fix: SSH auth decoding for JSON date strings

[LLBlumire]

Fixes #2786

What Changed

• Add JSON auth result schemas that decode ISO UTC date strings into DateTime.Utc.
• Use those schemas when decoding SSH remote auth responses for:
  • bearer bootstrap
  • session state
  • websocket token issuance
• Add regression coverage for the remote response shape reported in [Bug]: SSH BUG WINDOWS #2786.

Why

The remote server returns expiresAt over HTTP JSON as an ISO string, but the desktop SSH client decoded the parsed JSON with schemas expecting Schema.DateTimeUtc directly. That caused bootstrap to fail with: Expected DateTime.Utc, got "2026-06-26T13:15:36.023Z"

Testing

• bun run vitest run apps/desktop/src/ssh/DesktopSshRemoteApi.test.ts
• bun run --filter @t3tools/contracts typecheck
• bun run --filter @t3tools/desktop typecheck
• bun run --filter @t3tools/web typecheck
• bun fmt
• bun lint

No UI changes

---

Note

Low Risk
Narrow contract and desktop SSH client decode-path fix with regression tests; no auth policy or server behavior changes.

Overview
Fixes SSH remote auth failing when the server returns expiresAt as ISO strings in JSON (e.g. bootstrap error: expected DateTime.Utc, got a string).

Adds parallel JSON wire schemas in contracts (AuthBearerBootstrapJsonResult, AuthSessionJsonState, AuthWebSocketTokenJsonResult) that decode expiresAt via Schema.DateTimeUtcFromString, while keeping the existing in-memory types unchanged. DesktopSshRemoteApi now decodes bearer bootstrap, session state, and WebSocket token responses with those JSON schemas.

Adds a regression test that stubs the three auth endpoints with string timestamps and asserts they round-trip to DateTime via DateTime.formatIso.

^{Reviewed by Cursor Bugbot for commit 553ba54. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix SSH auth decoding of ISO timestamp strings for expiresAt fields

The SSH remote API was failing to decode expiresAt fields in JSON responses because the existing schemas expected native date types rather than ISO string representations.

• Adds JSON-specific schemas (AuthBearerBootstrapJsonResult, AuthWebSocketTokenJsonResult, AuthSessionJsonState) in auth.ts that use Schema.DateTimeUtcFromString for expiresAt.
• Updates decoders in DesktopSshRemoteApi.ts for bootstrapBearerSession, fetchSessionState, and issueWebSocketToken to use the new JSON schemas.
• Adds tests verifying that ISO timestamp strings round-trip correctly through decoding via DateTime.formatIso.

^{Macroscope summarized 553ba54.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 5c91bb9a-5ad2-4732-94c4-a49b26ffc988

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a258ba4. Configure here.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR fixes JSON date string parsing in SSH authentication responses by adding new schemas with DateTimeUtcFromString. While the change is a straightforward parsing fix with good test coverage, it modifies auth-related code paths which warrants human review per security-sensitive file guidelines.

^{You can customize Macroscope's approvability policy. Learn more.}

Dismissing prior approval to re-evaluate 553ba54