fix(desktop): bump Clerk Electron SDK to 0.0.24 and register t3code:// scheme on Linux

[juliusmarminge]

Summary

@clerk/electron@0.0.24 ships the fix for the stuck OAuth spinner / "You are signed out" state: the SDK now holds Electron's single-instance lock so deep-link callbacks are forwarded to the running app instead of being swallowed by a second instance (see @clerk/electron README). This PR upgrades to it and does the required app-side changes.

Version bumps (pnpm-workspace.yaml catalog)

• @clerk/electron 0.0.18 → 0.0.24
• @clerk/clerk-js 6.25.7 → 6.25.12, @clerk/react 6.12.7 → 6.12.9, @clerk/shared 4.25.7 → 4.25.9 (exactly what 0.0.24 depends on)
• @clerk/backend 3.13.0 → 3.14.0, @clerk/expo 4.0.2 → 4.1.2 so every Clerk package agrees on the shared internals
• @clerk/electron-passkeys stays 0.0.3 (latest stable)

The lockfile resolves each @clerk/* package to exactly one version — no duplicated Clerk internals.

Single-instance lock handoff

createClerkBridge now acquires the lock itself when a renderer scheme is configured. DesktopClerk.configure previously acquired its own lock after bridge creation, which would conflict; it now gates bootstrap on the bridge's new isPrimaryInstance flag per the README (secondary instances quit and interrupt startup before whenReady fires). The second-instance handler that reveals the main window is unchanged, and the now-unused requestSingleInstanceLock wrapper is removed from the ElectronApp service.

Ordering note: the lock is now acquired at bridge creation, before the custom userData path is set. This is safe — primary and secondary instances of the same build both acquire it at the same point with the same default path, and dev-instance isolation via XDG_CONFIG_HOME applies to Electron's default path too.

Linux .desktop scheme registration

Adds protocols: [{ name: "T3 Code", schemes: ["t3code", "t3code-dev"] }] to the Linux electron-builder config (mirroring macOS). Verified against electron-builder 26.15.6's LinuxTargetHelper: this emits MimeType=x-scheme-handler/t3code;x-scheme-handler/t3code-dev; and the generated Exec already ends with %U — the missing registration behind the "No apps installed" dialog Firefox users saw. Linux users get this with the next packaged release since the .desktop entry is generated at build time.

Test plan

• New tests for primary/secondary-instance gating in DesktopClerk.test.ts
• Regression assertion for the Linux protocols config in build-desktop-artifact.test.ts
• Full suites pass: desktop (406), web (1692), relay (209), build scripts
• Typecheck clean: desktop, web, mobile, relay

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes desktop auth bootstrap ordering (userData path before Clerk bridge) and single-instance behavior, which are sensitive for OAuth and multi-launch edge cases; Linux deep-link registration only affects packaged builds.

Overview
Upgrades Clerk packages (notably @clerk/electron 0.0.18 → 0.0.24) so the desktop app relies on the SDK’s single-instance lock for OAuth deep links instead of calling requestSingleInstanceLock itself.

Bootstrap / single-instance: DesktopClerk sets Electron userData via exported resolveUserDataPath before creating the Clerk bridge, so lock acquisition does not create a misleading legacy folder on fresh installs. configure gates startup on bridge.isPrimaryInstance (secondary instances quit and interrupt before whenReady); the second-instance window-reveal handler remains. requestSingleInstanceLock is removed from the ElectronApp service and test mocks.

Linux packaging: The electron-builder Linux config adds protocols for t3code and t3code-dev so generated .desktop files register x-scheme-handler MIME types for browser OAuth callbacks.

^{Reviewed by Cursor Bugbot for commit 702ae3f. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Bump Clerk Electron SDK to 0.0.24 and register t3code:// scheme on Linux

• Bumps @clerk/electron and related Clerk packages in pnpm-workspace.yaml.
• Registers t3code and t3code-dev URL scheme handlers for Linux in scripts/build-desktop-artifact.ts via electron-builder protocols, which causes the generated .desktop file to advertise the scheme handlers.
• Replaces ElectronApp.requestSingleInstanceLock with bridge.isPrimaryInstance from the Clerk SDK; secondary instances now call electronApp.quit() and interrupt startup instead.
• Extracts resolveUserDataPath as a standalone exported Effect in DesktopAppIdentity.ts and sets Electron's userData path before the Clerk bridge is created.
• Behavioral Change: single-instance locking is now delegated to the Clerk bridge rather than Electron's native lock, changing how secondary instances are detected and terminated.

^{Macroscope summarized 702ae3f.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6378b6b6-a790-4436-ba42-f7c5cdbc8383

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit fd073ca. Configure here.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR changes authentication infrastructure - the Clerk SDK upgrade introduces a new single-instance lock mechanism (isPrimaryInstance flag), requires careful ordering of userData path initialization, and adds Linux OAuth deep-link registration. While well-tested, these runtime behavior changes to auth flow and platform integration warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

One convention issue: the extracted resolveUserDataPath helper takes the DesktopEnvironment service instance as a parameter in production code instead of acquiring it from the Effect environment. Inline comment below.

^{Posted via Macroscope — Effect Service Conventions}