Surface a browser fallback when Safari sign-in hangs (#6015)

[austinywang]

Problem

macOS sign-in (Settings → Account → Sign In) hangs: a Safari window opens — even when Safari is not the default browser — then nothing. No page progress, no callback, the app stays "Not signed in". Reported by a Founder's Edition customer; blocking them from signing in at all. (#6015)

Root cause map (from the code, not yet a confirmed web repro):

• Sign-in always runs through ASWebAuthenticationSession, which on macOS is always Safari-backed regardless of the user's default browser — that part is Apple-by-design, not the bug. The hang is when the hosted page never redirects to cmux://auth-callback.
• The only backstop today is browserAttemptTimeout (10 minutes), after which the attempt is silently cancelled. The user gets zero feedback and no recovery path in the meantime.

What this PR does

This is the UX + recovery fix the issue's "Expected" calls for ("surface an actionable error promptly instead of hanging silently"). It does not attempt to fix the web-side root cause (why the hosted redirect never fires for some users) — that genuinely needs a clean, not-signed-in macOS repro, and the cloud-mac repro infra is currently down.

• HostBrowserSignInFlow flips a new observable signInIsSlow after slowSignInThreshold (30s) of an attempt still waiting on the browser. It is non-destructive — the popup keeps running, so a user who is simply taking their time can still finish in it. Resets on finish / cancel / replacement.
• New activeAttemptSignInURL reuses the active attempt's callback state, so a sign-in completed in the user's real default browser deep-links cmux://auth-callback back into the in-flight attempt via the existing handleCallbackURL path (the cmux:// scheme is already registered and routed in AppDelegate). This is a genuine recovery route, not just a nag.
• Settings → Account card surfaces it: when sign-in is slow and the user is still signed out, it shows a hint + an "Open in Browser" button (NSWorkspace.open(activeAttemptSignInURL)).
• AccountFlow gains signInIsSlow + openSignInInDefaultBrowser; HostAccountFlow wires them to the shared flow. One model path — the command palette, mobile pairing, and CLI (auth.begin_sign_in already returns a manual URL) sign-in entrypoints all drive the same HostBrowserSignInFlow.

Regression test (two-commit red/green per repo policy)

• fe5194618 (RED): inert signInIsSlow stub + slowSignInSurfacesBrowserFallback test that drives a popup which never delivers a callback. Fails on exactly Expectation failed: becameSlow.
• 72bf8fe14 (GREEN): wires the slow-hint scheduling; the test passes. Adds activeAttemptSignInURLCarriesActiveAttemptState (asserts the fallback URL carries the active attempt's cmux_auth_state so the deep link routes back).

Test plan

• swift test --package-path Packages/CmuxAuthRuntime → 94/94 pass (was 92; +2 new). Verified the regression test fails on commit 1 and passes on commit 2.
• swift build of CmuxSettingsUI → clean.
• Full tagged Debug app build (reload.sh --tag fix-6015-signin-hang) → BUILD SUCCEEDED.

Localization audit

New user-facing strings settings.account.signIn.slowHint and settings.account.signIn.openInBrowser added to Resources/Localizable.xcstrings in en / ja / ko / uk — the exact locale set every other settings.account.* key uses (verified against the catalog). No bare English literals introduced (Text/Button use String(localized:)).

Issue: #6015

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

---

Summary by cubic

Adds a default-browser fallback when macOS sign-in via the system sign-in window hangs; addresses #6015. After 30s, Settings shows “Open in Browser” using the in‑flight attempt state; the hint clears on callback/finish/cancel, and the fallback callback is accepted even if the popup was closed.

• New Features

  • CmuxAuthRuntime: HostBrowserSignInFlow exposes signInIsSlow (30s, configurable) and activeAttemptSignInURL that reuses the active cmux_auth_state.
  • CmuxSettingsUI: Account card shows a slow-sign-in hint only when still signed out and adds “Open in Browser”; AccountFlow adds signInIsSlow and openSignInInDefaultBrowser; HostAccountFlow opens via NSWorkspace.
  • Localization + tests: Added en/ja/ko/uk strings; tests cover the slow state, the state-carrying fallback URL, and fallback completion after popup cancel.

• Bug Fixes

  • Preserve and accept callbacks from an issued fallback URL even after the popup is cancelled; clear the issued state once used and reject it after sign-out.

^{Written for commit a067a07. Summary will update on new commits.}

Summary by CodeRabbit

• New Features

  • Slow sign-in detection: When sign-in attempts exceed 30 seconds, users see a helpful hint instead of an indefinite spinner.
  • Browser fallback: A new "Open in Browser" button allows users to complete sign-in in their default browser if the popup window becomes unresponsive.

• Localization

  • Added translations for slow sign-in messaging in Japanese, Ukrainian, and Korean.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cmux	Canceled		Jun 14, 2026 10:51pm
cmux-staging	Building	Preview, Comment	Jun 14, 2026 10:51pm

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds slow-sign-in detection to HostBrowserSignInFlow via a configurable slowSignInThreshold (default 30 s) that flips a signInIsSlow flag when a browser sign-in attempt exceeds the threshold. A companion activeAttemptSignInURL property enables opening the in-flight sign-in in the default browser. This state is forwarded through HostAccountFlow, declared in the AccountFlow protocol, and surfaced in AccountIdentityCard as a localized fallback row with an "Open in Browser" button.

Changes

Slow Sign-In Detection and Default-Browser Fallback

Layer / File(s)	Summary
HostBrowserSignInFlow: slow-sign-in state, URL, and scheduling Packages/CmuxAuthRuntime/Sources/CmuxAuthRuntime/BrowserSignIn/HostBrowserSignInFlow.swift	Adds signInIsSlow public flag, slowSignInThreshold config (default 30 s, 0 disables), activeAttemptSignInURL computed from active attempt callback state, and scheduleSlowSignInHint/cancelSlowSignInHint task management that flips and resets signInIsSlow around each attempt lifecycle.
HostBrowserSignInFlow tests Packages/CmuxAuthRuntime/Tests/CmuxAuthRuntimeTests/HostBrowserSignInFlowTests.swift	makeHarness gains a slowSignInThreshold parameter; two new tests verify signInIsSlow flips true after the threshold and clears after cancellation, and that activeAttemptSignInURL shares the same cmux_auth_state as the active popup attempt.
AccountFlow protocol and HostAccountFlow wiring Packages/CmuxSettingsUI/Sources/CmuxSettingsUI/Account/AccountFlow.swift, Sources/Auth/HostAccountFlow.swift	AccountFlow protocol adds signInIsSlow: Bool and openSignInInDefaultBrowser(). HostAccountFlow implements both by forwarding browserSignIn.signInIsSlow and calling NSWorkspace.shared.open with activeAttemptSignInURL; adds AppKit import.
Fallback UI and localization Packages/CmuxSettingsUI/Sources/CmuxSettingsUI/Account/AccountIdentityCard.swift, Resources/Localizable.xcstrings	AccountIdentityCard restructures body into a VStack and conditionally appends slowSignInFallback (secondary hint text + "Open in Browser" button) when signInIsSlow && currentIdentity == nil. Adds settings.account.signIn.slowHint and settings.account.signIn.openInBrowser keys for en, ja, uk, and ko.

Sequence Diagram

sequenceDiagram
  actor User
  participant AccountIdentityCard
  participant HostAccountFlow
  participant HostBrowserSignInFlow
  participant NSWorkspace

  User->>AccountIdentityCard: initiates sign-in
  AccountIdentityCard->>HostAccountFlow: signIn()
  HostAccountFlow->>HostBrowserSignInFlow: startSignIn()
  HostBrowserSignInFlow->>HostBrowserSignInFlow: scheduleSlowSignInHint(attempt)
  Note over HostBrowserSignInFlow: threshold (30s) elapses with no completion
  HostBrowserSignInFlow-->>HostAccountFlow: signInIsSlow = true
  HostAccountFlow-->>AccountIdentityCard: signInIsSlow = true
  AccountIdentityCard-->>User: shows "Open in Browser" fallback row
  User->>AccountIdentityCard: taps "Open in Browser"
  AccountIdentityCard->>HostAccountFlow: openSignInInDefaultBrowser()
  HostAccountFlow->>HostBrowserSignInFlow: read activeAttemptSignInURL
  HostBrowserSignInFlow-->>HostAccountFlow: URL with cmux_auth_state
  HostAccountFlow->>NSWorkspace: open(url)

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related issues

• macOS sign-in hangs: auth window opens in Safari (even when not default browser), then nothing — never completes #6015: This PR directly implements the slow/hanging sign-in detection and default-browser fallback described in that issue, introducing the slowSignInThreshold timer, signInIsSlow state, and openSignInInDefaultBrowser() mechanism.

Poem

A hop, a click, and the browser just froze,
The rabbit grew tired of watching it doze.
So we set a small clock, thirty seconds or so,
"Too slow?" says the UI, "Here's a button — let's go!"
🐇✨ Open in Browser, and off the auth flows!

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Cmux Architecture Rethink	❌ Error	PR introduces slowSignInHintTask using delayed-dispatch (clock.sleep in Task) and a new observable mutable flag signInIsSlow to patch the symptom of hung browser redirects, rather than preven...	Refactor to make the long-wait bad state unrepresentable: either enforce a sub-30s timeout on attempted sign-ins, or own the UI timeout/feedback entirely in AccountFlow rather than delegating to HostBrowserSignInFlow state watches.
Docstring Coverage	⚠️ Warning	Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (19 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Surface a browser fallback when Safari sign-in hangs (#6015)' directly summarizes the main change: adding a recovery UX when macOS sign-in hangs, matching the PR's core objective.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Cmux Swift Actor Isolation	✅ Passed	All production Swift changes properly maintain Swift 6 actor isolation: new properties declared in @MainActor classes, new protocol requirements added to @MainActor protocol, new methods isolated v...
Cmux Swift Blocking Runtime	✅ Passed	Production code uses injected Clock abstraction with proper cancellation (Task.isCancelled checks, explicit .cancel() calls), not raw Task.sleep. Supports virtual-clock testing. Timeouts...
Cmux Expensive Synchronous Load	✅ Passed	PR contains no expensive synchronous loaders on main actor/interactive paths. New operations are: simple property reads, async Task-based scheduling, and NSWorkspace.open() in button actions—all no...
Cmux Cache Substitution Correctness	✅ Passed	activeAttemptSignInURL is a transient computed property used only for immediate UI action (opening browser URL), not persisted or used in undo/snapshot paths, so does not violate cache substitution...
Cmux No Hacky Sleeps	✅ Passed	Check applies only to TypeScript, JavaScript, shell, and build/runtime scripts; all PR changes are Swift code covered by separate rule.
Cmux Algorithmic Complexity	✅ Passed	PR adds slow-sign-in UX feedback with O(1) operations only: boolean flag, computed property, single Task scheduler, no collection scans/filters on hot paths, configurable fixed-duration timeout (0...
Cmux Swift Concurrency	✅ Passed	PR introduces modern async/await with proper Task lifecycle management (slowSignInHintTask and activeAttemptTimeoutTask stored and explicitly cancelled). No DispatchQueue, Combine, or completion-ha...
Cmux Swift @Concurrent	✅ Passed	All Task creations are explicitly marked with @MainActor isolation. The new openSignInInDefaultBrowser() is a synchronous function (not async) that intentionally calls NSWorkspace.shared.open() on...
Cmux Swift File And Package Boundaries	✅ Passed	PR respects Swift file/package boundaries: no oversized files created, small additions (+58/+53/+10 lines) to existing files under 800-line threshold, responsibilities clearly preserved in each fil...
Cmux Swift Logging	✅ Passed	PR contains no forbidden logging functions (print, debugPrint, dump, NSLog). The only logging added uses the approved AuthDebugLog utility which is Sendable and handles proper redaction of secrets.
Cmux User-Facing Error Privacy	✅ Passed	All user-facing strings in the PR follow the privacy rule: "slowHint" and "openInBrowser" localized messages contain no credentials, tokens, internal provider names, database details, or sensitive...
Cmux Full Internationalization	✅ Passed	All new user-facing strings use String(localized:) with matching catalog entries for all 4 locales (en/ja/ko/uk), consistent with the existing settings.account.* pattern, and all translations have...
Cmux Swiftui State Layout	✅ Passed	HostBrowserSignInFlow uses @Observable (modern pattern), signInIsSlow mutations occur in explicit Task callbacks with delays (not render-time), UI in AccountIdentityCard conditionally shows fallbac...
Cmux Swift Auxiliary Window Close Shortcuts	✅ Passed	PR introduces no new NSWindow, NSPanel, NSWindowController, SwiftUI Window, or WindowGroup. Changes are state management, view updates, and NSWorkspace.open() delegation to system handlers, not sta...
Cmux Source Artifacts	✅ Passed	All 6 changed files are legitimate source code, tests, or localization catalogs. No generated artifacts, caches, build output, or temp directories are present in the PR.
Description check	✅ Passed	The PR description comprehensively covers the problem, solution, testing approach, and localization audit with clear structure and technical detail.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch issue-6015-signin-safari-hang

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[greptile-apps]

Greptile Summary

Surfaces a "slow sign-in" fallback in the Settings Account card when macOS ASWebAuthenticationSession hangs past a configurable threshold (default 30 s). The HostBrowserSignInFlow gains a signInIsSlow observable, a slowSignInHintTask timer, and an activeAttemptSignInURL computed property that reuses the in-flight attempt's callback state so a deep link from the real default browser can complete the same attempt.

• HostBrowserSignInFlow: Adds signInIsSlow/slowSignInHintTask (mirrors the existing isSigningIn/activeAttemptTimeoutTask pattern), activeAttemptSignInURL (reuses activeCallbackState to route the fallback deep link back into the in-flight attempt), and pendingFallbackCallbackState for handleCallbackURL routing. Reset and cancel paths (cancelActiveAttempt, finishAttempt, routeToActive) are all symmetric.
• UI and protocol: AccountFlow grows signInIsSlow + openSignInInDefaultBrowser(); HostAccountFlow wires them; AccountIdentityCard adds the conditional hint row (showSlowSignInFallback guards on both signInIsSlow and currentIdentity == nil).
• Localization + tests: New strings added for en/ja/ko/uk — matching every existing settings.account.* entry. Four new tests cover the slow-state detection, fallback URL state, popup-cancellation survival, and post-sign-out rejection.

Confidence Score: 5/5

Safe to merge — the new slow-sign-in hint and browser-fallback path are non-destructive, all cancel/reset paths are symmetric, and four targeted regression tests validate the key scenarios.

The fallback routing in handleCallbackURL correctly differentiates the active-session, issued-fallback, and stateless paths. The pendingFallbackCallbackState lifecycle is properly maintained across cancelActiveAttempt, completeCallback, and the routeToIssuedFallback eager-clear. The showSlowSignInFallback guard (signInIsSlow AND currentIdentity == nil) prevents any stale-flag visual artifacts. Localization matches the established en/ja/ko/uk pattern for settings.account.* keys.

No files require special attention.

Important Files Changed

Filename	Overview
Packages/CmuxAuthRuntime/Sources/CmuxAuthRuntime/BrowserSignIn/HostBrowserSignInFlow.swift	Core logic change: adds signInIsSlow flag, slowSignInHintTask timer, activeAttemptSignInURL, and pendingFallbackCallbackState. All cancel/reset paths are symmetric; completeCallback cleans up pendingFallbackCallbackState for the popup-completion case; routeToIssuedFallback clears it eagerly before the async call.
Packages/CmuxAuthRuntime/Tests/CmuxAuthRuntimeTests/HostBrowserSignInFlowTests.swift	Adds four targeted tests covering slow-state detection, fallback URL state preservation, popup-cancellation survival, and post-sign-out rejection.
Packages/CmuxSettingsUI/Sources/CmuxSettingsUI/Account/AccountIdentityCard.swift	Adds slowSignInFallback sub-view behind showSlowSignInFallback guard (checks both signInIsSlow and currentIdentity == nil). Layout restructured from HStack to VStack. Localized strings use String(localized:defaultValue:) correctly.
Sources/Auth/HostAccountFlow.swift	Wires signInIsSlow and openSignInInDefaultBrowser() to HostBrowserSignInFlow; opens the URL via NSWorkspace.shared.open(url). Clean adapter-only change.
Resources/Localizable.xcstrings	Adds settings.account.signIn.slowHint and settings.account.signIn.openInBrowser in en/ja/ko/uk — exactly matching every other settings.account.* key's locale coverage.
.github/swift-file-length-budget.tsv	Updated budgets to reflect minor byte-count reductions; sort-order adjusted. No new files added over budget.
CLAUDE.md	Cosmetic tweak: changes ======= separator lines to ------- in output formatting examples.

Sequence Diagram

sequenceDiagram
    participant UI as AccountIdentityCard
    participant AF as HostAccountFlow
    participant Flow as HostBrowserSignInFlow
    participant Popup as ASWebAuthSession
    participant Browser as Default Browser
    participant App as AppDelegate (cmux://)

    UI->>AF: startSignIn()
    AF->>Flow: beginSignIn()
    Flow->>Popup: start() [scheduleSlowSignInHint T+30s]
    Note over Popup: Popup hangs

    Flow-->>Flow: "signInIsSlow = true (T+30s)"
    Flow-->>AF: signInIsSlow observable
    AF-->>UI: "signInIsSlow = true"
    UI->>UI: showSlowSignInFallback

    UI->>AF: openSignInInDefaultBrowser()
    AF->>Flow: activeAttemptSignInURL
    AF->>Browser: NSWorkspace.open(url)

    Browser->>App: "cmux://auth-callback?cmux_auth_state=STATE"
    App->>Flow: handleCallbackURL(url)

    alt Popup still has active continuation
        Flow->>Flow: routeToActive + cancelSlowSignInHint()
        Flow->>Flow: completeCallback(attemptID)
        Flow->>Popup: resumeContinuation(nil)
    else Popup already closed
        Flow->>Flow: routeToIssuedFallback
        Flow->>Flow: completeCallback(acceptedExternalState)
    end

    Flow-->>AF: "isSigningIn=false, signInIsSlow=false"
    AF-->>UI: currentIdentity updated

Loading

_{Reviews (8): Last reviewed commit: "fix: preserve issued fallback callback s..." | Re-trigger Greptile}

[greptile-apps]

Vendor name in user-facing hint copy. The string "The sign-in window opens in Safari and may hang…" names "Safari" — an upstream vendor product — directly in user-facing copy. The cmux copy rule prohibits upstream vendor or service names in hints, alerts, and recovery text. Replacing it with something like "The system sign-in window may take a moment or stop responding…" conveys the same information without surfacing the implementation detail, and holds up correctly if Apple ever changes the backing browser.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[austinywang]

Fixed in 98107a8: the slow sign-in hint copy no longer names a browser vendor, and the localized catalog entries were updated to match.

— Claude Code

[austinywang]

Removed the vendor-specific implementation detail from the sign-in fallback code path. The localized user-facing hint remains generic: system sign-in window plus default browser fallback.

— Claude Code