fix(desktop): preserve Cloud sign-in during policy suspension

[yomgui]

Summary

This restores the OpenWork Cloud first-launch sign-in gate while desktop policy enforcement is suspended. It also keeps request-body validation active before suspended policy actions no-op, preserves host-token verification for identity installation, and updates proxy coverage to reflect that local prompts no longer read the desktop-policy endpoint.

This does not change external-link policy decisions or make suspended desktop policy blocking again. Link-policy authority and fail-closed routing remain owned by #5123; that pull request was not merged or copied here.

The desktop-policy change intentionally suspended organization restriction enforcement and made Den policy outages non-blocking for local work. This repair keeps that behavior while restoring the independent request parsing and Cloud distribution first-launch gate, and adds an explicit regression check that identity installation remains host-authenticated.

The regression came from treating every desktop requireSignin value as optional and from returning before the proxy request parser. Cloud distributions now preserve their immutable sign-in requirement, ordinary desktop policy sign-in remains optional, and malformed prompt bodies are rejected before engine forwarding. The activated Enterprise package check now expects the intended local session shell rather than the suspended policy sign-in gate. Detailed control/red/repaired receipts are in reports/rca-desktop-policy-ci-regression-2026-09-18.md.

Screenshots

Before — packaged Cloud first launch incorrectly exposes the ordinary session shell.

After — a fresh packaged Cloud profile renders the expected Welcome to OpenWork sign-in gate.

Verification

• bun --conditions=development test src/opencode-proxy.e2e.test.ts — 30 passed
• bun --conditions=development test src/managed-desktop-policy.test.ts — 5 passed
• bun test tests/desktop-policy-optional.test.ts — 4 passed
• root pnpm typecheck — passed
• pnpm typecheck in apps/server — passed
• pnpm --filter @openwork/types build — passed
• fresh unsigned macOS arm64 Cloud and Enterprise package builds — passed
• pnpm evals:e2e packaged-first-launch --local — 1 passed; published test evidence
• pnpm evals:e2e packaged-activated-launch --local — 1 passed; Linux package proof is also in openwork-tests-build
• openwork-tests-core — passed
• openwork-tests-required — passed
• pnpm --dir evals typecheck — blocked by 12 existing progressbar/TargetRole errors, reproduced unchanged on origin/dev

Verification lane: local macOS plus manually dispatched GitHub build/core checks. The unrelated extended matrix was canceled after all required jobs completed successfully.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

4 Skipped Deployments

Project	Deployment	Actions	Updated
openwork-app	Ignored	Preview	Sep 18, 2026 5:12pm UTC
openwork-den	Ignored	Preview	Sep 18, 2026 5:12pm UTC
openwork-diagnostics	Ignored	Preview	Sep 18, 2026 5:12pm UTC
openwork-landing	Ignored	Preview	Sep 18, 2026 5:12pm UTC

[yomgui]

Test evidence — a packaged flavor renders its first-launch gate without a render crash — ✅ passed

SHA 23a81a7 · engine v1

✅ 0/1 screenshots passed · 1 assertion · 1 expectations passed · 0 failed · 0 pending

[probe] eventually(packaged distribution flavor) · eventually(cloud first-launch gate mounted in #root)
[user] see(text=Welcome to OpenWork) · notSee(text=/OpenWork hit an unexpected error|OpenWork couldn't start/) · screenshot
verdict passed · 3 user observations (see ×1, notSee ×1, screenshot ×1) · 2 probes · steps 0/0

ℹ️ ASSERTION — 1. The cloud desktop mounts "Welcome to OpenWork" on first launch without a render crash or an unexpected unhandled rejection

Final #root after 3000 ms: "OpenWork\nWelcome to OpenWork\n\nYour computer, but it works for you.\n\nSign in to OpenWork\nUsing OpenWork on-premises?\nPaste sign-in code"; visible enabled controls: [{"tag":"button","text":"Sign in to OpenWork","testId":null,"visible":true,"enabled":true},{"tag":"button","text":"Using OpenWork on-premises?","testId":null,"visible":true,"enabled":true},{"tag":"button","text":"Paste sign-in code","testId":null,"visible":true,"enabled":true}]; render crashes: 0; allowlisted rejections: 0 of 0 known; unexpected rejections: 0

• ✅ PASS The cloud desktop mounts "Welcome to OpenWork" on first launch without a render crash or an unexpected unhandled rejection — Final #root after 3000 ms: "OpenWork\nWelcome to OpenWork\n\nYour computer, but it works for you.\n\nSign in to OpenWork\nUsing OpenWork on-premises?\nPaste sign-in code"; visible enabled controls: [{"tag":"button","text":"Sign in to OpenWork","testId":null,"visible":true,"enabled":true},{"tag":"button","text":"Using OpenWork on-premises?","testId":null,"visible":true,"enabled":true},{"tag":"button","text":"Paste sign-in code","testId":null,"visible":true,"enabled":true}]; render crashes: 0; allowlisted rejections: 0 of 0 known; unexpected rejections: 0

⚪ UNVALIDATED — 2. a packaged flavor renders its first-launch gate without a render crash artifact 1

• ⚪ UNVALIDATED — no visual expectations recorded.

---

Test run created 2026-09-18T17:12:38.326Z · Source: evals/results/test-runs/2026-09-18T17-12-38-325Z-a-packaged-flavor-renders-its-first-launch-gate-without-a-render-crash/test-run.json · Repro: pnpm --dir evals artifacts:publish -- --pr 5140 --test-run 2026-09-18T17-12-38-325Z-a-packaged-flavor-renders-its-first-launch-gate-without-a-render-crash