fix(desktop): require an explicit accept for every sign-in prompt answer and arm prompts only while visible

Author: waleedlatif1

apps/desktop/e2e/browser-sign-in-prompts.spec.ts

@@ -504,10 +504,11 @@ createRoot(document.getElementById('root')).render(createElement(Fixture));`,
         } })
         await make('user-ada', 'ada@example.com')
         await make('user-grace', 'grace@example.com')
-        globalThis.passkeyResult = navigator.credentials.get({ publicKey: {
+        globalThis.passkeyOutcome = 'pending'
+        navigator.credentials.get({ publicKey: {
           challenge: new Uint8Array(16), rpId: 'localhost', userVerification: 'preferred',
         } }).then((credential) => new TextDecoder().decode(credential.response.userHandle),
-          (error) => 'error:' + error.name)
+          (error) => 'error:' + error.name).then((outcome) => { globalThis.passkeyOutcome = outcome })
         return 'created'
       })()`
       )
@@ -520,26 +521,31 @@ createRoot(document.getElementById('root')).render(createElement(Fixture));`,
       expect(
         prompt?.kind === 'passkey-account' && prompt.accounts.map((account) => account.name).sort()
       ).toEqual(['ada@example.com', 'grace@example.com'])
-      // A stray Enter must never send an identity: nothing is preselected, and Enter refuses.
+      // A stray Enter must never send an identity: nothing is preselected and Enter does not
+      // continue. It dismisses when the prompt has keyboard focus and is ignored when it does
+      // not (as on a CI runner without window focus); either way, refuse and ask again.
+      const passkeyOutcome = () => pageAt<string>(passkeyPage, 'globalThis.passkeyOutcome')
       await shell.keyboard.press('Enter')
-      await expect
-        .poll(() => pageAt<string>(passkeyPage, 'globalThis.passkeyResult'))
-        .toBe('error:NotAllowedError')
+      await sleep(QUIET_MS)
+      expect(['pending', 'error:NotAllowedError']).toContain(await passkeyOutcome())
+      if ((await passkeyOutcome()) === 'pending') {
+        await shell.getByRole('button', { name: 'Cancel', exact: true }).click()
+      }
+      await expect.poll(passkeyOutcome).toBe('error:NotAllowedError')
       await pageAt(
         passkeyPage,
-        `globalThis.passkeyResult = navigator.credentials.get({ publicKey: {
+        `globalThis.passkeyOutcome = 'pending'
+        navigator.credentials.get({ publicKey: {
           challenge: new Uint8Array(16), rpId: 'localhost', userVerification: 'preferred',
         } }).then((credential) => new TextDecoder().decode(credential.response.userHandle),
-          (error) => 'error:' + error.name); 'asked'`
+          (error) => 'error:' + error.name).then((outcome) => { globalThis.passkeyOutcome = outcome }); 'asked'`
       )
       await expect.poll(pagePrompt).toMatchObject({ kind: 'passkey-account' })
       const dialog = shell.getByRole('dialog')
       await dialog.getByRole('button').filter({ hasText: 'Choose an account' }).click()
       await shell.getByRole('menuitemradio', { name: 'grace@example.com' }).click()
       await shell.getByRole('button', { name: 'Continue', exact: true }).click()
-      await expect
-        .poll(() => pageAt<string>(passkeyPage, 'globalThis.passkeyResult'))
-        .toBe('user-grace')
+      await expect.poll(passkeyOutcome).toBe('user-grace')
       expect(await pagePrompt()).toBeNull()
     })
     passed = true

apps/desktop/src/main/browser-agent/page-prompts.test.ts

@@ -11,11 +11,12 @@ import type {
   WebContents,
   WebFrameMain,
 } from 'electron'
-import { app, shell } from 'electron'
+import { app, webContents as electronWebContents, shell } from 'electron'
 import {
   appLaunchNoticeForContents,
   handleBrowserLogin,
   handleSelectClientCertificate,
+  handleSelectPasskeyAccount,
   httpAuthChallenge,
   noteMainFrameNavigation,
   pagePromptForContents,
@@ -309,3 +310,90 @@ describe('app links', () => {
     expect(shell.openExternal).toHaveBeenCalledExactlyOnceWith('zoommtg://zoom.us/join?id=1')
   })
 })
+
+describe('accepting an answer', () => {
+  const topFrame = { parent: null, frameTreeNodeId: 1, origin: PAGE } as WebFrameMain
+
+  /** What a renderer could send over IPC without `allowed: true`, which the gesture gate keys on. */
+  function withoutAllowed(response: Record<string, unknown>): BrowserPagePromptResponse {
+    // double-cast-allowed: an IPC payload is untyped; this is the shape a hostile renderer could send
+    return response as unknown as BrowserPagePromptResponse
+  }
+
+  it.each([
+    [
+      'client-certificate',
+      { kind: 'client-certificate', choiceId: 'sha256/first' },
+      (contents: WebContents, callback: () => void) =>
+        handleSelectClientCertificate(
+          { preventDefault: () => {} },
+          contents,
+          'https://mtls.corp',
+          [{ fingerprint: 'sha256/first', subjectName: 'Personal' } as Certificate],
+          callback
+        ),
+    ],
+    [
+      'passkey-account',
+      { kind: 'passkey-account', choiceId: 'credential-1' },
+      (contents: WebContents, callback: () => void) => {
+        vi.mocked(electronWebContents.fromFrame).mockReturnValue(contents)
+        handleSelectPasskeyAccount(
+          {},
+          {
+            relyingPartyId: 'meet.example',
+            accounts: [{ credentialId: 'credential-1', name: 'ada', userHandle: 'u1' }],
+            frame: topFrame,
+          },
+          callback
+        )
+      },
+    ],
+    [
+      'http-auth',
+      { kind: 'http-auth', username: 'ada', password: 'pw' },
+      (contents: WebContents, callback: () => void) => {
+        noteMainFrameNavigation(contents, 'https://intranet.example/')
+        handleBrowserLogin(
+          { preventDefault: () => {} },
+          contents,
+          {
+            url: 'https://intranet.example/',
+            isRequestForNavigation: true,
+            firstAuthAttempt: true,
+          } as AuthenticationResponseDetails,
+          { isProxy: false, scheme: 'basic', host: 'intranet.example', port: 443 } as AuthInfo,
+          callback
+        )
+      },
+    ],
+  ])('sends nothing for a %s answer without allowed: true', (_kind, response, ask) => {
+    const contents = agentContents()
+    const callback = vi.fn()
+    ask(contents, callback)
+    answer(contents, withoutAllowed(response))
+    expect(callback).toHaveBeenCalledExactlyOnceWith()
+  })
+
+  it.each([
+    ['an app prompt', { kind: 'external-app', alwaysAllow: true }, 'prompt'],
+    ['an app notice', { kind: 'app-launch-notice' }, 'notice'],
+  ])('opens nothing for %s answer without allowed: true', async (_label, response, slot) => {
+    app.getApplicationNameForProtocol = vi.fn(() => 'Zoom')
+    vi.mocked(shell.openExternal).mockClear()
+    context.userActivated = slot === 'prompt'
+    const contents = agentContents()
+    requestExternalLaunch(contents, 'zoommtg://zoom.us/join', { initiator: topFrame })
+    const requestId =
+      slot === 'prompt'
+        ? shownPrompt(contents).requestId
+        : appLaunchNoticeForContents(contents)?.requestId
+    respondToPagePrompt('chat', {
+      action: 'respond-prompt',
+      requestId,
+      response: withoutAllowed(response),
+    })
+    await vi.advanceTimersByTimeAsync(0)
+    expect(shell.openExternal).not.toHaveBeenCalled()
+  })
+})

apps/desktop/src/main/browser-agent/page-prompts.ts

@@ -289,7 +289,8 @@ export function respondToPagePrompt(scopeId: string, action: BrowserPanelAction)
     settle(entry, response)
     return
   }
-  settle(entry, response?.kind === entry.kind && context.onScreen ? response : null)
+  const accepted = response?.allowed === true && response.kind === entry.kind && context.onScreen
+  settle(entry, accepted ? response : null)
 }
 
 /**
@@ -321,6 +322,7 @@ export function httpAuthChallenge(
 /**
  * `app.on('login')` for agent browser tabs. Other contents keep Electron's
  * default, which cancels: the main window's proxy prompt needs a shell form.
+ * The prompt never takes focus, since a page can trigger it on its own.
  */
 export function handleBrowserLogin(
   event: { preventDefault(): void },
@@ -357,7 +359,7 @@ export function handleBrowserLogin(
           answer()
         }
       },
-      { joinable: true, focus: true }
+      { joinable: true }
     )
     if (held === 'held') {
       prompts.push(Date.now())
@@ -468,7 +470,7 @@ export function handleSelectClientCertificate(
           return
         }
         const certificate =
-          response?.kind === 'client-certificate'
+          response?.allowed === true && response.kind === 'client-certificate'
             ? certificates.find((candidate) => candidate.fingerprint === response.choiceId)
             : undefined
         if (!certificate) {
@@ -574,6 +576,7 @@ export function requestExternalLaunch(
         }
         launchAppLink(target.url)
       },
+      // The prompt answers the user's own click in the page, so it takes the focus that click had.
       { focus: true }
     )
     if (held) attempts.push(Date.now())

apps/desktop/src/main/browser-agent/session.ts

@@ -4141,7 +4141,10 @@ export async function clearProfileStorage(): Promise<void> {
   await clearBrowserSignIns(ses)
 }
 
-/** HTTP credentials Chromium caches, and remembered certificate and app-launch choices. */
+/**
+ * Sign-out forgets every HTTP credential Chromium cached for browser tabs, in the
+ * borrowed app session too, and the remembered certificate and app-launch choices.
+ */
 async function clearBrowserSignIns(agentSession: Session): Promise<void> {
   resetPagePromptDecisions()
   await agentSession.clearAuthCache()
@@ -4179,7 +4182,7 @@ export async function clearAgentData(kinds: readonly BrowserDataKind[]): Promise
   if (storages.length > 0) {
     await ses.clearStorageData({ storages } as Parameters<Session['clearStorageData']>[0])
   }
-  if (kinds.includes('cookies')) await clearBrowserSignIns(ses)
+  if (kinds.includes('cookies')) await ses.clearAuthCache()
   if (kinds.includes('cache')) {
     await ses.clearCache()
     // Resolved-host verdicts are a cache too, and a user clearing the cache

apps/desktop/src/test/electron-mock.ts

@@ -107,6 +107,11 @@ export const session = {
   fromPartition: vi.fn(),
 }
 
+/** Resolves a frame to its WebContents; tests return the contents they registered. */
+export const webContents = {
+  fromFrame: vi.fn(),
+}
+
 export const protocol = {
   registerSchemesAsPrivileged: vi.fn(),
   handle: vi.fn(),

apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-content/components/browser-session/browser-page-prompt.tsx

@@ -32,13 +32,21 @@ const ACTIVATION_DELAY_MS = 500
 
 type RespondToPrompt = (requestId: string, response: BrowserPagePromptResponse) => void
 
-/** False until the prompt has been on screen long enough to be read; remount per request. */
-function useActivationDelay(): boolean {
+/**
+ * False until the prompt has been visible long enough to be read. Hiding it
+ * disarms it again, so a prompt shown after waiting behind another dialog
+ * starts its delay only once it appears.
+ */
+function useActivationDelay(visible: boolean): boolean {
   const [armed, setArmed] = useState(false)
   useEffect(() => {
+    if (!visible) {
+      setArmed(false)
+      return
+    }
     const timer = setTimeout(() => setArmed(true), ACTIVATION_DELAY_MS)
     return () => clearTimeout(timer)
-  }, [])
+  }, [visible])
   return armed
 }
 
@@ -48,7 +56,9 @@ interface PromptModalProps<Prompt extends BrowserPagePrompt> {
   onRespond: RespondToPrompt
 }
 
+/** Signing in takes a click on Sign in: Enter in a field never submits credentials a keystroke meant for the page. */
 function HttpAuthPromptModal({ prompt, open, onRespond }: PromptModalProps<BrowserHttpAuthPrompt>) {
+  const armed = useActivationDelay(open)
   const [username, setUsername] = useState('')
   const [password, setPassword] = useState('')
   const cancel = () => onRespond(prompt.requestId, { allowed: false })
@@ -83,7 +93,12 @@ function HttpAuthPromptModal({ prompt, open, onRespond }: PromptModalProps<Brows
       </ChipModalBody>
       <ChipModalFooter
         onCancel={cancel}
-        primaryAction={{ label: 'Sign in', onClick: submit, disabled: !username && !password }}
+        defaultAction='dismiss'
+        primaryAction={{
+          label: 'Sign in',
+          onClick: submit,
+          disabled: !armed || (!username && !password),
+        }}
       />
     </ChipModal>
   )
@@ -119,7 +134,7 @@ function ChoicePromptModal({
   onCancel,
   onChoose,
 }: ChoicePromptModalProps) {
-  const armed = useActivationDelay()
+  const armed = useActivationDelay(open)
   const [choiceId, setChoiceId] = useState('')
   return (
     <ChipModal open={open} onOpenChange={(next) => !next && onCancel()} srTitle={title} size='sm'>
@@ -219,7 +234,7 @@ function ExternalAppPromptModal({
   open,
   onRespond,
 }: PromptModalProps<BrowserExternalAppPrompt>) {
-  const armed = useActivationDelay()
+  const armed = useActivationDelay(open)
   const [alwaysAllow, setAlwaysAllow] = useState(false)
   const checkboxId = `browser-always-open-${prompt.requestId}`
   return (
@@ -289,7 +304,7 @@ interface BrowserAppLaunchNoticeBarProps {
 
 /** A page's unprompted request to open another app; nothing opens until the user chooses Open. */
 export function BrowserAppLaunchNoticeBar({ notice, onRespond }: BrowserAppLaunchNoticeBarProps) {
-  const armed = useActivationDelay()
+  const armed = useActivationDelay(true)
   return (
     <Banner className='border-[var(--border)] border-t bg-[var(--surface-3)] px-3 py-1.5'>
       <div className='flex items-center justify-between gap-3'>

packages/browser-protocol/src/index.ts

@@ -358,7 +358,7 @@ export interface BrowserHttpAuthPrompt {
   retry: boolean
 }
 
-export interface BrowserPasskeyAccount {
+interface BrowserPasskeyAccount {
   /** The credential id the shell resolves the choice by. */
   id: string
   name: string
@@ -373,7 +373,7 @@ export interface BrowserPasskeyPrompt {
   accounts: BrowserPasskeyAccount[]
 }
 
-export interface BrowserClientCertificate {
+interface BrowserClientCertificate {
   /** Certificate fingerprint; the shell resolves the choice by it. */
   id: string
   subject: string