fix: stabilize local dev auth startup by huxcrux · Pull Request #3252 · pingdotgg/t3code

huxcrux · 2026-06-20T09:36:35Z

What Changed

Prevent Clerk-dependent desktop/web code from loading when Clerk local config is absent.
Register the desktop app scheme independently so local desktop startup no longer depends on Clerk side effects.
Route desktop custom-scheme requests through the app protocol using the Effect/Undici HTTP client.
Load the diff worker via the portable worker entry to avoid Vite worker default-export failures.
Route configured local-dev HTTP requests through the Vite origin while preserving direct WebSocket targets.
Harden pairing bootstrap by deduping same-token submits and tolerating already-authenticated stale token retries.

Why

Local development could fail when Clerk config was missing or when running the web dev flow through vp run dev. Clerk was being loaded too eagerly, desktop scheme registration depended on Clerk bridge setup, diff worker imports could fail under Vite, and pairing-token exchange could consume a one-time token before the browser session was observable on the correct origin.

This keeps local startup resilient without Clerk config, avoids CORS/cookie-origin issues by using the web/Vite origin for browser HTTP requests, and preserves direct loopback WebSockets where required.

UI Changes

Checklist

This PR is small and focused
I explained what changed and why
I included before/after screenshots for any UI changes
I included a video for animation/interaction changes

Note

Medium Risk
Desktop auth and renderer URL selection change in development, but production paths with a Clerk key stay on the custom protocol and bridge; mobile list scrolling behavior changes with the keyboard refactor.

Overview
Makes local desktop dev work without Clerk by gating every Clerk touchpoint on whether a valid build-time publishable key resolves to a Frontend API hostname.

Desktop: New DesktopClerkConfig centralizes hostname parsing and isDesktopClerkBridgeEnabled(). The Clerk SDK bridge, preload exposeClerkBridge, and custom-scheme protocol registration are skipped when disabled; in that dev mode the main window loads the Vite dev server URL instead of t3code-dev://. makeDesktopClerkLayer can omit bridge acquire/release while still providing single-instance / second-window behavior.

Mobile: Thread chat drops KeyboardAwareLegendList / shared-value keyboard inset hooks in favor of KeyboardAvoidingLegendList, measured composer overlay height, and direct scrollToEnd after send.

Web: Adds a thin TimelineLegendList type wrapper so the timeline can pass contentInsetEndAdjustment without fighting LegendList typings.

^{Reviewed by Cursor Bugbot for commit 59f460b. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix local dev auth startup by conditionally initializing the Clerk bridge

Introduces DesktopClerkConfig.ts to centralize Clerk bridge enablement checks and hostname resolution from the publishable key.
The Electron custom protocol registration, preload bridge exposure, and SDK bridge acquisition are now all skipped when no Clerk publishable key is present (isDesktopClerkBridgeEnabled() === false).
Development builds without a publishable key load the renderer directly from the dev server URL instead of the custom t3code-dev protocol.
Refactors ThreadDetailScreen and ThreadFeed on mobile to use KeyboardAvoidingLegendList with manual composer layout tracking, removing Legend keyboard helpers.

^{Macroscope summarized 59f460b.}

coderabbitai · 2026-06-20T09:36:43Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 4b99ca00-2b8d-42cd-a793-51b896f18c02

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

macroscopeapp · 2026-06-20T09:43:20Z

Approvability

Verdict: Needs human review

1 blocking correctness issue found. This PR modifies runtime behavior in desktop auth startup and mobile keyboard/scroll handling. Unresolved review comments identify potential bugs in the scroll behavior changes that warrant human review before merging.

^{You can customize Macroscope's approvability policy. Learn more.}

juliusmarminge · 2026-06-22T22:09:39Z

+  const effect = Effect.gen(function* () {
+    const clientRequest = HttpClientRequest.fromWeb(new Request(targetUrl, init));
+    const clientResponse = yield* httpClient.execute(clientRequest);
+    return withContentSecurityPolicy(
+      new Response(
+        request.method === "HEAD" ? null : Stream.toReadableStream(clientResponse.stream),
+        {
+          status: clientResponse.status,
+          headers: clientResponse.headers,
+        },
+      ),
+      contentSecurityPolicy,
+    );
+  });


why was this made? i ran into clerk bot protection when the fetch was made using undici earlier

This was an attempt to try keep the custom scheme for all app requests. However to avoid alot of the changes we could simply revert back to http://127.0.0.1 when clerk config is not present.

I'll push a fix

It should be better now

Gate Clerk-dependent renderer and desktop bridge setup when local config is absent, register the desktop schemes independently, proxy custom-scheme requests through the app protocol, and load the diff worker via the portable package worker entry. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Route configured loopback HTTP requests through the Vite origin so browser-session cookies are scoped to the page origin, while preserving direct WebSocket targets. Dedupe same-token pairing submits and tolerate stale one-time-token retries when a session is already authenticated. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Stream desktop protocol proxy responses instead of buffering complete bodies, and wait for browser sessions to become observable after manual pairing exchanges. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

cursor

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 59f460b. Configure here.}

cursor · 2026-06-30T14:04:11Z

    lastScrolledAnchorMessageIdRef.current = null;
-    freeze.set(false);
-  }, [freeze, selectedThreadKey]);
+  }, [selectedThreadKey]);


Composer inset stale after changes

Low Severity

Replacing the keyboard inset hooks with composerOverlayHeight state means contentBottomInset can stay at an old measured value when estimatedOverlayHeight drops (for example after switching threads or when the working indicator clears) until onComposerLayout runs again, leaving excess bottom padding on the thread feed.

^{Reviewed by Cursor Bugbot for commit 59f460b. Configure here.}

macroscopeapp · 2026-06-30T14:07:35Z

🟡 Medium

t3code/apps/mobile/src/features/threads/ThreadDetailScreen.tsx

Line 289 in 59f460b

const frame = requestAnimationFrame(() => {

After sending a message from the focused composer, listRef.current?.scrollToEnd() runs immediately in the requestAnimationFrame callback, but at that point the keyboard is still dismissing and the KeyboardAvoidingLegendList has not finished adjusting its content insets. The scroll target is computed against the pre-keyboard-dismiss layout, so the newest message ends up scrolled underneath the closing keyboard instead of being fully visible. The previous useKeyboardScrollToEnd helper coordinated the scroll with the keyboard animation freeze so the list settled after the insets updated; removing it means freshly sent messages are not brought fully into view until the user manually scrolls.

🤖 Copy this AI Prompt to have your agent fix this:

In file @apps/mobile/src/features/threads/ThreadDetailScreen.tsx around line 289: After sending a message from the focused composer, `listRef.current?.scrollToEnd()` runs immediately in the `requestAnimationFrame` callback, but at that point the keyboard is still dismissing and the `KeyboardAvoidingLegendList` has not finished adjusting its content insets. The scroll target is computed against the pre-keyboard-dismiss layout, so the newest message ends up scrolled underneath the closing keyboard instead of being fully visible. The previous `useKeyboardScrollToEnd` helper coordinated the scroll with the keyboard animation freeze so the list settled after the insets updated; removing it means freshly sent messages are not brought fully into view until the user manually scrolls.

huxcrux · 2026-06-30T14:19:57Z

This has been fixed in main, closing the PR

github-actions Bot added vouch:unvouched PR author is not yet trusted in the VOUCHED list. size:L 100-499 changed lines (additions + deletions). labels Jun 20, 2026

cursor Bot reviewed Jun 20, 2026

View reviewed changes

Comment thread apps/desktop/src/electron/ElectronProtocol.ts Outdated

Comment thread apps/web/src/environments/primary/auth.ts Outdated

huxcrux marked this pull request as draft June 20, 2026 09:42

macroscopeapp Bot reviewed Jun 20, 2026

View reviewed changes

Comment thread apps/web/src/environments/primary/auth.ts Outdated

huxcrux marked this pull request as ready for review June 20, 2026 09:52

This was referenced Jun 20, 2026

[codex] Structure desktop Clerk bridge failures #3308

Merged

[codex] Structure Electron protocol teardown failures #3310

Merged

huxcrux force-pushed the dev-fix branch from 6593a5f to 89bf5f5 Compare June 21, 2026 09:57

juliusmarminge reviewed Jun 22, 2026

View reviewed changes

huxcrux force-pushed the dev-fix branch from fde6cc2 to 63d0d6a Compare June 23, 2026 00:19

cursor Bot reviewed Jun 23, 2026

View reviewed changes

Comment thread apps/desktop/src/preload.ts

aanishs mentioned this pull request Jun 23, 2026

[Bug]: Failed startup session probe bricks the app — fatal, sticky error in root beforeLoad with no recovery #3513

Open

2 tasks

huxcrux force-pushed the dev-fix branch from 7bdb453 to 910d4d0 Compare June 27, 2026 18:41

huxcrux and others added 12 commits June 30, 2026 15:44

fix: address local dev startup review feedback

0b74fec

Stream desktop protocol proxy responses instead of buffering complete bodies, and wait for browser sessions to become observable after manual pairing exchanges. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix: resolve latest main rebase conflicts

dad0f1a

some web changes

15628da

fix: avoid local desktop clerk startup without config

2239dbf

fix: align desktop clerk bridge config

5e26036

fix: keep desktop preload config sandbox-safe

0c5069b

fix: reduce connect auth startup diff

1cc0b01

fix: align local dev auth tests with latest main

ec97269

fix: reduce local auth startup diff

9ceb5e6

fix: align mobile chat list keyboard handling

59f460b

huxcrux force-pushed the dev-fix branch from a26ded2 to 59f460b Compare June 30, 2026 13:59

cursor Bot reviewed Jun 30, 2026

View reviewed changes

macroscopeapp Bot reviewed Jun 30, 2026

View reviewed changes

huxcrux closed this Jun 30, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: stabilize local dev auth startup#3252

fix: stabilize local dev auth startup#3252
huxcrux wants to merge 12 commits into
pingdotgg:mainfrom
huxcrux:dev-fix

huxcrux commented Jun 20, 2026 •

edited by macroscopeapp Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 20, 2026 •

edited

Loading

Review skipped

Uh oh!

Uh oh!

Uh oh!

Uh oh!

macroscopeapp Bot commented Jun 20, 2026 •

edited

Loading

Uh oh!

juliusmarminge Jun 22, 2026

Uh oh!

huxcrux Jun 23, 2026

Uh oh!

huxcrux Jun 23, 2026

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Jun 30, 2026

Uh oh!

macroscopeapp Bot Jun 30, 2026

Uh oh!

huxcrux commented Jun 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

huxcrux commented Jun 20, 2026 • edited by macroscopeapp Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Changed

Why

UI Changes

Checklist

Fix local dev auth startup by conditionally initializing the Clerk bridge

Uh oh!

coderabbitai Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Uh oh!

Uh oh!

Uh oh!

macroscopeapp Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Approvability

Uh oh!

juliusmarminge Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

huxcrux Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

huxcrux Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jun 30, 2026

Choose a reason for hiding this comment

Composer inset stale after changes

Uh oh!

macroscopeapp Bot Jun 30, 2026

Choose a reason for hiding this comment

Uh oh!

huxcrux commented Jun 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

huxcrux commented Jun 20, 2026 •

edited by macroscopeapp Bot

Loading

coderabbitai Bot commented Jun 20, 2026 •

edited

Loading

macroscopeapp Bot commented Jun 20, 2026 •

edited

Loading