fix(desktop): generate valid User-Agent that follows RFC 9110 guidelines

[jztmanyl]

Problem

The desktop preview sends an invalid User-Agent product token in nightly, stable (Alpha), and development builds. A .NET gateway forwarding the header with HttpRequestMessage.Headers.Add("User-Agent", value) throws FormatException, preventing the page from loading.

Nightly 0.0.43-nightly.20260929.2428 sends T3Code(Nightly)/0.0.43-nightly.20260929.2428; stable 0.0.45 sends T3Code(Alpha)/0.0.45. Parentheses are not allowed in the product-name token by RFC 9110. Electron 44.4.2 derives the native User-Agent from app.getName(), removing ASCII spaces but retaining parentheses.

Reproduction: open a page in a desktop preview and forward its received User-Agent using:

using var forwarded = new HttpRequestMessage(HttpMethod.Get, "http://localhost/subgraph");
forwarded.Headers.Add("User-Agent", receivedUserAgent);

With the old nightly name, the isolated reproduction reports the same error as the affected gateway:

The format of value 'T3Code(Nightly)/0.0.43-nightly.20260929.2428 Chrome/152.0.7977.130 Electron/44.4.2 Safari/537.36' is invalid.

Change

Configure Electron's internal runtime name as T3 Code Nightly, T3 Code Alpha, or T3 Code Dev. Electron then generates valid native product tokens, including T3CodeNightly/0.0.43-nightly.20260929.2428.

Keep the existing display name in the About panel and macOS application menu, including the About, Hide, and Quit labels. This menu change is needed to preserve branding when the internal runtime name changes. Electron's internal name override does not change the OS application name or packaged product metadata.

Preview sessions retain Electron's own User-Agent. This preserves the approach established in #7110: no session or request-header overrides, no removal of the app or Electron identity, and no changes to Chromium version or browser hints.

Scope and approval

This uses the very small, focused fix for an obvious bug exception: an invalid HTTP product token causes a reproducible parser failure, and the fix makes the existing native identity valid. The application-menu changes and focused tests belong to that same correction. There are no new settings, browser workflows, or gateway changes.

Searched existing User-Agent and malformed-header reports. #7110 documents the native-identity constraint; #16617 proposes optional browser compatibility settings and addresses a different problem.

Verification

• vp test run apps/desktop/src/app/DesktopAppIdentity.test.ts apps/desktop/src/window/DesktopApplicationMenu.test.ts apps/desktop/src/preview/BrowserSession.test.ts: 23 tests passed in three files, including a final run with Node 24.13.1. Covers valid product names for Alpha/Nightly/Dev, preserved display branding and macOS role labels, and the existing native preview identity behavior.
• pnpm --filter @t3tools/desktop typecheck: passed. File-scoped vp lint, vp fmt --check, and git diff --check: passed.
• Isolated real Electron 44.4.2 / Chromium 152.0.7977.130, macOS arm64, using the modified DesktopAppIdentity.configure and existing BrowserSession.getSession, with a local ASP.NET 10.0.400 SDK endpoint performing the exact Headers.Add operation above: five checks passed. The old nightly and stable names were rejected; the fixed nightly, stable, and development names were accepted. Each check verified that app.userAgentFallback, session identity, navigator.userAgent, and the actually received request header were identical. Every run used temporary app storage and an ephemeral preview partition.
• The Cloudflare dashboard sign-in form rendered with the fixed native identity; no Turnstile 600010 console messages were recorded during a 30-second observation. Credentials were not submitted, and full authentication/Turnstile challenge completion was not established.

The deployed gateway, a complete packaged T3 client, Windows, and Linux were not exercised. The local endpoint reproduces the reported forwarding failure. Temporary harnesses and evidence are outside the repository.

Prepared with GPT-6.1-Sol using the Codex harness in T3 Code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: fe23b5c7-8eee-4db6-a05d-aa878e061f0d

📥 Commits

Reviewing files that changed from the base of the PR and between f999eb2 and 4b70579.

📒 Files selected for processing (4)

• apps/desktop/src/app/DesktopAppIdentity.test.ts
• apps/desktop/src/app/DesktopAppIdentity.ts
• apps/desktop/src/window/DesktopApplicationMenu.test.ts
• apps/desktop/src/window/DesktopApplicationMenu.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The Electron runtime name now combines the branding base name with the stage label. The About panel and macOS application menu labels use the environment display name.

Changes

Desktop branding

Layer / File(s)	Summary
Runtime identity and About name apps/desktop/src/app/DesktopAppIdentity.ts, apps/desktop/src/app/DesktopAppIdentity.test.ts	The runtime name uses T3 Code followed by the stage label, without parentheses. The About panel retains the parenthesized display name. Tests cover Alpha, Nightly, and Dev, including the runtime name’s space-stripped RFC 9110 token form.
macOS menu labels apps/desktop/src/window/DesktopApplicationMenu.ts, apps/desktop/src/window/DesktopApplicationMenu.test.ts	The macOS About, Hide, and Quit labels use the environment display name. The test setup accepts partial environment overrides and tests nightly branding on macOS.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to 4b705

The branding change is ready to merge after normal checks; no actionable risk remains identified.

Security Architecture Review

Security architecture risk: ⚪ Minimal · up to 4b705

The change corrects runtime branding without introducing a new externally callable interface or changing credential storage, preview-session ownership, or menu privileges. No material security risk was identified in the reviewed change.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed identity is application-wide and can be observed by destinations receiving native preview User-Agent headers. Preview storage identities remain derived from scope, persistence mode, and namespace rather than the runtime name.

Security Findings and Attack Paths

• inferred — The routed public-API classifications do not establish a new attacker-callable endpoint. DesktopAppIdentity.make constructs an existing service, and configureMenu is a non-exported test helper using supplied mock services. The reviewed changes add no remote input or privileged menu action.

Trust Boundaries and Controls

• observed — Preview session creation remains partition-based and synchronized, retains the native User-Agent, and installs the existing permission request and permission check handlers. The PR changes the application-name input rather than rewriting session headers or weakening these controls.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: generating a valid RFC 9110-compliant User-Agent.
Description check	✅ Passed	The description is complete. It covers the problem, change, scope and approval rationale, focused verification results, limitations, and agent attribution.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}