Integrate Agent hosted handoff and isolated Research Dev desktop

.github/workflows/agent-ci.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [master]
   pull_request:
-    branches: [master]
+    # Run unprivileged validation for stacked PRs as well as master targets.
   workflow_dispatch:
 
 # PR code, including forks, executes only on fresh hosted runners with a

.github/workflows/agent-desktop-build.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches: [master]
   pull_request:
-    branches: [master]
+    # Run unprivileged validation for stacked PRs as well as master targets.
   workflow_dispatch:
 
 # Signing is confined to protected master jobs. PR packaging runs with a

.github/workflows/desktop-pr-build.yml

@@ -5,7 +5,7 @@ permissions:
 
 on:
   pull_request:
-    branches: [master]
+    # Run unprivileged validation for stacked PRs as well as master targets.
 
 jobs:
   changes:
@@ -55,6 +55,44 @@ jobs:
             apps/maple-research/frontend/src-tauri/target/reproducibility/desktop-pr-macos-*.sha256
           retention-days: 5
 
+  build-research-dev-macos:
+    needs: changes
+    if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.macos != 'false') }}
+    runs-on: macos-26
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # was v4
+        with:
+          persist-credentials: false
+
+      - name: Select pinned Xcode
+        run: python3 scripts/ci/select-xcode.py
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        with:
+          github-token: ""
+
+      - name: Cache sccache
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
+        with:
+          path: ~/Library/Caches/Mozilla.sccache
+          key: ${{ runner.os }}-sccache-research-dev-${{ hashFiles('apps/maple-research/frontend/src-tauri/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-sccache-research-dev-
+
+      - name: Build isolated Research Dev app (unsigned)
+        run: nix develop --no-update-lock-file .#ci -c ./scripts/ci/research-dev-desktop.sh
+
+      - name: Upload Research Dev PR package and identity proof
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # was v4
+        with:
+          name: maple-research-dev-macos-pr
+          path: |
+            apps/maple-research/frontend/src-tauri/target/research-dev/maple-research-dev-macos.tar.gz
+            apps/maple-research/frontend/src-tauri/target/research-dev/build-profile.json
+          if-no-files-found: error
+          retention-days: 5
+
   build-linux:
     needs: changes
     if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.linux != 'false') }}

.github/workflows/frontend-tests.yml

@@ -17,7 +17,7 @@ on:
       - "flake.nix"
       - "flake.lock"
   pull_request:
-    branches: [ master ]
+    # Run unprivileged validation for stacked PRs as well as master targets.
     paths:
       - ".github/workflows/frontend-tests.yml"
       - "apps/maple-research/frontend/**"

.github/workflows/repository-checks.yml

@@ -12,7 +12,7 @@ on:
       - "flake.nix"
       - "flake.lock"
   pull_request:
-    branches: [master]
+    # Run unprivileged validation for stacked PRs as well as master targets.
     paths:
       - ".github/workflows/**"
       - "scripts/ci/**"

.github/workflows/rust-tests.yml

@@ -23,7 +23,7 @@ on:
       - "flake.nix"
       - "flake.lock"
   pull_request:
-    branches: [master]
+    # Run unprivileged validation for stacked PRs as well as master targets.
     paths:
       - ".github/workflows/rust-tests.yml"
       - "apps/maple-research/frontend/src-tauri/**"

.github/workflows/web-build.yml

@@ -17,7 +17,7 @@ on:
       - "flake.nix"
       - "flake.lock"
   pull_request:
-    branches: [ master ]
+    # Run unprivileged validation for stacked PRs as well as master targets.
     paths:
       - ".github/workflows/web-build.yml"
       - "apps/maple-research/frontend/**"

apps/maple-agent/CLAUDE.md

@@ -8,6 +8,14 @@ GPUI desktop app for Maple. Workspace crates: `app` (package `maple-agent-app`,
 `crates/maple-agent`, `crates/maple-billing`. See `README.md` for the
 layout, prerequisites, and command line modes.
 
+Packaged Dev OAuth uses the compiled Auth origin and a one-attempt loopback
+listener in `app/src/hosted_oauth.rs`; Prod and unpackaged builds retain the
+provider callback paste flow. Keep the listener bound to `127.0.0.1` through
+completion, close it on cancellation/deadline/view disposal, and redeem the
+original SDK prepared handle only once. Publish through the existing backend
+account authority; never log callback queries or grants. Update profile metadata
+and release verification together when changing the compiled Auth destination.
+
 ## Build, test, run
 
 `just` lists the recipes. `just ci` runs the same checks as CI (format,

apps/maple-agent/README.md

@@ -53,6 +53,10 @@ has an independent dependency graph.
 ## Features
 
 - Sign in with email and password, or with GitHub, Google, or Apple OAuth.
+  Packaged Dev uses hosted browser sign-in and an automatic loopback return;
+  Prod and unpackaged builds retain the callback URL paste flow. Hosted Dev
+  requires the matching Auth host and provider/backend callback configuration;
+  building the client does not deploy those services.
   The session persists in `auth.json` (mode 0600) so the next launch and
   the `acp` mode skip sign-in. The window opens while the saved session is
   checked, and a check that cannot reach the server keeps the credentials

apps/maple-agent/app/Cargo.toml

@@ -45,6 +45,8 @@ gpui = { version = "0.2.2", git = "https://github.com/zed-industries/zed", rev =
 gpui-platform = { package = "gpui_platform", version = "0.1.0", git = "https://github.com/zed-industries/zed", rev = "cc053a4a6fa2fd0e8793201ed9099466af1be0b1", features = ["font-kit", "wayland", "x11"], optional = true }
 image = { version = "0.25", default-features = false, features = ["png", "jpeg", "webp"], optional = true }
 base64 = "0.22"
+httparse = "1"
+rand = "0.8.6"
 tokio = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
@@ -76,6 +78,9 @@ tower-http = { version = "0.6", features = ["cors"], optional = true }
 [target.'cfg(target_os = "linux")'.dependencies]
 wayland-client = { version = "0.31", optional = true }
 
+[target.'cfg(windows)'.dependencies]
+windows-sys = { version = "0.61", features = ["Win32_Networking_WinSock"] }
+
 [dev-dependencies]
 parking_lot = "0.12"
 # The gpui test harness. Keep this out of [dependencies]: with test-support on,

apps/maple-agent/app/build.rs

@@ -61,6 +61,7 @@ fn main() {
         "api_url": profile.api_url,
         "billing_api_url": profile.billing_api_url,
         "web_url": profile.web_url,
+        "auth_origin": profile.auth_origin,
         "client_id": profile.client_id,
         "pcr_environment": profile.pcr_environment,
         "version": std::env::var("CARGO_PKG_VERSION").expect("Cargo package version"),