[waleedlatif1]

Summary

• Electron can't use iCloud Keychain passkeys, the phone/QR flow, Google Password Manager passkeys, or PIN-protected security keys (Chrome-only code), so sites like the AWS console offer a passkey and then hang in the agent browser. This adds the escape hatch other embedded-browser apps use: finish the sign-in in your real browser
• "Continue in Chrome" (or the chosen Chrome-family profile) opens the tab's page there via open -n -b <bundleId> --args --profile-directory=… (no shell); a notice then offers Bring session back, which imports that site's cookies and reloads the original tab
• Per-site import is scoped to the page's registrable domain (tldts, private suffixes respected), filtered in SQL and checked per row before decryption; whole-profile import is unchanged
• One pending handoff per chat, held in main with the resolved profile; the URL is read from the tab in main, never from the renderer; app-origin + user-gesture gated; no agent tool can reach it
• A subtle hint appears on known sign-in hosts ("Signing in with a passkey? Finish in Chrome…"), dismissible per host
• Capability-detected: hidden on older shells, off macOS, or when no Chromium browser is installed; old web apps never call the new channels
• Shared BrowserNotice now also backs the theme notice; the profile list is one React Query query shared with the browser import dialog

Type of Change

• New feature

Testing

• site-scope.test.ts (scope leaks: lookalikes, github.io tenants, IP/localhost exact, leading dots), chromium-cookies.test.ts (out-of-scope rows never decrypted or counted), import-service.test.ts, new browser-import/index.test.ts (continue/bring-back/cancel/race), ipc.test.ts (gesture/origin gating, renderer URL ignored, closed-tab reopen), sign-in-hosts.test.ts, browser-session suite
• e2e/continue-sign-in.spec.ts (real Electron, JSON report): feature present with no browsers offered when none installed; scripted call without a click refused; main reads the tab URL and refuses http
• Red→green by reverting each guard
• Not exercised automatically: the real round-trip through an installed Chrome + Keychain prompt — needs a manual check on a Mac
• desktop tsc --noEmit, changed-file type-check in apps/sim, biome, check:desktop-ipc, check:desktop-bridge, check:react-query, check:comment-hygiene; full gate in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 31, 2026 9:29am UTC

[greptile-apps]

Confidence Score: 5/5

[Critical impact] The PR appears safe to merge, with a non-blocking stale-notice issue after a failed replacement launch.

Findings

1.  Failed launch leaves stale notice ▶

Summary

Adds a browser escape hatch for passkey sign-ins:

• A sign-in can continue in another browser and return to its chat.
• The return flow imports cookies only for the page's site.
• The browser offers a sign-in hint and a way to bring the session back.

One non-blocking issue remains: a failed replacement launch leaves an old sign-in notice in the renderer.

Diagram

sequenceDiagram
  participant User
  participant Panel
  participant Shell
  participant Browser
  User->>Panel: Continue in browser
  Panel->>Shell: Chosen profile and chat
  Shell->>Shell: Check sender, click, scope, and tab URL
  Shell->>Browser: Open page in chosen profile
  User->>Browser: Finish signing in
  User->>Panel: Bring session back
  Panel->>Shell: Import pending sign-in
  Shell->>Shell: Read scoped cookies and reopen page
  Shell-->>Panel: Import counts

Loading

_{Reviews (2) · Last reviewed commit: "fix(desktop): keep sign-in handoffs curr..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 31 files

<sub>This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 32 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>