fix(desktop): browser pane popups, fingerprinting, and tab title/favicon bleed

apps/desktop/electron.vite.config.ts

@@ -182,6 +182,11 @@ export default defineConfig({
 			rollupOptions: {
 				input: {
 					index: resolve("src/preload/index.ts"),
+					// Browser-pane session preload — registered at runtime by
+					// src/main/lib/browser/user-agent.ts via registerPreloadScript.
+					"browser-client-hints": resolve(
+						"src/preload/browser-client-hints.ts",
+					),
 				},
 			},
 		},

apps/desktop/src/main/index.ts

@@ -27,6 +27,7 @@ import { requestAppleEventsAccess } from "./lib/apple-events-permission";
 import { isUpdateReadyToInstall, setupAutoUpdater } from "./lib/auto-updater";
 import { startBrowserBridge } from "./lib/browser/browser-bridge";
 import { downloadManager } from "./lib/browser/download-manager";
+import { configureBrowserUserAgent } from "./lib/browser/user-agent";
 import { installBundledCliShim } from "./lib/bundled-cli";
 import { resolveDevWorkspaceName } from "./lib/dev-workspace-name";
 import { setWorkspaceDockIcon } from "./lib/dock-icon";
@@ -413,6 +414,11 @@ if (!gotTheLock) {
 			.fromPartition("persist:superset")
 			.protocol.handle(PAGE_SCHEME, pageProtocolHandler);
 
+		// Before any webview loads: replace Electron's default UA (which appends
+		// `Electron/x.y.z` + the product name) with real Chrome's, so browser-pane
+		// traffic doesn't trip bot detection.
+		configureBrowserUserAgent();
+
 		// Serve system fonts (e.g. SF Mono on macOS) via custom protocol
 		// so the renderer can use @font-face with font-src 'self' CSP
 		if (process.platform === "darwin") {

apps/desktop/src/main/lib/browser/browser-manager.ts

@@ -200,7 +200,27 @@ class BrowserManager extends EventEmitter {
 			// throttled+hidden guest stops presenting frames and CDP input and
 			// screenshots silently break.
 			this.applyThrottling(paneId, wc);
-			wc.setWindowOpenHandler(({ url }) => {
+			wc.setWindowOpenHandler(({ url, disposition, features }) => {
+				// Popup-shaped requests — a non-empty features string (the
+				// `width=…,height=…` shape OAuth "Sign in with …" buttons use) or
+				// Chromium's NEW_POPUP disposition, which Electron reports as
+				// "new-window" — must become a real child window. Denying them
+				// makes `window.open()` return null and severs `window.opener`, so
+				// postMessage/`popup.closed` handshakes never complete.
+				const isPopup = disposition === "new-window" || features !== "";
+				if (isPopup && isAllowedGuestUrl(url)) {
+					return {
+						action: "allow" as const,
+						overrideBrowserWindowOptions: {
+							// Share the pane's session so the popup sees the same
+							// cookies/storage as its opener.
+							webPreferences: { partition: "persist:superset" },
+						},
+					};
+				}
+				// Tab-shaped requests (target="_blank" links, featureless
+				// window.open) stay in-app: deny the native window and let the
+				// renderer open the URL as a new browser split.
 				if (url && url !== "about:blank") {
 					this.emit(`new-window:${paneId}`, url);
 				}

apps/desktop/src/main/lib/browser/user-agent.ts

@@ -0,0 +1,119 @@
+import { join } from "node:path";
+import { type Session, session } from "electron";
+import {
+	chromeMajorVersion,
+	clientHintsBrandList,
+	clientHintsPlatform,
+	formatBrandVersionList,
+} from "shared/client-hints";
+
+const BROWSER_PARTITION = "persist:superset";
+
+/**
+ * The frozen platform token real desktop Chrome sends per OS. Chrome stopped
+ * exposing the actual OS version in the UA (macOS is pinned to 10_15_7 even on
+ * Apple Silicon, Windows to NT 10.0), so these literals are what an ordinary
+ * Chrome install reports today.
+ */
+function chromePlatformToken(): string {
+	switch (process.platform) {
+		case "darwin":
+			return "Macintosh; Intel Mac OS X 10_15_7";
+		case "win32":
+			return "Windows NT 10.0; Win64; x64";
+		default:
+			return "X11; Linux x86_64";
+	}
+}
+
+/**
+ * A user-agent string matching what real desktop Chrome sends on this OS for
+ * the Chromium bundled with this Electron build. The major version comes from
+ * `process.versions.chrome` — never hardcode one: Client Hints (`sec-ch-ua`,
+ * `navigator.userAgentData`) are generated by the engine itself, and a UA
+ * claiming a different version than the hints report is a stronger bot signal
+ * than no override at all. Real Chrome's UA is version-reduced to
+ * `<major>.0.0.0` (the full build number only appears in Client Hints), so
+ * ours is too.
+ */
+export function buildChromeUserAgent(): string {
+	const chromeMajor = chromeMajorVersion(process.versions.chrome);
+	return `Mozilla/5.0 (${chromePlatformToken()}) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${chromeMajor}.0.0.0 Safari/537.36`;
+}
+
+/**
+ * Rewrite the `sec-ch-ua*` request headers to match the UA string.
+ * `setUserAgent()` doesn't touch Chromium's UserAgentMetadata, which generates
+ * these headers independently — and Electron's brand list has "Chromium" but
+ * no "Google Chrome" entry, so without this every request carries Client
+ * Hints contradicting the UA: a stronger bot signal than the stock Electron
+ * UA ever was.
+ */
+function configureClientHintHeaders(browserSession: Session): void {
+	const chromeVersion = process.versions.chrome;
+	// Real Chrome sends the low-entropy hints on every request to a secure
+	// origin; the full-version ones only after a site opts in via Accept-CH,
+	// which Chromium tracks for us — so those are only replaced when the
+	// engine chose to send them.
+	const lowEntropyHeaders: Record<string, string> = {
+		"sec-ch-ua": formatBrandVersionList(
+			clientHintsBrandList(chromeVersion, "major"),
+		),
+		"sec-ch-ua-mobile": "?0",
+		"sec-ch-ua-platform": `"${clientHintsPlatform(process.platform)}"`,
+	};
+	const optInHeaders: Record<string, string> = {
+		"sec-ch-ua-full-version-list": formatBrandVersionList(
+			clientHintsBrandList(chromeVersion, "full"),
+		),
+		"sec-ch-ua-full-version": `"${chromeMajorVersion(chromeVersion)}.0.0.0"`,
+	};
+
+	// Electron keeps a single onBeforeSendHeaders listener per session — a
+	// second registration elsewhere would silently replace this one.
+	browserSession.webRequest.onBeforeSendHeaders((details, callback) => {
+		const headers = details.requestHeaders;
+		const present = new Set<string>();
+		for (const name of Object.keys(headers)) {
+			const lower = name.toLowerCase();
+			if (
+				Object.hasOwn(lowEntropyHeaders, lower) ||
+				Object.hasOwn(optInHeaders, lower)
+			) {
+				present.add(lower);
+				delete headers[name];
+			}
+		}
+		const secureOrigin =
+			details.url.startsWith("https:") || details.url.startsWith("wss:");
+		for (const [name, value] of Object.entries(lowEntropyHeaders)) {
+			if (secureOrigin || present.has(name)) headers[name] = value;
+		}
+		for (const [name, value] of Object.entries(optInHeaders)) {
+			if (present.has(name)) headers[name] = value;
+		}
+		callback({ requestHeaders: headers });
+	});
+}
+
+/**
+ * Make the browser pane's session fingerprint as ordinary Chrome, in all
+ * three places bot-detection scripts (Cloudflare, DataDome, PerimeterX, …)
+ * cross-check: the UA string, the `sec-ch-ua*` request headers, and the
+ * `navigator.userAgentData` object page JS reads. All are derived from the
+ * same `process.versions.chrome`, so they can never disagree. A mismatch
+ * between any two can get a user's own ordinary browsing wrongly challenged
+ * or blocked.
+ */
+export function configureBrowserUserAgent(): void {
+	const browserSession = session.fromPartition(BROWSER_PARTITION);
+	browserSession.setUserAgent(buildChromeUserAgent());
+	configureClientHintHeaders(browserSession);
+	// Headers alone don't change what live scripts read from
+	// navigator.userAgentData; a session preload rebuilds it in every frame
+	// before page scripts run.
+	browserSession.registerPreloadScript({
+		type: "frame",
+		filePath: join(__dirname, "../preload/browser-client-hints.js"),
+	});
+}

apps/desktop/src/preload/browser-client-hints.ts

@@ -0,0 +1,54 @@
+import { contextBridge } from "electron";
+import {
+	buildUserAgentDataOverride,
+	type UserAgentDataOverride,
+} from "shared/client-hints";
+
+/**
+ * Session preload for the browser pane (registered in
+ * main/lib/browser/user-agent.ts), running at document-start in every frame.
+ * Rewriting the `sec-ch-ua*` headers doesn't change what page JS reads from
+ * `navigator.userAgentData` — Chromium builds that from the same metadata
+ * `setUserAgent()` can't touch, so scripts would still see a brand list with
+ * no "Google Chrome" entry contradicting the UA string. Replace it in the
+ * main world before any page script can read it.
+ */
+
+const override = buildUserAgentDataOverride({
+	chromeVersion: process.versions.chrome,
+	platform: process.platform,
+	arch: process.arch,
+	osVersion: process.getSystemVersion(),
+});
+
+contextBridge.executeInMainWorld({
+	// Serialized and re-executed in the page's world: only `data` and globals
+	// are in scope here.
+	func: (data: UserAgentDataOverride) => {
+		// Real Chrome exposes navigator.userAgentData only in secure contexts.
+		if (!globalThis.isSecureContext) return;
+		const uaData = {
+			brands: data.brands,
+			mobile: data.mobile,
+			platform: data.platform,
+			getHighEntropyValues: async (_hints?: string[]) => ({
+				brands: data.brands,
+				mobile: data.mobile,
+				...data.highEntropy,
+			}),
+			toJSON: () => ({
+				brands: data.brands,
+				mobile: data.mobile,
+				platform: data.platform,
+			}),
+		};
+		// Redefine the prototype accessor (where the real property lives)
+		// rather than adding an own property to the navigator instance.
+		Object.defineProperty(Navigator.prototype, "userAgentData", {
+			get: () => uaData,
+			configurable: true,
+			enumerable: true,
+		});
+	},
+	args: [override],
+});

apps/desktop/src/renderer/routes/_authenticated/_dashboard/v2-workspace/$workspaceId/hooks/usePaneRegistry/components/BrowserPane/browserRuntimeRegistry.ts

@@ -22,7 +22,8 @@ export interface BrowserRuntimeState {
 export interface PersistableBrowserState {
 	url: string;
 	pageTitle: string;
-	faviconUrl: string | null;
+	/** Omitted when the persist source has no fresh favicon; consumers keep the previous value. */
+	faviconUrl?: string | null;
 }
 
 interface RegistryEntry {
@@ -305,14 +306,6 @@ class BrowserRuntimeRegistryImpl {
 			lastUsedAt: 0,
 		};
 
-		const firePersist = () => {
-			entry.onPersist?.({
-				url: entry.state.currentUrl,
-				pageTitle: entry.state.pageTitle,
-				faviconUrl: entry.state.faviconUrl,
-			});
-		};
-
 		const handleDomReady = () => {
 			const webContentsId = webview.getWebContentsId();
 			if (entry.webContentsId !== webContentsId) {
@@ -350,7 +343,10 @@ class BrowserRuntimeRegistryImpl {
 						console.error("[browserRuntimeRegistry] upsert history:", err);
 					});
 			}
-			firePersist();
+			// No faviconUrl here: did-start-loading reset it to null and the real
+			// one arrives via page-favicon-updated, which persists it itself —
+			// including the null would clobber a good favicon on every navigation.
+			entry.onPersist?.({ url, pageTitle: title });
 		};
 
 		const handleDidNavigate = (e: Electron.DidNavigateEvent) => {
@@ -388,7 +384,11 @@ class BrowserRuntimeRegistryImpl {
 						console.error("[browserRuntimeRegistry] upsert favicon:", err);
 					});
 			}
-			firePersist();
+			entry.onPersist?.({
+				url: entry.state.currentUrl,
+				pageTitle: entry.state.pageTitle,
+				faviconUrl: favicon,
+			});
 		};
 
 		const handleDidFailLoad = (e: Electron.DidFailLoadEvent) => {

apps/desktop/src/renderer/routes/_authenticated/_dashboard/v2-workspace/$workspaceId/hooks/usePaneRegistry/components/BrowserPane/hooks/usePersistentWebview/usePersistentWebview.ts

@@ -73,18 +73,26 @@ export function usePersistentWebview({
 			attachUrlRef.current,
 			workspaceId ?? "",
 			({ url, pageTitle, faviconUrl }) => {
+				// A detached pane keeps its onPersist so an in-flight navigation can
+				// still finish persisting, while this component instance may already
+				// be rendering a different pane (unkeyed tab reuse / replacePane).
+				// A late event from the old pane must not write through ctxRef into
+				// whichever pane is active now.
+				if (ctxRef.current.pane.id !== paneId) return;
 				const current = ctxRef.current.pane.data as BrowserPaneData;
+				const nextFaviconUrl =
+					faviconUrl === undefined ? current.faviconUrl : faviconUrl;
 				if (
 					current.url === url &&
 					current.pageTitle === pageTitle &&
-					current.faviconUrl === faviconUrl
+					current.faviconUrl === nextFaviconUrl
 				)
 					return;
 				ctxRef.current.actions.updateData({
 					...current,
 					url,
 					pageTitle,
-					faviconUrl,
+					faviconUrl: nextFaviconUrl,
 				});
 			},
 		);