[waleedlatif1]

Summary

• Site passwords (HTTP basic/digest + proxy): there was no login handler, so these silently cancelled and sites showed a bare 401. Agent tabs now get a Chrome-style prompt — only for the tab's own top-level navigation (or a proxy), origin shown, no server-chosen realm text, "not private" warning on http, re-prompt on a wrong password, capped per tab+origin across reloads. Credentials are never logged or persisted; the agent can't answer it and is told to wait
• Passkey account picker: registers select-webauthn-account; without it Electron cancelled every usernameless (discoverable) security-key sign-in even with one account
• Client certificates: Electron silently sent the first certificate to any agent-browser site that asked. Now nothing is sent unless the user picks one (subject, issuer, expiry); choices are remembered per session+host until restart. The main app window is unchanged
• App links (Zoom, Teams, Slack, Okta Verify, mailto…): were silently cancelled. Now: a user click shows "Open ?" naming the origin (Open armed after 500 ms); a page that launches on load gets a passive notice; agent input never launches; iframe-initiated launches are refused; hard denylist (file, smb, ms-msdt, search-ms, ms-officecmd, jnlp, …), registered handler required, rebuilt URL only, rate-limited; all launches go through openExternalSafe
• Keyjacking-safe: picker prompts have no preselection, Enter dismisses, Continue is armed after a delay, and they never steal focus
• Sign-out clears the HTTP auth cache and remembered certificate/always-allow decisions
• Removes the unused Bluetooth entitlement and usage string (Electron never starts the WebAuthn phone flow)
• Version skew: the renderer opts in via enable-page-dialogs { pagePrompts: true }; an older renderer gets today's behaviour (everything refused), an older shell ignores the flag

Type of Change

• Improvement

Testing

• New apps/desktop/e2e/browser-sign-in-prompts.spec.ts (10 checks, JSON report): older renderer still refuses; basic auth prompt/retry/sign-in; cross-origin subresource never prompts; agent navigation waits for the user; agent clicks never launch; user click prompts and opens only on Open; on-load launch gets the passive notice; rate limit; denied schemes never open; passkey picker via CDP virtual authenticator (stray Enter refuses)
• page-prompts.test.ts: URL validation/denylist, auth decision, certificate flow, frame attribution, reset on sign-out, single-launch-per-prompt
• Red→green for every guard by reverting it
• session/ipc/driver/security-guards/navigation/context-menu suites, browser-tools popup tests, browser-page-parity; desktop tsc, targeted apps/sim type-check, biome; full gate in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 31, 2026 10:08am UTC

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge, with a non-blocking cleanup gap when users clear browsing data.

Findings

1.  Certificate choices survive clearing data ▶

Summary

Adds user-controlled browser prompts for site passwords, passkey accounts, client certificates, and links to other apps.

• Browser sign-ins wait for the user to choose what gets sent.
• Agent-browser links ask before opening another app.
• macOS builds stop requesting unused Bluetooth access.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Page[Browser page asks] --> Shell[Shell checks the request]
  Shell -->|Unsupported renderer or refused request| Refuse[Cancel]
  Shell -->|Supported request| Prompt[Show prompt or notice]
  Prompt -->|User accepts| Check[Check scope, visible tab, and user action]
  Check -->|Allowed| Complete[Answer sign-in or open app]
  Prompt -->|Cancel or timeout| Refuse

Loading

_{Reviews (3) · Last reviewed commit: "fix(desktop): refuse window.open app lin..." · Reviewed by Greptile}

[cubic-dev-ai]

1 issue found across 16 files

Confidence score: 4/5

• In session.ts, clearing agent cookies also clears the app’s auth cache and remembered prompt decisions, which can disrupt the app session and reset user choices. Limit those clears to sign-out and keep clearAgentData scoped to agent data.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/desktop/src/main/browser-agent/session.ts">

<violation number="1" location="apps/desktop/src/main/browser-agent/session.ts:4182">
P2: Clearing agent cookies also clears the app session's auth cache and every remembered prompt decision. Limit the app-session clear and the decision reset to the sign-out path, and keep clearAgentData to the agent partition.</violation>
</file>

<sub>This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 17 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 18 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}