fix(desktop): cover the remaining traffic-light overlaps, and enumerate them in CI

Fixing signup by hand would have been the fourth time this bug was found by a person
hitting it. The audit now enumerates instead of listing what to inspect: it walks every
`.tsx` outside workspace chrome, flags each full-viewport root, and fails unless that
root either composes `.desktop-title-bar-page` or appears in an allowlist with a written
reason. A brand-new page that fills the viewport fails on arrival — verified by adding
one, and by reverting each fix below.

Running it found three more surfaces already overlapping:

- `/oauth-error` is Better Auth's `onAPIError.errorURL`, which is precisely where desktop
  OAuth failures land, so the one page a user sees when sign-in breaks drew its content
  under the lights.
- `/f/[token]` public file view, same shell family, same origin, reachable in the window.
- The signup and reset-password Suspense fallbacks are viewport-tall *inside* the
  lane-reserving shell, so the page overflowed by the lane while the split chunk loaded.
  A placeholder needs no viewport height.

Four surfaces are allowlisted with reasons: the two landing shells (the desktop shell
boots to /login or a workspace and has no path to marketing routes), the dev-only
playground, and the embedded resume interface.

Measured over CDP: /oauth-error reserves 40px with zero overflow.

Author: waleedlatif1

apps/sim/app/(auth)/reset-password/reset-password-content.tsx

@@ -80,7 +80,9 @@ function ResetPasswordContent() {
 
 export default function ResetPasswordPage() {
   return (
-    <Suspense fallback={<div className='flex h-screen items-center justify-center'>Loading…</div>}>
+    <Suspense
+      fallback={<div className='flex min-h-[320px] items-center justify-center'>Loading…</div>}
+    >
       <ResetPasswordContent />
     </Suspense>
   )

apps/sim/app/(auth)/signup/signup-form.tsx

@@ -490,7 +490,9 @@ export default function SignupPage({
   emailSignupEnabled,
 }: SignupFormProps) {
   return (
-    <Suspense fallback={<div className='flex h-screen items-center justify-center'>Loading…</div>}>
+    <Suspense
+      fallback={<div className='flex min-h-[320px] items-center justify-center'>Loading…</div>}
+    >
       <SignupFormContent
         githubAvailable={githubAvailable}
         googleAvailable={googleAvailable}

apps/sim/app/_shell/desktop-title-bar-surfaces.test.ts

@@ -1,7 +1,7 @@
 /**
  * @vitest-environment node
  */
-import { readFileSync } from 'node:fs'
+import { readdirSync, readFileSync } from 'node:fs'
 import { describe, expect, it } from 'vitest'
 
 /** Anchored to this file, not `process.cwd()`, which only resolves from `apps/sim`. */
@@ -149,3 +149,45 @@ describe('desktop title-bar surface audit', () => {
     expect(resourceHeader).not.toMatch(/py-\[8\.5px\]/)
   })
 })
+
+/**
+ * Every full-viewport page root outside workspace chrome, and why it is safe.
+ *
+ * A root that fills the viewport and is NOT lane-aware draws its top chrome underneath
+ * the macOS traffic lights, because the pre-paint script marks the lane on every desktop
+ * route whether or not the page reserves it. That is one bug that has now surfaced four
+ * separate times — workspace headers, signup, the CLI handoff, the OAuth error page —
+ * each found by a person hitting it rather than by a check.
+ *
+ * So the check enumerates instead of listing what to look at: any new full-viewport root
+ * fails here until it either composes `.desktop-title-bar-page` or is added below with a
+ * reason. Reaching for this allowlist should feel like a claim you have to defend.
+ */
+const LANE_EXEMPT: Record<string, string> = {
+  'app/(landing)/components/landing-shell/landing-shell.tsx':
+    'Marketing chrome. The desktop shell boots straight to /login or a workspace and has no path to the landing routes.',
+  'app/(landing)/components/logo-shell/logo-shell.tsx':
+    'Marketing chrome, same reasoning as landing-shell.',
+  'app/playground/page.tsx': 'Dev-only scratch route, not shipped in the desktop shell.',
+  'app/(interfaces)/resume/[workflowId]/[executionId]/loading.tsx':
+    'Embedded interface surface rendered inside a host page, never as the desktop window root.',
+}
+
+describe('desktop traffic-light lane coverage', () => {
+  it('leaves no full-viewport root outside workspace chrome unaccounted for', () => {
+    const appDir = new URL('../', import.meta.url)
+    const files = readdirSync(appDir, { recursive: true, encoding: 'utf8' })
+      .filter((f) => f.endsWith('.tsx') && !f.startsWith('workspace/'))
+      .map((f) => `app/${f}`)
+
+    const unaccounted = files.filter((file) => {
+      const source = stripComments(read(`../${file.slice('app/'.length)}`))
+      const fillsViewport = /\b(min-h-screen|h-screen)\b/.test(source)
+      if (!fillsViewport) return false
+      const laneAware = source.includes('desktop-title-bar-page') || source.includes('AuthShell')
+      return !laneAware && !(file in LANE_EXEMPT)
+    })
+
+    expect(unaccounted).toEqual([])
+  })
+})

apps/sim/app/f/[token]/public-file-view.tsx

@@ -65,7 +65,7 @@ export function PublicFileView({
   )
 
   return (
-    <div className='light flex min-h-screen flex-col bg-[var(--bg)]'>
+    <div className='light desktop-title-bar-page flex flex-col bg-[var(--bg)]'>
       <header className='sticky top-0 z-10 flex items-center justify-between gap-4 border-[var(--border)] border-b bg-[var(--bg)] px-4 py-3'>
         <div className='flex min-w-0 items-center gap-3'>
           {!brand.logoUrl && (

apps/sim/app/oauth-error/page.tsx

@@ -36,7 +36,7 @@ export default async function OAuthErrorPage({ searchParams }: OAuthErrorPagePro
   const code = typeof params.error === 'string' ? params.error : undefined
 
   return (
-    <main className='flex min-h-screen items-center justify-center px-6'>
+    <main className='desktop-title-bar-page flex items-center justify-center px-6'>
       <div className='max-w-sm text-center'>
         <h1 className='font-semibold text-foreground text-lg'>Couldn’t complete that</h1>
         <p className='mt-2 text-muted-foreground text-sm'>{messageForError(code)}</p>