[quickbeard]

Summary

Ports the CLI's first-run experience (codev configure) to the desktop app, per the approved plan:

Hiding (web + desktop). Upstream's hosted providers (opencode Zen free models, opencode-go) are filtered out client-side at the provider-normalization choke point (global-sync/utils.ts wraps its return in the fork-only packages/app/src/gateway/hidden-providers.ts). They disappear from every model picker, the connect dialog, settings, and the default-model fallback — a fresh install no longer silently chats against upstream's gateway. connected keeps the TUI's isConnectedProvider semantics: only the unauthenticated free tier is dropped, so a paid Zen key never gets gated. The composer's "unpaid" click opens the connect dialog instead of the now-empty free-models lists (the only UX seam on web); downstream hosted-provider surfaces are left byte-identical to upstream as deliberately-dead code (documented in DIVERGENCES) so syncs stay cheap.

The gate (desktop only). When the local sidecar server has no configured provider, a persistent setup dialog opens with the CLI's three options: Login with SSO, Custom provider (existing dialog), Connect provider (existing dialog). A stateless invariant (packages/app/src/components/gateway/gateway-configure-gate.tsx, twin of the TUI's gate effect) reopens it whenever the dialog stack empties while unconfigured, and closes it reactively once a provider appears — including setup completed in another window or the CLI. Activation is keyed on a new platform.gatewaySso capability, so the browser web deployment never gates.

SSO flow. Runs in the Electron main process (packages/desktop/src/main/gateway-sso/, wrapping @codev/gateway's loopback OAuth): single-flight across windows, generation-counter cancellation (login has no cancel API — stale results are dropped), status streaming over sandbox-pattern IPC, open-in-browser + copy-link + paste-callback fallback, manual API-key path when the account has no provisioned key, 3× retries, shell.openExternal, and Electron net.fetch (new optional fetchImpl on the gateway backend) so enterprise proxies/PAC apply. The API key never crosses IPC inbound. Completion mirrors the TUI exactly: saveApiKey → raw config PATCH with buildGatewayConfig → dispose → wait for netgate → seed model recents → toast. Failures toast and bounce back to the entry screen — the desktop never quits.

Dialog persistence. packages/ui's dialog context gains a per-dialog persistent flag (TUI precedent): Escape/backdrop/outside-click are inert for the marked dialog, programmatic close() works, pushed sub-dialogs stay dismissable.

Docs

• 8 new DIVERGENCES.md rows (filter choke point + dead-surface note, dialog persistence, gate mount, platform capability, prompt-input handler swap, desktop wiring, package export, i18n)
• 2 CHANGELOG "Unreleased" entries

Verification

• bun typecheck: app, desktop, ui, codev-gateway, tui — all clean
• bun test: app 674 unit + 69 browser, desktop 90 (7 new controller tests), ui 14, codev-gateway 37 — all pass
• New tests: hidden-providers filter (5), gate predicate truth table (6), SSO controller (single-flight, cancel drops stale results, paste error contract, retry/exhaustion, auth-file base_url semantics)
• Not yet done: the manual end-to-end pass against the live IdP (fresh-profile bun dev:desktop, browser + paste-fallback login, second-window behavior; CODEV_BYPASS_LOGIN=1 for the no-IdP loop) — please run before merging or ask me to smoke it

🤖 Generated with Claude Code