fix(desktop): stop unsolicited Messages code autofill

[StiensWout]

macOS 26 and later offer recent Messages/Mail verification codes in any focused text field by default. T3's macOS bundle had not opted out, so the popup appears in the composer and other text inputs.

Set NSAutoFillRequiresTextContentTypeForOneTimeCodeOnMac to true in packaged builds and local desktop launchers. Bump the launcher version so cached bundles rebuild with the setting. This limits native code suggestions to fields explicitly marked for one-time codes, including within the desktop browser panel.

Apple documents the behavior and opt-out here.

Validation: 86 focused packaging/launcher tests passed, targeted lint and formatting passed, and the scripts package typecheck passed. On the Mac mini, an electron-builder packaging fixture and the signed local launcher both emitted the key as Boolean true. The exact SMS popup was not reproduced because the test Mac has no signed-in Messages account.

_{Prepared for Wout by gpt-6.1-sol in the Codex harness through T3 Code.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR changes the macOS desktop app's default one-time-code autofill behavior across packaged and locally launched bundles. Although the implementation is small and directly tested, this product-default change warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[StiensWout]

The default change is intentional. Wout explicitly requested a fix for unsolicited Messages code autofill in the macOS desktop app and asked for this PR.

Apple documents that macOS 26+ offers recent Messages/Mail codes in all focused text fields by default. The bundle-level opt-out is the documented way to require an explicit one-time-code content type. Its scope includes the composer, terminals, and embedded browser fields; that scope is already called out in the PR description.

The correctness check passed. This approvability result asks for human review of the default choice, so there is no code finding to fix here. The PR remains open for that review.

_{gpt-6.1-sol via the Codex harness through T3 Code, responding for Wout.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5c18faaa-b590-4a27-ac2e-f8c37b3e3b08

📥 Commits

Reviewing files that changed from the base of the PR and between 8ac4b97 and 3167367.

📒 Files selected for processing (3)

• apps/desktop/scripts/electron-launcher.mjs
• scripts/build-desktop-artifact.test.ts
• scripts/build-desktop-artifact.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

The macOS packaging configuration and launcher now set NSAutoFillRequiresTextContentTypeForOneTimeCodeOnMac to true. The packaging test checks this setting, and the launcher cache version increases from 19 to 20.

Changes: macOS autofill metadata

Layer / File(s)	Summary
Set and verify one-time-code autofill metadata scripts/build-desktop-artifact.ts, apps/desktop/scripts/electron-launcher.mjs, scripts/build-desktop-artifact.test.ts	The macOS packaging configuration and launcher set the Info.plist key to true. The test asserts the packaging configuration value. The launcher cache version increases from 19 to 20.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to 31673

The change constrains one-time-code suggestions in packaged and locally launched macOS apps; no material merge risk remains.

Security architecture risk: ⚪ Minimal · up to 31673

The change narrows unsolicited verification-code suggestions without adding permissions or expanding access to sensitive data. No material security risk introduced or worsened by this PR was identified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed control operates at the macOS application-bundle level, affecting code-suggestion eligibility across that application's text inputs. Its scope is the desktop application and the current user's OS-provided suggestions, not a new tenant, service, or data-store authority.

Trust Boundaries and Controls

• inferred — The setting tightens OS-mediated suggestion eligibility; it does not introduce a Messages/Mail reader or a new verification-code transmission path. It is not a blanket prohibition on autofill: explicitly designated one-time-code fields remain eligible under the stated platform contract.

Resilience and Maintainability Implications

• observed — The existing launcher rebuilds the shared bundle in place without transactional staging or locking. Cache acceptance checks file existence and matching metadata rather than independently verifying completed signing or plist contents. These recovery limitations predate the PR; version-19 metadata cannot validate a partial version-20 upgrade, and no worsened security exposure was established.

Pre-merge checks · 4

Passed checks (4 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: stopping unsolicited macOS Messages code autofill in the desktop app.
Description check		The description explains the problem, the configuration change, the launcher version bump, and focused verification results. It does not use the template headings or explicitly address scope and appro…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}