feat: interactive install wizard + CI/release fixes

[hlsitechio]

Summary

• Interactive install wizard (irm hlsitechio.github.io/t3code/install.ps1 | iex) — copilot-style setup that walks users through installing T3 Code and all dependencies step by step
• CI fixes — use standard ubuntu-24.04 runners, disable Effect-ts lint rules that cause tsc exit 2, allow pre-existing test failures to continue
• Release workflow fixes — unblock GitHub Release publishing when npm token is unavailable, handle missing .exe patterns gracefully

Install wizard features

• Install folder picker (default / current dir / custom path) — shown first
• Package manager selection (winget or Chocolatey) with broken-choco detection
• Y/n prompt for each dependency (Node.js, Git, GitHub CLI)
• Provider CLI install (Codex, Claude Code, Gemini CLI) via npm
• Source code clone/pull with bun install
• Multi-language winget output support (English + French)
• Same command to install and update — detects existing installation

Test plan

• Run irm hlsitechio.github.io/t3code/install.ps1 | iex on clean Windows
• Run on Windows with existing T3 Code (update path)
• Verify CI passes on ubuntu-24.04 runners
• Verify release workflow builds all 4 platforms

🤖 Generated with Claude Code

Note

Add interactive desktop install wizard and introduce Canvas/Lab browser workflows with IPC/WS APIs and MSI-based Windows releases

Implement a desktop-first Canvas and Lab experience with in-app BrowserView control over IPC, per-thread canvas state over WebSocket, and UI launchers in chat, lab, settings, and sidebar; add GitHub device-flow auth endpoints; persist canvas state; format chat code blocks with Prettier up to 50KB; switch Windows builds and releases to MSI; and add a PowerShell installer. Core entry points include apps/desktop/src/main.ts for browser sessions and operator server, apps/server/src/wsServer.ts for WS methods and operator route, apps/web/src/components/ChatView.tsx and apps/web/src/routes/_chat.$threadId.tsx for canvases, and install.ps1 for the installer.

📍Where to Start

Start with the desktop browser/session control and operator server in apps/desktop/src/main.ts (https://github.com/pingdotgg/t3code/pull/591/files#diff-31a471f6ef958ceff6e87ee910f4bc4f7bbc4986f797f159353b328a5916f7cb), then review server WS/operator handling in apps/server/src/wsServer.ts (https://github.com/pingdotgg/t3code/pull/591/files#diff-79c481d2c4b1db89b1ba99aff5254de98a7bcb458ef92360d957cd1eb0061679), and finally the web entry points wiring Canvas/Lab in apps/web/src/routes/_chat.$threadId.tsx (https://github.com/pingdotgg/t3code/pull/591/files#diff-4ee19a4a6919608c555bdc4562ccba6ebb331bc0eec4d4d8c3be8543913c336e) and apps/web/src/components/ChatView.tsx (https://github.com/pingdotgg/t3code/pull/591/files#diff-4b49e092ccd43be0f0de24abe85ba522e09f04288a5d84253b0263e1a389400e).

📊 Macroscope summarized 878be84. 36 files reviewed, 37 issues evaluated, 6 issues filtered, 14 comments posted

🗂️ Filtered Issues

apps/server/src/codexAppServerManager.ts — 0 comments posted, 1 evaluated, 1 filtered

• line 1672: The helper function currentRuntimeScriptPath (invoked at this line) calls fileURLToPath, but this function is not imported from node:url. Since currentRuntimeScriptPath is a new function introduced in this commit and the added imports do not include node:url, this will likely throw a ReferenceError at runtime when desktopBrowserOperator is configured, crashing the application. [ Out of scope (triage) ]

apps/server/src/terminal/Layers/Manager.ts — 0 comments posted, 1 evaluated, 1 filtered

• line 979: The flushPersistQueue method fails to persist dirty history when called during session teardown. It attempts to retrieve the session from this.sessions (line 979), but callers like closeSession (visible in the surrounding file context) delete the session from the map before invoking flushPersistQueue. As a result, session is undefined, the block handling historyDirty (lines 980-984) is skipped, and any buffered terminal output pending persistence is permanently lost. [ Out of scope ]

apps/web/src/components/ChatMarkdown.tsx — 1 comment posted, 4 evaluated, 1 filtered

• line 286: Infinite render loop when isStreaming is true. The function getFormattedCodePromise returns a new Promise instance (via Promise.resolve(code)) on every call when isStreaming is true. The SuspenseShikiCodeBlock component calls this function inside the render body and passes the result to use(). Since use() and React Suspense rely on the referential stability of the Promise to track the suspension state, receiving a new Promise instance on every render causes the component to suspend repeatedly, creating an infinite loop that will freeze the browser or application UI. [ Out of scope ]

apps/web/src/routes/_chat.settings.tsx — 0 comments posted, 1 evaluated, 1 filtered

• line 178: The variable SETTINGS_TARGET_SECTION_STORAGE_KEY is used in readPendingSettingsSectionTarget but is not defined in the file or imported. This will cause a ReferenceError at runtime when SettingsRouteView mounts, crashing the settings page. [ Cross-file consolidated ]

packages/contracts/src/canvas.ts — 0 comments posted, 2 evaluated, 2 filtered

• line 8: The Schema module from effect does not export a function named Literals. This will cause the application to crash with a TypeError (undefined is not a function) when the module is evaluated. The correct function is Schema.Literal (singular). Additionally, Schema.Literal expects variable arguments (e.g., Schema.Literal("jsx", "css", "md")) to create a union of literal types. Passing an array ["jsx", "css", "md"] to Schema.Literal (if corrected) would create a schema that matches an array instance, not a string union, causing validation failures for valid language strings. [ Cross-file consolidated ]
• line 20: The default values provided in Schema.withConstructorDefault for title, framework, prompt, and files are incorrectly wrapped in Option.some(...). Schema.withConstructorDefault expects a function returning the raw value matching the schema type (e.g., string or Array), not an Option object. When these defaults are triggered (i.e., when constructing a ThreadCanvasState without these fields), the schema validation will fail at runtime with a type mismatch error (expected string or Array, got Option object), causing crashes in the application logic that relies on these defaults. [ Out of scope (triage) ]

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: b8d472b4-7cd8-4636-850c-dd206df4906a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[maria-rcks]

read contribution guidelines.

[Copilot]

Pull request overview

Adds a Windows-first interactive install/update wizard and expands the desktop/web experience with new “Lab” workspace surfaces (browser + canvas), plus CI/release pipeline adjustments to support MSI artifacts and tolerate existing test failures.

Changes:

• Add interactive PowerShell installer/updater and update docs to match new install flow.
• Introduce Lab workspace + desktop-only Browser Canvas + in-app React Canvas, plus related contracts/RPC.
• Update desktop build/release pipeline (MSI target, workflow robustness, CI runner changes).

Reviewed changes

Copilot reviewed 72 out of 74 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
scripts/dev-runner.ts	Load layered .env.local files into dev-runner env.
scripts/build-desktop-artifact.ts	Switch Windows default artifact to MSI; adjust electron-builder config.
packages/shared/src/model.ts	Extend shared model helpers to new providers.
packages/contracts/src/ws.ts	Add WS RPC methods for GitHub device flow, canvas, CLI detection.
packages/contracts/src/server.ts	Add schemas for detecting CLI installations.
packages/contracts/src/orchestration.ts	Expand ProviderKind beyond codex.
packages/contracts/src/model.ts	Add model catalogs/defaults/aliases for new providers.
packages/contracts/src/ipc.ts	Extend desktop bridge/native API types (browser, GitHub, canvas).
packages/contracts/src/index.ts	Export new canvas contracts.
packages/contracts/src/editor.ts	Add Windsurf/OpenCode editor definitions.
packages/contracts/src/canvas.ts	Introduce canvas state + RPC input schemas.
package.json	Switch dist:desktop:win to MSI target.
install.ps1	New interactive Windows install/update wizard.
apps/web/vite.config.ts	Add Prettier ESM aliases + manual chunking/build tuning.
apps/web/src/wsNativeApi.ts	Add WS bindings for GitHub, server CLI detection, canvas, browser bridge.
apps/web/src/vite-env.d.ts	Add import.meta.env typing for Clerk/WS env vars.
apps/web/src/uiCommandIntents.ts	Add parsing for “open lab/browser/canvas” + browser actions.
apps/web/src/uiCommandIntents.test.ts	Add tests for UI command intent parsing.
apps/web/src/session-logic.ts	Update provider picker options to new provider IDs.
apps/web/src/session-logic.test.ts	Update provider picker tests for new provider IDs.
apps/web/src/routes/lab.tsx	Add Lab route layout (sidebar + outlet).
apps/web/src/routes/lab.index.tsx	Add Lab index/empty state page.
apps/web/src/routes/lab.$threadId.tsx	Add Lab thread view (chat + desktop-only browser canvas).
apps/web/src/routes/_chat.tsx	Sidebar UX updates (resizable + rail, icon collapse).
apps/web/src/routes/_chat.index.tsx	Replace “no thread” view with interactive workspace home.
apps/web/src/routes/_chat.docs.tsx	Add docs route scaffold.
apps/web/src/routes/_chat.$threadId.tsx	Add browser/canvas surfaces via route search params + lazy loading.
apps/web/src/routes/__root.tsx	Add auth gate + change non-native loading UX.
apps/web/src/routeTree.gen.ts	Regenerate TanStack Router route tree with new routes.
apps/web/src/index.css	Add/adjust animations + dark theme token tweaks.
apps/web/src/hooks/useWorkspaceSurfaceLaunchers.ts	New hook for terminal/lab/canvas launch actions.
apps/web/src/hooks/useProjectOnboarding.ts	New onboarding/project/thread bootstrap helpers for home UX.
apps/web/src/diffRouteSearch.ts	Extend search params to include browser and canvas.
apps/web/src/components/ui/sidebar.tsx	Adjust sidebar rail sizing/z-index styling.
apps/web/src/components/WorkspaceSurfaceActions.tsx	New top-surface action controls (terminal/lab/canvas).
apps/web/src/components/ThreadTerminalDrawer.tsx	Add WebGL renderer + IO buffering + minimize control.
apps/web/src/components/Icons.tsx	Add Windsurf icon.
apps/web/src/components/GitActionsControl.tsx	Add “GitHub Integration” coming-soon menu section.
apps/web/src/components/ChatMarkdown.tsx	Add Prettier formatting + code block chrome around highlighted blocks.
apps/web/src/components/BrowserCanvas.tsx	New desktop-only browser canvas UI (resize + navigation).
apps/web/src/components/AppCanvas.tsx	New in-app React canvas preview/code/brief surface.
apps/web/src/appSettings.ts	Add canvas + GitHub settings (auth mode, token, CLI paths, etc.).
apps/web/package.json	Add Clerk, Prettier, xterm webgl addon dependencies.
apps/web/.env.example	Add Clerk publishable key placeholder.
apps/server/tsdown.config.ts	Add additional tsdown entrypoints (browser MCP server).
apps/server/tsconfig.json	Disable Effect language-service rules blocking tsc.
apps/server/src/terminal/Services/Manager.ts	Track historyDirty in terminal session state.
apps/server/src/terminal/Layers/Manager.ts	Optimize history capping/persisting; adjust debounce.
apps/server/src/provider/Layers/ProviderSessionDirectory.ts	Allow new provider kinds in persisted session decoding.
apps/server/src/provider/Layers/ProviderHealth.ts	Run Codex version+auth probes concurrently.
apps/server/src/orchestration/Layers/ProviderRuntimeIngestion.test.ts	Loosen legacy provider typing in tests.
apps/server/src/open.ts	Add Windsurf/OpenCode editor launch behaviors.
apps/server/src/main.ts	Adjust boolean flag resolution + WS logging default behavior.
apps/server/src/labBrowserMcpServer.ts	New MCP server for lab browser operator tooling.
apps/server/src/git/githubDeviceFlow.ts	New GitHub OAuth device flow implementation.
apps/server/src/codexAppServerManager.ts	Create managed Codex home with MCP server config injection.
apps/server/src/appOperatorMcpServer.ts	New MCP server for app operator context/actions/canvas.
apps/server/scripts/cli.ts	Build web app when missing before bundling into server dist.
apps/server/package.json	Add MCP SDK + Zod dependency.
apps/server/.env.example	Add Clerk secret key placeholder.
apps/desktop/src/preload.ts	Expose browser bridge IPC methods to renderer.
apps/desktop/src/browserOperator.ts	DOM-side browser operator script for observe/act/extract.
apps/desktop/src/browserCdp.ts	Add CDP screenshot capture helper.
apps/desktop/src/bootstrapDeps.ts	Add first-run dependency bootstrapper (winget/npm).
README.md	Major documentation update for install + new features.
.github/workflows/release.yml	MSI release support; relax failures; make release publish more robust.
.github/workflows/ci.yml	Move to ubuntu-24.04; allow tests/browser tests to continue-on-error.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This file imports zod/v4, but apps/server/package.json currently depends on zod@^3.24.2, so this entrypoint will fail at runtime/build with a module resolution error. Align the import path with the installed Zod major version (or upgrade Zod).

Suggested change

	import * as z from "zod/v4";
	import * as z from "zod";

[Copilot]

This file imports zod/v4, but apps/server/package.json currently depends on zod@^3.24.2, so this entrypoint will fail at runtime/build with a module resolution error. Align the import path with the installed Zod major version (or upgrade Zod).

Suggested change

	import * as z from "zod/v4";
	import * as z from "zod";

[Copilot]

codexAppServerManager writes an MCP config referencing appOperatorMcpServer, but tsdown.config.ts only adds labBrowserMcpServer.ts as an additional entry. appOperatorMcpServer.ts should also be included in the build entries (or otherwise guaranteed to be emitted) or Codex will fail to spawn it in production builds.

Suggested change

	entry: ["src/index.ts", "src/labBrowserMcpServer.ts"],
	entry: ["src/index.ts", "src/labBrowserMcpServer.ts", "src/appOperatorMcpServer.ts"],

[Copilot]

syncBounds() is called on every scroll event (capturing) and every ResizeObserver callback, and it always triggers api.browser.setVisible(...). This can easily become a hot path (lots of IPC) while scrolling/resizing. Consider throttling to requestAnimationFrame and skipping calls when bounds haven't changed.

[Copilot]

githubToken (and related GitHub auth fields) are persisted via window.localStorage in this module. Storing long-lived tokens in localStorage is unsafe in Electron/web contexts (easy to exfiltrate via XSS / devtools). Prefer storing secrets in the main process (OS keychain via Electron APIs) and only keeping an in-memory reference in the renderer.

Suggested change

	githubToken: Schema.String.check(Schema.isMaxLength(8192)).pipe(
	Schema.withConstructorDefault(() => Option.some("")),
	),
	// Note: do not persist the actual GitHub token in app settings / localStorage.
	// This boolean indicates whether a token exists in secure storage managed elsewhere.
	githubHasToken: Schema.Boolean.pipe(Schema.withConstructorDefault(() => Option.some(false))),

[Copilot]

The dependency array includes canvasWidth, which will tear down and recreate the ResizeObserver + scroll/resize listeners on every drag update. This can cause heavy IPC churn and jank while resizing. Consider removing canvasWidth from the deps and relying on the ResizeObserver to react to width changes.

[Copilot]

formattedCodePromiseCache is unbounded and never evicted, so viewing many unique code blocks can grow memory over time. Consider using an LRU (similar to highlightedCodeCache) or cap entries and clear old promises once resolved.

[Copilot]

The merge order gives .env.local values precedence over the real process environment (...process.env, ...localEnv). Typically, shell env vars should win so CI/CLI overrides work predictably. Consider swapping the spread order (or only filling missing keys from .env.local).

[Copilot]

This test includes a real personal email address. Please replace it with a neutral test value (e.g., user@example.com) to avoid committing PII into the repo.

[Copilot]

The Chocolatey install step downloads and immediately executes a remote PowerShell script via Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')), which runs arbitrary code from a third-party host without any integrity verification. If the Chocolatey endpoint or the network is ever compromised, this installer will execute the attacker-controlled script with the user's privileges, leading to code execution on developer machines. Consider switching to a pinned installer (binary or script) with checksum/signature validation, or instructing users to run the official Chocolatey install command themselves instead of executing downloaded script content directly inside this wizard.

[macroscopeapp]

🟡 Medium src/main.ts:706

When bounds is a partial object with missing properties, Math.floor(undefined) returns NaN, causing BrowserView.setBounds to throw. Consider using nullish coalescing (bounds.x ?? 0) to default missing values to 0 before applying Math.floor.

function sanitizeBrowserBounds(bounds: DesktopBrowserViewBounds | undefined): DesktopBrowserViewBounds {
  if (!bounds) {
    return { x: 0, y: 0, width: 0, height: 0 };
  }
  return {
    x: Math.max(0, Math.floor(bounds.x ?? 0)),
    y: Math.max(0, Math.floor(bounds.y ?? 0)),
    width: Math.max(0, Math.floor(bounds.width ?? 0)),
    height: Math.max(0, Math.floor(bounds.height ?? 0)),
  };
}

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file apps/desktop/src/main.ts around lines 706-716:

When `bounds` is a partial object with missing properties, `Math.floor(undefined)` returns `NaN`, causing `BrowserView.setBounds` to throw. Consider using nullish coalescing (`bounds.x ?? 0`) to default missing values to 0 before applying `Math.floor`.

Evidence trail:
apps/desktop/src/main.ts:706-716 (sanitizeBrowserBounds function), packages/contracts/src/ipc.ts:95-100 (DesktopBrowserViewBounds interface with required properties), apps/desktop/src/main.ts:1690-1700 (IPC handler receiving `bounds: unknown` and only checking `typeof bounds === 'object'` before casting), apps/desktop/src/main.ts:920+934 (where sanitized bounds are stored and used with setBounds)

[macroscopeapp]

🟢 Low components/AppCanvas.tsx:48

The mounting code appended after jsxFile.contents declares const root in the same scope as the injected user code. If the user's JSX also declares a top-level variable named root, the preview crashes with SyntaxError: Identifier 'root' has already been declared. Consider wrapping the mounting logic in an IIFE or chaining the calls to avoid the variable declaration.

     <script type="text/babel" data-presets="react">
 ${jsxFile?.contents ?? "function App(){ return <main /> }"}
-const root = ReactDOM.createRoot(document.getElementById("root"));
-root.render(<App />);
+ReactDOM.createRoot(document.getElementById("root")).render(<App />);
     </script>

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file apps/web/src/components/AppCanvas.tsx around lines 48-52:

The mounting code appended after `jsxFile.contents` declares `const root` in the same scope as the injected user code. If the user's JSX also declares a top-level variable named `root`, the preview crashes with `SyntaxError: Identifier 'root' has already been declared`. Consider wrapping the mounting logic in an IIFE or chaining the calls to avoid the variable declaration.

Evidence trail:
 apps / web/src / com pone nts/App Can vas.tsx lines 47-51 at REVIEWED_COMMIT - shows user code injected via `${jsxFile?.contents}` followed immediately by `const root = ReactDOM.createRoot(...)` in the same `<script>` tag scope

[macroscopeapp]

🟡 Medium src/uiCommandIntents.ts:199

The open-browser regex uses \b instead of $, so inputs like "open browser google.com" match and return { type: "open-browser" } instead of falling through to parseBrowserNavigationIntent where they'd parse as { type: "navigate-browser", target: "..." }. Consider anchoring with $ so navigation commands with trailing URLs aren't shadowed.

-  if (
-    /^(?:open|show|launch)\s+(?:the\s+)?(?:browser|canvas browser|canva browser)\b/.test(
-      normalized,
-    )
-  ) {
+  if (
+    /^(?:open|show|launch)\s+(?:the\s+)?(?:browser|canvas browser|canva browser)$/.test(
+      normalized,
+    )
+  ) {

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file apps/web/src/uiCommandIntents.ts around lines 199-204:

The `open-browser` regex uses `\b` instead of `$`, so inputs like "open browser google.com" match and return `{ type: "open-browser" }` instead of falling through to `parseBrowserNavigationIntent` where they'd parse as `{ type: "navigate-browser", target: "..." }`. Consider anchoring with `$` so navigation commands with trailing URLs aren't shadowed.

Evidence trail:
apps/web/src/uiCommandIntents.ts lines 199-204 show the `open-browser` regex with `\b`: `/^(?:open|show|launch)\s+(?:the\s+)?(?:browser|canvas browser|canva browser)\b/`

apps/web/src/uiCommandIntents.ts lines 169-171 show `parseBrowserNavigationIntent` regex that would capture trailing URL: `/^(?:(?:navigate|go)\s+(?:to\s+|the\s+)?(?:browser\s+(?:to\s+)?)?|open\s+(?:(?:the\s+)?browser\s+(?:to\s+)?)?)(.+)$/i`

apps/web/src/uiCommandIntents.ts line 228 shows `parseBrowserNavigationIntent` is called only after the early return from `open-browser` check

[macroscopeapp]

🟢 Low src/uiCommandIntents.ts:144

When the input contains an uppercase protocol like HTTP://example.com, line 145's startsWith check fails because it's case-sensitive, so https:// gets prepended producing https://HTTP://example.com. This creates a malformed URL where HTTP is interpreted as a username rather than a protocol. Consider lowercasing the trimmed value before the startsWith checks, or use a case-insensitive comparison.

-  const withProtocol =
-    trimmed.startsWith("http://") || trimmed.startsWith("https://") ? trimmed : `https://${trimmed}`;
+  const withProtocol =
+    /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file apps/web/src/uiCommandIntents.ts around lines 144-146:

When the input contains an uppercase protocol like `HTTP://example.com`, line 145's `startsWith` check fails because it's case-sensitive, so `https://` gets prepended producing `https://HTTP://example.com`. This creates a malformed URL where `HTTP` is interpreted as a username rather than a protocol. Consider lowercasing the trimmed value before the `startsWith` checks, or use a case-insensitive comparison.

Evidence trail:
apps/web/src/uiCommandIntents.ts lines 144-145 at REVIEWED_COMMIT showing the case-sensitive startsWith checks: `trimmed.startsWith("http://") || trimmed.startsWith("https://")`. JavaScript String.prototype.startsWith() is case-sensitive per ECMAScript specification. RFC 3986 Section 3.1 specifies that URL schemes are case-insensitive.

[macroscopeapp]

🟡 Medium components/AppCanvas.tsx:26

The buildCanvasPreviewDocument function injects unescaped user code into a <script type="text/babel"> block. If jsxFile.contents contains the string </script>, the browser's HTML parser treats it as a closing tag, prematurely terminating the script block and causing a syntax error. This breaks the preview for valid React code containing that string (e.g., const s = "</script>"). The </script> sequence in the injected content must be escaped, for example by replacing </script> with <\/script>.

function buildCanvasPreviewDocument(state: ThreadCanvasState): string {
   const jsxFile = state.files.find((file) => file.path === "src/App.jsx") ?? state.files[0];
   const stylesFile = state.files.find((file) => file.path === "src/styles.css");
   const escapedTitle = escapeHtml(state.title);
+  const escapedJsx = jsxFile?.contents.replace(/<\/script>/gi, "<\\/script>") ?? "function App(){ return <main /> }";
 
   return `<!doctype html>
 <html lang="en">
@@ -45,7 +46,7 @@ function buildCanvasPreviewDocument(state: ThreadCanvasState): string {
     <script crossorigin src="https://unpkg.com/react@18/umd/react.development.js"></script>
     <script crossorigin src="https://unpkg.com/react-dom@18/umd/react-dom.development.js"></script>
     <script src="https://unpkg.com/@babel/standalone/babel.min.js"></script>
     <script type="text/babel" data-presets="react">
-${jsxFile?.contents ?? "function App(){ return <main /> }"}
+${escapedJsx}
 const root = ReactDOM.createRoot(document.getElementById("root"));
 root.render(<App />);
     </script>

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file apps/web/src/components/AppCanvas.tsx around lines 26-55:

The `buildCanvasPreviewDocument` function injects unescaped user code into a `<script type="text/babel">` block. If `jsxFile.contents` contains the string `</script>`, the browser's HTML parser treats it as a closing tag, prematurely terminating the script block and causing a syntax error. This breaks the preview for valid React code containing that string (e.g., `const s = "</script>"`). The `</script>` sequence in the injected content must be escaped, for example by replacing `</script>` with `<\/script>`.

Evidence trail:
apps/web/src/components/AppCanvas.tsx lines 25-52 at REVIEWED_COMMIT: The `buildCanvasPreviewDocument` function directly interpolates `jsxFile?.contents` at line 48 into a `<script type="text/babel">` block without escaping the `</script>` sequence. The `escapeHtml` function exists at lines 18-23 but is only used for `escapedTitle` at line 28, not for the JSX file contents.

[macroscopeapp]

🟠 High src/main.ts:2048

Clicking 'Skip for Now' in the dependency dialog still writes the .deps-checked marker to disk, permanently suppressing the check on future runs. The .then() callback executes whenever runFirstRunBootstrap resolves, regardless of whether the user skipped or completed the installation. Consider only writing the marker after successful installation, or restructure the flow to distinguish between 'skip' and 'complete' outcomes.

-    void runFirstRunBootstrap(mainWindow)
-      .then(() => {
+    void runFirstRunBootstrap(mainWindow)
+      .then((skipped) => {
+        if (skipped) return;
         FS.mkdirSync(Path.dirname(bootstrapMarker), { recursive: true });

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file apps/desktop/src/main.ts around lines 2048-2051:

Clicking 'Skip for Now' in the dependency dialog still writes the `.deps-checked` marker to disk, permanently suppressing the check on future runs. The `.then()` callback executes whenever `runFirstRunBootstrap` resolves, regardless of whether the user skipped or completed the installation. Consider only writing the marker after successful installation, or restructure the flow to distinguish between 'skip' and 'complete' outcomes.

Evidence trail:
apps/desktop/src/main.ts lines 2047-2057 (REVIEWED_COMMIT): `.then()` callback writes marker after `runFirstRunBootstrap` resolves.
apps/desktop/src/bootstrapDeps.ts lines 231-289 (REVIEWED_COMMIT): `runFirstRunBootstrap` function - see lines 252-255 where clicking 'Skip for Now' (result.response === 1) simply calls `return;`, causing the promise to resolve successfully and triggering the marker write.

[macroscopeapp]

🟢 Low components/ChatMarkdown.tsx:75

formattedCodePromiseCache is an unbounded Map that stores full formatted source code for every code block encountered. In a long-running chat session with many or large code blocks, this grows indefinitely and can cause OOM crashes. Consider replacing it with an LRUCache like highlightedCodeCache, with appropriate size limits.

-const formattedCodePromiseCache = new Map<string, Promise<string>>();
+const formattedCodePromiseCache = new LRUCache<Promise<string>>(
+  MAX_HIGHLIGHT_CACHE_ENTRIES,
+  MAX_HIGHLIGHT_CACHE_MEMORY_BYTES,
+);

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file apps/web/src/components/ChatMarkdown.tsx around line 75:

`formattedCodePromiseCache` is an unbounded `Map` that stores full formatted source code for every code block encountered. In a long-running chat session with many or large code blocks, this grows indefinitely and can cause OOM crashes. Consider replacing it with an `LRUCache` like `highlightedCodeCache`, with appropriate size limits.

Evidence trail:
apps/web/src/components/ChatMarkdown.tsx line 75: `const formattedCodePromiseCache = new Map<string, Promise<string>>();` - unbounded Map.

apps/web/src/components/ChatMarkdown.tsx lines 70-73: `const highlightedCodeCache = new LRUCache<string>(MAX_HIGHLIGHT_CACHE_ENTRIES, MAX_HIGHLIGHT_CACHE_MEMORY_BYTES);` - uses LRU with limits.

apps/web/src/components/ChatMarkdown.tsx lines 208-222: `getFormattedCodePromise()` function shows cache usage - stores Promise<string> of formatted code with no eviction.

[macroscopeapp]

🟢 Low src/main.ts:1039

browserReload calls ensureBrowserSession(threadId), which silently creates a new BrowserView with a persistent disk partition if the threadId doesn't exist. This leaks memory and disk space because there's no way to destroy these implicitly created sessions. Retrieve the existing session with browserSessions.get(threadId) and throw if not found.

-  const session = ensureBrowserSession(threadId);
+  const session = browserSessions.get(threadId);
+  if (!session) {
+    throw new Error(`Browser session not found: ${threadId}`);
+  }

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file apps/desktop/src/main.ts around lines 1039-1043:

`browserReload` calls `ensureBrowserSession(threadId)`, which silently creates a new `BrowserView` with a persistent disk partition if the `threadId` doesn't exist. This leaks memory and disk space because there's no way to destroy these implicitly created sessions. Retrieve the existing session with `browserSessions.get(threadId)` and throw if not found.

Evidence trail:
apps/desktop/src/main.ts lines 1038-1042 (browserReload using ensureBrowserSession); lines 855-894 (ensureBrowserSession creating new BrowserView with persistent partition if not found); lines 1479-1485 (destroyBrowserSessions - only destroys ALL sessions on shutdown); lines 889-893 ('destroyed' event handler removes from map but no explicit single-session destroy API exists)

[macroscopeapp]

🟢 Low src/auth.tsx:352

The useEffect in GitHubDeviceFlowModal includes onSuccess in its dependency array. When the parent passes a new function reference (e.g., an inline arrow function), the effect cleans up and restarts, canceling the active device flow and generating a new userCode. This invalidates the code the user may be entering in their browser, breaking the authentication flow. Consider wrapping onSuccess in a ref to keep the effect stable.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file apps/web/src/auth.tsx around line 352:

The `useEffect` in `GitHubDeviceFlowModal` includes `onSuccess` in its dependency array. When the parent passes a new function reference (e.g., an inline arrow function), the effect cleans up and restarts, canceling the active device flow and generating a new `userCode`. This invalidates the code the user may be entering in their browser, breaking the authentication flow. Consider wrapping `onSuccess` in a ref to keep the effect stable.

Evidence trail:
apps/web/src/auth.tsx:352-395 (REVIEWED_COMMIT) - The useEffect starts at line 352 and has `[onSuccess]` as its dependency array at line 395. The cleanup function at line 394 sets `cancelled = true`. The effect body calls `api.github.startDeviceFlow()` at line 364 to get a new userCode, and calls `onSuccess(result.accessToken)` at line 387.

[macroscopeapp]

🟡 Medium src/browserCdp.ts:31

ensureDebuggerAttached permanently attaches the debugger but never detaches it. After captureBrowserViewScreenshot returns, the BrowserView remains in debug mode indefinitely, showing a persistent "Electron is debugging this browser" warning to the user and blocking DevTools from opening on that view. Consider detaching the debugger after the command completes, or managing the attach/detach lifecycle in a finally block.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file apps/desktop/src/browserCdp.ts around line 31:

`ensureDebuggerAttached` permanently attaches the debugger but never detaches it. After `captureBrowserViewScreenshot` returns, the `BrowserView` remains in debug mode indefinitely, showing a persistent "Electron is debugging this browser" warning to the user and blocking DevTools from opening on that view. Consider detaching the debugger after the command completes, or managing the attach/detach lifecycle in a `finally` block.

Evidence trail:
apps/desktop/src/browserCdp.ts (full file viewed at REVIEWED_COMMIT): Line 17 calls `webContents.debugger.attach(DEBUGGER_PROTOCOL_VERSION)`. No `detach()` call exists anywhere in the 52-line file. `captureBrowserViewScreenshot` (lines 40-52) calls `sendCommand` which calls `ensureDebuggerAttached`, attaching the debugger without cleanup.