[saphid]

macOS can deliver the URL or HTML file that launched T3 Code before shell probing and startup configuration finish. The old listeners were installed later, so a cold launch could open the app without the requested page or thread.

Capture accepted launch events when the primary desktop service starts, then drain them into the existing receivers in arrival order. The renderer queue still controls delivery readiness. Cold provider-auth returns wait for the registered live main window; hosted sign-in work cancels with startup, and concurrent auth navigations are serialized without revealing an obsolete window. Main retains ownership of the profile-scoped single-instance lock.

Closes #18613.

Maintainer takeover of #18422, preserving @saphid's commits and their later main integration. Removed the repeated startup syntax matrix and adapted the implementation to current main. In the two edited module suites, expanded cases went 50 → 45 after main integration; PR-specific additions went 12 → 7. Two retained additions cover newly confirmed auth cancellation and concurrent-window regressions.

Verification on headless Linux:

• 156/156 tests pass across eight desktop service suites, rerun after integrating the author's latest commit. Desktop typecheck and targeted lint pass.
• The cold mixed URL/file/prompt/thread regression fails against main with no delivered links, then passes with this change. Focused mutation checks also fail when scoped hosted-auth cleanup, auth serialization, or stale-window protection is removed.
• Tests use real DesktopClerk/DesktopWebLinks services and a real localhost callback listener, with Electron events and windows supplied by fixtures. No Electron executable ran; ELECTRON_OVERRIDE_DIST_PATH=/tmp bypassed binary lookup.
• Before/after behavior and current-candidate proof.
• One independent full-diff review round by Claude Opus 5.5 and GPT-6-Sol found no correctness issues. Published-head code CI passes, including build/typecheck, lint, desktop tests, server suites, and Macroscope correctness. CodeRabbit reports review rate limiting; its earlier review does not cover this head. Macroscope approvability remains neutral pending human approval.

Remaining human checks: packaged macOS cold launches from Finder with a URL and HTML file; native window focus/navigation; actual provider and Clerk sign-in. These could not be verified on this Linux host. Windows, native Linux Electron, iOS, and Android were not run. This PR changes desktop startup behavior and has no visual layout change; no native screenshot or recording is claimed. Macroscope requires human approval for the authentication-related startup handling. The PR remains unmerged.

Tests: GPT-6-Astra (high). Implementation and integration: GPT-6.1-Sol (high). Independent review: Claude Opus 5.5 (high) and GPT-6-Sol (high). Harness: Codex and Claude through T3 Code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 595dcec0-b383-4e85-aeb0-3684ac3e5d84

📥 Commits

Reviewing files that changed from the base of the PR and between 77dfaec and 241bcc3.

📒 Files selected for processing: 6

• apps/desktop/src/app/DesktopClerk.test.ts
• apps/desktop/src/app/DesktopClerk.ts
• apps/desktop/src/app/DesktopLifecycle.test.ts
• apps/desktop/src/electron/ElectronWindow.ts
• apps/desktop/src/updates/updatesTestHarness.ts
• apps/desktop/src/window/DesktopWindow.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

📝 Walkthrough

DesktopClerk now captures accepted macOS URL and file events before configuration, queues them for later routing, and waits for a live main window for provider-auth returns. ElectronWindow exposes the wait operation, with tests for window updates and link delivery.

Changes: macOS Launch Link Handling

Layer / File(s)	Summary
Wait for a live main window apps/desktop/src/electron/ElectronWindow.ts, apps/desktop/src/electron/ElectronWindow.test.ts, apps/desktop/src/app/DesktopLifecycle.test.ts, apps/desktop/src/ssh/DesktopSshPasswordPrompts.test.ts, apps/desktop/src/updates/updatesTestHarness.ts, apps/desktop/src/window/DesktopWindow.test.ts	ElectronWindow now exposes waitForMain and observes main-window updates until it finds a live window. Tests cover the behavior and add the method to test doubles.
Capture launch links before configuration apps/desktop/src/app/DesktopClerk.ts, apps/desktop/src/app/DesktopClerk.test.ts	The primary instance registers URL and file handlers before configuration. Tests cover accepted cold-start links and the app overrides used to emit launch events.
Drain and route launch links apps/desktop/src/app/DesktopClerk.ts, apps/desktop/src/app/DesktopClerk.test.ts	Configuration drains queued links. Provider-auth returns wait for a live window before loading the destination and revealing it. Tests cover cold and warm events, readiness, repeat readiness, unrelated events, and listener cleanup.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant ElectronApp
  participant DesktopClerk
  participant ElectronWindow
  participant MainWindow
  participant WebLinks
  ElectronApp->>DesktopClerk: Emit open-url or open-file
  DesktopClerk->>DesktopClerk: Queue accepted link before configuration
  DesktopClerk->>DesktopClerk: Configure and drain queued links
  DesktopClerk->>ElectronWindow: Wait for live window for provider-auth return
  ElectronWindow-->>DesktopClerk: Return live main window
  DesktopClerk->>MainWindow: Load provider-auth destination and reveal window
  DesktopClerk->>WebLinks: Forward other links

Loading

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to 241bc

Cold-launch thread links are captured and delivered through the intended path. No actionable merge-blocking risk remains after normal checks.

Security architecture risk: 🔵 Low · up to 241bc

The change preserves existing URL restrictions while allowing launch links and sign-in returns to survive startup. No new destination authority or privilege escalation was established in the inspected paths. Packaged macOS startup, interruption, and native navigation behavior remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The directly affected authority is the profile-scoped primary desktop instance and its selected window or renderer. External launch inputs can now reach existing navigation, renderer-delivery, and hosted-sign-in operations during cold startup, rather than only after configuration. The inspected changes do not establish new cross-service or cross-tenant authority.

Trust Boundaries and Controls

• observed — Codex handoff inputs retain scheme, host, path, size, schema, authorization-origin, redirect, state, and PKCE-shape checks before starting the existing handoff. Delivery validates callback origin, path, and state again and encodes the result in the validated return URL fragment. These controls predate the PR and remain applicable to newly retained cold-start requests.

Resilience and Maintainability Implications

• observed — The newly introduced provider-window wait is forked into the configuration scope, and OS listeners have removal finalizers. Window closure clears the main reference only when its identity matches, preventing an older window from clearing a replacement. The existing hosted Codex handoff remains separately launched as before; the new scoped ownership guarantee should not be generalized to that unchanged operation.

Pre-merge checks: 4

Check name	Status	Explanation
Linked Issues check		Issue #18613 requires a cold t3code://threads/<environmentId>/<threadId> link to open its thread. DesktopClerk.make registers open-url before configure, queues recognized links, and drains the…
Out of Scope Changes check		The changes stay within the stated desktop startup-link fix. Web links, HTML files, prompt and thread links, and provider-auth returns use the same early-event queue and startup handoff. `ElectronWind…
Description check		The description explains the problem, implementation, scope, linked issues, verification results, limitations, and human checks. It is detailed and relevant, although it does not use the template head…
Title check		The title clearly and concisely describes the main desktop fix: retaining macOS-launched links and HTML files.

Full details: Linked Issues check

Explanation

Issue #18613 requires a cold t3code://threads/<environmentId>/<threadId> link to open its thread. DesktopClerk.make registers open-url before configure, queues recognized links, and drains them after configuration. promptLinkAppPath recognizes thread links, and webLinks.receive dispatches them. DesktopClerk.test.ts covers a cold thread link, ordered delivery, renderer readiness, and exactly-once delivery.

Full details: Out of Scope Changes check

Explanation

The changes stay within the stated desktop startup-link fix. Web links, HTML files, prompt and thread links, and provider-auth returns use the same early-event queue and startup handoff. ElectronWindow.waitForMain supports the stated cold provider-auth case. The added tests cover these paths and test-fixture updates support the new service contract. No unrelated change is shown.

Full details: Description check

Explanation

The description explains the problem, implementation, scope, linked issues, verification results, limitations, and human checks. It is detailed and relevant, although it does not use the template headings explicitly.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR requires human approval — This PR changes production desktop startup and authentication flows, including provider navigation, hosted sign-in callback cancellation, and main-window lifecycle handling. The behavior is covered by substantial regression tests, but the authentication-sensitive runtime impact and macOS-specific lifecycle behavior require human review.

^{You can add or adjust custom eligibility rules. Learn more.}

Dismissing prior approval to re-evaluate 77dfaec

[juliusmarminge]

Taking over this one as maintainer for batch ssh-relay-remote-11. I will preserve your commits and this PR, integrate main, minimize the startup regression tests, and run fresh implementation and independent review passes. Packaged macOS launch verification remains a human check on this Linux host. It will remain unmerged.