@@ -215,7 +215,7 @@ jobs:
           git config user.name "${APP_SLUG}[bot]"
           git config user.email "${user_id}+${APP_SLUG}[bot]@users.noreply.github.com"
           git add apps/mobile/app.config.ts
-          git commit \
+          git commit --no-verify \
             -m "chore(mobile): bump app version to $RELEASE_VERSION" \
             -m "Co-authored-by: codex <[email protected]>"
           git push origin "HEAD:refs/heads/${GITHUB_REF_NAME}"
 
@@ -1388,7 +1388,7 @@ jobs:
           git config user.email "${{ steps.app_bot.outputs.email }}"
 
           git add apps/server/package.json apps/desktop/package.json apps/web/package.json packages/contracts/package.json pnpm-lock.yaml
-          git commit -m "chore(release): prepare $RELEASE_TAG"
+          git commit --no-verify -m "chore(release): prepare $RELEASE_TAG"
           git push origin HEAD:main
 
   announce_discord:
 
@@ -91,7 +91,7 @@ The most common defect in this repo is a change that works on the path you teste
 An empty database is a bad test. Seed your worktree's `.t3` with a copy of real data instead of pointing at live state:
 
 - The first `vp run dev` in a worktree does this for you when its database is missing and the source is at most 500 MiB. Larger sources warn and dev starts with an empty database. `--no-seed` or `T3CODE_DEV_SEED=0` skips seeding. Manual migration still accepts larger sources and may use substantial disk space before pruning.
-- Run `vp run migrate-dev-db` with your dev server stopped to refresh. It rebuilds `<worktree>/.t3/userdata/statev2.sqlite` from a read-only snapshot of `~/.t3/userdata/statev2.sqlite`, the developer's real data. It keeps recent projects and their stopped threads, and drops scheduled tasks, pending work, and auth sessions, so your dev server never runs the developer's agents. Raise `--projects` and `--threads-per-project` for more data.
+- Run `vp run migrate-dev-db` with your dev server stopped to refresh. It rebuilds `<worktree>/.t3/userdata/statev2.sqlite` from a read-only snapshot of `~/.t3/userdata/statev2.sqlite`, the developer's real data. It keeps recent projects and their stopped threads, and drops scheduled tasks, pending work, auth sessions, and links to other environments, so your dev server never runs the developer's agents or reaches their other machines. Raise `--projects` and `--threads-per-project` for more data.
 - Refresh `statev2.sqlite`, not `state.sqlite`. The server copies the V1 `state.sqlite` only when `statev2.sqlite` is missing.
 - Bring `secrets` and `settings.json` only if the flow under test needs them.
 - Copy in, never symlink. Data flows one way: into your sandbox, never back out.
 
@@ -1,3 +1,35 @@
+!include "StrFunc.nsh"
+!ifdef BUILD_UNINSTALLER
+  ${UnStrRep}
+  !define T3StrRep '${UnStrRep}'
+!else
+  ${StrRep}
+  !define T3StrRep '${StrRep}'
+!endif
+
+!macro customAppRunningMessages
+  Push $0
+  Push $1
+  ${If} $IsPowerShellAvailable == 0
+    System::Call 'kernel32::SetEnvironmentVariable(t "T3CODE_INSTALL_DIR", t "$INSTDIR")'
+    nsExec::ExecToStack `"$PowerShellPath" -NoProfile -NonInteractive -C "Get-CimInstance -ClassName Win32_Process | Where-Object { $$_.ExecutablePath -and [IO.Path]::GetDirectoryName($$_.ExecutablePath) -eq $$env:T3CODE_INSTALL_DIR } | ForEach-Object { [IO.Path]::GetFileNameWithoutExtension($$_.ExecutablePath) } | Where-Object { $$_ -in 'T3 Code (Alpha)', 'T3 Code (Beta)', 'T3 Code (Nightly)' } | Select-Object -First 1 | ForEach-Object { [Console]::Write($$_) }"`
+    Pop $0
+    Pop $1
+    System::Call 'kernel32::SetEnvironmentVariable(t "T3CODE_INSTALL_DIR", p 0)'
+    ${If} $0 == 0
+      ${If} $1 == "T3 Code (Alpha)"
+      ${OrIf} $1 == "T3 Code (Beta)"
+      ${OrIf} $1 == "T3 Code (Nightly)"
+        ${T3StrRep} $appRunningMessage $appRunningMessage "${PRODUCT_NAME}" $1
+        ${T3StrRep} $appClosingMessage $appClosingMessage "${PRODUCT_NAME}" $1
+        ${T3StrRep} $appCannotBeClosedMessage $appCannotBeClosedMessage "${PRODUCT_NAME}" $1
+      ${EndIf}
+    ${EndIf}
+  ${EndIf}
+  Pop $1
+  Pop $0
+!macroend
+
 !macro customInstall
   !ifndef DO_NOT_CREATE_START_MENU_SHORTCUT
     ${IfNot} ${FileExists} "$newStartMenuLink"
 
@@ -0,0 +1,189 @@
+// @effect-diagnostics nodeBuiltinImport:off -- These tests assert real POSIX modes on a temporary directory.
+import * as NodeFS from "node:fs";
+import * as NodeOS from "node:os";
+import * as NodePath from "node:path";
+import { assert, describe, it } from "@effect/vitest";
+import { vi } from "vite-plus/test";
+
+vi.mock("node:fs", { spy: true });
+
+import { openClerkTokenStorage, type ClerkTokenStorage } from "./ClerkTokenStore.ts";
+
+// oxlint-disable-next-line t3code/no-global-process-runtime -- Unix mode bits are the assertion; Windows reports them through ACLs.
+const describePosix = describe.skipIf(process.platform === "win32");
+
+const modeOf = (path: string): number => NodeFS.statSync(path).mode & 0o777;
+
+function writeLoose(path: string, contents: string): void {
+  NodeFS.writeFileSync(path, contents, { mode: 0o666 });
+  NodeFS.chmodSync(path, 0o666);
+}
+
+async function withStateDir(run: (stateDir: string) => Promise<void> | void): Promise<void> {
+  const stateDir = NodeFS.mkdtempSync(NodePath.join(NodeOS.tmpdir(), "t3-clerk-tokens-"));
+  try {
+    await run(stateDir);
+  } finally {
+    NodeFS.rmSync(stateDir, { recursive: true, force: true });
+  }
+}
+
+const idleStorage = (): ClerkTokenStorage => ({
+  getItem: async () => null,
+  setItem: async () => undefined,
+  removeItem: () => undefined,
+});
+
+describePosix("ClerkTokenStore", () => {
+  it("keeps clerk tokens at 0600 inside a 0700 directory", async () => {
+    await withStateDir(async (stateDir) => {
+      NodeFS.chmodSync(stateDir, 0o755);
+      const directory = NodePath.join(stateDir, "clerk");
+      const legacyPath = NodePath.join(stateDir, "clerk-tokens.json");
+      const tokenPath = NodePath.join(directory, "clerk-tokens.json");
+      NodeFS.mkdirSync(directory, { mode: 0o755 });
+      NodeFS.chmodSync(directory, 0o755);
+      writeLoose(legacyPath, '{"__clerk_client_jwt":"enc:existing"}\n');
+
+      const opened: string[] = [];
+      const storage = openClerkTokenStorage(stateDir, (cwd) => {
+        opened.push(cwd);
+        return {
+          getItem: async () => {
+            writeLoose(tokenPath, "from-get");
+            return "from-get";
+          },
+          setItem: (_key, value) => {
+            writeLoose(tokenPath, value);
+          },
+          removeItem: () => {
+            NodeFS.rmSync(tokenPath, { force: true });
+          },
+        };
+      });
+
+      assert.deepEqual(opened, [directory]);
+      assert.equal(modeOf(stateDir), 0o755);
+      assert.equal(modeOf(directory), 0o700);
+      assert.equal(modeOf(tokenPath), 0o600);
+      assert.equal(NodeFS.existsSync(legacyPath), false);
+      assert.equal(
+        NodeFS.readFileSync(tokenPath, "utf8"),
+        '{"__clerk_client_jwt":"enc:existing"}\n',
+      );
+
+      assert.equal(await storage.getItem("client"), "from-get");
+      assert.equal(modeOf(tokenPath), 0o600);
+      await storage.setItem("client", "from-set");
+      assert.equal(modeOf(tokenPath), 0o600);
+      assert.equal(NodeFS.readFileSync(tokenPath, "utf8"), "from-set");
+      storage.removeItem("client");
+      assert.equal(NodeFS.existsSync(tokenPath), false);
+
+      writeLoose(tokenPath, "kept");
+      writeLoose(legacyPath, "stale");
+      NodeFS.chmodSync(directory, 0o755);
+      openClerkTokenStorage(stateDir, () => idleStorage());
+      assert.equal(modeOf(directory), 0o700);
+      assert.equal(modeOf(tokenPath), 0o600);
+      assert.equal(NodeFS.existsSync(legacyPath), false);
+      assert.equal(NodeFS.readFileSync(tokenPath, "utf8"), "kept");
+    });
+  });
+
+  it("removes the legacy token file when the private copy already exists", async () => {
+    await withStateDir((stateDir) => {
+      const directory = NodePath.join(stateDir, "clerk");
+      const legacyPath = NodePath.join(stateDir, "clerk-tokens.json");
+      const tokenPath = NodePath.join(directory, "clerk-tokens.json");
+      NodeFS.mkdirSync(directory, { mode: 0o755 });
+      writeLoose(legacyPath, "stale-credential");
+      writeLoose(tokenPath, "kept-credential");
+
+      openClerkTokenStorage(stateDir, () => idleStorage());
+
+      assert.equal(NodeFS.existsSync(legacyPath), false);
+      assert.equal(modeOf(directory), 0o700);
+      assert.equal(modeOf(tokenPath), 0o600);
+      assert.equal(NodeFS.readFileSync(tokenPath, "utf8"), "kept-credential");
+    });
+  });
+
+  it("resolves a relative state directory before opening storage", async () => {
+    await withStateDir(async (stateDir) => {
+      const relativeStateDir = NodePath.relative(process.cwd(), stateDir);
+      const opened: string[] = [];
+      openClerkTokenStorage(relativeStateDir, (directory) => {
+        opened.push(directory);
+        return idleStorage();
+      });
+
+      const directory = NodePath.join(stateDir, "clerk");
+      assert.equal(NodePath.isAbsolute(relativeStateDir), false);
+      assert.deepEqual(opened, [directory]);
+      assert.equal(modeOf(directory), 0o700);
+    });
+  });
+
+  it("migrates relative state paths from Electron userData, not the working directory", async () => {
+    await withStateDir((stateDir) => {
+      const relativeStateDir = NodePath.relative(process.cwd(), stateDir);
+      const userData = NodePath.join(
+        stateDir,
+        "electron",
+        ...relativeStateDir.split(NodePath.sep).map(() => "profile"),
+      );
+      const legacyStateDir = NodePath.join(userData, relativeStateDir);
+      const legacyPath = NodePath.join(legacyStateDir, "clerk-tokens.json");
+      NodeFS.mkdirSync(legacyStateDir, { recursive: true });
+      writeLoose(legacyPath, "existing-session");
+      const unrelatedPath = NodePath.join(stateDir, "clerk-tokens.json");
+      writeLoose(unrelatedPath, "not-the-electron-session");
+
+      openClerkTokenStorage(relativeStateDir, idleStorage, userData);
+
+      const tokenPath = NodePath.join(stateDir, "clerk", "clerk-tokens.json");
+      assert.equal(NodeFS.readFileSync(tokenPath, "utf8"), "existing-session");
+      assert.equal(modeOf(tokenPath), 0o600);
+      assert.equal(NodeFS.existsSync(legacyPath), false);
+      assert.equal(NodeFS.readFileSync(unrelatedPath, "utf8"), "not-the-electron-session");
+    });
+  });
+
+  it("migrates tokens when the legacy directory is on another filesystem", async () => {
+    await withStateDir((stateDir) => {
+      const legacyPath = NodePath.join(stateDir, "clerk-tokens.json");
+      writeLoose(legacyPath, "existing-session");
+      using _rename = vi.spyOn(NodeFS, "renameSync").mockImplementation(() => {
+        throw Object.assign(new Error("cross-device link"), { code: "EXDEV" });
+      });
+
+      openClerkTokenStorage(stateDir, idleStorage);
+
+      const tokenPath = NodePath.join(stateDir, "clerk", "clerk-tokens.json");
+      assert.equal(NodeFS.readFileSync(tokenPath, "utf8"), "existing-session");
+      assert.equal(modeOf(tokenPath), 0o600);
+      assert.equal(NodeFS.existsSync(legacyPath), false);
+    });
+  });
+
+  it("does not follow a symlinked clerk directory or token file", async () => {
+    await withStateDir(async (stateDir) => {
+      const outsideDirectory = NodePath.join(stateDir, "outside-dir");
+      NodeFS.mkdirSync(outsideDirectory, { mode: 0o755 });
+      NodeFS.chmodSync(outsideDirectory, 0o755);
+      NodeFS.symlinkSync(outsideDirectory, NodePath.join(stateDir, "clerk"));
+
+      assert.throws(() => openClerkTokenStorage(stateDir, idleStorage), /must be a real directory/);
+      assert.equal(modeOf(outsideDirectory), 0o755);
+      NodeFS.unlinkSync(NodePath.join(stateDir, "clerk"));
+
+      const outsideFile = NodePath.join(stateDir, "outside.json");
+      NodeFS.writeFileSync(outsideFile, "secret", { mode: 0o644 });
+      NodeFS.chmodSync(outsideFile, 0o644);
+      NodeFS.symlinkSync(outsideFile, NodePath.join(stateDir, "clerk-tokens.json"));
+      assert.throws(() => openClerkTokenStorage(stateDir, idleStorage), /must be a regular file/);
+      assert.equal(modeOf(outsideFile), 0o644);
+    });
+  });
+});
@@ -0,0 +1,117 @@
+// @effect-diagnostics nodeBuiltinImport:off -- The Clerk bridge must lock the token file down before startup can yield to Electron's ready event.
+import * as NodeFS from "node:fs";
+import * as NodePath from "node:path";
+
+// electron-store chmods every write to 0666; the private directory protects tokens during writes.
+const CLERK_TOKEN_DIRECTORY_MODE = 0o700;
+const CLERK_TOKEN_FILE_MODE = 0o600;
+const CLERK_TOKEN_DIRECTORY_NAME = "clerk";
+const CLERK_TOKEN_FILE_NAME = "clerk-tokens.json";
+
+type Awaitable<T> = T | Promise<T>;
+
+export interface ClerkTokenStorage {
+  readonly getItem: (key: string) => Awaitable<string | null>;
+  readonly setItem: (key: string, value: string) => Awaitable<void>;
+  readonly removeItem: (key: string) => Awaitable<void>;
+}
+
+function isErrno(error: unknown, code: string): boolean {
+  return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+
+function lstatIfExists(path: string): NodeFS.Stats | undefined {
+  try {
+    return NodeFS.lstatSync(path);
+  } catch (error) {
+    if (isErrno(error, "ENOENT")) return undefined;
+    throw error;
+  }
+}
+
+function assertRegularFile(path: string, stat: NodeFS.Stats): void {
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    throw new Error(`Clerk token file "${path}" must be a regular file.`);
+  }
+}
+
+function restrictClerkTokenFile(path: string): void {
+  const stat = lstatIfExists(path);
+  if (stat === undefined) return;
+  assertRegularFile(path, stat);
+  if ((stat.mode & 0o777) === CLERK_TOKEN_FILE_MODE) return;
+  NodeFS.chmodSync(path, CLERK_TOKEN_FILE_MODE);
+}
+
+function migrateLegacyClerkTokenFile(stateDir: string, directory: string): void {
+  const legacyPath = NodePath.join(stateDir, CLERK_TOKEN_FILE_NAME);
+  const tokenPath = NodePath.join(directory, CLERK_TOKEN_FILE_NAME);
+  const legacy = lstatIfExists(legacyPath);
+  if (legacy !== undefined) {
+    assertRegularFile(legacyPath, legacy);
+    NodeFS.chmodSync(legacyPath, CLERK_TOKEN_FILE_MODE);
+  }
+
+  const destination = lstatIfExists(tokenPath);
+  if (destination === undefined) {
+    if (legacy === undefined) return;
+    try {
+      NodeFS.copyFileSync(legacyPath, tokenPath, NodeFS.constants.COPYFILE_EXCL);
+      NodeFS.chmodSync(tokenPath, CLERK_TOKEN_FILE_MODE);
+      NodeFS.unlinkSync(legacyPath);
+    } catch (error) {
+      if (!isErrno(error, "ENOENT")) throw error;
+    }
+    return;
+  }
+
+  assertRegularFile(tokenPath, destination);
+  NodeFS.chmodSync(tokenPath, CLERK_TOKEN_FILE_MODE);
+  if (legacy === undefined) return;
+  try {
+    NodeFS.unlinkSync(legacyPath);
+  } catch (error) {
+    if (!isErrno(error, "ENOENT")) throw error;
+  }
+}
+
+function restrictAfter<T>(run: () => Awaitable<T>, tighten: () => void): Awaitable<T> {
+  let result: Awaitable<T>;
+  try {
+    result = run();
+  } catch (error) {
+    tighten();
+    throw error;
+  }
+  if (result instanceof Promise) return result.finally(tighten);
+  tighten();
+  return result;
+}
+
+/** Opens Clerk token storage in a private directory and keeps the file at `0600`. */
+export function openClerkTokenStorage(
+  stateDir: string,
+  createStorage: (directory: string) => ClerkTokenStorage,
+  userDataPath = ".",
+): ClerkTokenStorage {
+  const absoluteStateDir = NodePath.resolve(stateDir);
+  const directory = NodePath.join(absoluteStateDir, CLERK_TOKEN_DIRECTORY_NAME);
+  NodeFS.mkdirSync(directory, { recursive: true, mode: CLERK_TOKEN_DIRECTORY_MODE });
+  const stat = NodeFS.lstatSync(directory);
+  if (stat.isSymbolicLink() || !stat.isDirectory()) {
+    throw new Error(`Clerk token directory "${directory}" must be a real directory.`);
+  }
+  NodeFS.chmodSync(directory, CLERK_TOKEN_DIRECTORY_MODE);
+  // electron-store rebases relative paths under Electron userData, not the working directory.
+  migrateLegacyClerkTokenFile(NodePath.resolve(userDataPath, stateDir), directory);
+  const tokenPath = NodePath.join(directory, CLERK_TOKEN_FILE_NAME);
+  restrictClerkTokenFile(tokenPath);
+
+  const storage = createStorage(directory);
+  const tighten = () => restrictClerkTokenFile(tokenPath);
+  return {
+    getItem: (key) => restrictAfter(() => storage.getItem(key), tighten),
+    setItem: (key, value) => restrictAfter(() => storage.setItem(key, value), tighten),
+    removeItem: (key) => restrictAfter(() => storage.removeItem(key), tighten),
+  };
+}