test(desktop): Keep WSL busy-runtime fixtures visible when sh is bash

apps/desktop/src/app/ClerkTokenStorage.test.ts

@@ -0,0 +1,54 @@
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { assert, describe, it } from "@effect/vitest";
+import { isHostWindows } from "@t3tools/shared/hostProcess";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import { vi } from "vite-plus/test";
+
+vi.mock("electron", () => ({
+  safeStorage: {
+    isEncryptionAvailable: () => true,
+    encryptString: (value: string) => Buffer.from(value),
+    decryptString: (value: Buffer) => value.toString(),
+  },
+}));
+
+import { storage } from "@clerk/electron/storage";
+
+const fileMode = (path: string) =>
+  Effect.gen(function* () {
+    const fileSystem = yield* FileSystem.FileSystem;
+    const info = yield* fileSystem.stat(path);
+    return info.mode & 0o777;
+  });
+
+describe("Clerk token storage", () => {
+  it.effect("writes the token file readable and writable only by its owner", () =>
+    Effect.gen(function* () {
+      if (yield* isHostWindows) return;
+      const fileSystem = yield* FileSystem.FileSystem;
+      const stateDir = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3-clerk-tokens-" });
+
+      yield* Effect.promise(async () => {
+        await storage({ path: stateDir }).setItem("__clerk_client_jwt", "t");
+      });
+
+      assert.equal(yield* fileMode(`${stateDir}/clerk-tokens.json`), 0o600);
+    }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
+  );
+
+  it.effect("tightens a token file left world-writable by an earlier version", () =>
+    Effect.gen(function* () {
+      if (yield* isHostWindows) return;
+      const fileSystem = yield* FileSystem.FileSystem;
+      const stateDir = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3-clerk-tokens-" });
+      const tokenFile = `${stateDir}/clerk-tokens.json`;
+      yield* fileSystem.writeFileString(tokenFile, "{}");
+      yield* fileSystem.chmod(tokenFile, 0o666);
+
+      storage({ path: stateDir });
+
+      assert.equal(yield* fileMode(tokenFile), 0o600);
+    }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
+  );
+});

apps/desktop/src/wsl/DesktopWslEnvironment.test.ts

@@ -69,6 +69,28 @@ const runShell = (script: string) => {
 
 const sh = (value: string) => `'${value.replaceAll("'", "'\\''")}'`;
 
+// Polls for up to five seconds until a background holder has taken effect.
+const awaitHolder = (condition: string) =>
+  `i=0; until ${condition}; do i=$((i + 1)); [ "$i" -lt 500 ] || exit 1; sleep 0.01; done`;
+
+// Holds a cache busy the way a running server does: the holder's argv[0] is the
+// runtime entry, which the prune and install scripts look for in /proc cmdline.
+// It reads a pipe the script keeps open on fd 7, so it exits with the script
+// instead of outliving it on a timer.
+const holdRuntimeBusy = (entry: string) =>
+  [
+    `exec 7> >(exec -a ${entry} cat >/dev/null 2>&1)`,
+    awaitHolder(`grep -qF -- ${entry} /proc/[0-9]*/cmdline 2>/dev/null`),
+  ].join("\n");
+
+// Holds a cache's install lock the way a concurrent install does, and likewise
+// releases it when the script exits.
+const holdInstallLock = (lock: string) =>
+  [
+    `exec 6> >(exec 9> ${lock}; flock -x 9; cat >/dev/null 2>&1)`,
+    awaitHolder(`! flock -n ${lock} true`),
+  ].join("\n");
+
 const readField = (stdout: string, field: string) => {
   const line = stdout.split("\n").find((candidate) => candidate.startsWith(`${field}:`));
   if (line === undefined) throw new Error(`missing ${field} in fixture output: ${stdout}`);
@@ -712,9 +734,7 @@ describe.skipIf(posixShellRunner === null)("WSL runtime install script (executed
         `runtime_root=${sh(fixture.runtimeRoot)}`,
         `runtime_parent=${sh(fixture.runtimeParent)}`,
         'rm "$runtime_root/.t3code-wsl-runtime-ready"',
-        'sh -c "sleep 30" "$runtime_root/t3" >/dev/null 2>&1 &',
-        "active_pid=$!",
-        "sleep 0.1",
+        holdRuntimeBusy('"$runtime_root/t3"'),
         fixture.installScript(),
         'stale=$(find "$runtime_parent" -maxdepth 1 -type d -name ".sha256-*.stale.*" -print -quit)',
         'test -n "$stale"',
@@ -723,8 +743,6 @@ describe.skipIf(posixShellRunner === null)("WSL runtime install script (executed
         "export HOME",
         buildWslRuntimePruneScript(fixture.runtimeId),
         'test ! -e "$stale"',
-        "kill $active_pid",
-        "wait $active_pid 2>/dev/null || true",
       ].join("\n"),
     );
 
@@ -750,15 +768,8 @@ describe.skipIf(posixShellRunner === null)("WSL runtime install script (executed
         'touch -d "4 minutes ago" "$runtime_parent/sha256-active"',
         'touch -d "3 minutes ago" "$runtime_parent/sha256-old"',
         'touch -d "2 minutes ago" "$runtime_parent/sha256-locked"',
-        'sh -c "sleep 30" "$runtime_parent/sha256-active/t3" >/dev/null 2>&1 &',
-        "active_pid=$!",
-        "(",
-        '  exec 9> "$runtime_parent/.sha256-locked.install.lock"',
-        "  flock -x 9",
-        "  sleep 30",
-        ") >/dev/null 2>&1 &",
-        "lock_pid=$!",
-        "sleep 0.1",
+        holdRuntimeBusy('"$runtime_parent/sha256-active/t3"'),
+        holdInstallLock('"$runtime_parent/.sha256-locked.install.lock"'),
         `HOME="$home"`,
         "export HOME",
         buildWslRuntimePruneScript("sha256-current"),
@@ -769,9 +780,6 @@ describe.skipIf(posixShellRunner === null)("WSL runtime install script (executed
         'test -d "$runtime_parent/versions"',
         'test ! -e "$runtime_parent/sha256-old"',
         'test ! -e "$runtime_parent/sha256-markerless"',
-        "kill $active_pid $lock_pid",
-        "wait $active_pid 2>/dev/null || true",
-        "wait $lock_pid 2>/dev/null || true",
         'rm -rf "$work"',
       ].join("\n"),
     );

apps/mobile/app.config.test.ts

@@ -0,0 +1,191 @@
+import type { ExpoConfig } from "expo/config";
+import { afterEach, describe, expect, it, vi } from "vite-plus/test";
+
+const { loadRepoEnv } = vi.hoisted(() => ({
+  loadRepoEnv: vi.fn<() => Record<string, string | undefined>>(),
+}));
+
+vi.mock("../../scripts/lib/public-config.ts", () => ({ loadRepoEnv }));
+
+afterEach(() => {
+  vi.resetModules();
+  loadRepoEnv.mockReset();
+});
+
+const variants = [
+  { value: undefined, name: "T3 Code", suffix: "", policy: "fingerprint" },
+  { value: "production", name: "T3 Code", suffix: "", policy: "fingerprint" },
+  { value: "development", name: "T3 Code Dev", suffix: ".dev", policy: "appVersion" },
+  { value: "preview", name: "T3 Code Preview", suffix: ".preview", policy: "fingerprint" },
+] as const;
+
+const personalBundleIdentifier = "com.example.t3code.personal";
+
+describe("mobile app configuration", () => {
+  for (const variant of variants) {
+    describe(variant.value ?? "default release", () => {
+      it("retains the standard identity and team capabilities by default", async () => {
+        const config = await evaluateConfig({ APP_VARIANT: variant.value });
+        const bundleIdentifier = `com.t3tools.t3code${variant.suffix}`;
+
+        expect(config.name).toBe(variant.name);
+        expect(config.scheme).toBe(`t3code${variant.suffix.replace(".", "-")}`);
+        expect(config.runtimeVersion).toEqual({ policy: variant.policy });
+        expect(config.ios).toMatchObject({
+          bundleIdentifier,
+          appleTeamId: "ARK85ZXQ4Z",
+          associatedDomains: ["applinks:clerk.t3.codes", "webcredentials:clerk.t3.codes"],
+          entitlements: {
+            "keychain-access-groups": [`$(AppIdentifierPrefix)${bundleIdentifier}`],
+          },
+        });
+        expect(config.android?.package).toBe(bundleIdentifier);
+        expect(config.extra?.iosPersonalTeamBuild).toBe(false);
+        expect(plugin(config, "@clerk/expo")).toEqual([
+          "@clerk/expo",
+          { theme: "./clerk-theme.json", appleSignIn: true },
+        ]);
+        expect(plugin(config, "expo-widgets")).toEqual([
+          "expo-widgets",
+          expect.objectContaining({
+            bundleIdentifier: `${bundleIdentifier}.widgets`,
+            groupIdentifier: `group.${bundleIdentifier}`,
+          }),
+        ]);
+        expect(plugin(config, "expo-sharing")).toEqual([
+          "expo-sharing",
+          expect.objectContaining({
+            ios: expect.objectContaining({
+              enabled: true,
+              extensionBundleIdentifier: `${bundleIdentifier}.sharing`,
+              appGroupId: `group.${bundleIdentifier}`,
+            }),
+          }),
+        ]);
+        expect(plugin(config, "./plugins/withShareExtensionDisplayName.cjs")).toBeDefined();
+        expect(plugin(config, "./plugins/withoutIosPersonalTeamCapabilities.cjs")).toBeUndefined();
+      });
+
+      it.each(["", "0", "true"])(
+        "requires explicit opt-in, not flag %j or a bundle override alone",
+        async (flag) => {
+          const standard = await evaluateConfig({ APP_VARIANT: variant.value });
+          const flagOff = await evaluateConfig({
+            APP_VARIANT: variant.value,
+            T3CODE_IOS_PERSONAL_TEAM: flag,
+            T3CODE_IOS_PERSONAL_TEAM_BUNDLE_ID: "invalid bundle ignored without opt-in",
+          });
+          expect(flagOff).toEqual(standard);
+          expect(
+            await evaluateConfig({
+              APP_VARIANT: variant.value,
+              T3CODE_IOS_PERSONAL_TEAM_BUNDLE_ID: personalBundleIdentifier,
+            }),
+          ).toEqual(standard);
+        },
+      );
+
+      it("uses the explicit personal identifier and omits unsupported team capabilities", async () => {
+        const standard = await evaluateConfig({ APP_VARIANT: variant.value });
+        const config = await evaluateConfig({
+          APP_VARIANT: variant.value,
+          T3CODE_IOS_PERSONAL_TEAM: "1",
+          T3CODE_IOS_PERSONAL_TEAM_BUNDLE_ID: `  ${personalBundleIdentifier}  `,
+        });
+
+        expect(config.ios?.bundleIdentifier).toBe(personalBundleIdentifier);
+        expect(config.ios).not.toHaveProperty("appleTeamId");
+        expect(config.ios).not.toHaveProperty("associatedDomains");
+        expect(config.ios).not.toHaveProperty("entitlements");
+        const expectedIos = { ...standard.ios, bundleIdentifier: personalBundleIdentifier };
+        delete expectedIos.appleTeamId;
+        delete expectedIos.associatedDomains;
+        delete expectedIos.entitlements;
+        expect(config.ios).toEqual(expectedIos);
+        expect(config.extra?.iosPersonalTeamBuild).toBe(true);
+        expect(plugin(config, "expo-widgets")).toBeUndefined();
+        expect(plugin(config, "./plugins/withWidgetLogoAsset.cjs")).toBeUndefined();
+        expect(plugin(config, "./plugins/withShareExtensionDisplayName.cjs")).toBeUndefined();
+        expect(plugin(config, "@clerk/expo")).toEqual([
+          "@clerk/expo",
+          { theme: "./clerk-theme.json", appleSignIn: false },
+        ]);
+        expect(plugin(config, "expo-sharing")).toEqual([
+          "expo-sharing",
+          expect.objectContaining({
+            ios: expect.objectContaining({
+              enabled: false,
+              extensionBundleIdentifier: `${personalBundleIdentifier}.sharing`,
+              appGroupId: `group.${personalBundleIdentifier}`,
+            }),
+          }),
+        ]);
+        expect(plugin(config, "./plugins/withoutIosPersonalTeamCapabilities.cjs")).toBeDefined();
+      });
+
+      it("leaves Android values and plugins unchanged by the iOS opt-in", async () => {
+        const env = {
+          APP_VARIANT: variant.value,
+          T3CODE_ANDROID_GOOGLE_SERVICES_FILE: "./fixture-google-services.json",
+        };
+        const standard = await evaluateConfig(env);
+        const personal = await evaluateConfig({
+          ...env,
+          T3CODE_IOS_PERSONAL_TEAM: "1",
+          T3CODE_IOS_PERSONAL_TEAM_BUNDLE_ID: personalBundleIdentifier,
+        });
+
+        expect(personal.android).toEqual(standard.android);
+        expect(personal.android?.googleServicesFile).toBe(env.T3CODE_ANDROID_GOOGLE_SERVICES_FILE);
+        expect(androidPlugins(personal)).toEqual(androidPlugins(standard));
+        expect(plugin(personal, "expo-notifications")).toEqual(
+          plugin(standard, "expo-notifications"),
+        );
+        expect(plugin(personal, "expo-quick-actions")).toEqual(
+          plugin(standard, "expo-quick-actions"),
+        );
+      });
+    });
+  }
+
+  it.each([undefined, "", "  ", "singleword", "com..example", "com.example_bad", "com.example.*"])(
+    "rejects missing or invalid personal bundle identifier %j",
+    async (bundleIdentifier) => {
+      await expect(
+        evaluateConfig({
+          T3CODE_IOS_PERSONAL_TEAM: "1",
+          T3CODE_IOS_PERSONAL_TEAM_BUNDLE_ID: bundleIdentifier,
+        }),
+      ).rejects.toThrow(
+        "T3CODE_IOS_PERSONAL_TEAM_BUNDLE_ID must be a reverse-DNS identifier such as com.example.t3code when T3CODE_IOS_PERSONAL_TEAM=1.",
+      );
+    },
+  );
+});
+
+async function evaluateConfig(env: Record<string, string | undefined>) {
+  const originalEnv = process.env;
+  // Evaluate the real module afresh without reading repository env files or host values.
+  process.env = { NODE_ENV: "test" };
+  loadRepoEnv.mockReturnValue(env);
+  vi.resetModules();
+  try {
+    return (await import("./app.config.ts")).default;
+  } finally {
+    process.env = originalEnv;
+  }
+}
+
+function plugin(config: ExpoConfig, name: string) {
+  return config.plugins?.find((entry) => (Array.isArray(entry) ? entry[0] : entry) === name);
+}
+
+function androidPlugins(config: ExpoConfig) {
+  return config.plugins?.flatMap<{ name: string; android?: unknown }>((entry) => {
+    if (typeof entry === "string") {
+      return entry.startsWith("./plugins/withAndroid") ? [{ name: entry }] : [];
+    }
+    if (entry[0] === undefined || entry[1]?.android === undefined) return [];
+    return [{ name: entry[0], android: entry[1].android }];
+  });
+}

apps/mobile/app.config.ts

@@ -240,14 +240,18 @@ const config: ExpoConfig = {
     // Pin code signing to the T3 Tools team so non-interactive `expo run:ios`
     // does not fall back to a personal team (which cannot sign app groups,
     // Sign in with Apple, or push notification entitlements).
-    appleTeamId: "ARK85ZXQ4Z",
-    associatedDomains: [
-      `applinks:${variant.relyingParty}`,
-      `webcredentials:${variant.relyingParty}`,
-    ],
-    entitlements: {
-      "keychain-access-groups": [`$(AppIdentifierPrefix)${variant.iosBundleIdentifier}`],
-    },
+    ...(isIosPersonalTeamBuild
+      ? {}
+      : {
+          appleTeamId: "ARK85ZXQ4Z",
+          associatedDomains: [
+            `applinks:${variant.relyingParty}`,
+            `webcredentials:${variant.relyingParty}`,
+          ],
+          entitlements: {
+            "keychain-access-groups": [`$(AppIdentifierPrefix)${variant.iosBundleIdentifier}`],
+          },
+        }),
     infoPlist: {
       NSAppTransportSecurity: {
         NSAllowsArbitraryLoads: true,

apps/mobile/src/App.tsx

@@ -17,6 +17,7 @@ import {
   AppearancePreferencesProvider,
   useAppearancePreferences,
 } from "./features/settings/appearance/AppearancePreferencesProvider";
+import { readRememberedNavigationState, rememberNavigationState } from "./navigationPersistence";
 import { RootStack } from "./Stack";
 import { appAtomRegistry } from "./state/atom-registry";
 import { OverlayPortalHost } from "./components/OverlayPortal";
@@ -87,7 +88,12 @@ function AppContent() {
                 the system is in dark mode. */}
             <View style={{ flex: 1 }}>
               <IncomingShareProvider>
-                <Navigation linking={appLinking} theme={navigationTheme} />
+                <Navigation
+                  initialState={readRememberedNavigationState()}
+                  linking={appLinking}
+                  onStateChange={rememberNavigationState}
+                  theme={navigationTheme}
+                />
               </IncomingShareProvider>
               <ConfirmDialogHost />
               <ThreadArrangementHost />