chore: sync with upstream pingdotgg/t3code main

.github/workflows/cursor-hygiene-webhook.yml

@@ -3,7 +3,9 @@ name: Forward to Cursor hygiene
 on:
   push:
     branches: [main]
-  pull_request:
+  # Use trusted workflow code and repository secrets for fork PRs.
+  # Keep this job payload-only: never check out or run PR code.
+  pull_request_target:
     types: [opened, reopened, ready_for_review]
   issues:
     types: [opened, closed, reopened]
@@ -34,7 +36,7 @@ jobs:
               --output /dev/null --write-out '%{http_code}' \
               -H "Authorization: $AUTH" \
               -H "Content-Type: application/json" \
-              -H "X-GitHub-Event: ${{ github.event_name }}" \
+              -H "X-GitHub-Event: ${{ github.event_name == 'pull_request_target' && 'pull_request' || github.event_name }}" \
               -H "X-GitHub-Delivery: ${{ github.run_id }}-${{ github.run_attempt }}" \
               --data-binary @"${{ github.event_path }}") || curl_status=$?
             if [ "$curl_status" -eq 0 ]; then

apps/desktop/src/app/DesktopClerk.test.ts

@@ -1,6 +1,7 @@
 // @effect-diagnostics nodeBuiltinImport:off globalFetchInEffect:off - Hosted handoff test uses a real localhost listener without an OpenAI account.
 import * as NodeHttp from "node:http";
-import * as NodePath from "@effect/platform-node/NodePath";
+import * as NodePath from "node:path";
+import * as PlatformNodePath from "@effect/platform-node/NodePath";
 import { codexAuthHandoffUrl, readCodexAuthDelivery } from "@t3tools/shared/codexAuthHandoff";
 import { EnvironmentId, ProviderInstanceId } from "@t3tools/contracts";
 import * as HostProcess from "@t3tools/shared/HostProcess";
@@ -59,11 +60,15 @@ const layerDesktopClerk = (
     copyText: () => Effect.void,
   },
   listeners = new Map<string, (...args: unknown[]) => void>(),
+  isPackaged = false,
 ) => {
   const environment = DesktopEnvironment.DesktopEnvironment.of({
     stateDir: "/tmp/t3-state",
     isDevelopment,
     appDataDirectory: "/tmp/app-data",
+    isPackaged,
+    dirname: platform === "win32" ? String.raw`C:\T3 Code\dist-electron` : "/tmp/dist-electron",
+    path: platform === "win32" ? NodePath.win32 : NodePath.posix,
     platform,
   } as unknown as DesktopEnvironment.DesktopEnvironment["Service"]);
 
@@ -95,7 +100,7 @@ const layerDesktopClerk = (
   return DesktopClerk.layer.pipe(
     Layer.provide(
       Layer.mergeAll(
-        NodePath.layerPosix,
+        PlatformNodePath.layerPosix,
         Layer.succeed(DesktopEnvironment.DesktopEnvironment, environment),
         Layer.succeed(ElectronApp.ElectronApp, electronApp),
         Layer.succeed(ElectronShell.ElectronShell, shell),
@@ -112,6 +117,67 @@ describe("DesktopClerk", () => {
     storageMock.mockReset();
   });
 
+  it.effect.each([
+    { platform: "win32", isPackaged: false, isDevelopment: false, registers: true },
+    { platform: "win32", isPackaged: false, isDevelopment: true, registers: false },
+    { platform: "win32", isPackaged: true, isDevelopment: false, registers: false },
+    { platform: "darwin", isPackaged: false, isDevelopment: false, registers: false },
+    { platform: "linux", isPackaged: false, isDevelopment: false, registers: false },
+  ] as const)(
+    "registers an entry point only for unpackaged non-development Windows ($platform, packaged=$isPackaged, development=$isDevelopment)",
+    ({ platform, isPackaged, isDevelopment, registers }) => {
+      const events: string[] = [];
+      storageMock.mockReturnValue(storageAdapter);
+      createClerkBridgeMock.mockImplementation(() => {
+        events.push("bridge");
+        return { cleanup: vi.fn() };
+      });
+      const setAsDefaultProtocolClient = vi.fn(() =>
+        Effect.sync(() => {
+          events.push("register");
+          return true;
+        }),
+      );
+      const electronApp = {
+        on: () => Effect.void,
+        setAsDefaultProtocolClient,
+      } as unknown as ElectronApp.ElectronApp["Service"];
+
+      return Effect.gen(function* () {
+        const clerk = yield* DesktopClerk.DesktopClerk;
+        yield* clerk.configure;
+
+        assert.deepEqual(
+          setAsDefaultProtocolClient.mock.calls,
+          registers
+            ? [["t3code", process.execPath, [String.raw`C:\T3 Code\dist-electron\main.cjs`]]]
+            : [],
+        );
+        assert.deepEqual(events, registers ? ["bridge", "register"] : ["bridge"]);
+      }).pipe(
+        Effect.scoped,
+        Effect.provide(
+          layerDesktopClerk(
+            isDevelopment,
+            [],
+            platform,
+            undefined,
+            undefined,
+            undefined,
+            isPackaged,
+          ),
+        ),
+        Effect.provideService(ElectronApp.ElectronApp, electronApp),
+        Effect.provideService(
+          ElectronWindow.ElectronWindow,
+          {} as ElectronWindow.ElectronWindow["Service"],
+        ),
+        Effect.provideService(DesktopWebLinks.DesktopWebLinks, ignoreWebLinks),
+        Effect.provideService(HostProcess.Arguments, ["electron"]),
+      );
+    },
+  );
+
   it.effect("acquires and releases the SDK bridge with the layer", () => {
     const cleanup = vi.fn();
     const events: string[] = [];

apps/desktop/src/app/DesktopClerk.ts

@@ -151,6 +151,20 @@ export const make = Effect.gen(function* () {
       const context = yield* Effect.context<ElectronWindow.ElectronWindow>();
       const runPromise = Effect.runPromiseWith(context);
 
+      // Clerk's bare scheme registration omits the app entry on unpackaged Windows.
+      // Development callbacks also need dev server environment this command cannot restore.
+      if (
+        !environment.isPackaged &&
+        !environment.isDevelopment &&
+        environment.platform === "win32"
+      ) {
+        yield* electronApp.setAsDefaultProtocolClient(
+          ElectronProtocol.getDesktopScheme(environment.isDevelopment),
+          process.execPath,
+          [environment.path.join(environment.dirname, "main.cjs")],
+        );
+      }
+
       const startProviderAuthHandoff = (value: string | undefined) => {
         if (!value) return false;
         const request = readCodexAuthHandoff(value, environment.isDevelopment);

apps/desktop/src/ipc/methods/wsl.test.ts

@@ -120,6 +120,43 @@ describe("WSL IPC", () => {
     ),
   );
 
+  it.effect("does not enumerate distros until the WSL backend is enabled", () => {
+    const distros = [
+      { name: "Ubuntu", isDefault: true, version: 2 as const },
+      { name: "Debian", isDefault: false, version: 2 as const },
+    ];
+    const layer = Layer.mergeAll(
+      DesktopAppSettings.layerTest({
+        ...DesktopAppSettings.DEFAULT_DESKTOP_SETTINGS,
+        wslDistro: "Debian",
+      }),
+      DesktopWslEnvironment.layerTest({ isAvailable: true, distros }),
+      layerWslBackend(),
+      layerLifecycle([]),
+      layerUnusedLifecycleRuntime,
+    );
+
+    return Effect.gen(function* () {
+      const wsl = yield* DesktopWslEnvironment.DesktopWslEnvironment;
+      const state = yield* getWslState.handler(undefined).pipe(
+        Effect.provideService(DesktopWslEnvironment.DesktopWslEnvironment, {
+          ...wsl,
+          listDistros: Effect.die("must not enumerate distros"),
+        }),
+        Effect.flatMap(decodeWslState),
+      );
+      assert.equal(state.enabled, false);
+      assert.equal(state.available, true);
+      assert.equal(state.distro, "Debian");
+      assert.deepEqual(state.distros, []);
+
+      const enabledState = yield* invokeSetWslBackendEnabled(true);
+      assert.equal(enabledState.enabled, true);
+      assert.equal(enabledState.distro, "Debian");
+      assert.deepEqual(enabledState.distros, distros);
+    }).pipe(Effect.provide(layer));
+  });
+
   it.effect("stages dual-backend preferences before enabling without relaunching", () => {
     const relaunchReasons: Array<string> = [];
     const layer = Layer.mergeAll(

apps/desktop/src/ipc/methods/wsl.ts

@@ -22,9 +22,9 @@ const readWslState: Effect.Effect<
   const wslBackend = yield* DesktopWslBackend.DesktopWslBackend;
   const settings = yield* appSettings.get;
   const available = settings.localEnvironmentEnabled && (yield* wslEnvironment.isAvailable);
-  // Only enumerate distros when WSL is actually available — listDistros on a
-  // non-WSL host would spawn wsl.exe and hit the timeout for nothing.
-  const distros = available ? yield* wslEnvironment.listDistros : [];
+  // Windows ships a wsl.exe stub that can prompt to install WSL when invoked.
+  // Keep disabled state reads from launching it to enumerate distros.
+  const distros = available && settings.wslBackendEnabled ? yield* wslEnvironment.listDistros : [];
   const preflightError = yield* wslBackend.lastPreflightError;
   return {
     enabled: settings.wslBackendEnabled,

apps/desktop/src/preview/BrowserImport/ChromiumCookies.test.ts

@@ -151,56 +151,57 @@ describe("readChromiumCookieDatabase", () => {
       }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
   );
 
-  it.effect("reads plaintext, encrypted, and genuinely empty cookie values", () =>
-    Effect.gen(function* () {
-      const fileSystem = yield* FileSystem.FileSystem;
-      const directory = yield* fileSystem.makeTempDirectoryScoped({
-        prefix: "t3code-chromium-cookies-",
-      });
-      const filename = `${directory}/Cookies`;
-      const key = Buffer.from("0123456789abcdef");
+  it.effect.each([14, 24])(
+    "imports mixed TEXT and BLOB cookie values, including empty values, in schema %i",
+    (schemaVersion) =>
+      Effect.gen(function* () {
+        const fileSystem = yield* FileSystem.FileSystem;
+        const directory = yield* fileSystem.makeTempDirectoryScoped({
+          prefix: "t3code-chromium-cookies-",
+        });
+        const filename = `${directory}/Cookies`;
+        const key = Buffer.from("0123456789abcdef");
+        const host = "secure.example";
+        const value = "stored encrypted";
+        const payload =
+          schemaVersion >= 24
+            ? Buffer.concat([
+                NodeCrypto.createHash("sha256").update(host).digest(),
+                Buffer.from(value),
+              ])
+            : Buffer.from(value);
+        const encrypted = encryptV10(payload, key);
 
-      yield* Effect.gen(function* () {
-        const sql = yield* SqlClient.SqlClient;
-        yield* sql`create table meta (key text primary key, value text not null)`;
-        yield* sql`insert into meta values ('version', 23)`;
-        yield* sql`
-          create table cookies (
-            host_key text not null,
-            name text not null,
-            value text not null,
-            encrypted_value blob not null,
-            path text not null,
-            expires_utc integer not null,
-            is_secure integer not null,
-            is_httponly integer not null,
-            samesite integer not null,
-            top_frame_site_key text not null default ''
-          )
-        `;
-        yield* sql`
-          insert into cookies (host_key, name, value, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite) values
-            ('plain.example', 'plain', 'stored plaintext', ${new Uint8Array()}, '/', 0, 0, 0, -1)
-        `;
-        yield* sql`
-          insert into cookies (host_key, name, value, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite) values
-            ('secure.example', 'encrypted', '', ${encryptV10("stored encrypted", key)}, '/', 0, 1, 1, 2)
-        `;
-        yield* sql`
-          insert into cookies (host_key, name, value, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite) values
-            ('empty.example', 'empty', '', ${new Uint8Array()}, '/', 0, 0, 0, 0)
-        `;
-      }).pipe(Effect.provide(NodeSqliteClient.layer({ filename })));
+        yield* Effect.gen(function* () {
+          const sql = yield* SqlClient.SqlClient;
+          yield* sql`create table meta (key text primary key, value text not null)`;
+          yield* sql`insert into meta values ('version', ${schemaVersion})`;
+          yield* sql`create table cookies (
+            host_key text not null, name text not null, value text not null,
+            encrypted_value blob not null, path text not null, expires_utc integer not null,
+            is_secure integer not null, is_httponly integer not null, samesite integer not null
+          )`;
+          if (schemaVersion >= 15) {
+            yield* sql`alter table cookies add column top_frame_site_key text not null default ''`;
+          }
+          yield* sql`insert into cookies
+            (host_key, name, value, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite) values
+            ('plain.example', 'plain', 'stored plaintext', '', '/', 0, 0, 0, -1),
+            (${host}, 'text-encrypted', '', cast(${encrypted} as text), '/', 0, 1, 1, 2),
+            (${host}, 'blob-encrypted', '', ${encrypted}, '/', 0, 1, 1, 2),
+            ('empty.example', 'empty', '', ${new Uint8Array()}, '/', 0, 0, 0, 0)`;
+        }).pipe(Effect.provide(NodeSqliteClient.layer({ filename })));
 
-      const result = yield* readChromiumCookieDatabase(filename, { cbcV10: key }, "darwin");
+        const result = yield* readChromiumCookieDatabase(filename, { cbcV10: key }, "darwin");
 
-      expect(result.undecryptable).toBe(0);
-      expect(result.cookies.map(({ name, value }) => ({ name, value }))).toEqual([
-        { name: "plain", value: "stored plaintext" },
-        { name: "encrypted", value: "stored encrypted" },
-        { name: "empty", value: "" },
-      ]);
-    }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
+        expect(result.undecryptable).toBe(0);
+        expect(result.cookies.map(({ name, value }) => ({ name, value }))).toEqual([
+          { name: "plain", value: "stored plaintext" },
+          { name: "text-encrypted", value },
+          { name: "blob-encrypted", value },
+          { name: "empty", value: "" },
+        ]);
+      }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
   );
 
   it.effect("enforces domain binding only for schema 24 and newer", () =>

apps/desktop/src/preview/BrowserImport/ChromiumCookies.ts

@@ -200,12 +200,14 @@ export const readChromiumCookieDatabase = Effect.fn("ChromiumCookies.readChromiu
         Effect.flatMap(decodeSchemaVersion),
         Effect.map(([row]) => row.value),
       );
+      // SQLite's BLOB affinity still permits TEXT. Cast before Node decodes
+      // those bytes as UTF-8, which can corrupt an encrypted payload.
       const raw =
         schemaVersion >= 15
-          ? yield* sql`select host_key, name, value, encrypted_value, path,
+          ? yield* sql`select host_key, name, value, cast(encrypted_value as blob) as encrypted_value, path,
                 expires_utc / 1000000 as expires_seconds, is_secure, is_httponly,
                 samesite, top_frame_site_key from cookies`
-          : yield* sql`select host_key, name, value, encrypted_value, path,
+          : yield* sql`select host_key, name, value, cast(encrypted_value as blob) as encrypted_value, path,
                 expires_utc / 1000000 as expires_seconds, is_secure, is_httponly,
                 samesite, '' as top_frame_site_key from cookies`;
       return { rows: yield* decodeCookieRows(raw), schemaVersion };

apps/desktop/src/settings/DesktopAppSettings.test.ts

@@ -283,7 +283,7 @@ describe("DesktopSettings", () => {
       Effect.gen(function* () {
         const settings = yield* DesktopAppSettings.DesktopAppSettings;
         yield* writeSettingsPatch({
-          mainWindowBounds: { x: 10.5, y: 20, width: 839, height: 620 },
+          mainWindowBounds: { x: 10, y: 20, width: 599, height: 620 },
           mainWindowMaximized: true,
           serverExposureMode: "network-accessible",
         });
@@ -342,17 +342,24 @@ describe("DesktopSettings", () => {
         const fileSystem = yield* FileSystem.FileSystem;
         const settings = yield* DesktopAppSettings.DesktopAppSettings;
 
-        yield* settings.setMainWindowBounds({ x: -1200, y: 40, width: 1440, height: 960 }, true);
+        yield* settings.setMainWindowBounds({ x: -1200, y: 40, width: 600, height: 620 }, true);
         yield* settings.setServerExposureMode("network-accessible");
 
         const persisted = yield* decodeDesktopSettingsPatch(
           yield* fileSystem.readFileString(environment.desktopSettingsPath),
         );
         assert.deepEqual(persisted, {
-          mainWindowBounds: { x: -1200, y: 40, width: 1440, height: 960 },
+          mainWindowBounds: { x: -1200, y: 40, width: 600, height: 620 },
           mainWindowMaximized: true,
           serverExposureMode: "network-accessible",
         } satisfies typeof DesktopSettingsPatch.Type);
+
+        const restored = yield* Effect.gen(function* () {
+          const freshSettings = yield* DesktopAppSettings.DesktopAppSettings;
+          return yield* freshSettings.load;
+        }).pipe(Effect.provide(DesktopAppSettings.layer));
+        assert.deepEqual(restored.mainWindowBounds, persisted.mainWindowBounds);
+        assert.isTrue(restored.mainWindowMaximized);
       }),
     ),
   );

apps/desktop/src/settings/DesktopAppSettings.ts

@@ -48,8 +48,8 @@ export interface DesktopSettingsChange {
 }
 
 const DEFAULT_TAILSCALE_SERVE_PORT = 443;
-const MIN_MAIN_WINDOW_SIZE = {
-  width: 840,
+export const MIN_MAIN_WINDOW_SIZE = {
+  width: 600,
   height: 620,
 } as const;
 export const DesktopWindowBoundsSchema = Schema.Struct({