fix: stabilize local dev auth startup

[huxcrux]

What Changed

• Prevent Clerk-dependent desktop/web code from loading when Clerk local config is absent.
• Register the desktop app scheme independently so local desktop startup no longer depends on Clerk side effects.
• Route desktop custom-scheme requests through the app protocol using the Effect/Undici HTTP client.
• Load the diff worker via the portable worker entry to avoid Vite worker default-export failures.
• Route configured local-dev HTTP requests through the Vite origin while preserving direct WebSocket targets.
• Harden pairing bootstrap by deduping same-token submits and tolerating already-authenticated stale token retries.

Why

Local development could fail when Clerk config was missing or when running the web dev flow through vp run dev. Clerk was being loaded too eagerly, desktop scheme registration depended on Clerk bridge setup, diff worker imports could fail under Vite, and pairing-token exchange could consume a one-time token before the browser session was observable on the correct origin.

This keeps local startup resilient without Clerk config, avoids CORS/cookie-origin issues by using the web/Vite origin for browser HTTP requests, and preserves direct loopback WebSockets where required.

UI Changes

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

---

Note

Medium Risk
Touches auth bootstrap, desktop protocol proxying, and environment URL resolution—important for cookies and pairing—but changes are scoped with broad test coverage.

Overview
Stabilizes local dev and desktop auth by decoupling startup from Clerk, fixing how API URLs are resolved, and hardening pairing-token exchange.

Desktop: When Clerk is not configured, the custom app scheme is registered at startup via registerDesktopSchemePrivileges, and the Clerk SDK bridge is skipped through makeDesktopClerkLayer / desktopClerkBridgeEnabled. Custom-scheme proxying moves from Electron.net.fetch to Effect HttpClient (Undici), with streamed bodies, hop-by-hop header stripping, and cache: no-store.

Web: Primary environment HTTP targets loopback through the Vite dev origin when VITE_DEV_SERVER_URL applies, and through t3code-dev://app when the renderer runs on the desktop custom scheme (WebSocket bases stay direct). Pairing submit dedupes concurrent same-token calls, waits for session establishment after exchange, and treats 401 as success if the session is already authenticated. Clerk UI, cloud auth root, connections settings, and diff workers load lazily (portable worker URL) so missing Clerk config does not break vp run dev. Vite exposes VITE_DEV_SERVER_URL and sets HMR clientPort.

^{Reviewed by Cursor Bugbot for commit 6593a5f. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix local dev auth startup by stabilizing protocol, URL resolution, and credential submission

• Rewrites ElectronProtocol.proxyRequest to use HttpClient instead of Electron.net.fetch, streaming response bodies and stripping hop-by-hop headers; adds registerDesktopSchemePrivileged to configure the custom scheme at startup when the Clerk bridge is disabled
• Introduces desktopClerkBridgeEnabled in DesktopClerk and gates Clerk SDK bridge acquisition on that flag via makeDesktopClerkLayer
• Rewrites resolveHttpRequestBaseUrl in target.ts to prefer the Vite dev server origin for loopback targets in local dev and the custom desktop scheme origin (t3code-dev://app) when running in the desktop dev app
• Deduplicates concurrent pairing token submissions in submitServerAuthCredential and adds a grace path that accepts an already-authenticated session on 401 when a duplicate token is submitted
• Lazily loads ConfiguredCloudAuthRoot, sidebar Clerk components, and connection settings to defer Clerk initialization

^{Macroscope summarized 6593a5f.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 3abce5a7-b66c-4885-967f-37e045186c32

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit cd0056b. Configure here.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR modifies authentication flow logic including credential submission, session validation, and desktop auth bridge enablement. Two unresolved medium-severity review comments identify potential bugs in proxy response buffering and session establishment timing. Changes to authentication code paths warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}