fix(desktop): require passkey signing material only when Clerk is configured

[Xalior]

A signed macOS build resolves the passkey signing configuration unconditionally, so it demands T3CODE_MACOS_PROVISIONING_PROFILE and either T3CODE_CLERK_PASSKEY_RP_DOMAINS or T3CODE_CLERK_PUBLISHABLE_KEY. All three serve passkey sign-in, which serves T3 Connect. With cloud features off there is no domain for the Associated Domains entitlement to claim, but the build still refuses.

.env.example says the cloud identifiers are optional and that removing them builds with cloud features disabled. That holds for unsigned builds only, and a signed build is the only kind that can auto-update. The failure names a provisioning profile and mentions neither Clerk nor T3 Connect, so it does not lead anywhere useful.

The fix gates the passkey configuration on T3CODE_CLERK_PUBLISHABLE_KEY. That key is the root of the chain, and resolveMacPasskeySigningConfiguration already derives the RP domain from it. With a key present nothing changes.

Testing

Built a signed macOS artifact from this branch with only T3CODE_APPLE_TEAM_ID set. It completes, the app is signed by a Developer ID identity, and codesign -d --entitlements shows no associated-domains entry. Before the change the same build threw MissingMacPasskeyProvisioningProfileError immediately after staging.

vp run --filter scripts typecheck is clean. vp test run scripts/build-desktop-artifact.test.ts gives 48 passed and 1 failed; that one failure, "skips the primary native probe for cross-architecture Windows payloads", also fails on an unmodified checkout of main, so it is not from this change.

Written by Claude Fable 5.0 running as an agent in Claude Code.

---

Note

Medium Risk
Changes when signed mac builds apply passkey entitlements; misconfigured CI (signed mac + Clerk expected but env vars missing) would skip Associated Domains signing instead of failing loudly.

Overview
Signed macOS desktop builds no longer always resolve passkey signing (Associated Domains provisioning profile + Clerk RP domains). In buildDesktopArtifact, passkey setup now runs only when the build is mac, signing is enabled, and T3CODE_CLERK_PUBLISHABLE_KEY or T3CODE_CLERK_PASSKEY_RP_DOMAINS is set in repo env.

Repo env is loaded once as repoEnvForSigning and passed into resolveMacPasskeySigningConfiguration instead of calling loadRepoEnv inside the resolver path. Signed mac builds without Clerk/T3 Connect config can complete with Developer ID signing and without passkey entitlements, matching optional cloud identifiers in .env.example.

^{Reviewed by Cursor Bugbot for commit 2d9eadb. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Require passkey signing material only when Clerk env vars are set in buildDesktopArtifact

Updates the mac signed build path so resolveMacPasskeySigningConfiguration runs only when T3CODE_CLERK_PUBLISHABLE_KEY or T3CODE_CLERK_PASSKEY_RP_DOMAINS is present. Repo environment variables are loaded once into repoEnvForSigning and reused for both the configuration check and the resolution call.

^{Macroscope summarized 2d9eadb.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 452b2d7c-42cb-4007-9c7c-663e4571fd64

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This change alters signed macOS artifact generation by conditionally including passkey authentication entitlements based on Clerk configuration. Although the diff is small and focused, authentication-sensitive behavior in shipped artifacts warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}