[yaacovcorcos]

WhatsApp Web now opens in Scient's browser. It used to show "WhatsApp works with Google Chrome 100+" even though the engine is Chrome 152.

Cause

Electron's native identity includes the app's name: Scient/0.6.26 Chrome/152… Electron/44… Safari/537.36. WhatsApp's server refuses any browser that names an app beside Chrome. It refused the token before Chrome, after Safari, and with a modern version number. Electron/… alone is accepted.

Change

New apps/desktop/src/scient/browser/siteBrowserIdentity.ts drops the app name from the User-Agent request header for web.whatsapp.com only. It is mounted where each browser session is created, so normal and incognito tabs both get it. The page's own navigator.userAgent stays native.

It is one host because a general rewrite is what upstream removed in pingdotgg/t3code#7110: Cloudflare Turnstile loops on rewritten identities.

Measured (Electron 44.10 / Chrome 152, macOS)

Identity on dash.cloudflare.com/login	Challenge loads in 24 s	600010 errors
Native	1	0
App name removed, Electron kept	1	0
Plain Chrome	16	15

Upstream measured the middle row failing on Electron 41 / Linux, which is another reason not to apply it everywhere.

Through the real BrowserSession code in a dev app with this change:

• WhatsApp shows a live login QR, and still does after two reloads under its service worker.
• dash.cloudflare.com/login does not loop in the same session.

Electron proxies a session's requests once any webRequest listener exists, so the hook's path reaches beyond WhatsApp. A session with the hook matched one without on download, 500 KB upload, CORS preflight, streaming, WebSocket and the Google sign-in page.

Not proven

• Linking a phone by scanning the QR, which needs a real account.
• Windows and Linux.
• Passkeys and video calls with the hook active.

Electron keeps one onBeforeSendHeaders listener per session, so any later listener on these sessions would silently replace this one. Nothing else registers one today.

🤖 Generated with Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.5 KiB	5.5 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	4.2 KiB	4.2 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.3 KiB	1.3 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	22.4 KiB	22.4 KiB	0 B (0.0%)	24.4 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.5 KiB	5.5 KiB	+4 B (+0.1%)	6.8 KiB	✅
Claude	Thread snapshot wire	4.2 KiB	4.2 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.3 KiB	1.3 KiB	+4 B (+0.3%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	22.7 KiB	22.7 KiB	0 B (0.0%)	24.4 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 488ca93 · PR result: 437140a · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.
Bounded compact HTTP snapshot with live cursor.

• Codex decoded thread snapshot: 88.2 KiB
• Claude decoded thread snapshot: 88.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.