[codex] Rewrite client connection architecture

apps/desktop/package.json

@@ -20,13 +20,16 @@
     "@t3tools/tailscale": "workspace:*",
     "effect": "catalog:",
     "electron": "41.5.0",
-    "electron-updater": "^6.6.2"
+    "electron-updater": "^6.6.2",
+    "playwright-core": "1.60.0",
+    "react-grab": "^0.1.32"
   },
   "devDependencies": {
     "@effect/vitest": "catalog:",
     "@types/node": "catalog:",
     "cross-env": "^10.1.0",
     "electron-builder": "26.8.1",
+    "tailwindcss": "^4.0.0",
     "vite-plus": "catalog:"
   },
   "productName": "T3 Code (Alpha)"

apps/desktop/scripts/build-preview-annotation-css.mjs

@@ -0,0 +1,40 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { compile } from "tailwindcss";
+
+const directory = dirname(fileURLToPath(import.meta.url));
+const appRoot = join(directory, "..");
+const sourcePath = join(appRoot, "src", "preview", "Annotation.css");
+const preloadPath = join(appRoot, "src", "preview", "PickPreload.ts");
+const outputPath = join(appRoot, "src", "preview", "AnnotationStyles.generated.ts");
+const require = createRequire(import.meta.url);
+const tailwindRoot = dirname(require.resolve("tailwindcss/package.json"));
+
+const [annotationSource, preloadSource, themeSource, preflightSource] = await Promise.all([
+  readFile(sourcePath, "utf8"),
+  readFile(preloadPath, "utf8"),
+  readFile(join(tailwindRoot, "theme.css"), "utf8"),
+  readFile(join(tailwindRoot, "preflight.css"), "utf8"),
+]);
+
+const candidates = new Set(
+  Array.from(preloadSource.matchAll(/!?-?[A-Za-z0-9_:@/.[\]()%,-]+/g), (match) => match[0]),
+);
+const compilerInput = [
+  themeSource,
+  preflightSource,
+  annotationSource.replace('@import "tailwindcss";', "@tailwind utilities;"),
+].join("\n");
+const compiler = await compile(compilerInput, { base: appRoot });
+const css = compiler.build([...candidates]);
+const encodedCss = `'${css
+  .replaceAll("\\", "\\\\")
+  .replaceAll("'", "\\'")
+  .replaceAll("\r", "\\r")
+  .replaceAll("\n", "\\n")}'`;
+const moduleSource = `// Generated by scripts/build-preview-annotation-css.mjs. Do not edit.\nexport const previewAnnotationStyles =\n  ${encodedCss};\n`;
+
+await writeFile(outputPath, moduleSource);

apps/desktop/scripts/dev-electron.mjs

@@ -2,7 +2,11 @@ import { spawn, spawnSync } from "node:child_process";
 import { watch } from "node:fs";
 import { join } from "node:path";
 
-import { desktopDir, resolveDevProtocolClient, resolveElectronPath } from "./electron-launcher.mjs";
+import {
+  desktopDir,
+  resolveDevProtocolClient,
+  resolveElectronLaunchCommand,
+} from "./electron-launcher.mjs";
 import { waitForResources } from "./wait-for-resources.mjs";
 
 const devServerUrl = process.env.VITE_DEV_SERVER_URL?.trim();
@@ -79,7 +83,8 @@ function startApp() {
   const launchArgs = devProtocolClient
     ? electronArgs
     : [...electronArgs, `--t3code-dev-root=${desktopDir}`, "dist-electron/main.cjs"];
-  const app = spawn(resolveElectronPath(), launchArgs, {
+  const electronCommand = resolveElectronLaunchCommand(launchArgs);
+  const app = spawn(electronCommand.electronPath, electronCommand.args, {
     cwd: desktopDir,
     env: childEnv,
     stdio: "inherit",

apps/desktop/scripts/electron-launcher.mjs

@@ -307,6 +307,31 @@ function buildMacLauncher(electronBinaryPath) {
   return targetBinaryPath;
 }
 
+function isLinuxSetuidSandboxConfigured(electronBinaryPath) {
+  if (process.platform !== "linux") {
+    return true;
+  }
+
+  const sandboxPath = join(dirname(electronBinaryPath), "chrome-sandbox");
+  try {
+    const sandboxStat = statSync(sandboxPath);
+    return sandboxStat.uid === 0 && (sandboxStat.mode & 0o4777) === 0o4755;
+  } catch {
+    return false;
+  }
+}
+
+function resolveLinuxSandboxArgs(electronBinaryPath) {
+  if (isLinuxSetuidSandboxConfigured(electronBinaryPath)) {
+    return [];
+  }
+
+  console.warn(
+    "[desktop-launcher] Electron chrome-sandbox is not root-owned with mode 4755; launching local Electron with --no-sandbox.",
+  );
+  return ["--no-sandbox"];
+}
+
 export function resolveElectronPath() {
   ensureElectronRuntime();
 
@@ -320,6 +345,14 @@ export function resolveElectronPath() {
   return buildMacLauncher(electronBinaryPath);
 }
 
+export function resolveElectronLaunchCommand(args = []) {
+  const electronPath = resolveElectronPath();
+  return {
+    electronPath,
+    args: [...resolveLinuxSandboxArgs(electronPath), ...args],
+  };
+}
+
 export function resolveDevProtocolClient() {
   if (process.platform !== "darwin" || !isDevelopment) {
     return null;

apps/desktop/scripts/smoke-test.mjs

@@ -1,15 +1,16 @@
 import { spawn } from "node:child_process";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { resolveElectronLaunchCommand } from "./electron-launcher.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const desktopDir = resolve(__dirname, "..");
-const electronBin = resolve(desktopDir, "node_modules/.bin/electron");
 const mainJs = resolve(desktopDir, "dist-electron/main.cjs");
 
 console.log("\nLaunching Electron smoke test...");
 
-const child = spawn(electronBin, [mainJs], {
+const electronCommand = resolveElectronLaunchCommand([mainJs]);
+const child = spawn(electronCommand.electronPath, electronCommand.args, {
   stdio: ["pipe", "pipe", "pipe"],
   env: {
     ...process.env,

apps/desktop/scripts/start-electron.mjs

@@ -1,11 +1,12 @@
 import { spawn } from "node:child_process";
 
-import { desktopDir, resolveElectronPath } from "./electron-launcher.mjs";
+import { desktopDir, resolveElectronLaunchCommand } from "./electron-launcher.mjs";
 
 const childEnv = { ...process.env };
 delete childEnv.ELECTRON_RUN_AS_NODE;
 
-const child = spawn(resolveElectronPath(), ["dist-electron/main.cjs"], {
+const electronCommand = resolveElectronLaunchCommand(["dist-electron/main.cjs"]);
+const child = spawn(electronCommand.electronPath, electronCommand.args, {
   stdio: "inherit",
   cwd: desktopDir,
   env: childEnv,

apps/desktop/src/app/DesktopApp.ts

@@ -176,7 +176,7 @@ const bootstrap = Effect.gen(function* () {
     );
   }
 
-  yield* installDesktopIpcHandlers;
+  yield* installDesktopIpcHandlers();
   yield* logBootstrapInfo("bootstrap ipc handlers registered");
 
   if (!(yield* Ref.get(state.quitting))) {

apps/desktop/src/app/DesktopCloudAuthTokenStore.test.ts

@@ -5,7 +5,7 @@ import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 
-import * as ElectronSafeStorage from "../electron/ElectronSafeStorage.ts";
+import * as ElectronSafeStorage from "../electron/ElectronSafeStorageService.ts";
 import * as DesktopConfig from "./DesktopConfig.ts";
 import * as DesktopEnvironment from "./DesktopEnvironment.ts";
 import * as DesktopCloudAuthTokenStore from "./DesktopCloudAuthTokenStore.ts";

apps/desktop/src/app/DesktopCloudAuthTokenStore.ts

@@ -11,7 +11,7 @@ import * as Path from "effect/Path";
 import * as PlatformError from "effect/PlatformError";
 import * as Schema from "effect/Schema";
 
-import * as ElectronSafeStorage from "../electron/ElectronSafeStorage.ts";
+import * as ElectronSafeStorage from "../electron/ElectronSafeStorageService.ts";
 import * as DesktopEnvironment from "./DesktopEnvironment.ts";
 
 interface CloudAuthTokenDocument {

apps/desktop/src/app/DesktopConnectionCatalogStore.test.ts

@@ -0,0 +1,123 @@
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { assert, describe, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Ref from "effect/Ref";
+
+import * as ElectronSafeStorage from "../electron/ElectronSafeStorageService.ts";
+import * as DesktopConfig from "./DesktopConfig.ts";
+import * as DesktopConnectionCatalogStore from "./DesktopConnectionCatalogStore.ts";
+import * as DesktopEnvironment from "./DesktopEnvironment.ts";
+
+const textDecoder = new TextDecoder();
+const textEncoder = new TextEncoder();
+
+function makeSafeStorageLayer(available: boolean, failDecrypt: Ref.Ref<boolean> | null = null) {
+  return Layer.succeed(ElectronSafeStorage.ElectronSafeStorage, {
+    isEncryptionAvailable: Effect.succeed(available),
+    encryptString: (value) => Effect.succeed(textEncoder.encode(`encrypted:${value}`)),
+    decryptString: (value) => {
+      return Effect.gen(function* () {
+        const decoded = textDecoder.decode(value);
+        if (
+          !decoded.startsWith("encrypted:") ||
+          (failDecrypt !== null && (yield* Ref.get(failDecrypt)))
+        ) {
+          return yield* new ElectronSafeStorage.ElectronSafeStorageDecryptError({
+            cause: new Error("invalid encrypted catalog"),
+          });
+        }
+        return decoded.slice("encrypted:".length);
+      });
+    },
+  } satisfies ElectronSafeStorage.ElectronSafeStorageShape);
+}
+
+function makeLayer(
+  baseDir: string,
+  encryptionAvailable = true,
+  failDecrypt: Ref.Ref<boolean> | null = null,
+) {
+  const environmentLayer = DesktopEnvironment.layer({
+    dirname: "/repo/apps/desktop/src",
+    homeDirectory: baseDir,
+    platform: "darwin",
+    processArch: "arm64",
+    appVersion: "1.2.3",
+    appPath: "/repo",
+    isPackaged: true,
+    resourcesPath: "/missing/resources",
+    runningUnderArm64Translation: false,
+  }).pipe(
+    Layer.provide(
+      Layer.mergeAll(NodeServices.layer, DesktopConfig.layerTest({ T3CODE_HOME: baseDir })),
+    ),
+  );
+
+  return DesktopConnectionCatalogStore.layer.pipe(
+    Layer.provideMerge(environmentLayer),
+    Layer.provideMerge(makeSafeStorageLayer(encryptionAvailable, failDecrypt)),
+    Layer.provideMerge(NodeServices.layer),
+  );
+}
+
+const withStore = <A, E, R>(
+  effect: Effect.Effect<A, E, R | DesktopConnectionCatalogStore.DesktopConnectionCatalogStore>,
+  encryptionAvailable = true,
+) =>
+  Effect.gen(function* () {
+    const fileSystem = yield* FileSystem.FileSystem;
+    const baseDir = yield* fileSystem.makeTempDirectoryScoped({
+      prefix: "t3-desktop-connection-catalog-test-",
+    });
+    return yield* effect.pipe(Effect.provide(makeLayer(baseDir, encryptionAvailable)));
+  }).pipe(Effect.provide(NodeServices.layer), Effect.scoped);
+
+describe("DesktopConnectionCatalogStore", () => {
+  it.effect("persists, reads, and clears an encrypted connection catalog", () =>
+    withStore(
+      Effect.gen(function* () {
+        const store = yield* DesktopConnectionCatalogStore.DesktopConnectionCatalogStore;
+        const catalog = '{"schemaVersion":1,"targets":[]}';
+
+        assert.isTrue(yield* store.set(catalog));
+        assert.deepStrictEqual(yield* store.get, Option.some(catalog));
+
+        yield* store.clear;
+        assert.deepStrictEqual(yield* store.get, Option.none());
+      }),
+    ),
+  );
+
+  it.effect("does not persist when secure storage is unavailable", () =>
+    withStore(
+      Effect.gen(function* () {
+        const store = yield* DesktopConnectionCatalogStore.DesktopConnectionCatalogStore;
+        assert.isFalse(yield* store.set("{}"));
+        assert.deepStrictEqual(yield* store.get, Option.none());
+      }),
+      false,
+    ),
+  );
+
+  it.effect("discards a catalog that can no longer be decrypted", () =>
+    Effect.gen(function* () {
+      const fileSystem = yield* FileSystem.FileSystem;
+      const baseDir = yield* fileSystem.makeTempDirectoryScoped({
+        prefix: "t3-desktop-connection-catalog-test-",
+      });
+      const failDecrypt = yield* Ref.make(false);
+      const layer = makeLayer(baseDir, true, failDecrypt);
+      const store = yield* DesktopConnectionCatalogStore.DesktopConnectionCatalogStore.pipe(
+        Effect.provide(layer),
+      );
+
+      assert.isTrue(yield* store.set('{"schemaVersion":1,"targets":[]}'));
+      yield* Ref.set(failDecrypt, true);
+      assert.deepStrictEqual(yield* store.get, Option.none());
+      assert.deepStrictEqual(yield* store.get, Option.none());
+    }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
+  );
+});