PR: https://git.cafe/pingdotgg/t3code/pulls/22835
Date: 2026-10-30, Linux x64 Boat VM
Main: 028ed851d5 (github/main)
PR head: de5956c83650134a82076ee8baf61c078c7c699e
Electron 44.10.0 / Chromium 152.0.7977.169

Setup:
  git worktree add ../main github/main
  cd ../main && timeout 600 vp i
  setsid nohup timeout 6600 vp run dev > /tmp/main-dev.log 2>&1 &
  main dev-runner: serverPort=16733 webPort=8693
  Playwright from repo dependencies, /usr/bin/google-chrome:
    paired web client; added /home/user/main through Add project > Local folder;
    selected Codex gpt-6.1-sol; submitted git status/head request.
  Real provider ran both commands and completed:
    git status --short: clean
    git rev-parse --short HEAD: 028ed851d5

Desktop setup (each revision, one server at a time):
  installed libsecret-1-dev, required by desktop native-secret build
  vp run --filter @t3tools/desktop dev:bundle (background, timeout 600)
  cd apps/server && vp pack (development backend bundle, timeout 600)
  stopped the web/server dev group by its captured PID
  vp run dev:web (background, captured PID)
  launched the real dist-electron/main.cjs with VITE_DEV_SERVER_URL,
    T3CODE_HOME pointing to this checkout/.t3, T3CODE_PORT, isolated XDG_CONFIG_HOME,
    --password-store=basic, --no-sandbox, --remote-debugging-port=9223;
    DBUS_SESSION_BUS_ADDRESS points to a nonexistent socket to avoid keyring prompts.
  Desktop starts its own real backend and FD browser bridge.
  No LocalNetworkAccessChecks flags or permission-handler overrides.
  Opened Browser panel using UI and navigated to https://example.com.

Browser APIs queried in the actual preview webview:
  navigator.permissions.query({name})
                          main          PR
  loopback-network        denied        granted
  local-network           denied        denied
  local-network-access    denied        denied
  notifications           denied        denied
  geolocation             granted       granted
  clipboard-write         granted       granted

Actual cross-origin fetch from https://example.com:
  fetch("http://127.0.0.1:<backend>/.well-known/t3/environment", {mode:"no-cors"})
  main: resolved, response.type=opaque, response.status=0
  PR:   resolved, response.type=opaque, response.status=0
  status=0 is the expected opaque CORS response, not a claimed HTTP 200.
  Both real backend logs recorded GET /.well-known/t3/environment, HTTP 200.
  Ordinary CORS fetch without no-cors failed; this PR does not grant CORS access.

PR setup:
  git switch --detach de5956c83650134a82076ee8baf61c078c7c699e
  timeout 600 vp i
  setsid nohup timeout 6000 vp run dev > /tmp/dev.log 2>&1 &
  pr dev-runner: serverPort=13773 webPort=5733
  Root checkout first defaulted to ~/.t3; stopped and restarted with explicit
  T3CODE_HOME=/home/user/t3code/.t3. Verification used the isolated directory.
  Added real /home/user/t3code through web UI and selected Codex gpt-6.1-sol.

Real Codex gpt-6.1-sol desktop turn:
  Submitted through composer, invoked app MCP preview_status then preview_evaluate.
  preview_status: existing https://example.com/ tab, available=true.
  preview_evaluate: loopback-network granted; local-network denied;
    local-network-access denied; notifications denied; geolocation granted.
  git rev-parse --short HEAD: de5956c836
  A mistakenly generated root dist/ directory was reported as untracked by the
  provider, then removed. Subsequent git status was clean. No source edits.

Nearby behavior:
  Navigated preview to http://127.0.0.1:13773/.well-known/t3/environment;
  displayed the real server environment descriptor.
  Back returned to https://example.com/; Refresh worked.
  Direct webview query after refresh: loopback granted, LAN denied.
  Later provider retry after manual browser interaction: preview unavailable,
  then evaluate timeout (15000ms); after releasing control, automation evaluated
  about:blank rather than the still-visible example.com guest.
  This later attachment/control path is not claimed as passing.

Checks:
  blacksmith-check run (dedicated task testbox):
    vp i && vp test run apps/desktop/src/preview/BrowserSession.test.ts
  PASS: 1 file, 8 tests.
  cafe pr status at exact head: 29 successful, 0 failing, 0 pending.
  No source fixes, commits, pushes, rebase, merge, close, or label changes.

Not verified:
  Real Okta tenant/FastPass/Okta Verify authentication (tenant/helper unavailable).
  macOS, Windows, native iOS/Android, other SSO helpers.
  Older Okta widgets querying only local-network-access remain denied by design.

Matching main capture repeated after PR verification:
  main guest DevTools at https://example.com again shows loopback denied,
  LAN/legacy/notifications denied, geolocation and clipboard-write granted.
  Real main Codex turn after this UI transition returned preview_status
  available=false with no tab. The visible local preview/automation attachment
  discrepancy also occurs on main. No permission regression is inferred from it.
  Main and PR desktop/web processes stopped by captured PIDs.