fix(desktop): refuse window.open app links, gate every launch on a prompt-capable renderer, and keep page-raised prompts from taking focus

Author: waleedlatif1

apps/desktop/src/main/browser-agent/page-prompts.test.ts

@@ -268,30 +268,36 @@ describe('app links', () => {
       frameTreeNodeId: 2,
       origin: 'https://ads.example',
     } as WebFrameMain
-    requestExternalLaunch(contents, 'zoommtg://zoom.us/join', { initiator: frame })
-    requestExternalLaunch(contents, 'zoommtg://zoom.us/join', {
-      initiator: topFrame('https://ads.example'),
-    })
-    requestExternalLaunch(contents, 'zoommtg://zoom.us/join', { initiator: null })
+    requestExternalLaunch(contents, 'zoommtg://zoom.us/join', frame)
+    requestExternalLaunch(contents, 'zoommtg://zoom.us/join', topFrame('https://ads.example'))
+    requestExternalLaunch(contents, 'zoommtg://zoom.us/join', null)
     expect(pagePromptForContents(contents)).toBeUndefined()
     expect(appLaunchNoticeForContents(contents)).toBeUndefined()
   })
 
-  it('asks after the top document is clicked, but only offers a popup passively', () => {
+  it('asks after the top document is clicked, and otherwise only offers passively', () => {
     const clicked = agentContents()
-    requestExternalLaunch(clicked, 'zoommtg://zoom.us/join', { initiator: topFrame() })
+    requestExternalLaunch(clicked, 'zoommtg://zoom.us/join', topFrame())
     expect(pagePromptForContents(clicked)).toMatchObject({ kind: 'external-app', appName: 'Zoom' })
 
-    const popup = agentContents()
-    requestExternalLaunch(popup, 'zoommtg://zoom.us/join', 'popup')
-    expect(pagePromptForContents(popup)).toBeUndefined()
-    expect(appLaunchNoticeForContents(popup)).toMatchObject({ origin: PAGE, appName: 'Zoom' })
+    context.userActivated = false
+    const unclicked = agentContents()
+    requestExternalLaunch(unclicked, 'zoommtg://zoom.us/join', topFrame())
+    expect(pagePromptForContents(unclicked)).toBeUndefined()
+    expect(appLaunchNoticeForContents(unclicked)).toMatchObject({ origin: PAGE, appName: 'Zoom' })
+  })
+
+  it('opens nothing, not even a clicked mail link, without a renderer that shows prompts', async () => {
+    context.promptsEnabled = false
+    requestExternalLaunch(agentContents(), 'mailto:ada@example.com', topFrame())
+    await vi.advanceTimersByTimeAsync(0)
+    expect(shell.openExternal).not.toHaveBeenCalled()
   })
 
   it('opens only the first link while its prompt is pending', async () => {
     const contents = agentContents()
-    requestExternalLaunch(contents, 'zoommtg://zoom.us/join?id=1', { initiator: topFrame() })
-    requestExternalLaunch(contents, 'zoommtg://zoom.us/join?id=2', { initiator: topFrame() })
+    requestExternalLaunch(contents, 'zoommtg://zoom.us/join?id=1', topFrame())
+    requestExternalLaunch(contents, 'zoommtg://zoom.us/join?id=2', topFrame())
     expect(appLaunchNoticeForContents(contents)).toBeUndefined()
     answer(contents, { allowed: true, kind: 'external-app', alwaysAllow: false })
     await vi.advanceTimersByTimeAsync(0)
@@ -300,11 +306,11 @@ describe('app links', () => {
 
   it('forgets "Always allow" on reset', async () => {
     const contents = agentContents()
-    requestExternalLaunch(contents, 'zoommtg://zoom.us/join?id=1', { initiator: topFrame() })
+    requestExternalLaunch(contents, 'zoommtg://zoom.us/join?id=1', topFrame())
     answer(contents, { allowed: true, kind: 'external-app', alwaysAllow: true })
     resetPagePromptDecisions()
     vi.advanceTimersByTime(20_000)
-    requestExternalLaunch(contents, 'zoommtg://zoom.us/join?id=2', { initiator: topFrame() })
+    requestExternalLaunch(contents, 'zoommtg://zoom.us/join?id=2', topFrame())
     await vi.advanceTimersByTimeAsync(0)
     expect(pagePromptForContents(contents)).toMatchObject({ kind: 'external-app' })
     expect(shell.openExternal).toHaveBeenCalledExactlyOnceWith('zoommtg://zoom.us/join?id=1')
@@ -383,7 +389,7 @@ describe('accepting an answer', () => {
     vi.mocked(shell.openExternal).mockClear()
     context.userActivated = slot === 'prompt'
     const contents = agentContents()
-    requestExternalLaunch(contents, 'zoommtg://zoom.us/join', { initiator: topFrame })
+    requestExternalLaunch(contents, 'zoommtg://zoom.us/join', topFrame)
     const requestId =
       slot === 'prompt'
         ? shownPrompt(contents).requestId

apps/desktop/src/main/browser-agent/page-prompts.ts

@@ -486,13 +486,6 @@ export function handleSelectClientCertificate(
   })
 }
 
-/**
- * Who asked to open another app: a navigation names its initiating frame; a
- * popup cannot be attributed to one, since Electron's window-open details
- * carry no frame.
- */
-export type AppLaunchSource = { initiator: WebFrameMain | null | undefined } | 'popup'
-
 /** The tab's own top-level document asked, not a frame inside it. */
 function isTopDocument(
   contents: WebContents,
@@ -516,16 +509,18 @@ function launchAppLink(url: string): void {
 }
 
 /**
- * A browser tab asked to open a non-web URL. Agent input never launches
- * anything, and neither do frames. The top document's request right after the
- * user's own click asks them to confirm the app (mail links open directly);
- * a popup or a request without that click only gets a passive notice the user
- * can act on. A pending launch prompt refuses further requests.
+ * A browser tab's navigation to a non-web URL, with the frame that initiated
+ * it. Agent input never launches anything, and neither do frames; `window.open`
+ * never reaches here, since it names no initiating frame. The top document's
+ * request right after the user's own click asks them to confirm the app (mail
+ * links open directly); one without that click only gets a passive notice the
+ * user can act on. Nothing launches without a renderer that shows prompts, and
+ * a pending launch prompt refuses further requests.
  */
 export function requestExternalLaunch(
   contents: WebContents,
   rawUrl: string,
-  source: AppLaunchSource
+  initiator: WebFrameMain | null | undefined
 ): void {
   if (!host || contents.isDestroyed() || !isAgentWebContents(contents)) return
   const target = appLinkTarget(rawUrl)
@@ -540,7 +535,7 @@ export function requestExternalLaunch(
     appName = displayText(app.getApplicationNameForProtocol(target.url), 80)
   } catch {}
   const context = host.tabContext(contents)
-  if (!appName || !context) return
+  if (!appName || !context?.promptsEnabled) return
   if (context.agentActedLast) {
     host.noticeForAgent(
       contents,
@@ -550,14 +545,14 @@ export function requestExternalLaunch(
   }
   const origin = parseHttpUrl(contents.getURL())?.origin
   if (!origin) return
-  if (source !== 'popup' && !isTopDocument(contents, source.initiator, origin)) {
+  if (!isTopDocument(contents, initiator, origin)) {
     logger.warn('Denied an app link from a frame in agent browser', { scheme: target.scheme })
     return
   }
   const attempts = recentAttempts(contents, 'app-launch', LAUNCH_RATE_WINDOW_MS)
   if (attempts.length >= MAX_LAUNCHES_PER_WINDOW) return
   const launchKey = `${origin}|${target.scheme}`
-  if (source !== 'popup' && context.userActivated && !context.agentDrives) {
+  if (context.userActivated && !context.agentDrives) {
     if (target.scheme === 'mailto' || alwaysAllowedLaunches.has(launchKey)) {
       attempts.push(Date.now())
       launchAppLink(target.url)

apps/desktop/src/main/browser-agent/session.test.ts

@@ -12,13 +12,15 @@ vi.mock('node:dns/promises', () => ({
 }))
 
 import {
+  app,
   BrowserWindow,
   dialog,
   session as electronSession,
   Menu,
   shell,
   WebContentsView,
 } from 'electron'
+import { appLaunchNoticeForContents } from '@/main/browser-agent/page-prompts'
 import * as panel from '@/main/browser-agent/panel'
 import { agentAppOrigin, routeAgentNavigation } from '@/main/browser-agent/registry'
 import * as sessionModule from '@/main/browser-agent/session'
@@ -1257,6 +1259,11 @@ describe('browser-agent session', () => {
     contents.loadURL.mockClear()
     expect(openHandler({ url: 'file:///etc/passwd' })).toEqual({ action: 'deny' })
     expect(contents.loadURL).not.toHaveBeenCalled()
+    // window.open names no initiating frame, so an app link from it is never offered either.
+    session.enablePagePrompts()
+    app.getApplicationNameForProtocol = vi.fn(() => 'Zoom')
+    expect(openHandler({ url: 'zoommtg://zoom.us/join' })).toEqual({ action: 'deny' })
+    expect(appLaunchNoticeForContents(contents as unknown as WebContents)).toBeUndefined()
   })
 
   it('opens a background-disposition popup by URL and keeps cross-scheme popups denied', () => {

apps/desktop/src/main/browser-agent/session.ts

@@ -60,7 +60,6 @@ import {
   cancelPagePrompts,
   handleSelectPasskeyAccount,
   noteMainFrameNavigation,
-  requestExternalLaunch,
   resetPagePromptDecisions,
   setPagePromptHost,
 } from '@/main/browser-agent/page-prompts'
@@ -2777,10 +2776,6 @@ function initializeTabView(
   // WebContents keeps window.opener for sign-in popups that post back to it.
   contents.setWindowOpenHandler((details) =>
     withBrowserScope(scopeId, () => {
-      if (!isBlankPopupUrl(details.url) && !/^https?:\/\//i.test(details.url)) {
-        requestExternalLaunch(contents, details.url, 'popup')
-        return { action: 'deny' }
-      }
       const agentOwned = agentOwnsPopupFrom(contents)
       const background = details.disposition === 'background-tab'
       const adopt = canAdoptPopup(contents, details.url)

apps/desktop/src/main/security-guards.ts

@@ -43,7 +43,7 @@ export function attachNavigationGuards(contents: WebContents, deps: GuardDeps):
       if (!hasAllowedAgentBrowserScheme) {
         event.preventDefault()
         if (event.isMainFrame === true) {
-          requestExternalLaunch(contents, url, { initiator: event.initiator })
+          requestExternalLaunch(contents, url, event.initiator)
         } else logger.warn('Denied non-http navigation in agent browser', { url: scrubUrl(url) })
       }
       return

apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/resource-content/components/browser-session/browser-page-prompt.tsx

@@ -56,7 +56,10 @@ interface PromptModalProps<Prompt extends BrowserPagePrompt> {
   onRespond: RespondToPrompt
 }
 
-/** Signing in takes a click on Sign in: Enter in a field never submits credentials a keystroke meant for the page. */
+/**
+ * A page raised this, so it never takes focus, and signing in takes a click on
+ * Sign in: Enter in a field never submits credentials typed for the page.
+ */
 function HttpAuthPromptModal({ prompt, open, onRespond }: PromptModalProps<BrowserHttpAuthPrompt>) {
   const armed = useActivationDelay(open)
   const [username, setUsername] = useState('')
@@ -65,7 +68,13 @@ function HttpAuthPromptModal({ prompt, open, onRespond }: PromptModalProps<Brows
   const submit = () =>
     onRespond(prompt.requestId, { allowed: true, kind: 'http-auth', username, password })
   return (
-    <ChipModal open={open} onOpenChange={(next) => !next && cancel()} srTitle='Sign in' size='sm'>
+    <ChipModal
+      open={open}
+      onOpenChange={(next) => !next && cancel()}
+      srTitle='Sign in'
+      size='sm'
+      focusOnOpen={false}
+    >
       <ChipModalHeader onClose={cancel}>Sign in</ChipModalHeader>
       <ChipModalBody>
         <ChipModalDescription>
@@ -118,9 +127,9 @@ interface ChoicePromptModalProps {
 }
 
 /**
- * Picks one of the page's offered identities. Nothing is chosen up front, Enter
- * dismisses, and Continue waits out the activation delay, so a keystroke meant
- * for the page can never send an identity.
+ * Picks one of the page's offered identities. It never takes focus, nothing is
+ * chosen up front, Enter dismisses, and Continue waits out the activation delay,
+ * so a keystroke meant for the page can never send an identity.
  */
 function ChoicePromptModal({
   open,
@@ -137,7 +146,13 @@ function ChoicePromptModal({
   const armed = useActivationDelay(open)
   const [choiceId, setChoiceId] = useState('')
   return (
-    <ChipModal open={open} onOpenChange={(next) => !next && onCancel()} srTitle={title} size='sm'>
+    <ChipModal
+      open={open}
+      onOpenChange={(next) => !next && onCancel()}
+      srTitle={title}
+      size='sm'
+      focusOnOpen={false}
+    >
       <ChipModalHeader onClose={onCancel}>{title}</ChipModalHeader>
       <ChipModalBody>
         <ChipModalDescription>{description}</ChipModalDescription>

packages/emcn/src/components/chip-modal/chip-modal.tsx

@@ -156,6 +156,10 @@ function focusChipModalDefaultAction(event: Event): void {
   focusChipModalContent(event.currentTarget as HTMLElement | null)
 }
 
+function keepFocusOnOpen(event: Event): void {
+  event.preventDefault()
+}
+
 /**
  * Supplies implicit submission for single-line custom inputs that are not a
  * {@link ChipModalField}. Canonical fields handle Enter at the control so they
@@ -216,6 +220,13 @@ interface ChipModalProps {
    * @default false
    */
   dismissDisabled?: boolean
+  /**
+   * Whether opening moves focus into the modal. Set `false` for a modal the
+   * user did not ask for, such as a prompt a web page raised: typing meant for
+   * whatever had focus never lands in it, and the user clicks into it instead.
+   * @default true
+   */
+  focusOnOpen?: boolean
   children?: React.ReactNode
 }
 
@@ -276,6 +287,7 @@ function ChipModal({
   size = 'md',
   className,
   dismissDisabled = false,
+  focusOnOpen = true,
   children,
   'aria-describedby': ariaDescribedBy,
 }: ChipModalProps) {
@@ -287,7 +299,7 @@ function ChipModal({
         srTitle={srTitle}
         size={size}
         dismissDisabled={dismissDisabled}
-        onOpenAutoFocus={focusChipModalDefaultAction}
+        onOpenAutoFocus={focusOnOpen ? focusChipModalDefaultAction : keepFocusOnOpen}
         aria-describedby={ariaDescribedBy}
       >
         <ChipModalSurface className={className}>{children}</ChipModalSurface>