[Bug]: Sidebar "update everything" never updates CLI/npm servers (npm check blocked by CORS preflight)
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 76/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- typescript
Research direction
Read apps/web/src/state/npmRelease.ts, especially the npmReleasePublishedAtom request and its Effect pipeline; compare it with the proposed tracer propagation setting. Check the npm version lookup from the web app or Electron renderer and confirm it succeeds without a CORS preflight. Done means "update everything" includes eligible boot-service CLI servers when the target npm version is published.
Written by the indexing model from the issue text.
Description
What happens
On desktop nightly 0.0.46-nightly.20261012.3021, the sidebar's "update everything" button (#18053) updates desktop-app servers but never includes a CLI server. The connected server is a launcher-managed t3 __service-launcher systemd service on 0.0.46-nightly.20261012.3010, which advertises serverSelfUpdate: "boot-service". That server's row in Settings → Connections still shows its update icon, and updating from there works.
npm already has the target version (nightly dist-tag = 0.0.46-nightly.20261012.3021), and both versions are on the nightly channel, so the server should be included.
Cause
useUpdateEverything keeps non-desktop-managed servers only after npm confirms the target version:
apps/web/src/components/sidebar/useUpdateEverything.ts:56-58filters withuseNpmReleasePublished(targetVersion)apps/web/src/state/npmRelease.ts:14checks with Effect'sHttpClient.get+FetchHttpClient.layer
Effect's HttpClient adds traceparent and b3 headers to every request by default (HttpClient.TracerPropagationEnabled defaults to true). Those headers make the browser send a CORS preflight, and registry.npmjs.org answers OPTIONS with 404 and no Access-Control-Allow-Origin. The fetch is blocked, the atom fails, AsyncResult.getOrElse(result, () => false) (npmRelease.ts:40) reports "not published", and every npm/CLI server is dropped from the run. This affects the desktop renderer and app.t3.codes alike. The Connections "Update all" and per-row update don't check npm, which is why they still work.
Repro / evidence
Preflight is rejected:
$ curl -sI -X OPTIONS -H 'Origin: https://app.t3.codes' -H 'Access-Control-Request-Method: GET' \
https://registry.npmjs.org/t3/0.0.46-nightly.20261012.3021
HTTP/2 404 # no access-control-allow-origin
What the effect 4.0.1 the web app ships sends for HttpClient.get(...) with FetchHttpClient.layer:
{"b3":"d25f…-a0cb…-1","traceparent":"00-d25f…-a0cb…-01"}
The same fetch inside the repo's Electron 44 (Chromium), run from an https:// page:
plain GET: ok 200
with trace headers: FAILED Failed to fetch
Expected
"Update everything" includes boot-service CLI servers once npm has the target version.
Suggested fix
Turn off trace propagation for this cross-origin request in npmReleasePublishedAtom (apps/web/src/state/npmRelease.ts):
}).pipe(
Effect.provideService(HttpClient.TracerPropagationEnabled, false),
Effect.provide(FetchHttpClient.layer),
)
With that change no extra headers are sent and the request stays a simple CORS GET (checked with the same probe). A test on the fetch-failure path would also help: right now a failed check looks the same as "not published", which hid this.
- Dominant language
- TypeScript
- Stars
- 24.8k
- Forks
- 6.4k
- Avg merge
- 11h 33m
- Merged PRs (30d)
- 312
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from pingdotgg/t3code
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
[Bug] Windows repository cloning fails while creating an existing drive rootPossibly taken @pujitha24 claimed this 1 day ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 73/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
[Bug]: iOS still shows "Failed to connect. Retrying" on every resume (follow-up to #5695)Possibly taken @otavio claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
[Bug]: Server git tests sign fixture commits with the developer's key when run from the repo rootPossibly taken @Mnigos claimed this 2 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
All issues in pingdotgg/t3code
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
openwatersio/slackwater-database#281 ·
Maintainers usually reply within 1 day
-
Bayern feature:Application ready web
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
digitalfabrik/entitlementcard#3176 ·
Maintainers usually reply within 7 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
NanmiCoder/cc-haha#1533 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
🐛 Bug: Calendar work items cannot be opened on mobilePossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 1/5 Under an hour Newbie friendliness 75/100
Maintainers usually reply within 1 day