refactor(desktop): classify app exports

[juliusmarminge]

Desktop app, window, shell, SSH, and update modules had 18 unclassified runtime exports. This marks 14 canonical Effect service constructors as intentional public APIs and keeps four implementation constants and state helpers private without changing runtime behavior.

This is layer 3 of 5 in the desktop Knip cleanup stack.

Verification after the full stack: desktop typecheck; desktop Knip export audit; 831 desktop tests; changed-file lint and format checks. The native libsecret test cannot start on this machine because the system libsecret-1 development package is unavailable.

Model: gpt-6 astra. Harness: Codex in T3 Code.

Note

Make desktop app helpers private and document public service APIs

• Removes the export keyword from internal helpers that are only used within their own module: URL_HANDLER_DESKTOP_ENTRY_NAME in DesktopLinuxUrlHandler.ts, isInstallableDesktopUpdateState in remoteUpdateFlow.ts, and nextStatusAfterDownloadFailure and getCanRetryAfterDownloadFailure in updateMachine.ts.
• Adds public API documentation comments to every exported service-construction effect and service value across the desktop app modules, clarifying the intended public surface.
• Behavioral Change: the four helpers above are no longer importable from outside their modules; any external consumers will need to be updated.

^{Macroscope summarized 4c6bb9a.}

Summary by CodeRabbit

• Documentation

  • Improved public API documentation for desktop application services and constructors.

• Refactor

  • Reduced the public API surface by keeping several internal update helpers private.
  • No runtime behavior changes.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	13.6 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	7.0 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	57.1 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	10	—	21	✅
Claude	Total thread wire	—	13.6 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	7.0 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	57.9 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	10	—	21	✅

Baseline: unavailable · PR result: 4c6bb9a · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.9 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at 227925c

Macroscope's review found this PR approvable — This is a contained export-surface cleanup: existing service constructors receive documentation, while four unused helper exports become module-private. Runtime logic, defaults, authentication behavior, and production workflows remain unchanged.

No code changes detected at 4c6bb9a. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

Dismissing prior approval to re-evaluate 227925c

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: a8a8fcd8-a5f1-4c34-ad8e-e21e746f802e

📥 Commits

Reviewing files that changed from the base of the PR and between bf20c62 and 4c6bb9a.

📒 Files selected for processing (16)

• apps/desktop/src/app/DesktopAppActivation.ts
• apps/desktop/src/app/DesktopAppIdentity.ts
• apps/desktop/src/app/DesktopAssets.ts
• apps/desktop/src/app/DesktopClerk.ts
• apps/desktop/src/app/DesktopConnectionCatalogStore.ts
• apps/desktop/src/app/DesktopLifecycle.ts
• apps/desktop/src/app/DesktopLinuxUrlHandler.ts
• apps/desktop/src/app/DesktopPreReadyPlatform.ts
• apps/desktop/src/shell/DesktopShellEnvironment.ts
• apps/desktop/src/ssh/DesktopSshEnvironment.ts
• apps/desktop/src/ssh/DesktopSshPasswordPrompts.ts
• apps/desktop/src/updates/DesktopUpdates.ts
• apps/desktop/src/updates/remoteUpdateFlow.ts
• apps/desktop/src/updates/updateMachine.ts
• apps/desktop/src/window/DesktopApplicationMenu.ts
• apps/desktop/src/window/DesktopWindow.ts

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 10 reviews per hour.

---

📝 Walkthrough

Walkthrough

The changes document desktop service constructors as public Effect APIs and remove exports from selected internal constants and update helpers. Runtime behavior remains unchanged.

Changes

Desktop Effect API surface

Layer / File(s)	Summary
Document public service constructors apps/desktop/src/app/*, apps/desktop/src/shell/*, apps/desktop/src/ssh/*, apps/desktop/src/updates/DesktopUpdates.ts, apps/desktop/src/window/*	Added public API documentation comments to exported make service constructors.
Restrict internal exports apps/desktop/src/app/DesktopLinuxUrlHandler.ts, apps/desktop/src/updates/remoteUpdateFlow.ts, apps/desktop/src/updates/updateMachine.ts	Made URL_HANDLER_DESKTOP_ENTRY_NAME, isInstallableDesktopUpdateState, nextStatusAfterDownloadFailure, and getCanRetryAfterDownloadFailure module-private without changing their behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 4c6bb

This change clarifies the desktop Effect API surface and makes four internal helpers unavailable to external imports without changing runtime behavior. No current merge-blocking risk remains.

Suggested reviewers: t3dotgg

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 16 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: classifying desktop application exports.
Description check	✅ Passed	The description clearly explains the export changes, rationale, scope, verification, and the unavailable libsecret test. It does not use the template headings or checklist, but it is otherwise complet…

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cleanup-desktop/app-shell-helpers

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

All clear

^{Posted via Macroscope — Effect Service Conventions}