Fix desktop sidecar failing to start when the auth token begins with a dash (#1169)

The local server auth token is randomBytes(32).toString("base64url"), which
can begin with "-". The packaged app spawned the bundled CLI with the token as
a separate argument ("--auth-token", token), so a leading-dash token was parsed
as an unknown flag: the daemon printed its help and exited, and the desktop
showed a fatal "local Executor server crashed during startup" dialog. It is
persistent (the token is saved) and cross-platform, hitting about 1 in 64 fresh
installs.

Pass the token in the combined "--auth-token=<value>" form so a leading dash is
treated as the value, not a flag.

Author: RhysSullivan

.changeset/desktop-sidecar-auth-token-dash.md

@@ -0,0 +1,5 @@
+---
+"executor": patch
+---
+
+Fix the desktop app failing to start its local server when the generated auth token begins with a dash. The token is `randomBytes(32).toString("base64url")`, which can start with "-", and the packaged app passed it to the bundled CLI as a separate argument (`--auth-token`, then the token). The CLI then read the leading-dash token as an unknown flag, printed its help, and exited, so the desktop showed a fatal "local Executor server crashed during startup" dialog. This was persistent (the token is saved) and cross-platform, affecting roughly 1 in 64 fresh installs. The token is now passed in the combined `--auth-token=<value>` form so a leading dash is treated as the value.

apps/desktop/src/main/sidecar.ts

@@ -237,8 +237,12 @@ const resolveSidecarCommand = (input: {
         String(input.port),
         "--hostname",
         input.hostname,
-        "--auth-token",
-        input.authToken,
+        // Combined `--flag=value` form: the auth token is base64url and can
+        // start with "-", which the space-separated form makes the CLI parser
+        // read as an unknown flag, so the daemon prints help and exits and the
+        // desktop reports a fatal "server crashed during startup". Persistent
+        // until the token rotates, and cross-platform (~1 in 64 fresh installs).
+        `--auth-token=${input.authToken}`,
       ],
       cwd: process.resourcesPath,
       cliManagedManifest: true,