fix(desktop): restore T3 Connect sign-in

[PixPMusic]

What changed

• Normalize Electron Clerk sign-in redirects to the registered renderer root.
• Preserve the full current URL for hosted web and CLI authorization flows.
• Share the redirect policy across T3 Connect sign-in entry points.
• Add focused coverage for packaged desktop, desktop development, and hosted web URLs.

Why

The Connect GA change forced window.location.href as the post-auth redirect. During desktop authentication Clerk uses /continue, which produced t3code://app/continue#/settings/general. Clerk only authorizes the Electron bridge callback at t3code://app/, so both stable 0.30 and Nightly rejected the sign-in request.

Using the stable renderer root on Electron keeps the request aligned with the native redirect allowlist while leaving browser redirects unchanged.

User impact

Desktop users can sign in to T3 Connect again in stable and Nightly builds without receiving an unauthorized redirect URI error.

Validation

• vp test run src/components/clerk/authRedirect.test.ts --project unit — 3 tests passed
• Targeted formatting and lint passed for all changed files
• vp run --filter @t3tools/web typecheck passed
• git diff --check passed

UI changes

No screenshots included. This changes the native authentication redirect rather than rendered UI, and the production Clerk flow was not launched during this pass.

Checklist

• This PR is small and focused
• I explained what changed and why
• I added regression coverage

Model: GPT-5.6 Sol | Harness: Codex in T3 Code

---

Note

Medium Risk
Touches authentication redirect behavior on Electron and web; incorrect policy could break sign-in or post-auth navigation, but scope is small and covered by targeted tests.

Overview
Fixes desktop T3 Connect sign-in failures caused by passing forceRedirectUrl: window.location.href into Clerk. On Electron, page-derived URLs (paths, hashes, or /continue handoff URLs) fall outside Clerk’s native allowlist, which only accepts the renderer root t3code://app/ (or t3code-dev://app/ in dev).

Introduces resolveClerkSignInProps, which returns an empty props object on Electron so Clerk/@clerk/electron use their default OAuth redirect, and still sets forceRedirectUrl to the full current URL on hosted web.

useT3ConnectAuthPrompt and ConnectCliAuthSurface (auto sign-in and the Sign in button) now call openSignIn through that helper. Unit tests cover web, packaged desktop, and dev desktop cases.

^{Reviewed by Cursor Bugbot for commit e2dd22b. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix T3 Connect sign-in redirect on desktop by skipping forceRedirectUrl under Electron

Introduces a resolveClerkSignInProps utility in authRedirect.ts that returns {} when running under Electron and {forceRedirectUrl: href} on web. Updates useT3ConnectAuthPrompt.tsx and ConnectCliAuthSurface.tsx to use this resolver instead of unconditionally setting forceRedirectUrl, fixing the broken sign-in flow in the desktop app.

^{Macroscope summarized e2dd22b.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b6e31b7e-b822-4232-bdc0-dafc5ac7447f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved e2dd22b

Straightforward bug fix that restores desktop sign-in by conditionally omitting a Clerk redirect parameter that's incompatible with Electron's OAuth allowlist. The change is small, well-documented, and includes tests.

^{You can customize Macroscope's approvability policy. Learn more.}

[juliusmarminge]

Pushed e2dd22b, which changes the approach: instead of normalizing forceRedirectUrl to the scheme root on Electron, we now omit the override entirely there (openSignIn() with Clerk defaults), which is exactly the configuration the pre-GA waitlist-era sign-in used — and that flow worked on desktop.

Rationale: the URL Clerk rejected in #4815 (t3code://app/CLERK-ROUTER/VIRTUAL/sign-up#/settings/general) is not the forceRedirectUrl — it's built by Clerk's modal virtual router from window.location.origin, so normalizing the override can't be shown to fix the Google flow. Reverting to defaults sidesteps the question: @clerk/electron's OAuth transport already substitutes the allowlisted t3code://app/ callback for the OAuth leg, and with no page-derived override in the request we match the previously working behavior instead of guessing at the allowlist's matching rules. Browser/CLI flows still get forceRedirectUrl: window.location.href unchanged.

Validation: helper unit tests (3 passed), @t3tools/web typecheck, vp fmt. The production Clerk flow still hasn't been exercised end-to-end — worth a packaged-build Google sign-in check before release. Note #4815 also reports the Linux AppImage never registers the t3code:// scheme handler; that's a separate packaging fix this PR doesn't cover.