fix(desktop): local-session 403 no longer forces register/login - #88
Merged
Merged
Conversation
Packaged WebView retries of POST /api/auth/local-session were returning 403 when the existing ~/.freeos DB had more than one user or OCTOP_DESKTOP was shadowed on Windows, then AuthGuard dropped into register/login. Issue a studio JWT on this device (loopback, *.localhost, Origin, or desktop env), overlay launch env so Windows keeps OCTOP_DESKTOP=1, and remember ?desktop=1 before the SPA replaces / with /projects. Co-authored-by: XYAI Labs <haoboy8@gmail.com>
After a successful local-session, first launch always opens optional model setup then the first agent. /setup no longer bounces to /login once the guest exists (setup_required is already false). Drop the Go host env overlay from this branch so the PR does not match desktop/** and will not start FreeOS Desktop Package. Co-authored-by: XYAI Labs <haoboy8@gmail.com>
Product path after a this-device session: optional model setup (skippable), then /chat/main. The SPA dump from / to /projects must not become home, and must not reopen the login wall. Co-authored-by: XYAI Labs <haoboy8@gmail.com>
This was referenced Sep 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Do not run FreeOS Desktop Package, GitHub Release,
workflow_dispatchpackaging, or installer upload. This PR has nodesktop/**files so the path filter should not start packaging. Coordinator merge only; pack after on-machine verify + user OK.#87 was closed to stop packaging. If Actions run
35525031422(FreeOS Desktop Package on the old head) is still in flight, ignore / cancel it — do not attach those artifacts to a Release.Summary
Desktop 0.0.4 still showed the old register/login wall because
POST /api/auth/local-sessionreturned 403 Forbidden. After the 403 is fixed, the product path is authoritative:Open app → optional cloud key / local model (skippable) → chat with the first agent (
/chat/main). No register/login in between. Do not stop on/projects.What changed
*.localhost/ Origin-or-Referer-on-this-device always adopt a studio session (guest or preferred existing admin). Remote clients still get 403.?desktop=1at boot (the/→/projectsdump must not drop the shell flag)./setup(model step, skippable) →/chat/main. Returning this-device users with providers also land on/chat/main, not the conversation list and not/login./setupno longer bounces a local guest to/loginoncesetup_requiredis false.Authorization: Beareris no longer forwarded to organization identity.Before / after
/chat/main~/.freeos, no JWT/chat/main/dump/projectsbecame home/projectsfor setup or/chat/mainHost: example.comTarget branch
main(urgent desktop hotfix; user-requested)Type of change
Test plan
uv run pytest tests/unit/users/test_local_session.py tests/integration/test_local_session.py— 17 passeduv run pytest tests/unit/api/test_jwt_auth_middleware.py tests/unit/api/test_org_identity.py tests/unit/test_org_integration.py— 15 passednpx vitest runAuthGuard / Login / Setup / desktopOnboarding / desktopShell — 24 passed (latest landing-path tests)npx tsc --noEmitindashboard/make all(CI on this PR)Checklist
CHANGELOG.md(if user-facing)