From ddf4e2fba3d96e8381465921b342b74e40ccff77 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Sat, 31 Oct 2026 00:52:22 -0700
Subject: [PATCH 1/2] fix(desktop): keep sign-in popups working in the agent
 browser

- Adopt window.open('') / about:blank popups as tabs that keep window.opener (MSAL-style sign-in and payment flows got null)
- Read an adopted popup's session from its contents, not its URL
- Refuse a form POST into a new tab rather than resending it as a GET; forward the referrer on reissued links
- Closing a popup returns to its opener unless the user switched tabs since (Chrome's rule)
- mailto: links in the app window open the mail client, with attach/extra headers refused
---
 apps/desktop/e2e/browser-tools.spec.ts        | 168 +++++++++++++++++-
 .../src/main/browser-agent/session.test.ts    |   2 +-
 .../desktop/src/main/browser-agent/session.ts |  76 +++++---
 apps/desktop/src/main/navigation.test.ts      |  31 ++++
 apps/desktop/src/main/navigation.ts           |  65 ++++++-
 5 files changed, 305 insertions(+), 37 deletions(-)

diff --git a/apps/desktop/e2e/browser-tools.spec.ts b/apps/desktop/e2e/browser-tools.spec.ts
index 3b573ad9df3..92e5e18d429 100644
--- a/apps/desktop/e2e/browser-tools.spec.ts
+++ b/apps/desktop/e2e/browser-tools.spec.ts
@@ -1,5 +1,5 @@
 import { mkdtempSync } from 'node:fs'
-import { createServer, type Server } from 'node:http'
+import { createServer, type IncomingMessage, type Server } from 'node:http'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -62,6 +62,36 @@ const CAPABILITIES_FIXTURE = `<!doctype html><title>Capabilities fixture</title>
 const POPUP_FIXTURE = `<!doctype html><title>Authorize fixture</title>
 <button onclick="window.opener.postMessage('granted', '*'); window.close()">Allow</button>`
 
+/** Sign-in and payment popup patterns: blank-then-navigate, and form posts into a new tab. */
+const popupsFixture = (
+  appOrigin: string,
+  popupOrigin: string
+) => `<!doctype html><title>Popups fixture</title>
+<form id="same-session" method="post" action="${popupOrigin}/echo" target="_blank"><input name="note" value="hello"></form>
+<form id="cross-session" method="post" action="${appOrigin}/echo" target="_blank"><input name="note" value="hello"></form>
+<script>
+  let popup = null;
+  function signIn() {
+    popup = window.open('', 'signin', 'width=400,height=400');
+    document.body.dataset.handle = String(popup !== null);
+    popup?.document.write('<script>opener.postMessage("ready", "*")<\\/script>');
+  }
+  addEventListener('message', (event) => {
+    if (event.data !== 'ready') return void (document.body.dataset.connected = event.data);
+    document.body.dataset.blank = 'ready';
+    popup.location.href = new URLSearchParams(location.search).get('next') || '${popupOrigin}/authorize';
+  });
+</script>`
+
+async function readBody(request: IncomingMessage): Promise<string> {
+  let body = ''
+  for await (const chunk of request) body += chunk.toString()
+  return body
+}
+
+const echoPage = (method: string | undefined, body: string) =>
+  `<!doctype html><title>${method} ${body}</title>`
+
 const UPLOAD_TARGET_FIXTURE = `<!doctype html><title>Upload target fixture</title>
 <div id="surface"></div>
 <script>
@@ -105,6 +135,7 @@ test.describe('browser tools', () => {
   let window: Page
   let callCount = 0
   let beforeUploadResponse: (() => Promise<void>) | undefined
+  const appEchoes: string[] = []
 
   test.beforeAll(async () => {
     server = createServer(async (request, response) => {
@@ -153,8 +184,7 @@ test.describe('browser tools', () => {
         return
       }
       if (path === '/api/desktop/tool/file') {
-        let body = ''
-        for await (const chunk of request) body += chunk.toString()
+        const body = await readBody(request)
         const { toolCallId, index } = JSON.parse(body)
         const reference = claimed.get(toolCallId)?.args.paths
         const found = Array.isArray(reference) && reference[index] === 'files/receipt.txt'
@@ -192,9 +222,25 @@ test.describe('browser tools', () => {
         )
         return
       }
+      if (path === '/echo') {
+        const body = await readBody(request)
+        appEchoes.push(`${request.method} ${body}`)
+        response.writeHead(200, { 'Content-Type': 'text/html' })
+        response.end(echoPage(request.method, body))
+        return
+      }
+      if (path === '/authorize') {
+        response.writeHead(200, { 'Content-Type': 'text/html' })
+        response.end(POPUP_FIXTURE)
+        return
+      }
+      if (path === '/popups') {
+        response.writeHead(200, { 'Content-Type': 'text/html' })
+        response.end(popupsFixture(origin, popupOrigin))
+        return
+      }
       if (path === '/api/desktop/tool/authorize') {
-        let body = ''
-        for await (const chunk of request) body += chunk.toString()
+        const body = await readBody(request)
         const authorization = calls.get(JSON.parse(body).toolCallId)
         calls.delete(JSON.parse(body).toolCallId)
         if (authorization) claimed.set(JSON.parse(body).toolCallId, authorization)
@@ -224,9 +270,11 @@ test.describe('browser tools', () => {
     origin = `http://127.0.0.1:${address.port}`
     /** Pages outside the app origin browse in the agent partition, like any third-party site. */
     site = origin.replace('127.0.0.1', 'localhost')
-    popupServer = createServer((_request, response) => {
+    popupServer = createServer(async (request, response) => {
       response.writeHead(200, { 'Content-Type': 'text/html' })
-      response.end(POPUP_FIXTURE)
+      response.end(
+        request.url === '/echo' ? echoPage(request.method, await readBody(request)) : POPUP_FIXTURE
+      )
     })
     await new Promise<void>((resolve) => popupServer.listen(0, '127.0.0.1', resolve))
     const popupAddress = popupServer.address()
@@ -276,6 +324,7 @@ test.describe('browser tools', () => {
 
   test.afterEach(async () => {
     beforeUploadResponse = undefined
+    appEchoes.length = 0
     await app?.close()
     calls.clear()
     claimed.clear()
@@ -626,6 +675,111 @@ test.describe('browser tools', () => {
       .toHaveLength(1)
   })
 
+  const tabsState = () =>
+    window.evaluate(
+      (scope) =>
+        (
+          globalThis as typeof globalThis & { simDesktop: SimDesktopApi }
+        ).simDesktop.browserAgent.activateScope(scope),
+      SCOPE
+    )
+  const tabUrls = async () => (await tabsState()).tabs.map((tab) => tab.url)
+  /** Runs script in a page with a user gesture, as the user's own click would. */
+  const inPage = (url: string, code: string) =>
+    app.evaluate(
+      ({ webContents }, { url, code }) =>
+        webContents
+          .getAllWebContents()
+          .find((contents) => contents.getURL() === url)
+          ?.executeJavaScript(code, true),
+      { url, code }
+    )
+  const pageDataset = (url: string) => inPage(url, '({ ...document.body.dataset })')
+
+  test('adopts a blank popup that keeps its opener and returns there when it closes', async () => {
+    const openerUrl = `${site}/popups`
+    expect((await execute('browser_open_url', { url: openerUrl })).ok).toBe(true)
+    // A second tab makes the strip neighbour differ from the opener.
+    expect((await execute('browser_open_tab', { url: `${site}/other` })).ok).toBe(true)
+    const openerTabId = (await tabsState()).tabs.find((tab) => tab.url === openerUrl)?.tabId
+    expect(openerTabId).toBeTruthy()
+
+    await inPage(openerUrl, 'signIn()')
+    await expect
+      .poll(() => pageDataset(openerUrl))
+      .toMatchObject({ handle: 'true', blank: 'ready' })
+    await expect.poll(tabUrls).toContain(`${popupOrigin}/authorize`)
+    const popupTab = (await tabsState()).tabs.find((tab) => tab.url === `${popupOrigin}/authorize`)
+    expect(popupTab?.active).toBe(true)
+
+    await inPage(`${popupOrigin}/authorize`, "document.querySelector('button').click()")
+    await expect.poll(() => pageDataset(openerUrl)).toMatchObject({ connected: 'granted' })
+    await expect.poll(async () => (await tabsState()).tabs.length).toBe(2)
+    expect((await tabsState()).activeTabId).toBe(openerTabId)
+  })
+
+  test('forgets the opener once the user switches tabs, closing the popup to its neighbour', async () => {
+    const openerUrl = `${site}/popups`
+    expect((await execute('browser_open_url', { url: openerUrl })).ok).toBe(true)
+    expect((await execute('browser_open_tab', { url: `${site}/other` })).ok).toBe(true)
+    const otherTabId = (await tabsState()).tabs.find((tab) => tab.url === `${site}/other`)?.tabId
+    await inPage(openerUrl, 'signIn()')
+    await expect.poll(tabUrls).toContain(`${popupOrigin}/authorize`)
+    const popupTabId = (await tabsState()).tabs.find(
+      (tab) => tab.url === `${popupOrigin}/authorize`
+    )?.tabId
+    for (const tabId of [otherTabId, popupTabId]) {
+      await window.evaluate(
+        ({ tabId, scope }) =>
+          (
+            globalThis as typeof globalThis & { simDesktop: SimDesktopApi }
+          ).simDesktop.browserAgent.panelAction({ action: 'switch-tab', tabId }, scope),
+        { tabId, scope: SCOPE }
+      )
+      await expect.poll(async () => (await tabsState()).activeTabId).toBe(tabId)
+    }
+
+    await inPage(`${popupOrigin}/authorize`, "document.querySelector('button').click()")
+    await expect.poll(() => pageDataset(openerUrl)).toMatchObject({ connected: 'granted' })
+    await expect.poll(async () => (await tabsState()).tabs.length).toBe(2)
+    expect((await tabsState()).activeTabId).toBe(otherTabId)
+  })
+
+  test('keeps data: popups denied', async () => {
+    const openerUrl = `${site}/popups`
+    expect((await execute('browser_open_url', { url: openerUrl })).ok).toBe(true)
+    expect(await inPage(openerUrl, "String(window.open('data:text/html,x') !== null)")).toBe(
+      'false'
+    )
+    expect((await tabsState()).tabs).toHaveLength(1)
+  })
+
+  test('posts a same-session form popup and refuses to reissue a cross-session one', async () => {
+    const openerUrl = `${site}/popups`
+    expect((await execute('browser_open_url', { url: openerUrl })).ok).toBe(true)
+    await inPage(openerUrl, "document.getElementById('same-session').requestSubmit()")
+    await expect.poll(() => inPage(`${popupOrigin}/echo`, 'document.title')).toBe('POST note=hello')
+
+    const before = (await tabsState()).tabs.length
+    await inPage(openerUrl, "document.getElementById('cross-session').requestSubmit()")
+    // The handler decides popups in order, so once this one is listed the post was decided.
+    await inPage(openerUrl, `void window.open('${site}/sentinel')`)
+    await expect.poll(tabUrls).toContain(`${site}/sentinel`)
+    expect((await tabsState()).tabs).toHaveLength(before + 1)
+    expect(appEchoes).toEqual([])
+  })
+
+  test('keeps the opener of a Sim page blank popup that navigates within Sim', async () => {
+    const openerUrl = `${origin}/popups?next=${encodeURIComponent(`${origin}/authorize`)}`
+    expect((await execute('browser_open_url', { url: openerUrl })).ok).toBe(true)
+    await inPage(openerUrl, 'signIn()')
+    await expect.poll(tabUrls).toContain(`${origin}/authorize`)
+    await inPage(`${origin}/authorize`, "document.querySelector('button').click()")
+    await expect
+      .poll(() => pageDataset(openerUrl))
+      .toMatchObject({ handle: 'true', connected: 'granted' })
+  })
+
   test('renders PDFs in the built-in viewer', async () => {
     const response = await execute('browser_open_url', { url: `${site}/doc.pdf` })
     expect(response.ok, response.error).toBe(true)
diff --git a/apps/desktop/src/main/browser-agent/session.test.ts b/apps/desktop/src/main/browser-agent/session.test.ts
index 10cc182f244..adc5fb2be85 100644
--- a/apps/desktop/src/main/browser-agent/session.test.ts
+++ b/apps/desktop/src/main/browser-agent/session.test.ts
@@ -1259,7 +1259,7 @@ describe('browser-agent session', () => {
     openWindow({ url: 'https://example.com/later' }).createWindow?.({})
     const popup = (session.activeTab()?.view as unknown as MockView).webContents
     expect(popup).not.toBe(source)
-    expect(popup.loadURL).toHaveBeenCalledWith('https://example.com/later')
+    expect(popup.loadURL).toHaveBeenCalledWith('https://example.com/later', expect.anything())
     expect(openWindow({ url: 'javascript:alert(1)' })).toEqual({ action: 'deny' })
     expect(session.listTabs()).toHaveLength(2)
   })
diff --git a/apps/desktop/src/main/browser-agent/session.ts b/apps/desktop/src/main/browser-agent/session.ts
index 752fca5bec9..ccdc35da492 100644
--- a/apps/desktop/src/main/browser-agent/session.ts
+++ b/apps/desktop/src/main/browser-agent/session.ts
@@ -34,6 +34,7 @@ import type {
   DownloadItem,
   Input,
   MenuItemConstructorOptions,
+  Referrer,
   Session,
   WebContents,
   WebContentsViewConstructorOptions,
@@ -80,7 +81,7 @@ import {
 import { clearHostVerdictCache } from '@/main/browser-agent/url-guard'
 import type { BrowserSessionSnapshot } from '@/main/desktop-chat-session-store'
 import { suggestedFilename, uniqueDownloadPath } from '@/main/downloads'
-import { isAppOrigin } from '@/main/navigation'
+import { isAppOrigin, isBlankPopupUrl } from '@/main/navigation'
 import {
   type FocusedResourceShortcut,
   isResourceTabSelectionShortcut,
@@ -120,6 +121,8 @@ export interface AgentTab {
   lastRealUserGestureAt?: number
   /** The tab whose page opened this one; agent work returns there when this tab closes. */
   openerTabId?: string
+  /** Closing this tab while active shows its opener, until the user switches tabs (as in Chrome). */
+  returnToOpenerOnClose?: boolean
   /** A user action asked for this page to take focus once it is on screen. */
   pendingUserFocus?: boolean
   /** Electron owns the native alert or confirm until CDP reports it closed. */
@@ -2292,12 +2295,11 @@ export function stopFindInActiveTab(focusPage: boolean): void {
   if (tab) tab.view.webContents.focus()
 }
 
-/**
- * Whether a page's popup can become a tab that keeps its opener: http(s), within the tab
- * limits, and in the opener's own session (a session boundary needs a separate, opener-less tab).
- */
+/** Whether a popup can become an opener-keeping tab: blank (Chromium puts it in the opener's session) or same-session http(s), within the tab limits. */
 function canAdoptPopup(opener: WebContents, url: string): boolean {
-  if (!/^https?:\/\//i.test(url) || !hasTabCapacity()) return false
+  if (!hasTabCapacity()) return false
+  if (isBlankPopupUrl(url)) return true
+  if (!/^https?:\/\//i.test(url)) return false
   return (
     !browserAppSession ||
     isAppOrigin(url, browserAppSession.origin) === Boolean(agentAppOrigin(opener))
@@ -2309,14 +2311,21 @@ function adoptPopupTab(
   opener: WebContents,
   url: string,
   popup: PopupWindowOptions,
-  { agentOwned, background }: { agentOwned: boolean; background: boolean }
+  {
+    agentOwned,
+    background,
+    referrer,
+  }: { agentOwned: boolean; background: boolean; referrer?: Referrer }
 ): WebContents {
   const openerTabId = tabForContents(opener)?.id
   const tab = openLinkTab(url, { agentOwned, background }, popup)
   tab.openerTabId = openerTabId
+  tab.returnToOpenerOnClose = true
   const contents = tab.view.webContents
   // A background-tab disposition defers creation, so Chromium supplies no contents to adopt.
-  if (!popup.webContents) void contents.loadURL(url).catch(() => {})
+  if (!popup.webContents && !isBlankPopupUrl(url)) {
+    void contents.loadURL(url, { httpReferrer: referrer }).catch(() => {})
+  }
   return contents
 }
 
@@ -2347,12 +2356,16 @@ function openLinkTab(
  */
 function openTabWithUrl(
   url: string,
-  { agentOwned, background = false }: { agentOwned: boolean; background?: boolean }
+  {
+    agentOwned,
+    background = false,
+    referrer,
+  }: { agentOwned: boolean; background?: boolean; referrer?: Referrer }
 ): void {
   if (!/^https?:\/\//i.test(url)) return
   try {
     const tab = openLinkTab(url, { agentOwned, background })
-    void tab.view.webContents.loadURL(url).catch(() => {})
+    void tab.view.webContents.loadURL(url, { httpReferrer: referrer }).catch(() => {})
   } catch (error) {
     logger.warn('Could not open a link in a new browser tab', {
       error: getErrorMessage(error),
@@ -2369,13 +2382,18 @@ type PopupWindowOptions = BrowserWindowConstructorOptions & WebContentsViewConst
 /**
  * Creates a tab's view. `popup` adopts a page-opened window's WebContents, which Chromium created
  * with the opener's (identical) web preferences, so the opener relationship and its session stay
- * intact; callers only adopt popups whose URL belongs to the opener's session.
+ * intact; callers only adopt popups that are blank or whose URL belongs to the opener's session.
  */
 function createTabView(url?: string, popup?: PopupWindowOptions): WebContentsView {
-  const appSession =
-    url && browserAppSession && isAppOrigin(url, browserAppSession.origin)
-      ? browserAppSession
-      : undefined
+  let appSession: BrowserAppSession | undefined
+  if (popup?.webContents) {
+    // A blank popup's URL names no origin, so trust the session Chromium created it in.
+    if (browserAppSession && popup.webContents.session === browserAppSession.session) {
+      appSession = browserAppSession
+    }
+  } else if (url && browserAppSession && isAppOrigin(url, browserAppSession.origin)) {
+    appSession = browserAppSession
+  }
   const scopeId = getBrowserScopeId()
   const view = popup?.webContents ? new WebContentsView(popup) : createFreshTabView(appSession)
   try {
@@ -2544,16 +2562,20 @@ function initializeTabView(
     })
   )
 
-  // Keep popups inside the browser resource: http(s) window.open and
-  // target=_blank requests become a new internal tab, never a native window.
-  // A same-session popup adopts Chromium's own WebContents so window.opener
-  // survives (sign-in and "connect" popups post their result back to it).
+  // Popups become internal tabs, never native windows; adopting Chromium's own
+  // WebContents keeps window.opener for sign-in popups that post back to it.
   contents.setWindowOpenHandler((details) =>
     withBrowserScope(scopeId, () => {
       const agentOwned = agentOwnsPopupFrom(contents)
       const background = details.disposition === 'background-tab'
-      if (!canAdoptPopup(contents, details.url)) {
-        openTabWithUrl(details.url, { agentOwned, background })
+      const adopt = canAdoptPopup(contents, details.url)
+      // Only Chromium can carry a form POST with its initiator; never reissue one as a GET.
+      if (details.postBody && (!adopt || background)) {
+        logger.warn('Refused a form POST into a new browser tab')
+        return { action: 'deny' }
+      }
+      if (!adopt) {
+        openTabWithUrl(details.url, { agentOwned, background, referrer: details.referrer })
         return { action: 'deny' }
       }
       return {
@@ -2564,7 +2586,11 @@ function initializeTabView(
         overrideBrowserWindowOptions: { webPreferences: { focusOnNavigation: false } },
         createWindow: (options) =>
           withBrowserScope(scopeId, () =>
-            adoptPopupTab(contents, details.url, options, { agentOwned, background })
+            adoptPopupTab(contents, details.url, options, {
+              agentOwned,
+              background,
+              referrer: details.referrer,
+            })
           ),
       }
     })
@@ -3500,6 +3526,7 @@ export function switchTab(tabId: string, { claim = true }: { claim?: boolean } =
   if (previousActiveTab && previousActiveTab.id !== tab.id) {
     revokeTabMediaPermissions(previousActiveTab, false)
     previousActiveTab.pendingUserFocus = false
+    for (const entry of tabs) entry.returnToOpenerOnClose = false
   }
   // The claim describes the page on screen, so a mirrored switch to another
   // page leaves that page unclaimed rather than inheriting the last one's.
@@ -3594,8 +3621,10 @@ function removeTab(
   clearFocusedBrowserTab(tab.id)
   detachIfAttached(tab.view)
   if (contents && !contents.isDestroyed()) contents.close()
+  const opener = tabs.find((entry) => entry.id === tab.openerTabId)
   if (currentScope.activeTabId === tab.id) {
-    currentScope.activeTabId = (tabs[index] ?? tabs[index - 1])?.id ?? null
+    const returnTo = tab.returnToOpenerOnClose ? opener : undefined
+    currentScope.activeTabId = (returnTo ?? tabs[index] ?? tabs[index - 1])?.id ?? null
     layout()
     const active = activeTab()
     if (active) {
@@ -3603,7 +3632,6 @@ function removeTab(
     }
   }
   if (currentScope.automationTabId === tab.id) {
-    const opener = tabs.find((entry) => entry.id === tab.openerTabId)
     currentScope.automationTabId =
       opener?.id ?? (adoptNeighborForAgent ? ((tabs[index] ?? tabs[index - 1])?.id ?? null) : null)
     applyAutomationTabPolicy()
diff --git a/apps/desktop/src/main/navigation.test.ts b/apps/desktop/src/main/navigation.test.ts
index d902421c109..9503a573056 100644
--- a/apps/desktop/src/main/navigation.test.ts
+++ b/apps/desktop/src/main/navigation.test.ts
@@ -61,6 +61,12 @@ describe('classifyNavigation', () => {
     ).toBe('external')
   })
 
+  it('sends mailto links to the mail client', () => {
+    expect(
+      classifyNavigation('mailto:support@sim.ai', { appOrigin: APP, currentUrl: `${APP}/login` })
+    ).toBe('external')
+  })
+
   it('denies non-web schemes everywhere', () => {
     for (const url of [
       'javascript:alert(1)',
@@ -75,6 +81,10 @@ describe('classifyNavigation', () => {
 })
 
 describe('classifyWindowOpen', () => {
+  it('sends mailto popups to the mail client instead of denying them', () => {
+    expect(classifyWindowOpen('mailto:support@sim.ai', '_blank', APP)).toBe('external')
+  })
+
   it('does not let a cross-origin http URL ride the mcp-oauth frame name in-app', () => {
     expect(classifyWindowOpen('http://mcp.example/authorize', 'mcp-oauth-srv1', APP)).toBe(
       'external'
@@ -106,4 +116,25 @@ describe('openExternalSafe', () => {
     await expect(openExternalSafe('file:///etc/passwd', true)).resolves.toBe(false)
     expect(shell.openExternal).not.toHaveBeenCalled()
   })
+
+  it.each([
+    'mailto:support@sim.ai',
+    'MAILTO:support@sim.ai,help@sim.ai?subject=Desktop%20offline&body=Hi%0Athere',
+    'mailto:?to=support@sim.ai&cc=a@b.example',
+  ])('hands the well-formed mailto %s to the system mail client', async (url) => {
+    await expect(openExternalSafe(url)).resolves.toBe(true)
+    expect(shell.openExternal).toHaveBeenCalledWith(url)
+  })
+
+  it.each([
+    ['an attachment field', 'mailto:a@b.example?attach=/etc/passwd'],
+    ['an unlisted header', 'mailto:a@b.example?X-Header=y'],
+    ['a non-address recipient field', 'mailto:a@b.example?cc=file:///etc/passwd'],
+    ['unencoded whitespace', 'mailto:a@b.example?subject=a b'],
+    ['an encoded header injection', 'mailto:a@b.example%0d%0aBcc:c@d.example'],
+    ['a fragment', 'mailto:a@b.example#frag'],
+  ])('refuses a mailto with %s', async (_rule, url) => {
+    await expect(openExternalSafe(url)).resolves.toBe(false)
+    expect(shell.openExternal).not.toHaveBeenCalled()
+  })
 })
diff --git a/apps/desktop/src/main/navigation.ts b/apps/desktop/src/main/navigation.ts
index 3131a5c125e..530eb49d6a2 100644
--- a/apps/desktop/src/main/navigation.ts
+++ b/apps/desktop/src/main/navigation.ts
@@ -1,5 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { isLoopbackHostname } from '@sim/security/ssrf'
+import { isValidEmailSyntax } from '@sim/utils/string'
 import { shell } from 'electron'
 import { scrubUrl } from '@/main/observability'
 
@@ -112,6 +113,9 @@ export function classifyNavigation(rawUrl: string, ctx: NavigationContext): Main
   if (rawUrl === 'about:blank') {
     return 'in-app'
   }
+  if (isMailtoUrl(rawUrl)) {
+    return 'external'
+  }
   const url = parseHttpUrl(rawUrl)
   if (!url) {
     return 'deny'
@@ -146,9 +150,12 @@ export function classifyWindowOpen(
   frameName: string,
   appOrigin: string
 ): WindowOpenAction {
-  if (rawUrl === '' || rawUrl === 'about:blank') {
+  if (isBlankPopupUrl(rawUrl)) {
     return 'popup-blank'
   }
+  if (isMailtoUrl(rawUrl)) {
+    return 'external'
+  }
   const url = parseHttpUrl(rawUrl)
   if (!url) {
     return 'deny'
@@ -174,7 +181,7 @@ export function classifyWindowOpen(
  * by the blank-then-assign pattern.
  */
 export function classifyBlankChildNavigation(rawUrl: string, appOrigin: string): BlankChildAction {
-  if (rawUrl === '' || rawUrl === 'about:blank') {
+  if (isBlankPopupUrl(rawUrl)) {
     return 'ignore'
   }
   const url = parseHttpUrl(rawUrl)
@@ -187,6 +194,54 @@ export function classifyBlankChildNavigation(rawUrl: string, appOrigin: string):
   return 'external'
 }
 
+/** The URL `window.open('')` and `window.open('about:blank')` hand a popup handler. */
+export function isBlankPopupUrl(url: string): boolean {
+  return url === '' || url === 'about:blank'
+}
+
+function isMailtoUrl(raw: string): boolean {
+  return /^mailto:/i.test(raw)
+}
+
+/** RFC 6068 fields a mail client fills in; anything else (`attach=`, arbitrary headers) is refused. */
+const MAILTO_FIELDS = new Set(['to', 'cc', 'bcc', 'subject', 'body'])
+
+function isMailtoAddressList(encoded: string): boolean {
+  if (encoded === '') return true
+  try {
+    return decodeURIComponent(encoded)
+      .split(',')
+      .every((address) => isValidEmailSyntax(address.trim()))
+  } catch {
+    return false
+  }
+}
+
+/**
+ * A `mailto:` of printable ASCII, plain addresses, and compose fields only: some mail clients
+ * honour `attach=` and other headers, which would let a page attach a local file.
+ */
+function isSafeMailtoUrl(raw: string): boolean {
+  if (!isMailtoUrl(raw) || raw.length > 4_096 || !/^[\x21-\x7e]+$/.test(raw)) {
+    return false
+  }
+  const [addresses = '', query, ...rest] = raw.slice(7).split('?')
+  if (rest.length > 0 || addresses.includes('#') || !isMailtoAddressList(addresses)) {
+    return false
+  }
+  if (query === undefined) return true
+  for (const field of query.split('&')) {
+    const separator = field.indexOf('=')
+    const name = (separator === -1 ? field : field.slice(0, separator)).toLowerCase()
+    if (!MAILTO_FIELDS.has(name)) return false
+    const value = separator === -1 ? '' : field.slice(separator + 1)
+    if ((name === 'to' || name === 'cc' || name === 'bcc') && !isMailtoAddressList(value)) {
+      return false
+    }
+  }
+  return true
+}
+
 /**
  * Validates a URL for handing to the system browser: https always, http only
  * for loopback hosts when explicitly allowed, never credentials in the URL,
@@ -212,11 +267,11 @@ export function isSafeExternalUrl(raw: string, allowHttpLocalhost = false): bool
 }
 
 /**
- * Opens a URL in the system browser after validation. Every openExternal in
- * the app goes through here — menu items, IPC, and navigation policy.
+ * Opens a URL in the system browser, or a `mailto:` in the system mail client, after validation.
+ * Every openExternal in the app goes through here — menu items, IPC, and navigation policy.
  */
 export async function openExternalSafe(raw: string, allowHttpLocalhost = false): Promise<boolean> {
-  if (!isSafeExternalUrl(raw, allowHttpLocalhost)) {
+  if (!isSafeExternalUrl(raw, allowHttpLocalhost) && !isSafeMailtoUrl(raw)) {
     logger.warn('Blocked unsafe external URL', { url: scrubUrl(raw) })
     return false
   }

From 245d363f8653d028d36b40de7b1b125e29f85ade Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Sat, 31 Oct 2026 01:13:14 -0700
Subject: [PATCH 2/2] fix(desktop): keep deferred popups in their opener's
 session

- A background-tab popup with no Chromium-supplied contents now opens in the opener's session rather than the agent partition
- Driver tests expect the referrer options loadURL now receives
---
 .../src/main/browser-agent/driver.test.ts     |  4 +--
 .../src/main/browser-agent/session.test.ts    | 19 +++++++++--
 .../desktop/src/main/browser-agent/session.ts | 32 ++++++++++++-------
 3 files changed, 40 insertions(+), 15 deletions(-)

diff --git a/apps/desktop/src/main/browser-agent/driver.test.ts b/apps/desktop/src/main/browser-agent/driver.test.ts
index 03ec50d8d57..a1594bf89af 100644
--- a/apps/desktop/src/main/browser-agent/driver.test.ts
+++ b/apps/desktop/src/main/browser-agent/driver.test.ts
@@ -804,7 +804,7 @@ describe('executeTool', () => {
     const popup = session.activeTab()?.view.webContents
     if (!popup) throw new Error('Expected user popup tab')
     expect(session.automationTab()?.view.webContents).toBe(source)
-    expect(popup.loadURL).toHaveBeenCalledWith('https://user-popup.example/')
+    expect(popup.loadURL).toHaveBeenCalledWith('https://user-popup.example/', expect.anything())
   })
 
   it('keeps agent-opened target-blank tabs agent-owned after dispatch ends', async () => {
@@ -823,7 +823,7 @@ describe('executeTool', () => {
     expect(session.activeTab()?.view.webContents).toBe(source)
     session.setAutomationActive(false)
     expect(session.automationTab()?.view.webContents).toBe(popup)
-    expect(popup.loadURL).toHaveBeenCalledWith('https://agent-popup.example/')
+    expect(popup.loadURL).toHaveBeenCalledWith('https://agent-popup.example/', expect.anything())
   })
 
   it('does not report a timed-out restored tab as ready to the model', async () => {
diff --git a/apps/desktop/src/main/browser-agent/session.test.ts b/apps/desktop/src/main/browser-agent/session.test.ts
index adc5fb2be85..d95cc7709ba 100644
--- a/apps/desktop/src/main/browser-agent/session.test.ts
+++ b/apps/desktop/src/main/browser-agent/session.test.ts
@@ -32,7 +32,7 @@ function _setPlatform(platform: NodeJS.Platform): void {
   Object.defineProperty(process, 'platform', { configurable: true, value: platform })
 }
 
-type PopupHandler = (details: { url: string }) => {
+type PopupHandler = (details: { url: string; disposition?: string }) => {
   action: string
   outlivesOpener?: boolean
   createWindow?: (options: Record<string, unknown>) => unknown
@@ -2321,13 +2321,28 @@ describe('importAgentCookies', () => {
 
 describe('first-party browser sessions', () => {
   const origin = 'https://www.dev.sim.ai'
+  const appSession = new WebContentsView().webContents.session
   function initialize(persistence?: sessionModule.BrowserSessionPersistence) {
     return freshSession(null, {}, persistence, undefined, {
       origin,
-      session: new WebContentsView().webContents.session,
+      session: appSession,
     })
   }
 
+  it("opens a deferred blank popup in its opener's session", () => {
+    const session = initialize()
+    const opener = session.addAutomationTab(`${origin}/home`).view.webContents
+    Object.assign(opener, { session: appSession })
+    const openWindow = vi.mocked(opener.setWindowOpenHandler).mock.calls[0]?.[0] as PopupHandler
+
+    const popup = openWindow({ url: 'about:blank', disposition: 'background-tab' }).createWindow?.(
+      {}
+    ) as WebContents
+    expect(popup).not.toBe(opener)
+    expect(agentAppOrigin(popup)).toBe(origin)
+    expect(popup.loadURL).not.toHaveBeenCalled()
+  })
+
   it('keeps a populated tab and its history when crossing the session boundary', () => {
     const session = initialize()
     const tab = session.addAutomationTab(`${origin}/home`)
diff --git a/apps/desktop/src/main/browser-agent/session.ts b/apps/desktop/src/main/browser-agent/session.ts
index ccdc35da492..0ac0c5d7c41 100644
--- a/apps/desktop/src/main/browser-agent/session.ts
+++ b/apps/desktop/src/main/browser-agent/session.ts
@@ -2318,7 +2318,7 @@ function adoptPopupTab(
   }: { agentOwned: boolean; background: boolean; referrer?: Referrer }
 ): WebContents {
   const openerTabId = tabForContents(opener)?.id
-  const tab = openLinkTab(url, { agentOwned, background }, popup)
+  const tab = openLinkTab(url, { agentOwned, background }, { opener, options: popup })
   tab.openerTabId = openerTabId
   tab.returnToOpenerOnClose = true
   const contents = tab.view.webContents
@@ -2336,7 +2336,7 @@ function adoptPopupTab(
 function openLinkTab(
   url: string,
   { agentOwned, background }: { agentOwned: boolean; background: boolean },
-  popup?: PopupWindowOptions
+  popup?: AdoptedPopup
 ): AgentTab {
   if (agentOwned) return addAutomationTab(url, popup)
   if (background) {
@@ -2379,23 +2379,33 @@ function openTabWithUrl(
  */
 type PopupWindowOptions = BrowserWindowConstructorOptions & WebContentsViewConstructorOptions
 
+/** A page-opened window becoming a tab, with the page that opened it. */
+interface AdoptedPopup {
+  opener: WebContents
+  options: PopupWindowOptions
+}
+
 /**
  * Creates a tab's view. `popup` adopts a page-opened window's WebContents, which Chromium created
  * with the opener's (identical) web preferences, so the opener relationship and its session stay
- * intact; callers only adopt popups that are blank or whose URL belongs to the opener's session.
+ * intact; a deferred popup without one gets a fresh view in the opener's session. Callers only
+ * adopt popups that are blank or whose URL belongs to the opener's session.
  */
-function createTabView(url?: string, popup?: PopupWindowOptions): WebContentsView {
+function createTabView(url?: string, popup?: AdoptedPopup): WebContentsView {
   let appSession: BrowserAppSession | undefined
-  if (popup?.webContents) {
-    // A blank popup's URL names no origin, so trust the session Chromium created it in.
-    if (browserAppSession && popup.webContents.session === browserAppSession.session) {
+  if (popup) {
+    // A popup follows its opener's session (Chromium creates it there); a blank URL names no origin.
+    const popupSession = popup.options.webContents?.session ?? popup.opener.session
+    if (browserAppSession && popupSession === browserAppSession.session) {
       appSession = browserAppSession
     }
   } else if (url && browserAppSession && isAppOrigin(url, browserAppSession.origin)) {
     appSession = browserAppSession
   }
   const scopeId = getBrowserScopeId()
-  const view = popup?.webContents ? new WebContentsView(popup) : createFreshTabView(appSession)
+  const view = popup?.options.webContents
+    ? new WebContentsView(popup.options)
+    : createFreshTabView(appSession)
   try {
     /** Detached tabs must lay out before a foreground panel owns their native view. */
     const [width, height] = getMainWindow()?.getContentSize() ?? [1280, 720]
@@ -2960,7 +2970,7 @@ interface AddTabOptions {
   activate?: boolean
   notify?: boolean
   url?: string
-  popup?: PopupWindowOptions
+  popup?: AdoptedPopup
 }
 
 function addTabInternal({
@@ -3441,7 +3451,7 @@ export function restoreBrowserSession(): void {
   }
 }
 
-export function addTab(url?: string, popup?: PopupWindowOptions): AgentTab {
+export function addTab(url?: string, popup?: AdoptedPopup): AgentTab {
   restoreBrowserSession()
   currentScope.visibleTabUserSelected = true
   return addTabInternal({ url, popup })
@@ -3452,7 +3462,7 @@ export function addTab(url?: string, popup?: PopupWindowOptions): AgentTab {
  * renderer's decision: every page is a resource tab there, and it shows the
  * agent's tab or badges it depending on what the user is doing.
  */
-export function addAutomationTab(url?: string, popup?: PopupWindowOptions): AgentTab {
+export function addAutomationTab(url?: string, popup?: AdoptedPopup): AgentTab {
   restoreBrowserSession()
   const tab = addTabInternal({ activate: false, notify: false, url, popup })
   currentScope.automationTabId = tab.id