fix(desktop): improve setup, local startup and provider OAuth

[davidmckayv]

What changes

Desktop setup now shows real installation progress, preserves selections when going Back, and selects usable local ports instead of failing on occupied or Windows-reserved defaults. It also adds Google Gemini/xAI connections and lets users create a CopilotKit project during setup.

• Show downloaded bytes, elapsed time and stage outcomes; fix spacing/navigation and move repair into Installation options.
• Persist chosen loopback ports through tools, supervision and reopen while retaining fixed container ports and existing process ownership. Include Windows Compose path-separator handling.
• Discover installed Docker credential helpers beside the resolved CLI, including symlink targets, without changing saved credentials. Require pinned Bun 1.3.14 and preserve useful startup diagnostics.
• Add Google/xAI API-key presets and browser/device OAuth with automatic refresh. Keep provider tokens in the host deployment; agents receive a separate local proxy credential.
• Use Google's native Gemini API for OAuth, translating streaming replies, tool calls/results, screenshots and thought signatures for existing agents. API-key connections retain their existing compatibility endpoint.
• Add authenticated CopilotKit project creation and a configurable setup-help link. No Intelligence code changes.
• Let unfinished setup recover from a leftover Postgres database without terminal commands. A confirmed reset removes only the exact unused Compose-owned database; existing configured installations and restored keys remain protected.

OAuth correctness

Windows Google and organization SSO callbacks restore blocking mode on accepted sockets and read a bounded complete request line, including delayed/fragmented requests.

Native sign-in and server refresh share an OS-owned lock. Refresh acquires it before spending a refresh token and holds it through durable replacement; process death releases ownership. An abandoned directory from an earlier PR build no longer prevents refresh or sign-in. Lock contention, failed request bodies, provider 403 and actual authentication failures have distinct sanitized outcomes, so quota/project denial does not send users through repeated sign-in.

xAI verification links must use the supported HTTPS accounts origin. Unused mailto capability is removed; configured organization/support links continue working. Credential-file and stream-failure guards have independent regressions and targeted mutation checks.

The proxy mounts only for a configured desktop credential file. Remote/Kubernetes deployments keep their existing ingress and authentication behavior. Bot calls retain the existing gateway and audit path; project authorization remains server-side. No new agent permission or shared server state.

Validation

• Leftover database recovery: production Rust recovery functions exercised against real Podman on Mac. Cancellation preserved the volume; confirmed reset cleared only the fixture database; fresh Postgres became healthy; resetting the attached database was refused and Postgres remained healthy. The confirmation UI was visually inspected in a separate browser fixture. All 97 App tests pass (660 assertions); native guards include engine affinity and shared-volume aliases.
• Fresh isolated Mac install: real OpenAI/Anthropic plan sign-in, CopilotKit sign-in/project creation, and selected agents visibly using the browser and rendering bar charts.
• Google: real browser authorization; native Mac LangGraph/Gemini browser use and chart rendering; expired-token refresh saved with mode 0600; full quit/reopen and another chart without signing in again. Real LangGraph SDK transport integration passed.
• xAI API key: real browser tool and chart verified in web/native Mac. OAuth: authorization, refresh and restart passed, but model calls return HTTP 402; the billing/account context causing that response remains unresolved. xAI OAuth model/browser/chart use is not verified.
• Startup: occupied ports on Mac; actual Windows reserved-port error 10013 and occupied-port recovery as a standard user. Native pinned-runtime rejection and installed Docker-helper discovery reproduced and checked.
• Follow-up regressions: 25 proxy tests, 15 native provider tests, six organization tests, 13 transport tests and eight connection-classification tests passed. Five credential-guard removals and ten behavior-changing stream mutations are caught; one equivalent duplicate guard is documented. Explicit typechecks, formatting/lint, native clippy and native binary build passed.
• Windows callbacks as a standard user: both original readers failed with Winsock 10035; all four fixed delayed/fragmented Google/organization cases passed. Credential storage as a standard user on pinned Bun 1.3.14: both native/server exclusion directions and process-death recovery passed; the native-held check lasted the full 5.3-second timeout. Both precreated symlink guards reject before provider I/O; Windows initially followed the credential symlink, and the final file-identity check fixes that. Six final-source Windows transaction tests pass (51 assertions), including concurrent rotation, new-sign-in preservation, timeout without token exchange and replaced-file detection.

CI is green on the database-recovery commit 5b70772b: 21 checks passed, including all three desktop builds, Windows standard-user setup and Python harness regressions; 3 conditional checks skipped. Native Clippy/binary build, desktop typecheck/lint/build, focused recovery regressions and real Podman recovery passed locally.

The previous accepted CI run on 70fa9944 was green: 21 passing checks and three conditional skips, including all three desktop builds, Windows standard-user setup and Python harness regressions. Prior accepted checks and real Mac workflows are retained; no new full provider browser sign-in on Windows is claimed by the targeted callback/storage checks.

Distribution and limits

Google OAuth uses a registered desktop client and Cloud project quota, not a personal Gemini subscription. Artifact/signing workflows accept distributor client settings; this repository is configured for the approved internal client. Wider distribution still requires the appropriate consent/verification and quota setup. xAI follows its endorsed OpenCode public flow and supports a distributor client-ID override. Configuration/provenance is documented in desktop/PROVIDER_OAUTH.md.

Earlier unmerged PR test stacks must be stopped before switching lock protocols. No local lock can make a provider's remote token exchange and the subsequent disk write one atomic transaction; a crash in that remaining window can require sign-in. Tyler’s earlier Mac build error still lacks its underlying log line, so that specific build failure is not claimed as reproduced. Craig’s separate missing-key/leftover-volume startup report is addressed by the confirmed database recovery above.

Fixes FOR-320

[linear-code]

FOR-320