chore: sync with upstream/main (ec80933ac)

apps/desktop/package.json

@@ -24,7 +24,7 @@
     "@t3tools/tailscale": "workspace:*",
     "dbus-next": "0.10.2",
     "effect": "catalog:",
-    "electron": "44.4.2",
+    "electron": "44.4.5",
     "electron-store": "^8.2.0",
     "electron-updater": "^6.8.9",
     "ffi-rs": "1.3.2",

apps/desktop/src/app/DesktopAppIdentity.test.ts

@@ -217,7 +217,7 @@ describe("DesktopAppIdentity", () => {
         const identity = yield* DesktopAppIdentity.DesktopAppIdentity;
         yield* identity.configure;
 
-        assert.deepEqual(calls.setName, ["T3 Code (Alpha)"]);
+        assert.deepEqual(calls.setName, ["T3 Code Alpha"]);
         assert.equal(calls.setAboutPanelOptions[0]?.applicationName, "T3 Code (Alpha)");
         assert.equal(calls.setAboutPanelOptions[0]?.applicationVersion, "1.2.3");
         assert.equal(calls.setAboutPanelOptions[0]?.version, "0123456789ab");
@@ -237,6 +237,39 @@ describe("DesktopAppIdentity", () => {
     );
   });
 
+  it.effect.each([
+    { stage: "Alpha", environment: {} },
+    {
+      stage: "Nightly",
+      environment: { appVersion: "0.0.43-nightly.20260929.2428" },
+    },
+    {
+      stage: "Dev",
+      environment: { env: { VITE_DEV_SERVER_URL: "http://localhost:5173" } },
+    },
+  ])("uses a valid native User-Agent product name for $stage", ({ stage, environment }) => {
+    const calls: ElectronAppCalls = {
+      setAboutPanelOptions: [],
+      setDockIcon: [],
+      setName: [],
+    };
+
+    return withIdentity(
+      Effect.gen(function* () {
+        const identity = yield* DesktopAppIdentity.DesktopAppIdentity;
+        yield* identity.configure;
+
+        const runtimeName = calls.setName[0];
+        assert.isDefined(runtimeName);
+        assert.equal(runtimeName, `T3 Code ${stage}`);
+        // RFC 9110's token grammar, after Electron removes ASCII spaces.
+        assert.match(runtimeName.replaceAll(" ", ""), /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/);
+        assert.equal(calls.setAboutPanelOptions[0]?.applicationName, `T3 Code (${stage})`);
+      }),
+      { calls, environment },
+    );
+  });
+
   it.effect("sets the dock icon only when running unpackaged", () => {
     const calls: ElectronAppCalls = {
       setAboutPanelOptions: [],

apps/desktop/src/app/DesktopAppIdentity.ts

@@ -91,7 +91,12 @@ export const make = Effect.gen(function* () {
 
   const configure = Effect.gen(function* () {
     const commitHash = yield* resolveAboutCommitHash;
-    yield* electronApp.setName(environment.displayName);
+    // Electron removes spaces from this name to build the native User-Agent
+    // product token, but leaves parentheses intact. Keep the runtime name valid
+    // without rewriting preview sessions (which breaks Turnstile, #7110).
+    yield* electronApp.setName(
+      `${environment.branding.baseName} ${environment.branding.stageLabel}`,
+    );
     yield* electronApp.setAboutPanelOptions({
       applicationName: environment.displayName,
       applicationVersion: environment.appVersion,

apps/desktop/src/app/DesktopCliCommand.test.ts

@@ -1,5 +1,5 @@
 import * as NodeServices from "@effect/platform-node/NodeServices";
-import { expect, it } from "@effect/vitest";
+import { afterEach, beforeEach, expect, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Option from "effect/Option";
@@ -85,6 +85,15 @@ const fakePowerShell = (initial: string) => {
   return { registry, spawner };
 };
 
+// The machine's own PATH may already hold a t3; each test sets the PATH it means.
+const machinePath = process.env.PATH;
+beforeEach(() => {
+  process.env.PATH = "";
+});
+afterEach(() => {
+  process.env.PATH = machinePath;
+});
+
 it.layer(NodeServices.layer)("DesktopCliCommand", (it) => {
   it.effect("links the launcher onto PATH and removes only that link", () =>
     Effect.gen(function* () {
@@ -165,24 +174,31 @@ it.layer(NodeServices.layer)("DesktopCliCommand", (it) => {
     }).pipe(Effect.scoped),
   );
 
-  it.effect("reports when another t3 earlier on PATH would run instead", () =>
+  it.effect("refuses to install behind another t3 that runs first", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
       const home = yield* fs.makeTempDirectoryScoped();
       const shadow = path.join(home, "shadow");
       yield* fs.makeDirectory(shadow);
       yield* fs.writeFileString(path.join(shadow, "t3"), "#!/bin/sh\n", { mode: 0o755 });
-      const previous = process.env.PATH;
       process.env.PATH = [shadow, path.join(home, ".local", "bin")].join(":");
-      yield* Effect.addFinalizer(() => Effect.sync(() => (process.env.PATH = previous)));
 
       const command = yield* commandIn({ home });
+      const theirs = path.join(shadow, "t3");
+      expect((yield* command.state).shadowedBy).toBe(theirs);
+      // A link behind it would never run, so nothing is created.
+      const error = yield* Effect.flip(command.install);
+      expect(error.message).toContain(theirs);
+      expect(yield* fs.exists(path.join(home, ".local", "bin", "t3"))).toBe(false);
+
+      yield* fs.remove(theirs);
       const installed = yield* command.install;
-      expect(installed.installedPath).toBe(path.join(home, ".local", "bin", "t3"));
-      expect(installed.onPath).toBe(false);
-      yield* fs.remove(path.join(shadow, "t3"));
-      expect((yield* command.state).onPath).toBe(true);
+      expect(installed).toMatchObject({
+        onPath: true,
+        installedPath: path.join(home, ".local", "bin", "t3"),
+      });
+      expect(installed.shadowedBy).toBeUndefined();
     }).pipe(Effect.scoped),
   );
 

apps/desktop/src/app/DesktopCliCommand.ts

@@ -146,6 +146,14 @@ export const make = Effect.gen(function* () {
     return Option.none<string>();
   });
 
+  /** The `t3` a new shell runs when it is not this app's, on Unix. */
+  const foreignFirstOnPath = Effect.gen(function* () {
+    if (windows) return Option.none<string>();
+    const first = yield* firstOnPath;
+    if (Option.isNone(first) || (yield* isOurLink(first.value))) return Option.none<string>();
+    return first;
+  });
+
   /** Where this app's command is installed now, if anywhere. */
   const installedAt = Effect.gen(function* () {
     if (windows) {
@@ -167,12 +175,16 @@ export const make = Effect.gen(function* () {
       return { supported: false, installedPath: null, onPath: false } as const;
     }
     const installed = yield* installedAt;
-    if (Option.isNone(installed)) return { supported: true, installedPath: null, onPath: false };
+    const shadowedBy = yield* foreignFirstOnPath;
+    const shadow = Option.isSome(shadowedBy) ? { shadowedBy: shadowedBy.value } : {};
+    if (Option.isNone(installed)) {
+      return { supported: true, installedPath: null, onPath: false, ...shadow };
+    }
     // On Windows only terminals opened after the change see it. On Unix the
     // first `t3` on PATH must be ours; a `t3` earlier on PATH would shadow it.
     const first = yield* firstOnPath;
     const onPath = windows || (Option.isSome(first) && (yield* isOurLink(first.value)));
-    return { supported: true, installedPath: installed.value, onPath };
+    return { supported: true, installedPath: installed.value, onPath, ...shadow };
   }).pipe(Effect.orElseSucceed(() => ({ supported: false, installedPath: null, onPath: false })));
 
   /** Writes the launcher if the app has not yet, e.g. when no local backend runs. */
@@ -209,6 +221,13 @@ export const make = Effect.gen(function* () {
         .remove(existing.value)
         .pipe(Effect.mapError(() => fail(`Could not replace ${existing.value}.`)));
     }
+    // A link behind another `t3` never runs, so installing one would only hide the problem.
+    const shadowedBy = yield* foreignFirstOnPath;
+    if (Option.isSome(shadowedBy)) {
+      return yield* fail(
+        `Another t3 at ${shadowedBy.value} runs first in a new terminal. Remove it, or run the launcher directly at ${launcher}.`,
+      );
+    }
     const onPath = pathEntries(process.env.PATH, ":");
     const candidates = unixCandidates(environment.homeDirectory, environment.platform);
     // Prefer a folder already on PATH that the user can write to without admin rights.

apps/desktop/src/app/DesktopLifecycle.test.ts

@@ -96,6 +96,7 @@ function layerDesktopWindow(
     dispatchMenuAction: () => Effect.void,
     dispatchSnapShotEvent: () => Effect.void,
     zoomMain: () => Effect.void,
+    runMainContentsCommand: () => Effect.void,
     syncAppearance: Effect.void,
   });
 }

apps/desktop/src/backend/DesktopBackendPool.test.ts

@@ -100,6 +100,7 @@ function layerPool(labelRef: Ref.Ref<string>): Layer.Layer<DesktopBackendPool.De
           dispatchMenuAction: () => Effect.die("unexpected menu action"),
           dispatchSnapShotEvent: () => Effect.void,
           zoomMain: () => Effect.die("unexpected zoom"),
+          runMainContentsCommand: () => Effect.die("unexpected main contents command"),
           syncAppearance: Effect.void,
         } satisfies DesktopWindow.DesktopWindow["Service"]),
       ),

apps/desktop/src/electron/ElectronDialog.ts

@@ -95,8 +95,10 @@ export class ElectronDialog extends Context.Service<
     readonly pickFiles: (
       input: ElectronDialogPickFilesInput,
     ) => Effect.Effect<readonly string[], ElectronDialogPickFilesError>;
+    /** Pass `owner` to attach the box to that window so it cannot fall behind it. */
     readonly showMessageBox: (
       options: Electron.MessageBoxOptions,
+      owner?: Electron.BrowserWindow,
     ) => Effect.Effect<Electron.MessageBoxReturnValue, ElectronDialogShowMessageBoxError>;
     readonly showErrorBox: (title: string, content: string) => Effect.Effect<void>;
   }
@@ -164,9 +166,12 @@ export const make = ElectronDialog.of({
     });
     return result.canceled ? [] : result.filePaths;
   }),
-  showMessageBox: (options) =>
+  showMessageBox: (options, owner) =>
     Effect.tryPromise({
-      try: () => Electron.dialog.showMessageBox(options),
+      try: () =>
+        owner === undefined
+          ? Electron.dialog.showMessageBox(options)
+          : Electron.dialog.showMessageBox(owner, options),
       catch: (cause) =>
         new ElectronDialogShowMessageBoxError({
           type: options.type ?? null,

apps/desktop/src/electron/ElectronShell.test.ts

@@ -106,6 +106,20 @@ describe("ElectronShell", () => {
     }).pipe(Effect.provide(ElectronShell.layer)),
   );
 
+  it.effect("opens the JetBrains Toolbox ssh deep link", () =>
+    Effect.gen(function* () {
+      openExternalMock.mockResolvedValue(undefined);
+
+      const url =
+        "jetbrains://gateway/ssh/environment?h=example.com&launchIde=true&ideHint=IU&projectHint=%2Fhome%2Fuser%2Fproject";
+      const electronShell = yield* ElectronShell.ElectronShell;
+      const result = yield* electronShell.openExternal(url);
+
+      assert.equal(result, true);
+      assert.deepEqual(openExternalMock.mock.calls, [[url]]);
+    }).pipe(Effect.provide(ElectronShell.layer)),
+  );
+
   it.effect("does not open editor URLs that mix up link shapes", () =>
     Effect.gen(function* () {
       openExternalMock.mockResolvedValue(undefined);
@@ -114,9 +128,12 @@ describe("ElectronShell", () => {
       const results = yield* Effect.all([
         electronShell.openExternal("zed://extension/attacker"),
         electronShell.openExternal("vscode://ssh/example.com/home/user/project"),
+        electronShell.openExternal("jetbrains://idea/navigate/reference?project=x&path=y"),
+        electronShell.openExternal("jetbrains://gateway/ssh/environment?launchIde=true"),
+        electronShell.openExternal("jetbrains://gateway/com.example.provider/connect?h=x"),
       ]);
 
-      assert.deepEqual(results, [false, false]);
+      assert.deepEqual(results, [false, false, false, false, false]);
       assert.equal(openExternalMock.mock.calls.length, 0);
     }).pipe(Effect.provide(ElectronShell.layer)),
   );
@@ -134,9 +151,10 @@ describe("ElectronShell", () => {
           "vscode://:secret@vscode-remote/ssh-remote+example.com/home/user/project",
         ),
         electronShell.openExternal("zed://ssh/user@example.com/home/user/project"),
+        electronShell.openExternal("jetbrains://user@gateway/ssh/environment?h=example.com"),
       ]);
 
-      assert.deepEqual(results, [false, false, false]);
+      assert.deepEqual(results, [false, false, false, false]);
       assert.equal(openExternalMock.mock.calls.length, 0);
     }).pipe(Effect.provide(ElectronShell.layer)),
   );

apps/desktop/src/electron/ElectronShell.ts

@@ -12,8 +12,8 @@ import * as Option from "effect/Option";
 import * as Electron from "electron";
 
 // Remote open-in-editor deep links (`vscode://vscode-remote/ssh-remote+…`,
-// `zed://ssh/<host>/<path>`) must reach the OS handler; every other non-web
-// scheme stays blocked.
+// `zed://ssh/<host>/<path>`, `jetbrains://gateway/ssh/environment?h=…`) must
+// reach the OS handler; every other non-web scheme stays blocked.
 const SAFE_WEB_PROTOCOLS = new Set(["http:", "https:"]);
 const REMOTE_EDITOR_PROTOCOLS = new Set(
   REMOTE_CAPABLE_EDITOR_IDS.flatMap((id) => {
@@ -31,9 +31,13 @@ const isRemoteEditorUrl = (url: URL) =>
   url.password.length === 0 &&
   (url.protocol === "zed:"
     ? url.host === "ssh" && ZED_SSH_PATHNAME.test(url.pathname)
-    : url.host === "vscode-remote" &&
-      url.pathname.startsWith("/ssh-remote+") &&
-      url.pathname.length > "/ssh-remote+".length);
+    : url.protocol === "jetbrains:"
+      ? url.host === "gateway" &&
+        url.pathname === "/ssh/environment" &&
+        (url.searchParams.get("h") ?? "").length > 0
+      : url.host === "vscode-remote" &&
+        url.pathname.startsWith("/ssh-remote+") &&
+        url.pathname.length > "/ssh-remote+".length);
 
 export function parseSafeExternalUrl(rawUrl: unknown): Option.Option<string> {
   if (typeof rawUrl !== "string") {

apps/desktop/src/ipc/channels.ts

@@ -109,6 +109,7 @@ export const PREVIEW_RECORDING_SAVE_CHANNEL = "desktop:preview-recording-save";
 export const PREVIEW_RECORDING_FRAME_CHANNEL = "desktop:preview-recording-frame";
 export const PREVIEW_STATE_CHANGE_CHANNEL = "desktop:preview-state-change";
 export const PREVIEW_POINTER_EVENT_CHANNEL = "desktop:preview-pointer-event";
+export const PREVIEW_OPEN_LINK_CHANNEL = "desktop:preview-open-link";
 
 export const MAC_PERMISSION_HELPER_CHANNEL = "desktop:mac-permission-helper";
 

apps/desktop/src/ipc/methods/preview.ts

@@ -54,6 +54,9 @@ export const installPreviewEventForwarding = Effect.fn(
   yield* manager.subscribePointerEvents((event) =>
     electronWindow.sendAll(IpcChannels.PREVIEW_POINTER_EVENT_CHANNEL, event),
   );
+  yield* manager.subscribeOpenLinks((event) =>
+    electronWindow.sendAll(IpcChannels.PREVIEW_OPEN_LINK_CHANNEL, event),
+  );
 });
 
 export const setForwardedShortcuts = DesktopIpc.makeIpcMethod({

apps/desktop/src/ipc/methods/window.test.ts

@@ -341,6 +341,6 @@ it.effect.skipIf(HostProcessPlatform.defaultValue() === "win32")(
       );
       assert.include(editors, "cursor");
       assert.include(editors, "vscode");
-      assert.notInclude(editors, "webstorm");
+      assert.include(editors, "webstorm");
     }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
 );

apps/desktop/src/preload.ts

@@ -1,5 +1,6 @@
 import type {
   DesktopBridge,
+  DesktopPreviewOpenLinkEvent,
   DesktopPreviewPointerEvent,
   DesktopPreviewRecordingInputEvent,
   DesktopPreviewRecordingFrame,
@@ -416,5 +417,14 @@ contextBridge.exposeInMainWorld("desktopBridge", {
       return () =>
         ipcRenderer.removeListener(IpcChannels.PREVIEW_POINTER_EVENT_CHANNEL, wrappedListener);
     },
+    onOpenLink: (listener) => {
+      const wrappedListener = (_event: Electron.IpcRendererEvent, linkEvent: unknown) => {
+        if (typeof linkEvent !== "object" || linkEvent === null) return;
+        listener(linkEvent as DesktopPreviewOpenLinkEvent);
+      };
+      ipcRenderer.on(IpcChannels.PREVIEW_OPEN_LINK_CHANNEL, wrappedListener);
+      return () =>
+        ipcRenderer.removeListener(IpcChannels.PREVIEW_OPEN_LINK_CHANNEL, wrappedListener);
+    },
   },
 } satisfies DesktopBridge);