[rynorris]

Before this PR

Signed macOS builds always claim com.apple.developer.associated-domains. To fill it in, the build needs a Clerk RP domain (T3CODE_CLERK_PUBLISHABLE_KEY or T3CODE_CLERK_PASSKEY_RP_DOMAINS), and it throws MissingMacPasskeyDomainConfigurationError if it has none. Those domains only serve T3 Connect passkey sign-in. The in-app browser passkey bridge from #16952 doesn't use them. It needs com.apple.developer.web-browser.public-key-credential and nothing else.

As a result, a build that has T3 Connect off but holds a profile with the browser passkey entitlement can't enable browser passkeys. We hit this in an internal fork that turns off T3 Connect: we want the bridge so security keys work in the in-app browser (the problem in #30599). Today our only option is a placeholder Clerk domain.

After this PR

The packager claims Associated Domains only when the provisioning profile grants it. It already works this way for the Touch ID keychain group and the browser passkey entitlement. A Clerk domain is required only in that case. A profile without Associated Domains now signs with just the entitlements it grants.

Why no prior issue

This is a small, focused fix under CONTRIBUTING's exception for obvious bugs. The defect: signed builds demand a Clerk domain for an entitlement the profile may not grant, which blocks browser passkeys. Profiles that grant Associated Domains, like upstream's, behave the same, and no product behavior changes.

Notes

• Upstream releases should behave the same. Their profile grants Associated Domains, so a missing Clerk config still fails the build loudly, which avoids the problem raised about fix(desktop): require passkey signing material only when Clerk is configured #8136. The build log line now also lists the associated domains.
• This assumes Developer ID profiles that grant Associated Domains include com.apple.developer.associated-domains (usually *) in their Entitlements. Please check the log line on the next signed release.
• This also fixes a smaller case: a profile without Associated Domains plus a Clerk domain used to produce an app that macOS refuses to launch.
• MissingMacPasskeyRpDomainError could no longer be reached, so it's removed.
• Evidence: the updated cases in scripts/build-desktop-artifact.test.ts fail on main with MissingMacPasskeyDomainConfigurationError and pass with this change. I didn't run a signed build with a real Apple profile.

🤖 Generated by Claude Code (Claude Opus 5.5)

[macroscopeapp]

Approvability

Verdict: Approved at d036a20

Macroscope's review found this PR approvable — Signed macOS builds can omit Clerk domains when their provisioning profile does not grant Associated Domains. Profiles that grant the capability still require domains, keeping the change limited to profile-compatible packaging.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

macOS passkey signing no longer requires RP domains when the provisioning profile does not grant Associated Domains. When the profile grants that entitlement, signing requires configured RP domains and includes them in the generated WebAuthn entitlements.

Changes: macOS passkey signing

Layer / File(s)	Summary
Optional RP-domain configuration scripts/build-desktop-artifact.ts, scripts/build-desktop-artifact.test.ts	Configuration resolution can return an empty RP-domain list when no domain source is configured. It deduplicates configured domains and removes the error for an empty list. Tests cover empty configuration and revised error messages.
Profile-driven entitlement generation scripts/build-desktop-artifact.ts, scripts/build-desktop-artifact.test.ts, .env.example, docs/operations/release.md	Entitlement resolution reads the Associated Domains grant from the provisioning profile. It returns configured domains only when the profile grants them, and the plist includes webcredentials: entries only when domains are present. Tests and signing notes cover profiles without the grant.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant Build as DesktopArtifactBuild
  participant Profile as ProvisioningProfile
  participant Resolver as resolveMacWebAuthnEntitlements
  participant Renderer as renderMacPasskeyEntitlements
  Build->>Profile: Read provisioning profile
  Build->>Resolver: Pass profile and configuration with RP domains
  Resolver-->>Build: Return resolved Associated Domains
  Build->>Renderer: Pass app and team IDs with resolved entitlements

Loading

Possibly related issues

• pingdotgg/t3code#30599 — This change permits signed builds with the browser passkey entitlement without Associated Domains. It does not add the PIN handling described in the issue.

Suggested labels: bugfix

Suggested reviewers: t3dotgg

Merge Risk: Minimal · up to d036a

No actionable merge-blocking issue is established; proceed with normal build and signing checks.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title describes the change. A Clerk domain is still required when the profile grants Associated Domains.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description covers the problem, change, scope, verification results, and verification limits. Its headings differ from the repository template.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: main
• File: .coderabbit.config.ts
• Commit: b90e554
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: 28692e57-d9cf-47fd-ba54-dcd3ffa6fb92

Commits

Reviewing files that changed from the base of the PR and between b90e554 and d036a20.

Files selected for processing: 4

• .env.example
• docs/operations/release.md
• scripts/build-desktop-artifact.test.ts
• scripts/build-desktop-artifact.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.