Note

Medium Risk
Touches auth credential exchange, primary HTTP URL resolution, and the desktop protocol proxy path—areas that affect cookies, pairing, and renderer loading, though changes are guarded by tests and mostly dev-scoped.

Overview
Stabilizes local development when Clerk config is missing or auth runs through Vite/desktop custom schemes.

Desktop: Clerk bridge acquisition is gated on desktopClerkBridgeEnabled; when disabled, the custom t3code/t3code-dev scheme is registered up front in main.ts instead of relying on Clerk side effects. Protocol proxying moves from Electron.net.fetch to Effect HttpClient (Undici), with streamed bodies, hop-by-hop header stripping, and registerDesktopSchemePrivileges.

Web primary environment: resolveHttpRequestBaseUrl routes loopback HTTP through the Vite dev origin when the page is served from the dev server, and through t3code-dev://app when the desktop dev shell is active—keeping cookies/proxy behavior aligned while WebSocket bases stay direct.

Auth bootstrap: submitServerAuthCredential dedupes concurrent submits for the same token, waits for session observability after exchange, and treats invalid-credential responses as success if the session is already authenticated.

Bundling/dev UX: Clerk UI and cloud auth root load via React.lazy; diff workers use @pierre/diffs/worker/worker-portable.js; Vite defines VITE_DEV_SERVER_URL, tightens HMR clientPort, and drops an unused @pierre/diffs optimizeDeps entry.

^{Reviewed by Cursor Bugbot for commit 89bf5f5. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix local dev auth startup by stabilizing Clerk bridge initialization and HTTP request routing

• Guards Clerk SDK bridge acquisition in DesktopClerk.makeDesktopClerkLayer behind an enabled flag, skipping bridge setup entirely when no frontend API hostname is configured.
• Reworks HTTP base URL resolution in target.ts to route loopback requests through the Vite dev server origin or the desktop dev custom scheme (t3code-dev://) as appropriate.
• Registers the desktop custom scheme with full privileges (standard, secure, streaming, CORS) on startup when the Clerk bridge is disabled.
• Replaces Electron.net.fetch in ElectronProtocol.ts with an injected HttpClient (Undici at runtime), adding hop-by-hop header filtering and streaming response bodies without buffering.
• Deduplicates concurrent one-time token submissions in auth.ts, treating an already-authenticated session as success instead of surfacing an error on race or retry.

^{Macroscope summarized 89bf5f5.}