Fix Electron dev and packaged renderer startup

[juliusmarminge]

Summary

• preserve the dedicated t3code-dev://app origin for development and t3code://app for packaged builds
• allow both desktop renderer origins through the local development backend CORS policy
• sanitize custom-protocol navigation headers before proxying renderer assets to Vite/server
• retry transient idempotent renderer fetch failures during startup
• do not rewrite, impersonate, or automatically select Clerk credentials

Verification

• switched the existing T3CODE_CLERK_PUBLISHABLE_KEY and T3CODE_CLERK_CLI_OAUTH_CLIENT_ID entries in the ignored local .env for each mode
• vp run dev:desktop with development credentials; Computer Use verified the signed-in project UI at t3code-dev://app/
• vp run dist:desktop:artifact with production credentials; fresh arm64 Alpha package reached backend ready and main window created
• focused suite: 115 passing tests
• vp check
• vp run typecheck

---

Note

Medium Risk
Touches auth-adjacent CORS and the Electron protocol proxy path used for all renderer traffic; changes are scoped to dev origins and idempotent GET/HEAD retries with tests.

Overview
Improves Electron desktop dev and packaged startup by fixing how the custom protocol proxies traffic and how the local API accepts browser calls from the renderer.

ElectronProtocol strips hop-by-hop and browser-only headers (origin, referer, sec-fetch-*, etc.) before forwarding to Vite/the app server, and retries GET/HEAD fetches up to three times (0/50/150ms) on transient connection failures like ECONNREFUSED.

In development, the server CORS layer now allows credentialed preflights from t3code://app and t3code-dev://app alongside the Vite dev origin. Vite HMR sets an explicit clientPort so the HMR WebSocket connects reliably inside Electron.

Marketing bumps Astro from 6 to 7.0.3. Tests cover header sanitization, retry behavior, and desktop-origin CORS preflights.

^{Reviewed by Cursor Bugbot for commit 41d30ee. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix Electron renderer startup by retrying transient fetch failures and correcting CORS and HMR config

• Adds fetchWithTransientRetry in ElectronProtocol.ts to retry GET/HEAD requests up to 3 times with short delays (0, 50, 150 ms) on transient failures like ECONNREFUSED during renderer startup.
• Strips browser-specific headers (origin, referer, sec-fetch-*, etc.) before forwarding proxied requests to the target.
• Adds t3code://app and t3code-dev://app to allowed CORS origins in apps/server/src/http.ts so credentialed requests from the packaged and dev Electron renderer work correctly.
• Sets clientPort explicitly in the Vite HMR config so WebSocket connections work inside the Electron BrowserWindow.
• Behavioral Change: non-GET/HEAD requests no longer forward origin, referer, or sec-fetch-* headers to the target.

^{Macroscope summarized 41d30ee.}

Toolchain follow-up

• configure Vite HMR with the explicit desktop dev client port, removing the recoverable initial WebSocket failure
• upgrade Vite+ and Vite+ core from 0.1.24 to exact 0.2.1
• remove the retired vite-plus-test wrapper and obsolete Vitest resolution rules; retain one transitive Vitest 4.1.9 / Vite+ core graph
• upgrade the marketing app from Astro 6 to Astro 7.0.3
• full verification: vp test (536 files / 4099 tests passed), vp check, vp run typecheck, Astro production build, dev UI + clean DevTools console, packaged renderer IPC bootstrap

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 2b6e73fc-1fea-4b72-ab19-f263e3211ac0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-electron-protocol-startup

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved

Bug fix for Electron renderer startup with well-tested, limited-scope changes: header stripping for proxied requests, retry logic for transient GET/HEAD failures, and dev-mode CORS configuration. All changes include corresponding tests.

^{You can customize Macroscope's approvability policy. Learn more.}