[waleedlatif1]

Summary

• window.open('') / about:blank popups returned null in agent browser tabs, breaking blank-then-navigate sign-in and payment flows (e.g. MSAL's default popup). They are now adopted as tabs that keep window.opener, matching Electron's docs and Min; their first real navigation still passes the http-only and network guards
• An adopted popup's session is read from the contents Chromium created, not its URL — a blank popup from a Sim page would otherwise have registered the app session as the agent partition
• A target=_blank form POST that we would have to reissue (cross-session or background) is refused instead of silently resent as a GET with no body; reissued links keep their referrer
• Closing a popup returns to its opener instead of the neighbouring tab, unless the user switched tabs since it opened (Chrome's ForgetAllOpeners rule)
• mailto: links in the app window (chat links, the offline page's Contact support) open the mail client; attach=, unknown headers, and malformed addresses are refused

Type of Change

• Bug fix

Testing

• apps/desktop/e2e/browser-tools.spec.ts: blank popup keeps opener + postMessage round-trip + close returns to opener; opener forgotten after a manual tab switch; data: popup still denied; same-session form POST arrives as POST, cross-session POST opens nothing; Sim-origin blank popup keeps its opener
• Red→green for each guard (blank adoption, opener activation, forget-on-switch, POST refusal, popup session)
• navigation.test.ts + session.test.ts (90 pass), desktop tsc --noEmit, biome on changed files; full gate in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 31, 2026 8:13am UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge.

Summary

Keeps blank sign-in popups inside the agent browser while preserving their opener.

• Blank sign-in popups stay connected to the page that opened them.
• New-tab form posts keep their body or are refused.
• Safe mail links open in the desktop mail client.

No actionable issues were found. Tests were inspected, not run.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Open[Page opens popup] --> Adopt{Blank or same-session HTTP URL?}
  Adopt -->|Yes| Contents[Adopt Chromium contents]
  Adopt -->|No| Post{Form POST?}
  Post -->|Yes| Deny[Refuse request]
  Post -->|No| Separate[Open checked HTTP URL in separate tab]
  Contents --> Navigate[First real navigation]
  Navigate --> Guards[Check scheme, network, and session]
  Guards -->|Same session and allowed| Load[Load page with opener]
  Guards -->|Different session, GET| Separate
  Guards -->|Unsafe or different-session POST| Deny

Loading

_{Reviews (1) · Last reviewed commit: "fix(desktop): keep sign-in popups workin..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 5 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>