Fix Cloud Run desktop handoff den base URL

[devcool20]

Summary

• Fix desktop handoff denBaseUrl resolution for Google Cloud Run web origins.
• Move desktop handoff URL resolution into a small dependency-free helper so it can be tested directly.
• Add default support for *.run.app web hosts, which makes Cloud Run handoff links include /api/den.
• Add DEN_DESKTOP_HANDOFF_WEB_HOSTS for self-hosted/custom domains that also need /api/den.

Issue

Closes #1807

Root cause

resolveDesktopDenBaseUrl() only treated hardcoded OpenWork app hosts, app.*, and local/private hosts as web app hosts. Cloud Run frontend origins like:

https://den-web-123.us-central1.run.app

did not match that allowlist, so the generated desktop deep link used:

denBaseUrl=https://den-web-123.us-central1.run.app

The desktop app then called:

/v1/auth/desktop-handoff/exchange

on the web frontend instead of:

/api/den/v1/auth/desktop-handoff/exchange

Expected behavior

For a Cloud Run web origin, the generated handoff URL should include:

denBaseUrl=https://den-web-123.us-central1.run.app/api/den

Testing

• bun test ee/apps/den-api/test/desktop-handoff-url.test.ts
  • pass: 6 tests
• git diff --check
  • pass
• Manual validation:
  • Imported the real resolveDesktopDenBaseUrl() helper.
  • Simulated a Cloud Run request with origin=https://den-web-123.us-central1.run.app.
  • Confirmed output is https://den-web-123.us-central1.run.app/api/den.

Notes

• pnpm --filter @openwork-ee/den-api build could not complete locally because this workspace install cannot resolve stripe from src/stripe-billing.ts.
• Full bun test ee/apps/den-api/test hits the same existing stripe module-load failure in unrelated tests.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-landing	Ready	Preview, Comment, Open in v0	May 16, 2026 6:37am

[vercel]

@devcool20 is attempting to deploy a commit to the Different AI Team on Vercel.

A member of the Team first needs to authorize it.