claude-code-session-manager 0.45.0 → 0.45.1

package/dist/index.html

@@ -7,7 +7,7 @@
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Newsreader:ital,opsz,wght@0,6..72,400;0,6..72,500;0,6..72,600;0,6..72,700;1,6..72,400&family=Geist:wght@300;400;500;600;700&family=IBM+Plex+Mono:wght@400;500;600&display=swap" rel="stylesheet">
-    <script type="module" crossorigin src="./assets/index-CSUJZAO6.js"></script>
+    <script type="module" crossorigin src="./assets/index-B_gf3jGN.js"></script>
     <link rel="modulepreload" crossorigin href="./assets/monaco-editor-BW5C4Iv1.js">
     <link rel="stylesheet" crossorigin href="./assets/monaco-editor-BTnBOi8r.css">
     <link rel="stylesheet" crossorigin href="./assets/index-l5y1xr1v.css">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-session-manager",
-  "version": "0.45.0",
+  "version": "0.45.1",
   "description": "Local cockpit for the Claude Code CLI — multi-tab terminal, full config surface, scheduler, voice dictation, and live observability.",
   "type": "module",
   "main": "src/main/index.cjs",

package/src/main/__tests__/browserView-destroyed-handler.test.cjs

@@ -32,6 +32,7 @@ class FakeWebContents extends EventEmitter {
     this.session = { on() {} };
   }
   setZoomFactor() {}
+  setUserAgent() {}
   setWindowOpenHandler() {}
   isDestroyed() { return false; }
 }

package/src/main/__tests__/browserView-oauth-popup.test.cjs

@@ -0,0 +1,126 @@
+/**
+ * browserView-oauth-popup.test.cjs — regression test for Google (and other
+ * identity-provider) OAuth login failing inside the Browser tab.
+ *
+ * Root cause: wc.setWindowOpenHandler() in browserView.cjs unconditionally
+ * denied every window.open() popup, which kills Google's GIS/FedCM popup —
+ * it needs a real window.opener to postMessage the credential back to. This
+ * test asserts identity-provider popups get `{ action: 'allow', ... }` (a
+ * real child window) while every other popup keeps the existing deny +
+ * browser:open-tab-request behavior, and that a realistic Chrome
+ * User-Agent (not Electron's default) is set on both the main view and the
+ * popup's webContents.
+ *
+ * `electron` isn't installed as a runnable binary here, and browserView.cjs
+ * pulls it in via a plain CJS `require` (not vite-node's ESM graph), so
+ * `vi.mock('electron', ...)` doesn't intercept it. Instead we pre-seed
+ * Node's own require cache for the resolved `electron` path with a fake
+ * `WebContentsView`, the only export browserView.cjs actually uses — same
+ * pattern as browserView-destroyed-handler.test.cjs.
+ *
+ * Run: timeout 300 npx vitest run src/main/__tests__/browserView-oauth-popup.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, beforeEach } from 'vitest';
+import { EventEmitter } from 'node:events';
+
+let nextWcId = 1;
+class FakeWebContents extends EventEmitter {
+  constructor() {
+    super();
+    this.id = nextWcId++;
+    this.session = { on() {} };
+    this.userAgent = null;
+    this._windowOpenHandler = null;
+  }
+  setZoomFactor() {}
+  setUserAgent(ua) { this.userAgent = ua; }
+  setWindowOpenHandler(fn) { this._windowOpenHandler = fn; }
+  isDestroyed() { return false; }
+}
+class FakeWebContentsView {
+  constructor() {
+    this.webContents = new FakeWebContents();
+  }
+}
+class FakeBrowserWindow {
+  constructor() {
+    this.webContents = new FakeWebContents();
+  }
+}
+
+const electronPath = require.resolve('electron');
+require.cache[electronPath] = {
+  id: electronPath,
+  filename: electronPath,
+  loaded: true,
+  exports: { WebContentsView: FakeWebContentsView },
+};
+
+const { registerBrowserView, views, isBrowserViewContents } = require('../browserView.cjs');
+
+function makeFakeIpcMain() {
+  const handlers = new Map();
+  return {
+    handle: (channel, fn) => handlers.set(channel, fn),
+    on: (channel, fn) => handlers.set(channel, fn),
+    invoke: (channel, payload) => handlers.get(channel)(null, payload),
+  };
+}
+
+let ipcMain;
+beforeEach(() => {
+  ipcMain = makeFakeIpcMain();
+  registerBrowserView({ mainWindow: { isDestroyed: () => true }, ipcMain });
+});
+
+test('main view webContents gets a real Chrome user-agent, not the Electron default', async () => {
+  const viewId = `oauth-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+  await ipcMain.invoke('browser:create', { viewId, partition: 'sm-test' });
+  const view = views.get(viewId);
+  expect(view.webContents.userAgent).toBeTruthy();
+  expect(view.webContents.userAgent).not.toMatch(/Electron/);
+  expect(view.webContents.userAgent).toMatch(/Chrome\//);
+});
+
+test('setWindowOpenHandler allows identity-provider popups with a real child window and denies others', async () => {
+  const viewId = `oauth2-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+  await ipcMain.invoke('browser:create', { viewId, partition: 'sm-test' });
+  const view = views.get(viewId);
+  const handler = view.webContents._windowOpenHandler;
+  expect(typeof handler).toBe('function');
+
+  const allowed = handler({ url: 'https://accounts.google.com/o/oauth2/v2/auth?foo=bar' });
+  expect(allowed.action).toBe('allow');
+  expect(allowed.overrideBrowserWindowOptions.webPreferences).toEqual({
+    contextIsolation: true,
+    nodeIntegration: false,
+    sandbox: true,
+  });
+
+  const denied = handler({ url: 'https://example.com/some-popup' });
+  expect(denied).toEqual({ action: 'deny' });
+});
+
+test('identity-provider popup child window gets a Chrome UA and cleans up on destroy', async () => {
+  const viewId = `oauth3-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+  await ipcMain.invoke('browser:create', { viewId, partition: 'sm-test' });
+  const view = views.get(viewId);
+
+  const childWindow = new FakeBrowserWindow();
+  view.webContents.emit('did-create-window', childWindow);
+
+  expect(childWindow.webContents.userAgent).toBeTruthy();
+  expect(childWindow.webContents.userAgent).toMatch(/Chrome\//);
+
+  // The popup's webContents.id must be exempted from index.cjs's global
+  // will-navigate lock the same way the main Browser view is — otherwise
+  // the OAuth handshake this fix enables would immediately get nav-locked
+  // shut once the popup tries to navigate through consent/callback pages.
+  expect(isBrowserViewContents(childWindow.webContents.id)).toBe(true);
+
+  expect(() => childWindow.webContents.emit('destroyed')).not.toThrow();
+  expect(isBrowserViewContents(childWindow.webContents.id)).toBe(false);
+});

package/src/main/browserView.cjs

@@ -36,6 +36,39 @@ const HISTORY_PATH = path.join(BROWSER_DATA_DIR, 'history.json');
 const ZOOM_PATH = path.join(BROWSER_DATA_DIR, 'zoom.json');
 const HISTORY_MAX = 500;
 
+// ── Identity-provider OAuth popup allowlist ───────────────────────────
+// window.open() popups from these hosts get a REAL child BrowserWindow
+// (setWindowOpenHandler returns `allow`) instead of the default deny —
+// Google's GIS/FedCM handshake (and equivalent flows from other providers)
+// needs a genuine window.opener to postMessage the credential back to.
+// Every other popup keeps the existing deny + browser:open-tab-request
+// broadcast. Add appleid.apple.com / login.microsoftonline.com / github.com
+// here when those flows need the same treatment — no restructuring needed.
+const IDENTITY_PROVIDER_HOSTS = ['accounts.google.com'];
+
+function isIdentityProviderUrl(rawUrl) {
+  try {
+    return IDENTITY_PROVIDER_HOSTS.includes(new URL(rawUrl).hostname);
+  } catch {
+    return false;
+  }
+}
+
+// A realistic desktop Chrome UA built from this Electron build's OWN
+// Chromium version (process.versions.chrome) rather than a hardcoded string
+// that drifts stale — OAuth endpoints can flag Electron's default UA
+// ("… Electron/x.y.z …") under a disallowed_useragent policy for embedded
+// webviews.
+function buildChromeUserAgent() {
+  const chromeVersion = process.versions.chrome;
+  const platformToken = process.platform === 'win32'
+    ? 'Windows NT 10.0; Win64; x64'
+    : process.platform === 'darwin'
+      ? 'Macintosh; Intel Mac OS X 10_15_7'
+      : 'X11; Linux x86_64';
+  return `Mozilla/5.0 (${platformToken}) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${chromeVersion} Safari/537.36`;
+}
+
 let lastZoomFactor = 1;
 // Startup-only, fixed constant path (not user input) — a plain sync read is
 // simpler than threading an async load through registerBrowserView's callers.
@@ -189,12 +222,39 @@ function wireNavEvents(viewId, view) {
   });
 
   wc.setWindowOpenHandler(({ url }) => {
+    if (isIdentityProviderUrl(url)) {
+      return {
+        action: 'allow',
+        overrideBrowserWindowOptions: {
+          webPreferences: { contextIsolation: true, nodeIntegration: false, sandbox: true },
+        },
+      };
+    }
     if (/^https?:\/\//i.test(url)) {
       sendIfAlive(win, 'browser:open-tab-request', { url });
     }
     return { action: 'deny' };
   });
 
+  // Fires only when setWindowOpenHandler above returned `allow` — i.e. only
+  // for identity-provider popups. Sets a real Chrome UA on the popup (same
+  // reasoning as the main view below) and registers its webContents.id in
+  // browserViewContentsIds so index.cjs's global will-navigate lock exempts
+  // it too — an OAuth popup needs to navigate through several redirects
+  // (consent screen, callback) exactly like the main Browser view already
+  // does, otherwise the very handshake this fix enables would immediately
+  // get nav-locked shut. Cleaned up on the popup's own 'destroyed' event,
+  // following create()'s `view.webContents.once('destroyed', ...)` pattern
+  // so nothing dangles once the popup closes.
+  wc.on('did-create-window', (childWindow) => {
+    const childWc = childWindow.webContents;
+    childWc.setUserAgent(buildChromeUserAgent());
+    browserViewContentsIds.add(childWc.id);
+    childWc.once('destroyed', () => {
+      browserViewContentsIds.delete(childWc.id);
+    });
+  });
+
   wc.session.on('will-download', (event) => {
     event.preventDefault();
   });
@@ -227,6 +287,7 @@ function create({ viewId, partition }) {
   browserViewContentsIds.add(wcId);
   contentsIdToViewId.set(wcId, viewId);
   view.webContents.setZoomFactor(lastZoomFactor);
+  view.webContents.setUserAgent(buildChromeUserAgent());
   wireNavEvents(viewId, view);
   view.webContents.once('destroyed', () => {
     browserViewContentsIds.delete(wcId);