t3code: bake T3 Connect public identifiers into the web client by repparw · Pull Request #555921 · NixOS/nixpkgs

repparw · 2026-08-24T02:05:22Z

The bundled T3 Connect cloud UI (sign-in, relay discovery, environment picker) renders nothing in the packaged client because its configuration is compiled empty. The web client gates every cloud feature on build-time constants (import.meta.env.VITE_CLERK_PUBLISHABLE_KEY, VITE_CLERK_JWT_TEMPLATE, VITE_T3CODE_RELAY_URL), which the monorepo env loader projects from the canonical T3CODE_* names found in repo-root .env. Runtime environment variables cannot fix this for a packaged browser bundle — the gating happens at build time.

This PR sets the four public identifiers (Clerk publishable key, JWT template name, CLI OAuth client ID, relay URL) as build-time env so the derivation matches official upstream release builds. These values are published upstream in .env.example, which describes them as "the same public identifiers baked into official release builds, not secrets"; see also docs/internals/t3-connect.md.

cc @iamanaws @qweered

Note for reviewers: #555814 touches the same file; this is a 12-line additive change and trivially rebasable if that merges first.

Things done

Addendum to "Tested basic functionality": built t3code.unwrapped with this change and verified the resulting store output contains the identifiers where they matter:

apps/server/dist/client/assets/index-*.js contains the publishable key, t3-relay, and relay.t3.codes (client gating now passes)
apps/server/dist/bin.mjs contains the publishable key and OAuth client ID

One known limitation: sign-in from non-app.t3.codes origins goes through Clerk components; if the production Clerk instance restricts allowed origins, that flow could still fail. Upstream ships the same bundle in its desktop releases, so parity with official builds remains the correct target.

The Linux wrapper also advertises x-scheme-handler/t3code on the packaged desktop entry and points upstream's launcher override (T3CODE_DESKTOP_LAUNCHER_PATH, pingdotgg/t3code#8668) at the wrapper, so a handler-launched instance keeps the runtime PATH. The app still skips its own xdg-mime default registration while app.isPackaged is false, so making T3 Code the default handler for the scheme is left to user configuration (xdg.mimeApps.defaultApplications).

qweered

I think its better to just cp .env.example .env as suggested by upstream

repparw · 2026-08-26T21:07:53Z

trying to solve url handling for SSO (google, github)
~~currently works through mail code, still testing rest~~ works

limwa · 2026-08-29T20:59:57Z

trying to solve url handling for SSO (google, github) ~~currently works through mail code, still testing rest~~ works

I've created 2 upstream PRs which should help with this:

fix(desktop): support Linux distro protocol launchers pingdotgg/t3code#8668
fix(desktop): make Linux URL handlers discoverable with the app icon pingdotgg/t3code#8673

You would then set T3CODE_DESKTOP_EXECUTABLE to $out/bin/t3code-desktop in the t3code-desktop wrapper.

EDIT: oh, and you also have to wrap t3code-desktop with xdg-utils and desktop-file-utils.

…deps Fixes Linux OAuth callbacks (Google/GitHub SSO) by setting T3CODE_DESKTOP_EXECUTABLE to the stable distro launcher $out/bin/t3code-desktop so the generated t3code-url-handler.desktop Exec is durable instead of a shared electron binary or transient AppImage mount. Prepares for upstream pingdotgg/t3code#8668 which reads T3CODE_DESKTOP_EXECUTABLE and allows unpackaged prod builds to register when the variable is set, and pingdotgg/t3code#8673 which requires update-desktop-database + xdg-mime on PATH. Wrap t3code-desktop (unwrapped) and the final symlinkJoin package with desktop-file-utils (update-desktop-database) and xdg-utils (xdg-mime) for Linux, as suggested in NixOS#555921 (comment).

repparw · 2026-10-18T00:00:01Z

Rebased onto current master (resolved the SPDX license-block interleave in unwrapped.nix, and moved to electron_44).

Heads-up: an auto-update to t3code 0.1.0 is pending as #575132 (merge-bot eligible). It only touches the version/hash lines in unwrapped.nix, so this PR should carry over cleanly once it lands — happy to rebase again then if GitHub flags it. The identifiers baked here are unchanged and still match v0.1.0's own .env.example.

…deps Fixes Linux OAuth callbacks (Google/GitHub SSO) by setting T3CODE_DESKTOP_EXECUTABLE to the stable distro launcher $out/bin/t3code-desktop so the generated t3code-url-handler.desktop Exec is durable instead of a shared electron binary or transient AppImage mount. Prepares for upstream pingdotgg/t3code#8668 which reads T3CODE_DESKTOP_EXECUTABLE and allows unpackaged prod builds to register when the variable is set, and pingdotgg/t3code#8673 which requires update-desktop-database + xdg-mime on PATH. Wrap t3code-desktop (unwrapped) and the final symlinkJoin package with desktop-file-utils (update-desktop-database) and xdg-utils (xdg-mime) for Linux, as suggested in NixOS#555921 (comment).

limwa · 2026-10-30T17:14:59Z

Both PRs were merged into upstream as of 0.1.3. Github SSO for T3 Connect should with this PR, although I'm still not sure if you need to remove the if(!app.isPackaged) return; line on the file where the changes were made.

0x4bs3nt · 2026-11-02T17:22:20Z

Besides the CI issues around formatting from what I see, approved.

otavio · 2026-11-02T17:49:05Z

We use the same approach in OSSystems/t3code-nix: copy upstream’s .env.example to .env before building, and set T3CODE_DESKTOP_LAUNCHER_PATH to the packaged desktop launcher. We carry these packaging fixes to keep T3 Connect available in our v0.1.6 package.

I reviewed the current diff against our packaging. The build-time configuration and launcher override match what we carry. This PR also supplies the desktop URL-handler MIME type and runtime tools. Merging it would let us drop the corresponding local overrides when we update our nixpkgs input.

Our package separately sets T3CODE_CLOUDFLARED_PATH to nixpkgs’ cloudflared, so the relay client is Nix-managed. That is independent of this PR.

This is a source/packaging review; I have not built this PR head or independently tested its SSO flow.

Assisted by Codex (gpt-6.1-sol).

Retain the public production identifiers and desktop URL registration on the current 0.1.6 nixpkgs package. Assisted-by: ChatGPT (GPT-6)

repparw requested review from iamanaws and qweered August 24, 2026 02:05

qweered suggested changes Aug 26, 2026

View reviewed changes

repparw force-pushed the t3code-connect-identifiers branch from 8c93f1d to 225bd7b Compare August 26, 2026 13:12

qweered approved these changes Aug 26, 2026

View reviewed changes

nixpkgs-ci Bot added 12.approvals: 1 This PR was reviewed and approved by one person. 12.approved-by: package-maintainer This PR was reviewed and approved by a maintainer listed in any of the changed packages. labels Aug 26, 2026

iamanaws approved these changes Aug 26, 2026

View reviewed changes

nixpkgs-ci Bot added 12.approvals: 2 This PR was reviewed and approved by two persons. and removed 12.approvals: 1 This PR was reviewed and approved by one person. labels Aug 26, 2026

repparw force-pushed the t3code-connect-identifiers branch 2 times, most recently from 1176a3d to 1e083d0 Compare August 26, 2026 20:31

repparw force-pushed the t3code-connect-identifiers branch from 1e083d0 to a054894 Compare August 26, 2026 21:23

repparw force-pushed the t3code-connect-identifiers branch from 56a237c to 620e2bc Compare August 30, 2026 01:10

nixpkgs-ci Bot added the 2.status: merge conflict This PR has merge conflicts with the target branch label Sep 6, 2026

repparw force-pushed the t3code-connect-identifiers branch from 620e2bc to ac66ed8 Compare October 17, 2026 23:41

nixpkgs-ci Bot removed the 2.status: merge conflict This PR has merge conflicts with the target branch label Oct 17, 2026

repparw force-pushed the t3code-connect-identifiers branch from ac66ed8 to 74c7f31 Compare October 18, 2026 00:14

repparw mentioned this pull request Oct 19, 2026

fix(t3code): separate version and workaround lifecycles repparw/nix#308

Merged

repparw mentioned this pull request Oct 30, 2026

fix(desktop): register Linux protocol handler for distro launchers pingdotgg/t3code#27725

Closed

repparw force-pushed the t3code-connect-identifiers branch from a02adcb to 519ad1b Compare November 2, 2026 17:09

nixpkgs-ci Bot requested a review from 0x4bs3nt November 2, 2026 17:17

nixpkgs-ci Bot added the llm-assisted Contributions that include code generation with LLMs label Nov 2, 2026

0x4bs3nt approved these changes Nov 2, 2026

View reviewed changes

nixpkgs-ci Bot added 12.approvals: 3+ This PR was reviewed and approved by three or more persons. and removed 12.approvals: 2 This PR was reviewed and approved by two persons. labels Nov 2, 2026

otavio approved these changes Nov 2, 2026

View reviewed changes

repparw added 3 commits November 12, 2026 22:47

t3code: bake T3 Connect public identifiers into the web client

f3f38d6

Retain the public production identifiers and desktop URL registration on the current 0.1.6 nixpkgs package. Assisted-by: ChatGPT (GPT-6)

t3code: format Linux wrapper runtime dependencies

c6fbf9f

t3code: format desktop launcher PATH wrapper

c988bec

repparw force-pushed the t3code-connect-identifiers branch from f31574d to c988bec Compare November 13, 2026 01:53

otavio approved these changes Nov 13, 2026

View reviewed changes

limwa reviewed Nov 13, 2026

View reviewed changes

Comment thread pkgs/by-name/t3/t3code/unwrapped.nix Resolved

t3code: avoid duplicate desktop utility PATH wrapping

02484c8

repparw mentioned this pull request Nov 13, 2026

t3code: use nixpkgs cloudflared for T3 Connect #587795

Open

13 tasks

Navigation Menu

Repository navigation

t3code: bake T3 Connect public identifiers into the web client - #555921

t3code: bake T3 Connect public identifiers into the web client#555921
repparw wants to merge 4 commits into
NixOS:masterfrom
repparw:t3code-connect-identifiers

repparw commented Aug 24, 2026 •

edited

Loading

Uh oh!

qweered left a comment

Uh oh!

repparw commented Aug 26, 2026 •

edited

Loading

Uh oh!

limwa commented Aug 29, 2026 •

edited

Loading

Uh oh!

repparw commented Oct 18, 2026

Uh oh!

limwa commented Oct 30, 2026

Uh oh!

0x4bs3nt commented Nov 2, 2026

Uh oh!

otavio commented Nov 2, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

repparw commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Things done

Uh oh!

qweered left a comment

Choose a reason for hiding this comment

Uh oh!

repparw commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

limwa commented Aug 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

repparw commented Oct 18, 2026

Uh oh!

limwa commented Oct 30, 2026

Uh oh!

0x4bs3nt commented Nov 2, 2026

Uh oh!

otavio commented Nov 2, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

repparw commented Aug 24, 2026 •

edited

Loading

repparw commented Aug 26, 2026 •

edited

Loading

limwa commented Aug 29, 2026 •

edited

Loading