feat: fail-proof org first connection (guided install link, first-run fork, mismatch guard, verified handoff)

[benjaminshafii]

What

Closes the loop on the org "first connection" handoff (web → download → installer → desktop → web) so an invited teammate can no longer silently end up on the wrong server (the Blue Yonder incident class). One link — the org install link — is now visible, copyable, and paste-recoverable at every step, every degraded path asks instead of guessing, and the org's own web page confirms the desktop actually connected.

Changes

den-web

• Install page is a 3-step checklist (download → open installer → sign in) with the install link pinned in a copy box and step 3 flipping to "✓ Connected — OpenWork is set up for {org}" via grant-status polling; expired links say so explicitly.
• Dashboard home card is now "Download for this workspace" with non-rotating Open/Copy install-link actions (dashboard use never revokes teammates' links).
• "Open OpenWork" surfaces (join-org success, auth panel) poll the grant and show connected / troubleshooting states with a paste-able sign-in code fallback.

den-api

• POST /v1/auth/desktop-handoff/status — rate-limited, public, returns pending|consumed|unknown, never leaks tokens.
• /v1/install/:platform serves mounted generic installers stamped (mac: zip sidecar; win: filename tag — was redirecting to the plain versioned desktop exe, a real bug found during Windows validation), falling back to the existing plain redirect + deep-link binding.

desktop app

• First-run fork on Welcome: "Use OpenWork Cloud" vs "Join your organization — paste your invite link" (accepts install links, openwork:// links, raw grants). No silent defaults; local-first escape hatch kept.
• Deep-link server mismatch guard: a den-auth link targeting a different server than a file-managed bootstrap asks before switching.
• Bootstrap boot race eliminated: preload exposes the bootstrap synchronously (meta.desktopBootstrap); no window where an org device believes it's on hosted cloud. Bootstrap now carries source: file|default.

installer

• Paste screen points back to the install page copy box; expired/replaced links get a named, friendly error.

Validation (commands + results)

• Linux Daytona sandbox, full end-to-end fraimz — 7/7 frames PASSED (pnpm fraimz --flow first-connection --cdp-url http://127.0.0.1:9825): real den stack, two Chrome profiles, real installer binary, real Electron. Results: evals/results/2026-07-21T21-04-57-963Z/ (fraimz comment below).
• Windows Daytona VM against a public den server — evals/results/first-connection-windows-20260721/report.md: W1 stamped-exe → Acme bootstrap in %LOCALAPPDATA% ✓, W2 renamed exe → paste fallback ✓, W3 expired link message ✓, W4 (app-on-Windows) skipped honestly (no toolchain in VM; read path covered by workspace-store unit tests).
• Unit/typecheck: den-web typecheck ✓, den-api tsc ✓ + 38 bun tests ✓, apps/app typecheck ✓, workspace-store 21/21 ✓, installer 29 tests ✓, eval-runner tests ✓.

Post-merge note

release-generic-installer.yml is workflow_dispatch — run it after merge so deployments can mount current generic installer builds; without mounted artifacts the route falls back to the plain installer + deep-link binding (now covered by the first-run fork).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-app	Error		Jul 21, 2026 9:36pm
openwork-den	Ready	Preview, Comment	Jul 21, 2026 9:36pm
openwork-den-worker-proxy	Ready	Preview, Comment	Jul 21, 2026 9:36pm
openwork-diagnostics	Ready	Preview, Comment	Jul 21, 2026 9:36pm
openwork-landing	Ready	Preview, Comment, Open in v0	Jul 21, 2026 9:36pm

[benjaminshafii]

fraimz — ✅ PASSED 7/7 (run 2026-07-21T21-04-57-963Z, Daytona Linux sandbox, real den stack + real installer + real Electron)

Full report: evals/results/2026-07-21T21-04-57-963Z/report.md (in-branch) · Windows evidence: evals/results/first-connection-windows-20260721/report.md

Frame 1 — dashboard "Download for this workspace": copied link is /install?token=, token resolves to Acme Robotics, requireSignin true.

Frame 2 — install page 3-step checklist, link pinned in copy box, step 3 "Waiting for sign-in…".

Frame 3 — stamped installer: sidecar names Acme; real binary dry-run writes org bootstrap (baseUrl/apiBaseUrl/requireSignin).

Frame 4 — renamed/bare installer asks, never guesses: paste screen points at the install page copy box; expired link gets a named error.

Frame 5 — plain app first-run fork: "Use OpenWork Cloud" vs "Join your organization"; pasting the link binds the device to Acme and lands on forced sign-in showing the org server.

Frame 6 — deep-link mismatch guard: a sign-in link for a different server prompts "Switch organization server?"; Cancel leaves the device on Acme (bootstrap + active org asserted).

Frame 7 — the loop closes on the org's page: step 3 flips to "✓ Connected — OpenWork is set up for Acme Robotics" after the desktop exchanges the grant.

Windows (real VM vs public den server): W1 stamped-filename exe → Acme bootstrap in %LOCALAPPDATA% ✓ · W2 renamed exe → paste fallback ✓ · W3 expired-link message ✓ · W4 app-on-Windows skipped honestly (no toolchain in VM; read path covered by workspace-store unit tests). Found+fixed real bug: /v1/install/win-x64 served the plain versioned exe instead of the stamped generic installer.

Repro: pnpm fraimz --flow first-connection --cdp-url http://127.0.0.1:9825 in a Daytona sandbox per .devcontainer/test-on-daytona.sh feat/first-connection --artifacts-volume + den stack (see report for full env).