feat(desktop): continue a passkey sign-in in your browser and bring the session back by waleedlatif1 · Pull Request #9515 · simstudioai/sim

waleedlatif1 · 2026-10-31T08:29:04Z

Summary

Electron can't use iCloud Keychain passkeys, the phone/QR flow, Google Password Manager passkeys, or PIN-protected security keys (Chrome-only code), so sites like the AWS console offer a passkey and then hang in the agent browser. This adds the escape hatch other embedded-browser apps use: finish the sign-in in your real browser
"Continue in Chrome" (or the chosen Chrome-family profile) opens the tab's page there via open -n -b <bundleId> --args --profile-directory=… (no shell); a notice then offers Bring session back, which imports that site's cookies and reloads the original tab
Per-site import is scoped to the page's registrable domain (tldts, private suffixes respected), filtered in SQL and checked per row before decryption; whole-profile import is unchanged
One pending handoff per chat, held in main with the resolved profile; the URL is read from the tab in main, never from the renderer; app-origin + user-gesture gated; no agent tool can reach it
A subtle hint appears on known sign-in hosts ("Signing in with a passkey? Finish in Chrome…"), dismissible per host
Capability-detected: hidden on older shells, off macOS, or when no Chromium browser is installed; old web apps never call the new channels
Shared BrowserNotice now also backs the theme notice; the profile list is one React Query query shared with the browser import dialog

Type of Change

New feature

Testing

site-scope.test.ts (scope leaks: lookalikes, github.io tenants, IP/localhost exact, leading dots), chromium-cookies.test.ts (out-of-scope rows never decrypted or counted), import-service.test.ts, new browser-import/index.test.ts (continue/bring-back/cancel/race), ipc.test.ts (gesture/origin gating, renderer URL ignored, closed-tab reopen), sign-in-hosts.test.ts, browser-session suite
e2e/continue-sign-in.spec.ts (real Electron, JSON report): feature present with no browsers offered when none installed; scripted call without a click refused; main reads the tab URL and refuses http
Red→green by reverting each guard
Not exercised automatically: the real round-trip through an installed Chrome + Keychain prompt — needs a manual check on a Mac
desktop tsc --noEmit, changed-file type-check in apps/sim, biome, check:desktop-ipc, check:desktop-bridge, check:react-query, check:comment-hygiene; full gate in CI

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-10-31T08:29:07Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 31, 2026 9:29am UTC

greptile-apps · 2026-10-31T08:33:20Z

Confidence Score: 5/5

[Critical impact] The PR appears safe to merge, with a non-blocking stale-notice issue after a failed replacement launch.

Findings

Failed launch leaves stale notice ▶

Summary

Adds a browser escape hatch for passkey sign-ins:

A sign-in can continue in another browser and return to its chat.
The return flow imports cookies only for the page's site.
The browser offers a sign-in hint and a way to bring the session back.

One non-blocking issue remains: a failed replacement launch leaves an old sign-in notice in the renderer.

Diagram

sequenceDiagram
  participant User
  participant Panel
  participant Shell
  participant Browser
  User->>Panel: Continue in browser
  Panel->>Shell: Chosen profile and chat
  Shell->>Shell: Check sender, click, scope, and tab URL
  Shell->>Browser: Open page in chosen profile
  User->>Browser: Finish signing in
  User->>Panel: Bring session back
  Panel->>Shell: Import pending sign-in
  Shell->>Shell: Read scoped cookies and reopen page
  Shell-->>Panel: Import counts

_{Reviews (2) · Last reviewed commit: "fix(desktop): keep sign-in handoffs curr..." · Reviewed by Greptile}

cubic-dev-ai

All reported issues were addressed across 31 files

_{This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-10-31T08:58:58Z

@greptile

waleedlatif1 · 2026-10-31T08:58:59Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-31T08:59:04Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 32 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

…he session back - From an agent browser tab, open the page in a chosen Chrome-family profile, finish the sign-in there, then bring that site's cookies back - Per-site import scoped to the page's registrable domain (tldts, private suffixes respected), filtered in SQL and checked per row before decryption - One pending handoff per chat in main; a remounted panel restores its Bring session back notice - Subtle hint on known sign-in hosts; hidden on older shells, off macOS, or with no Chromium browser installed

… and sign-out Retire in-flight launches on cancel, newer continue, and account teardown; move a provisional chat's handoff with its browser scope; skip reopening the tab when a bring-back's handoff was superseded; pin the platform in the continue-sign-in tests so they pass on Linux CI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…n shell support Re-read the chat's pending sign-in after any continue result so a failed launch that retired the previous handoff cannot leave a stale notice, and require the shell's continue-sign-in bridge before showing the feature, since the profiles cache is shared with the import dialog on older shells. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

waleedlatif1 requested a review from a team as a code owner October 31, 2026 08:29

greptile-apps Bot reviewed Oct 31, 2026

View reviewed changes

Comment thread apps/desktop/src/main/browser-import/index.ts Resolved

Comment thread apps/desktop/src/main/browser-import/index.ts Resolved

vercel Bot deployed to Preview October 31, 2026 08:34

View deployment

cubic-dev-ai Bot reviewed Oct 31, 2026

View reviewed changes

Comment thread apps/desktop/src/main/browser-import/index.ts Resolved

Comment thread apps/desktop/src/main/browser-import/index.ts Resolved

Comment thread apps/desktop/src/main/browser-import/index.ts Resolved

Comment thread apps/desktop/src/main/ipc.ts Resolved

waleedlatif1 force-pushed the feat/desktop-browser-continue-signin branch from b368cf8 to 457fdc2 Compare October 31, 2026 08:58

greptile-apps Bot reviewed Oct 31, 2026

View reviewed changes

Comment thread apps/sim/hooks/queries/browser-import.ts Resolved

vercel Bot deployed to Preview October 31, 2026 09:03

View deployment

cubic-dev-ai Bot reviewed Oct 31, 2026

View reviewed changes

Comment thread ...thership-view/components/resource-content/components/browser-session/use-continue-sign-in.ts Resolved

Comment thread ...thership-view/components/resource-content/components/browser-session/use-continue-sign-in.ts Resolved

waleedlatif1 and others added 3 commits October 31, 2026 02:24

waleedlatif1 force-pushed the feat/desktop-browser-continue-signin branch from 457fdc2 to 35c64f8 Compare October 31, 2026 09:25

vercel Bot deployed to Preview October 31, 2026 09:29

View deployment

waleedlatif1 merged commit 5f00f19 into staging Oct 31, 2026
76 checks passed

waleedlatif1 deleted the feat/desktop-browser-continue-signin branch October 31, 2026 17:45

waleedlatif1 mentioned this pull request Oct 31, 2026

fix(desktop): ask before an update restart from the menu, count uploads and downloads as running work, and harden sign-in prompts #9533

Merged

6 tasks done

Conversation

waleedlatif1 commented Oct 31, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Findings

Summary

Diagram

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 31, 2026

Uh oh!

waleedlatif1 commented Oct 31, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 31, 2026

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Oct 31, 2026 •

edited

Loading

greptile-apps Bot commented Oct 31, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading