/Button composition, sidebar avatar parity with the Clerk UserButton trigger classes, the sign-in prompt dialog) follows the existing primitive contracts.

^{Posted via Macroscope — UI Consistency}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	12.6 KiB	+8 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+11 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	51.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	12.6 KiB	−24 B (−0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	−21 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	52.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 8bbbab5 · PR result: 1fab1f8 · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a major new authentication feature: replacing embedded Clerk desktop auth with browser-based OAuth shared with the CLI. It adds new credential endpoints, new auth providers, and new UI flows - significant architectural changes to security-sensitive authentication that warrant thorough review.

Notes:

• No code objects were reviewed. Approvability was decided on eligibility alone.

No code changes detected at 627b8cb. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

One finding on the new desktop account control; the previously reported missing dialog accessible name in the same file is still open and is not re-posted here.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the changed Effect service code (DesktopSingleInstance, CliTokenManager, connect HTTP handlers, managedRelay, contracts). Module/service structure, namespace imports, Context.Service + make + layer layout, and Effect.catchTags usage all follow the conventions, and the removed DesktopClerk/DesktopLinuxUrlHandler modules leave no re-export shims behind.

One finding: the single-instance behavior that moved out of DesktopClerk lost its test coverage even though the lock acquisition itself changed.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[cursor]

Signed-in UI with unusable tokens

Medium Severity

authState treats a stored credential as signed in even when refresh fails, while authToken uses getExisting and fails that same refresh. Desktop can keep showing a session and then getToken returns null, so every relay call dies until the user signs in again.

Additional Locations (1)

• apps/server/src/cloud/CliTokenManager.ts#L724-L766

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[cursor]

Legacy sign-in backfill is not retried

Medium Severity

Desktop treats a user as signed in only when accountId is present, but polling stops as soon as the first authState response arrives. A legacy CLI credential that still needs the userinfo backfill can land as authorized with a null accountId and stay stuck on the sign-in button until a later focus refresh happens to succeed.

Additional Locations (1)

• apps/server/src/cloud/CliTokenManager.ts#L741-L765

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[t3dotgg]

Problem

Clerk inside Electron has been a constant source of auth bugs: passkey prompts firing on mount, hash-history redirect mangling, single-instance lock ordering, Linux AppImage scheme registration, and signed-build-only passkey testing on macOS.

Solution

The desktop app no longer runs any auth UI. Signing in opens the system browser through the bundled server, which runs the exact loopback PKCE flow npx t3 connect already uses and stores the same cloud-cli-oauth-token credential. Sign in from either the desktop app or the CLI and the other is signed in too.

• Relay: the DPoP token-exchange endpoint now accepts OAuth tokens as subject_token through the same verifyRelayClientBearerToken verifier the REST endpoints already used.
• Server: new /api/connect/auth/{state,login,logout,token} endpoints backed by CliTokenManager. beginBrowserLogin runs the loopback flow without a terminal. The stored credential gains an accountId (Clerk sub); legacy CLI credentials backfill it once via /oauth/userinfo.
• Web: one useT3ConnectAuth() session hook, backed by Clerk on the web and by the local server under Electron. All shared components (relay session, link controller, onboarding, sidebar) consume the hook. Electron gets a small "finish in your browser" dialog and a plain account menu over the existing relay-backed pages.
• Client runtime: DPoP token cache keys opaque OAuth tokens by their own value instead of bypassing the cache.
• Desktop: @clerk/electron is gone — the bridge, preload, passkey autofill hack, redirect hack, Clerk/Turnstile CSP entries, Linux URL handler, OS-level t3code:// registration, and macOS passkey entitlements/provisioning requirements all deleted. A small DesktopSingleInstance service takes over the single-instance lock the Clerk bridge used to hold.

Net: −1900/+1200 lines, two dependencies removed, and the release workflow no longer needs APPLE_TEAM_ID, MACOS_PROVISIONING_PROFILE, or CLERK_PASSKEY_RP_DOMAINS.

The Catch

Won't have the full auth view in desktop app anymore. You get this instead

I think it's a worthwhile compromise.

Deploy order: the relay must ship before (or with) the desktop release. A new desktop app against an old relay gets invalid_bearer on the DPoP exchange, so every relay feature dies; an old app against the new relay is unaffected. After deploying, set CLERK_CLI_OAUTH_CLIENT_ID in the relay environment so OAuth bearer tokens are pinned to the CLI/desktop OAuth application.

Rollout note: a signed-out browser needs the hosted app to carry #6285 (preserve CLI OAuth parameters through sign-in, on main since Aug 12, not in the v0.0.33 stable deploy). The next stable release deploys the hosted app and ships this change together, so the ordering resolves itself; only source-build testing against today's prod hosted app needs T3CODE_HOSTED_APP_URL=https://nightly.app.t3.codes or an already signed-in browser.

No Clerk dashboard changes are required to ship this; the Native API/allowed_origins/AASA setup just becomes unused.

Screenshots of the new desktop sign-in dialog and account menu to follow after an integrated pass.

---

Built by Claude Fable 5 via Claude Code.

---

Note

High Risk
Large auth architecture change on desktop plus shared credential and new token endpoints; relay must deploy with OAuth DPoP support and optional client pinning before desktop users rely on connect features.

Overview
Desktop auth is no longer in-app Clerk. The Electron app removes @clerk/electron, preload bridge, Linux t3code:// URL-handler registration, Clerk CSP allowances, and macOS passkey provisioning/release requirements. DesktopSingleInstance takes the single-instance lock the Clerk bridge used to hold; startup deletes legacy clerk-tokens.json.

Sign-in runs on the bundled environment server using the same loopback PKCE flow as npx t3 connect, persisting one cloud-cli-oauth-token for desktop and CLI. CliTokenManager adds beginBrowserLogin, submitBrowserLoginCode, and clientAuthState (with accountId and userinfo backfill for older credentials). New /api/connect/auth/* handlers expose state, login, code, logout, and token to the renderer.

Web/Electron share one session API:useT3ConnectAuth with ClerkConnectAuthProvider (browser) vs DesktopConnectAuthProvider (polls the local server). Desktop gets a “finish in your browser” dialog, optional pasted OOB code, and a non-Clerk account menu; cloud link/onboarding/sidebar use the hook instead of Clerk directly.

Relay optionally pins OAuth bearer tokens via CLERK_CLI_OAUTH_CLIENT_ID; tests cover rejecting tokens from other OAuth apps.

^{Reviewed by Cursor Bugbot for commit 627b8cb. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Sign in to T3 Connect on desktop via the browser, sharing the CLI OAuth credential

• Removes all Clerk Electron/passkey integration from the desktop app (dependencies, preload bridge, renderer provider, macOS signing/entitlements, protocol registration) and replaces it with a loopback PKCE browser sign-in flow handled by the bundled environment server.
• Adds DesktopSingleInstance service to manage single-instance locking; secondary launches quit and surface the primary window.
• Adds beginBrowserLogin, submitBrowserLoginCode, and clientAuthState to CloudCliTokenManager, including a loopback callback server with PKCE, timeout handling, and pending login state.
• Exposes five new HTTP endpoints under /api/connect/auth/ (state, login, code, logout, token) in the environment server, consumed by both the desktop renderer and the web UI via a new useT3ConnectAuth context.
• Opaque OAuth tokens (non-JWT) now participate in the DPoP credential cache in ManagedRelayClient, keyed by token value instead of bypassing the cache.
• Adds optional CLERK_CLI_OAUTH_CLIENT_ID to the relay to restrict accepted OAuth bearer tokens to the designated OAuth app.
• Risk: the desktop renderer no longer mounts Clerk at all; any feature that previously relied on Clerk in the Electron renderer will be broken.

^{Macroscope summarized 627b8cb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b6e705c3-95b7-4edd-8e19-db93198b235c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One finding in the changed web UI: the new desktop account dialog is the only DialogPopup in apps/web/src without an accessible name. Everything else in the diff (Menu/Dialog/Button composition, sidebar avatar parity with the Clerk UserButton trigger classes, the sign-in prompt dialog) follows the existing primitive contracts.

^{Posted via Macroscope — UI Consistency}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	12.6 KiB	+8 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+11 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	51.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	12.6 KiB	−24 B (−0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	−21 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	52.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 8bbbab5 · PR result: 1fab1f8 · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a major new authentication feature: replacing embedded Clerk desktop auth with browser-based OAuth shared with the CLI. It adds new credential endpoints, new auth providers, and new UI flows - significant architectural changes to security-sensitive authentication that warrant thorough review.

Notes:

• No code objects were reviewed. Approvability was decided on eligibility alone.

No code changes detected at 627b8cb. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

One finding on the new desktop account control; the previously reported missing dialog accessible name in the same file is still open and is not re-posted here.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the changed Effect service code (DesktopSingleInstance, CliTokenManager, connect HTTP handlers, managedRelay, contracts). Module/service structure, namespace imports, Context.Service + make + layer layout, and Effect.catchTags usage all follow the conventions, and the removed DesktopClerk/DesktopLinuxUrlHandler modules leave no re-export shims behind.

One finding: the single-instance behavior that moved out of DesktopClerk lost its test coverage even though the lock acquisition itself changed.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[cursor]

Signed-in UI with unusable tokens

Medium Severity

authState treats a stored credential as signed in even when refresh fails, while authToken uses getExisting and fails that same refresh. Desktop can keep showing a session and then getToken returns null, so every relay call dies until the user signs in again.

Additional Locations (1)

• apps/server/src/cloud/CliTokenManager.ts#L724-L766

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[cursor]

Legacy sign-in backfill is not retried

Medium Severity

Desktop treats a user as signed in only when accountId is present, but polling stops as soon as the first authState response arrives. A legacy CLI credential that still needs the userinfo backfill can land as authorized with a null accountId and stay stuck on the sign-in button until a later focus refresh happens to succeed.

Additional Locations (1)

• apps/server/src/cloud/CliTokenManager.ts#L741-L765

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[t3dotgg]

Problem

Clerk inside Electron has been a constant source of auth bugs: passkey prompts firing on mount, hash-history redirect mangling, single-instance lock ordering, Linux AppImage scheme registration, and signed-build-only passkey testing on macOS.

Solution

The desktop app no longer runs any auth UI. Signing in opens the system browser through the bundled server, which runs the exact loopback PKCE flow npx t3 connect already uses and stores the same cloud-cli-oauth-token credential. Sign in from either the desktop app or the CLI and the other is signed in too.

• Relay: the DPoP token-exchange endpoint now accepts OAuth tokens as subject_token through the same verifyRelayClientBearerToken verifier the REST endpoints already used.
• Server: new /api/connect/auth/{state,login,logout,token} endpoints backed by CliTokenManager. beginBrowserLogin runs the loopback flow without a terminal. The stored credential gains an accountId (Clerk sub); legacy CLI credentials backfill it once via /oauth/userinfo.
• Web: one useT3ConnectAuth() session hook, backed by Clerk on the web and by the local server under Electron. All shared components (relay session, link controller, onboarding, sidebar) consume the hook. Electron gets a small "finish in your browser" dialog and a plain account menu over the existing relay-backed pages.
• Client runtime: DPoP token cache keys opaque OAuth tokens by their own value instead of bypassing the cache.
• Desktop: @clerk/electron is gone — the bridge, preload, passkey autofill hack, redirect hack, Clerk/Turnstile CSP entries, Linux URL handler, OS-level t3code:// registration, and macOS passkey entitlements/provisioning requirements all deleted. A small DesktopSingleInstance service takes over the single-instance lock the Clerk bridge used to hold.

Net: −1900/+1200 lines, two dependencies removed, and the release workflow no longer needs APPLE_TEAM_ID, MACOS_PROVISIONING_PROFILE, or CLERK_PASSKEY_RP_DOMAINS.

The Catch

Won't have the full auth view in desktop app anymore. You get this instead

I think it's a worthwhile compromise.

Deploy order: the relay must ship before (or with) the desktop release. A new desktop app against an old relay gets invalid_bearer on the DPoP exchange, so every relay feature dies; an old app against the new relay is unaffected. After deploying, set CLERK_CLI_OAUTH_CLIENT_ID in the relay environment so OAuth bearer tokens are pinned to the CLI/desktop OAuth application.

Rollout note: a signed-out browser needs the hosted app to carry #6285 (preserve CLI OAuth parameters through sign-in, on main since Aug 12, not in the v0.0.33 stable deploy). The next stable release deploys the hosted app and ships this change together, so the ordering resolves itself; only source-build testing against today's prod hosted app needs T3CODE_HOSTED_APP_URL=https://nightly.app.t3.codes or an already signed-in browser.

No Clerk dashboard changes are required to ship this; the Native API/allowed_origins/AASA setup just becomes unused.

Screenshots of the new desktop sign-in dialog and account menu to follow after an integrated pass.

---

Built by Claude Fable 5 via Claude Code.

---

Note

High Risk
Large auth architecture change on desktop plus shared credential and new token endpoints; relay must deploy with OAuth DPoP support and optional client pinning before desktop users rely on connect features.

Overview
Desktop auth is no longer in-app Clerk. The Electron app removes @clerk/electron, preload bridge, Linux t3code:// URL-handler registration, Clerk CSP allowances, and macOS passkey provisioning/release requirements. DesktopSingleInstance takes the single-instance lock the Clerk bridge used to hold; startup deletes legacy clerk-tokens.json.

Sign-in runs on the bundled environment server using the same loopback PKCE flow as npx t3 connect, persisting one cloud-cli-oauth-token for desktop and CLI. CliTokenManager adds beginBrowserLogin, submitBrowserLoginCode, and clientAuthState (with accountId and userinfo backfill for older credentials). New /api/connect/auth/* handlers expose state, login, code, logout, and token to the renderer.

Web/Electron share one session API:useT3ConnectAuth with ClerkConnectAuthProvider (browser) vs DesktopConnectAuthProvider (polls the local server). Desktop gets a “finish in your browser” dialog, optional pasted OOB code, and a non-Clerk account menu; cloud link/onboarding/sidebar use the hook instead of Clerk directly.

Relay optionally pins OAuth bearer tokens via CLERK_CLI_OAUTH_CLIENT_ID; tests cover rejecting tokens from other OAuth apps.

^{Reviewed by Cursor Bugbot for commit 627b8cb. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Sign in to T3 Connect on desktop via the browser, sharing the CLI OAuth credential

• Removes all Clerk Electron/passkey integration from the desktop app (dependencies, preload bridge, renderer provider, macOS signing/entitlements, protocol registration) and replaces it with a loopback PKCE browser sign-in flow handled by the bundled environment server.
• Adds DesktopSingleInstance service to manage single-instance locking; secondary launches quit and surface the primary window.
• Adds beginBrowserLogin, submitBrowserLoginCode, and clientAuthState to CloudCliTokenManager, including a loopback callback server with PKCE, timeout handling, and pending login state.
• Exposes five new HTTP endpoints under /api/connect/auth/ (state, login, code, logout, token) in the environment server, consumed by both the desktop renderer and the web UI via a new useT3ConnectAuth context.
• Opaque OAuth tokens (non-JWT) now participate in the DPoP credential cache in ManagedRelayClient, keyed by token value instead of bypassing the cache.
• Adds optional CLERK_CLI_OAUTH_CLIENT_ID to the relay to restrict accepted OAuth bearer tokens to the designated OAuth app.
• Risk: the desktop renderer no longer mounts Clerk at all; any feature that previously relied on Clerk in the Electron renderer will be broken.

^{Macroscope summarized 627b8cb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b6e705c3-95b7-4edd-8e19-db93198b235c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One finding in the changed web UI: the new desktop account dialog is the only DialogPopup in apps/web/src without an accessible name. Everything else in the diff (Menu/Dialog/Button composition, sidebar avatar parity with the Clerk UserButton trigger classes, the sign-in prompt dialog) follows the existing primitive contracts.

^{Posted via Macroscope — UI Consistency}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	12.6 KiB	+8 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+11 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	51.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	12.6 KiB	−24 B (−0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	−21 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	52.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 8bbbab5 · PR result: 1fab1f8 · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a major new authentication feature: replacing embedded Clerk desktop auth with browser-based OAuth shared with the CLI. It adds new credential endpoints, new auth providers, and new UI flows - significant architectural changes to security-sensitive authentication that warrant thorough review.

Notes:

• No code objects were reviewed. Approvability was decided on eligibility alone.

No code changes detected at 627b8cb. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

One finding on the new desktop account control; the previously reported missing dialog accessible name in the same file is still open and is not re-posted here.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the changed Effect service code (DesktopSingleInstance, CliTokenManager, connect HTTP handlers, managedRelay, contracts). Module/service structure, namespace imports, Context.Service + make + layer layout, and Effect.catchTags usage all follow the conventions, and the removed DesktopClerk/DesktopLinuxUrlHandler modules leave no re-export shims behind.

One finding: the single-instance behavior that moved out of DesktopClerk lost its test coverage even though the lock acquisition itself changed.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[cursor]

Signed-in UI with unusable tokens

Medium Severity

authState treats a stored credential as signed in even when refresh fails, while authToken uses getExisting and fails that same refresh. Desktop can keep showing a session and then getToken returns null, so every relay call dies until the user signs in again.

Additional Locations (1)

• apps/server/src/cloud/CliTokenManager.ts#L724-L766

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[cursor]

Legacy sign-in backfill is not retried

Medium Severity

Desktop treats a user as signed in only when accountId is present, but polling stops as soon as the first authState response arrives. A legacy CLI credential that still needs the userinfo backfill can land as authorized with a null accountId and stay stuck on the sign-in button until a later focus refresh happens to succeed.

Additional Locations (1)

• apps/server/src/cloud/CliTokenManager.ts#L741-L765

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[t3dotgg]

Problem

Clerk inside Electron has been a constant source of auth bugs: passkey prompts firing on mount, hash-history redirect mangling, single-instance lock ordering, Linux AppImage scheme registration, and signed-build-only passkey testing on macOS.

Solution

The desktop app no longer runs any auth UI. Signing in opens the system browser through the bundled server, which runs the exact loopback PKCE flow npx t3 connect already uses and stores the same cloud-cli-oauth-token credential. Sign in from either the desktop app or the CLI and the other is signed in too.

• Relay: the DPoP token-exchange endpoint now accepts OAuth tokens as subject_token through the same verifyRelayClientBearerToken verifier the REST endpoints already used.
• Server: new /api/connect/auth/{state,login,logout,token} endpoints backed by CliTokenManager. beginBrowserLogin runs the loopback flow without a terminal. The stored credential gains an accountId (Clerk sub); legacy CLI credentials backfill it once via /oauth/userinfo.
• Web: one useT3ConnectAuth() session hook, backed by Clerk on the web and by the local server under Electron. All shared components (relay session, link controller, onboarding, sidebar) consume the hook. Electron gets a small "finish in your browser" dialog and a plain account menu over the existing relay-backed pages.
• Client runtime: DPoP token cache keys opaque OAuth tokens by their own value instead of bypassing the cache.
• Desktop: @clerk/electron is gone — the bridge, preload, passkey autofill hack, redirect hack, Clerk/Turnstile CSP entries, Linux URL handler, OS-level t3code:// registration, and macOS passkey entitlements/provisioning requirements all deleted. A small DesktopSingleInstance service takes over the single-instance lock the Clerk bridge used to hold.

Net: −1900/+1200 lines, two dependencies removed, and the release workflow no longer needs APPLE_TEAM_ID, MACOS_PROVISIONING_PROFILE, or CLERK_PASSKEY_RP_DOMAINS.

The Catch

Won't have the full auth view in desktop app anymore. You get this instead

I think it's a worthwhile compromise.

Deploy order: the relay must ship before (or with) the desktop release. A new desktop app against an old relay gets invalid_bearer on the DPoP exchange, so every relay feature dies; an old app against the new relay is unaffected. After deploying, set CLERK_CLI_OAUTH_CLIENT_ID in the relay environment so OAuth bearer tokens are pinned to the CLI/desktop OAuth application.

Rollout note: a signed-out browser needs the hosted app to carry #6285 (preserve CLI OAuth parameters through sign-in, on main since Aug 12, not in the v0.0.33 stable deploy). The next stable release deploys the hosted app and ships this change together, so the ordering resolves itself; only source-build testing against today's prod hosted app needs T3CODE_HOSTED_APP_URL=https://nightly.app.t3.codes or an already signed-in browser.

No Clerk dashboard changes are required to ship this; the Native API/allowed_origins/AASA setup just becomes unused.

Screenshots of the new desktop sign-in dialog and account menu to follow after an integrated pass.

---

Built by Claude Fable 5 via Claude Code.

---

Note

High Risk
Large auth architecture change on desktop plus shared credential and new token endpoints; relay must deploy with OAuth DPoP support and optional client pinning before desktop users rely on connect features.

Overview
Desktop auth is no longer in-app Clerk. The Electron app removes @clerk/electron, preload bridge, Linux t3code:// URL-handler registration, Clerk CSP allowances, and macOS passkey provisioning/release requirements. DesktopSingleInstance takes the single-instance lock the Clerk bridge used to hold; startup deletes legacy clerk-tokens.json.

Sign-in runs on the bundled environment server using the same loopback PKCE flow as npx t3 connect, persisting one cloud-cli-oauth-token for desktop and CLI. CliTokenManager adds beginBrowserLogin, submitBrowserLoginCode, and clientAuthState (with accountId and userinfo backfill for older credentials). New /api/connect/auth/* handlers expose state, login, code, logout, and token to the renderer.

Web/Electron share one session API:useT3ConnectAuth with ClerkConnectAuthProvider (browser) vs DesktopConnectAuthProvider (polls the local server). Desktop gets a “finish in your browser” dialog, optional pasted OOB code, and a non-Clerk account menu; cloud link/onboarding/sidebar use the hook instead of Clerk directly.

Relay optionally pins OAuth bearer tokens via CLERK_CLI_OAUTH_CLIENT_ID; tests cover rejecting tokens from other OAuth apps.

^{Reviewed by Cursor Bugbot for commit 627b8cb. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Sign in to T3 Connect on desktop via the browser, sharing the CLI OAuth credential

• Removes all Clerk Electron/passkey integration from the desktop app (dependencies, preload bridge, renderer provider, macOS signing/entitlements, protocol registration) and replaces it with a loopback PKCE browser sign-in flow handled by the bundled environment server.
• Adds DesktopSingleInstance service to manage single-instance locking; secondary launches quit and surface the primary window.
• Adds beginBrowserLogin, submitBrowserLoginCode, and clientAuthState to CloudCliTokenManager, including a loopback callback server with PKCE, timeout handling, and pending login state.
• Exposes five new HTTP endpoints under /api/connect/auth/ (state, login, code, logout, token) in the environment server, consumed by both the desktop renderer and the web UI via a new useT3ConnectAuth context.
• Opaque OAuth tokens (non-JWT) now participate in the DPoP credential cache in ManagedRelayClient, keyed by token value instead of bypassing the cache.
• Adds optional CLERK_CLI_OAUTH_CLIENT_ID to the relay to restrict accepted OAuth bearer tokens to the designated OAuth app.
• Risk: the desktop renderer no longer mounts Clerk at all; any feature that previously relied on Clerk in the Electron renderer will be broken.

^{Macroscope summarized 627b8cb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b6e705c3-95b7-4edd-8e19-db93198b235c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One finding in the changed web UI: the new desktop account dialog is the only DialogPopup in apps/web/src without an accessible name. Everything else in the diff (Menu/Dialog/Button composition, sidebar avatar parity with the Clerk UserButton trigger classes, the sign-in prompt dialog) follows the existing primitive contracts.

^{Posted via Macroscope — UI Consistency}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	12.6 KiB	+8 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+11 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	51.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	12.6 KiB	−24 B (−0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	−21 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	52.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 8bbbab5 · PR result: 1fab1f8 · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a major new authentication feature: replacing embedded Clerk desktop auth with browser-based OAuth shared with the CLI. It adds new credential endpoints, new auth providers, and new UI flows - significant architectural changes to security-sensitive authentication that warrant thorough review.

Notes:

• No code objects were reviewed. Approvability was decided on eligibility alone.

No code changes detected at 627b8cb. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

One finding on the new desktop account control; the previously reported missing dialog accessible name in the same file is still open and is not re-posted here.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the changed Effect service code (DesktopSingleInstance, CliTokenManager, connect HTTP handlers, managedRelay, contracts). Module/service structure, namespace imports, Context.Service + make + layer layout, and Effect.catchTags usage all follow the conventions, and the removed DesktopClerk/DesktopLinuxUrlHandler modules leave no re-export shims behind.

One finding: the single-instance behavior that moved out of DesktopClerk lost its test coverage even though the lock acquisition itself changed.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[cursor]

Signed-in UI with unusable tokens

Medium Severity

authState treats a stored credential as signed in even when refresh fails, while authToken uses getExisting and fails that same refresh. Desktop can keep showing a session and then getToken returns null, so every relay call dies until the user signs in again.

Additional Locations (1)

• apps/server/src/cloud/CliTokenManager.ts#L724-L766

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[cursor]

Legacy sign-in backfill is not retried

Medium Severity

Desktop treats a user as signed in only when accountId is present, but polling stops as soon as the first authState response arrives. A legacy CLI credential that still needs the userinfo backfill can land as authorized with a null accountId and stay stuck on the sign-in button until a later focus refresh happens to succeed.

Additional Locations (1)

• apps/server/src/cloud/CliTokenManager.ts#L741-L765

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[t3dotgg]

Problem

Clerk inside Electron has been a constant source of auth bugs: passkey prompts firing on mount, hash-history redirect mangling, single-instance lock ordering, Linux AppImage scheme registration, and signed-build-only passkey testing on macOS.

Solution

The desktop app no longer runs any auth UI. Signing in opens the system browser through the bundled server, which runs the exact loopback PKCE flow npx t3 connect already uses and stores the same cloud-cli-oauth-token credential. Sign in from either the desktop app or the CLI and the other is signed in too.

• Relay: the DPoP token-exchange endpoint now accepts OAuth tokens as subject_token through the same verifyRelayClientBearerToken verifier the REST endpoints already used.
• Server: new /api/connect/auth/{state,login,logout,token} endpoints backed by CliTokenManager. beginBrowserLogin runs the loopback flow without a terminal. The stored credential gains an accountId (Clerk sub); legacy CLI credentials backfill it once via /oauth/userinfo.
• Web: one useT3ConnectAuth() session hook, backed by Clerk on the web and by the local server under Electron. All shared components (relay session, link controller, onboarding, sidebar) consume the hook. Electron gets a small "finish in your browser" dialog and a plain account menu over the existing relay-backed pages.
• Client runtime: DPoP token cache keys opaque OAuth tokens by their own value instead of bypassing the cache.
• Desktop: @clerk/electron is gone — the bridge, preload, passkey autofill hack, redirect hack, Clerk/Turnstile CSP entries, Linux URL handler, OS-level t3code:// registration, and macOS passkey entitlements/provisioning requirements all deleted. A small DesktopSingleInstance service takes over the single-instance lock the Clerk bridge used to hold.

Net: −1900/+1200 lines, two dependencies removed, and the release workflow no longer needs APPLE_TEAM_ID, MACOS_PROVISIONING_PROFILE, or CLERK_PASSKEY_RP_DOMAINS.

The Catch

Won't have the full auth view in desktop app anymore. You get this instead

I think it's a worthwhile compromise.

Deploy order: the relay must ship before (or with) the desktop release. A new desktop app against an old relay gets invalid_bearer on the DPoP exchange, so every relay feature dies; an old app against the new relay is unaffected. After deploying, set CLERK_CLI_OAUTH_CLIENT_ID in the relay environment so OAuth bearer tokens are pinned to the CLI/desktop OAuth application.

Rollout note: a signed-out browser needs the hosted app to carry #6285 (preserve CLI OAuth parameters through sign-in, on main since Aug 12, not in the v0.0.33 stable deploy). The next stable release deploys the hosted app and ships this change together, so the ordering resolves itself; only source-build testing against today's prod hosted app needs T3CODE_HOSTED_APP_URL=https://nightly.app.t3.codes or an already signed-in browser.

No Clerk dashboard changes are required to ship this; the Native API/allowed_origins/AASA setup just becomes unused.

Screenshots of the new desktop sign-in dialog and account menu to follow after an integrated pass.

---

Built by Claude Fable 5 via Claude Code.

---

Note

High Risk
Large auth architecture change on desktop plus shared credential and new token endpoints; relay must deploy with OAuth DPoP support and optional client pinning before desktop users rely on connect features.

Overview
Desktop auth is no longer in-app Clerk. The Electron app removes @clerk/electron, preload bridge, Linux t3code:// URL-handler registration, Clerk CSP allowances, and macOS passkey provisioning/release requirements. DesktopSingleInstance takes the single-instance lock the Clerk bridge used to hold; startup deletes legacy clerk-tokens.json.

Sign-in runs on the bundled environment server using the same loopback PKCE flow as npx t3 connect, persisting one cloud-cli-oauth-token for desktop and CLI. CliTokenManager adds beginBrowserLogin, submitBrowserLoginCode, and clientAuthState (with accountId and userinfo backfill for older credentials). New /api/connect/auth/* handlers expose state, login, code, logout, and token to the renderer.

Web/Electron share one session API:useT3ConnectAuth with ClerkConnectAuthProvider (browser) vs DesktopConnectAuthProvider (polls the local server). Desktop gets a “finish in your browser” dialog, optional pasted OOB code, and a non-Clerk account menu; cloud link/onboarding/sidebar use the hook instead of Clerk directly.

Relay optionally pins OAuth bearer tokens via CLERK_CLI_OAUTH_CLIENT_ID; tests cover rejecting tokens from other OAuth apps.

^{Reviewed by Cursor Bugbot for commit 627b8cb. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Sign in to T3 Connect on desktop via the browser, sharing the CLI OAuth credential

• Removes all Clerk Electron/passkey integration from the desktop app (dependencies, preload bridge, renderer provider, macOS signing/entitlements, protocol registration) and replaces it with a loopback PKCE browser sign-in flow handled by the bundled environment server.
• Adds DesktopSingleInstance service to manage single-instance locking; secondary launches quit and surface the primary window.
• Adds beginBrowserLogin, submitBrowserLoginCode, and clientAuthState to CloudCliTokenManager, including a loopback callback server with PKCE, timeout handling, and pending login state.
• Exposes five new HTTP endpoints under /api/connect/auth/ (state, login, code, logout, token) in the environment server, consumed by both the desktop renderer and the web UI via a new useT3ConnectAuth context.
• Opaque OAuth tokens (non-JWT) now participate in the DPoP credential cache in ManagedRelayClient, keyed by token value instead of bypassing the cache.
• Adds optional CLERK_CLI_OAUTH_CLIENT_ID to the relay to restrict accepted OAuth bearer tokens to the designated OAuth app.
• Risk: the desktop renderer no longer mounts Clerk at all; any feature that previously relied on Clerk in the Electron renderer will be broken.

^{Macroscope summarized 627b8cb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b6e705c3-95b7-4edd-8e19-db93198b235c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One finding in the changed web UI: the new desktop account dialog is the only DialogPopup in apps/web/src without an accessible name. Everything else in the diff (Menu/Dialog/Button composition, sidebar avatar parity with the Clerk UserButton trigger classes, the sign-in prompt dialog) follows the existing primitive contracts.

^{Posted via Macroscope — UI Consistency}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	12.6 KiB	+8 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+11 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	51.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	12.6 KiB	−24 B (−0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	−21 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	52.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 8bbbab5 · PR result: 1fab1f8 · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a major new authentication feature: replacing embedded Clerk desktop auth with browser-based OAuth shared with the CLI. It adds new credential endpoints, new auth providers, and new UI flows - significant architectural changes to security-sensitive authentication that warrant thorough review.

Notes:

• No code objects were reviewed. Approvability was decided on eligibility alone.

No code changes detected at 627b8cb. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

One finding on the new desktop account control; the previously reported missing dialog accessible name in the same file is still open and is not re-posted here.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the changed Effect service code (DesktopSingleInstance, CliTokenManager, connect HTTP handlers, managedRelay, contracts). Module/service structure, namespace imports, Context.Service + make + layer layout, and Effect.catchTags usage all follow the conventions, and the removed DesktopClerk/DesktopLinuxUrlHandler modules leave no re-export shims behind.

One finding: the single-instance behavior that moved out of DesktopClerk lost its test coverage even though the lock acquisition itself changed.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[cursor]

Signed-in UI with unusable tokens

Medium Severity

authState treats a stored credential as signed in even when refresh fails, while authToken uses getExisting and fails that same refresh. Desktop can keep showing a session and then getToken returns null, so every relay call dies until the user signs in again.

Additional Locations (1)

• apps/server/src/cloud/CliTokenManager.ts#L724-L766

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[cursor]

Legacy sign-in backfill is not retried

Medium Severity

Desktop treats a user as signed in only when accountId is present, but polling stops as soon as the first authState response arrives. A legacy CLI credential that still needs the userinfo backfill can land as authorized with a null accountId and stay stuck on the sign-in button until a later focus refresh happens to succeed.

Additional Locations (1)

• apps/server/src/cloud/CliTokenManager.ts#L741-L765

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[t3dotgg]

Problem

Clerk inside Electron has been a constant source of auth bugs: passkey prompts firing on mount, hash-history redirect mangling, single-instance lock ordering, Linux AppImage scheme registration, and signed-build-only passkey testing on macOS.

Solution

The desktop app no longer runs any auth UI. Signing in opens the system browser through the bundled server, which runs the exact loopback PKCE flow npx t3 connect already uses and stores the same cloud-cli-oauth-token credential. Sign in from either the desktop app or the CLI and the other is signed in too.

• Relay: the DPoP token-exchange endpoint now accepts OAuth tokens as subject_token through the same verifyRelayClientBearerToken verifier the REST endpoints already used.
• Server: new /api/connect/auth/{state,login,logout,token} endpoints backed by CliTokenManager. beginBrowserLogin runs the loopback flow without a terminal. The stored credential gains an accountId (Clerk sub); legacy CLI credentials backfill it once via /oauth/userinfo.
• Web: one useT3ConnectAuth() session hook, backed by Clerk on the web and by the local server under Electron. All shared components (relay session, link controller, onboarding, sidebar) consume the hook. Electron gets a small "finish in your browser" dialog and a plain account menu over the existing relay-backed pages.
• Client runtime: DPoP token cache keys opaque OAuth tokens by their own value instead of bypassing the cache.
• Desktop: @clerk/electron is gone — the bridge, preload, passkey autofill hack, redirect hack, Clerk/Turnstile CSP entries, Linux URL handler, OS-level t3code:// registration, and macOS passkey entitlements/provisioning requirements all deleted. A small DesktopSingleInstance service takes over the single-instance lock the Clerk bridge used to hold.

Net: −1900/+1200 lines, two dependencies removed, and the release workflow no longer needs APPLE_TEAM_ID, MACOS_PROVISIONING_PROFILE, or CLERK_PASSKEY_RP_DOMAINS.

The Catch

Won't have the full auth view in desktop app anymore. You get this instead

I think it's a worthwhile compromise.

Deploy order: the relay must ship before (or with) the desktop release. A new desktop app against an old relay gets invalid_bearer on the DPoP exchange, so every relay feature dies; an old app against the new relay is unaffected. After deploying, set CLERK_CLI_OAUTH_CLIENT_ID in the relay environment so OAuth bearer tokens are pinned to the CLI/desktop OAuth application.

Rollout note: a signed-out browser needs the hosted app to carry #6285 (preserve CLI OAuth parameters through sign-in, on main since Aug 12, not in the v0.0.33 stable deploy). The next stable release deploys the hosted app and ships this change together, so the ordering resolves itself; only source-build testing against today's prod hosted app needs T3CODE_HOSTED_APP_URL=https://nightly.app.t3.codes or an already signed-in browser.

No Clerk dashboard changes are required to ship this; the Native API/allowed_origins/AASA setup just becomes unused.

Screenshots of the new desktop sign-in dialog and account menu to follow after an integrated pass.

---

Built by Claude Fable 5 via Claude Code.

---

Note

High Risk
Large auth architecture change on desktop plus shared credential and new token endpoints; relay must deploy with OAuth DPoP support and optional client pinning before desktop users rely on connect features.

Overview
Desktop auth is no longer in-app Clerk. The Electron app removes @clerk/electron, preload bridge, Linux t3code:// URL-handler registration, Clerk CSP allowances, and macOS passkey provisioning/release requirements. DesktopSingleInstance takes the single-instance lock the Clerk bridge used to hold; startup deletes legacy clerk-tokens.json.

Sign-in runs on the bundled environment server using the same loopback PKCE flow as npx t3 connect, persisting one cloud-cli-oauth-token for desktop and CLI. CliTokenManager adds beginBrowserLogin, submitBrowserLoginCode, and clientAuthState (with accountId and userinfo backfill for older credentials). New /api/connect/auth/* handlers expose state, login, code, logout, and token to the renderer.

Web/Electron share one session API:useT3ConnectAuth with ClerkConnectAuthProvider (browser) vs DesktopConnectAuthProvider (polls the local server). Desktop gets a “finish in your browser” dialog, optional pasted OOB code, and a non-Clerk account menu; cloud link/onboarding/sidebar use the hook instead of Clerk directly.

Relay optionally pins OAuth bearer tokens via CLERK_CLI_OAUTH_CLIENT_ID; tests cover rejecting tokens from other OAuth apps.

^{Reviewed by Cursor Bugbot for commit 627b8cb. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Sign in to T3 Connect on desktop via the browser, sharing the CLI OAuth credential

• Removes all Clerk Electron/passkey integration from the desktop app (dependencies, preload bridge, renderer provider, macOS signing/entitlements, protocol registration) and replaces it with a loopback PKCE browser sign-in flow handled by the bundled environment server.
• Adds DesktopSingleInstance service to manage single-instance locking; secondary launches quit and surface the primary window.
• Adds beginBrowserLogin, submitBrowserLoginCode, and clientAuthState to CloudCliTokenManager, including a loopback callback server with PKCE, timeout handling, and pending login state.
• Exposes five new HTTP endpoints under /api/connect/auth/ (state, login, code, logout, token) in the environment server, consumed by both the desktop renderer and the web UI via a new useT3ConnectAuth context.
• Opaque OAuth tokens (non-JWT) now participate in the DPoP credential cache in ManagedRelayClient, keyed by token value instead of bypassing the cache.
• Adds optional CLERK_CLI_OAUTH_CLIENT_ID to the relay to restrict accepted OAuth bearer tokens to the designated OAuth app.
• Risk: the desktop renderer no longer mounts Clerk at all; any feature that previously relied on Clerk in the Electron renderer will be broken.

^{Macroscope summarized 627b8cb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b6e705c3-95b7-4edd-8e19-db93198b235c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

One finding in the changed web UI: the new desktop account dialog is the only DialogPopup in apps/web/src without an accessible name. Everything else in the diff (Menu/Dialog/Button composition, sidebar avatar parity with the Clerk UserButton trigger classes, the sign-in prompt dialog) follows the existing primitive contracts.

^{Posted via Macroscope — UI Consistency}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	12.6 KiB	+8 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+11 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	51.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	12.6 KiB	−24 B (−0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	−21 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	52.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 8bbbab5 · PR result: 1fab1f8 · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a major new authentication feature: replacing embedded Clerk desktop auth with browser-based OAuth shared with the CLI. It adds new credential endpoints, new auth providers, and new UI flows - significant architectural changes to security-sensitive authentication that warrant thorough review.

Notes:

• No code objects were reviewed. Approvability was decided on eligibility alone.

No code changes detected at 627b8cb. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

One finding on the new desktop account control; the previously reported missing dialog accessible name in the same file is still open and is not re-posted here.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the changed Effect service code (DesktopSingleInstance, CliTokenManager, connect HTTP handlers, managedRelay, contracts). Module/service structure, namespace imports, Context.Service + make + layer layout, and Effect.catchTags usage all follow the conventions, and the removed DesktopClerk/DesktopLinuxUrlHandler modules leave no re-export shims behind.

One finding: the single-instance behavior that moved out of DesktopClerk lost its test coverage even though the lock acquisition itself changed.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[cursor]

Signed-in UI with unusable tokens

Medium Severity

authState treats a stored credential as signed in even when refresh fails, while authToken uses getExisting and fails that same refresh. Desktop can keep showing a session and then getToken returns null, so every relay call dies until the user signs in again.

Additional Locations (1)

• apps/server/src/cloud/CliTokenManager.ts#L724-L766

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}

[cursor]

Legacy sign-in backfill is not retried

Medium Severity

Desktop treats a user as signed in only when accountId is present, but polling stops as soon as the first authState response arrives. A legacy CLI credential that still needs the userinfo backfill can land as authorized with a null accountId and stay stuck on the sign-in button until a later focus refresh happens to succeed.

Additional Locations (1)

• apps/server/src/cloud/CliTokenManager.ts#L741-L765

^{Reviewed by Cursor Bugbot for commit 627b8cb. Configure here.}