Objective
Implement only the Content-Encoding half of #1999 on the current desktop transport epic. Keep endpoint-default centralization deferred because it overlaps active discovery/Connect reconciliation.
Scope
Make bounded desktop pairing response validation interoperable with Fetch transparent decompression. Retain the 4 KiB decoded-body cap and all timeout, abort, redirect, UTF-8, JSON/schema, status, header and secret-handling checks, but never compare a compressed Content-Length header directly to transparently decoded bytes.
- Accept valid identity, gzip and Brotli responses after decoding.
- Reject malformed/truncated encoded bodies, decoded bodies over 4 KiB, conflicting/duplicate/unsupported encodings, invalid or ambiguous length metadata, redirects, timeouts, aborts, invalid UTF-8 and schema violations fail-closed.
- Preserve main-process-only pairing secrets and bounded redacted diagnostics; do not add renderer credential access.
- Prefer changes only in
packages/client/src/pairingProtocol.ts plus a focused new packages/client/test/pairingContentEncoding.test.ts; touch existing pairing transport tests only if essential. Do not change package manifests, lockfiles, endpoint defaults, runtime config, API auth, Electron profiles, discovery schema, or Connect URL logic.
Validation and integration
Add deterministic identity/gzip/br proxy fixtures proving decoded size enforcement and no compressed-length confusion. Run focused client/pairing tests, client build/lint, desktop tests/typecheck, Validate Changes, Full Suite and git diff-check.
Target only 1953-epic-desktop-transport-api via the base label. Never target or merge to main. Do not merge the generated PR until #1989 is integrated, then sync this PR against the cumulative transport head and request exact-head Ultrafix review.
Child follow-up to #1999, #1977, #1953 and #1950.
Objective
Implement only the Content-Encoding half of #1999 on the current desktop transport epic. Keep endpoint-default centralization deferred because it overlaps active discovery/Connect reconciliation.
Scope
Make bounded desktop pairing response validation interoperable with Fetch transparent decompression. Retain the 4 KiB decoded-body cap and all timeout, abort, redirect, UTF-8, JSON/schema, status, header and secret-handling checks, but never compare a compressed
Content-Lengthheader directly to transparently decoded bytes.packages/client/src/pairingProtocol.tsplus a focused newpackages/client/test/pairingContentEncoding.test.ts; touch existing pairing transport tests only if essential. Do not change package manifests, lockfiles, endpoint defaults, runtime config, API auth, Electron profiles, discovery schema, or Connect URL logic.Validation and integration
Add deterministic identity/gzip/br proxy fixtures proving decoded size enforcement and no compressed-length confusion. Run focused client/pairing tests, client build/lint, desktop tests/typecheck, Validate Changes, Full Suite and git diff-check.
Target only
1953-epic-desktop-transport-apivia the base label. Never target or merge to main. Do not merge the generated PR until #1989 is integrated, then sync this PR against the cumulative transport head and request exact-head Ultrafix review.Child follow-up to #1999, #1977, #1953 and #1950.