Fix inherited env vars overriding bootstrap config and Windows fd resolution

cursoragent · cursoragent · commit 06b5fc27b522 · 2026-03-25T08:56:56.000Z
Bug 1: Strip T3CODE_MODE, T3CODE_PORT, T3CODE_HOME, T3CODE_NO_BROWSER,
and T3CODE_AUTH_TOKEN from the child process environment in the desktop
launcher. These values are now delivered exclusively via the bootstrap
pipe; inheriting them from the parent shell allowed stray env vars to
silently override the dynamically generated values (e.g. authToken,
port), breaking WebSocket auth.

Bug 2: On Windows there is no /dev/fd/ or /proc/self/fd/ virtual
filesystem. Return undefined from resolveFdPath on win32 and fall back
to using the inherited fd number directly, which Node's fs APIs accept
natively.
diff --git a/apps/desktop/src/main.ts b/apps/desktop/src/main.ts
@@ -949,6 +949,13 @@ function startBackend(): void {
     env: {
       ...process.env,
       ELECTRON_RUN_AS_NODE: "1",
+      // Clear env vars that the bootstrap pipe now delivers, so stray
+      // values inherited from the user's shell cannot override them.
+      T3CODE_MODE: undefined,
+      T3CODE_PORT: undefined,
+      T3CODE_HOME: undefined,
+      T3CODE_NO_BROWSER: undefined,
+      T3CODE_AUTH_TOKEN: undefined,
     },
     stdio: captureBackendLogs
       ? ["ignore", "pipe", "pipe", "pipe"]
diff --git a/apps/server/src/bootstrap.ts b/apps/server/src/bootstrap.ts
@@ -35,7 +35,11 @@ export const readBootstrapEnvelope = Effect.fn("readBootstrapEnvelope")(function
   if (!fdReady) return Option.none();
 
   const streamFd = yield* Effect.try({
-    try: () => NFS.openSync(resolveFdPath(fd), "r"),
+    try: () => {
+      const fdPath = resolveFdPath(fd);
+      if (fdPath === undefined) return fd;
+      return NFS.openSync(fdPath, "r");
+    },
     catch: (error) =>
       new BootstrapError({
         message: "Failed to duplicate bootstrap fd.",
@@ -113,9 +117,12 @@ function isUnavailableBootstrapFdError(error: unknown): boolean {
   );
 }
 
-function resolveFdPath(fd: number): string {
+function resolveFdPath(fd: number): string | undefined {
   if (process.platform === "linux") {
     return `/proc/self/fd/${fd}`;
   }
+  if (process.platform === "win32") {
+    return undefined;
+  }
   return `/dev/fd/${fd}`;
 }
