feat: add headless t3 connect setup for SSH hosts

.env.example

@@ -18,6 +18,10 @@
 # Get this from your relay deployment. `infra/relay` deploys update it automatically.
 # T3CODE_RELAY_URL=https://relay.example.com
 
+# Optional: hosted app origin used by the CLI's out-of-band OAuth flow.
+# Defaults to https://app.t3.codes; override to test against a staging deployment.
+# T3CODE_HOSTED_APP_URL=https://nightly.app.t3.codes
+
 # Public, ingest-only mobile OpenTelemetry configuration.
 # T3CODE_MOBILE_OTLP_TRACES_URL=https://api.axiom.co/v1/traces
 # T3CODE_MOBILE_OTLP_TRACES_DATASET=t3-code-mobile-traces-dev

apps/server/src/bin.test.ts

@@ -236,7 +236,7 @@ it.layer(NodeServices.layer)("bin cli parsing", (it) => {
     }),
   );
 
-  it.effect("logs in to headless connect without enabling access", () =>
+  it.effect("accepts the --headless login override without enabling access", () =>
     Effect.gen(function* () {
       const baseDir = NodeFS.mkdtempSync(
         NodePath.join(NodeOS.tmpdir(), "t3-cli-cloud-login-test-"),
@@ -254,7 +254,7 @@ it.layer(NodeServices.layer)("bin cli parsing", (it) => {
       );
 
       const login = yield* captureStdout(
-        runConnectCli(["connect", "login", "--base-dir", baseDir]),
+        runConnectCli(["connect", "login", "--base-dir", baseDir, "--headless"]),
       );
       const status = yield* captureStdout(
         runConnectCli(["connect", "status", "--base-dir", baseDir, "--json"]),

apps/server/src/cli/connect.test.ts

@@ -1,6 +1,7 @@
 import * as RelayClient from "@t3tools/shared/relayClient";
 import { assert, it } from "@effect/vitest";
 import * as Cause from "effect/Cause";
+import * as ConfigProvider from "effect/ConfigProvider";
 import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
 import * as Exit from "effect/Exit";
@@ -10,17 +11,30 @@ import * as References from "effect/References";
 
 import {
   acquireRelayClientForLink,
+  headlessSessionConfig,
   isPublishAgentActivityEnabledValue,
   reportCloudDisconnectResults,
 } from "./connect.ts";
 
+const readHeadlessSessionConfig = (env: Record<string, string>) =>
+  headlessSessionConfig.pipe(Effect.provide(ConfigProvider.layer(ConfigProvider.fromEnv({ env }))));
+
 const managedExecutable = {
   status: "available",
   executablePath: "/tmp/cloudflared",
   source: "managed",
   version: RelayClient.CLOUDFLARED_VERSION,
 } as const;
 
+it.effect("detects headless operation from individual SSH config values", () =>
+  Effect.gen(function* () {
+    assert.isFalse(yield* readHeadlessSessionConfig({}));
+    assert.isFalse(yield* readHeadlessSessionConfig({ CI: "true" }));
+    assert.isTrue(yield* readHeadlessSessionConfig({ SSH_CONNECTION: "client server" }));
+    assert.isTrue(yield* readHeadlessSessionConfig({ SSH_TTY: "/dev/pts/1" }));
+  }),
+);
+
 it.effect("does not install the relay client when the user declines the managed download", () =>
   Effect.gen(function* () {
     let installCalls = 0;