Fix native pairing sign-in failures

.github/swift-file-length-budget.tsv

@@ -204,7 +204,6 @@
 527	CLI/CLISocketPathResolver.swift
 526	Packages/macOS/CmuxSettings/Sources/CmuxSettings/SocketControl/SocketControlSettings.swift
 524	CLI/CMUXCLI+AutoNaming.swift
-524	Packages/Shared/CmuxAuthRuntime/Tests/CmuxAuthRuntimeTests/HostBrowserSignInFlowTests.swift
 522	Packages/macOS/CmuxSettingsUI/Sources/CmuxSettingsUI/Sections/AutomationSection.swift
 520	CLI/CMUXCLI+AmpExtension.swift
 520	cmuxTests/MainWindowVisibilityControllerTests.swift

Packages/Shared/CmuxAuthRuntime/Sources/CmuxAuthRuntime/BrowserSignIn/ASWebBrowserAuthSessionFactory.swift

@@ -18,7 +18,7 @@ public final class ASWebBrowserAuthSessionFactory: HostBrowserAuthSessionFactory
     public func makeSession(
         signInURL: URL,
         callbackScheme: String,
-        completion: @escaping @MainActor (URL?) -> Void
+        completion: @escaping @MainActor (HostBrowserAuthSessionResult) -> Void
     ) -> any HostBrowserAuthSession {
         log.log("auth.webauth.makeSession signInURL=\(signInURL.absoluteString) callbackScheme=\(callbackScheme)")
         let session = ASWebAuthenticationSession(
@@ -41,10 +41,11 @@ public final class ASWebBrowserAuthSessionFactory: HostBrowserAuthSessionFactory
     /// boundary when that off-main delivery happens. This bridge carries no
     /// isolation assumption and hops to the main actor itself.
     nonisolated func sessionCompletionBridge(
-        completion: @escaping @MainActor (URL?) -> Void
+        completion: @escaping @MainActor (HostBrowserAuthSessionResult) -> Void
     ) -> @Sendable (URL?, (any Error)?) -> Void {
         let log = self.log
         return { callbackURL, error in
+            let result = self.sessionResult(callbackURL: callbackURL, error: error)
             Task { @MainActor in
                 if let error {
                     let nsError = error as NSError
@@ -53,10 +54,39 @@ public final class ASWebBrowserAuthSessionFactory: HostBrowserAuthSessionFactory
                 } else {
                     log.log("auth.webauth.completion error=nil callback=\(callbackURL == nil ? "nil" : "present")")
                 }
-                completion(callbackURL)
+                completion(result)
             }
         }
     }
+
+    nonisolated private func sessionResult(
+        callbackURL: URL?,
+        error: (any Error)?
+    ) -> HostBrowserAuthSessionResult {
+        if let callbackURL {
+            return .callback(callbackURL)
+        }
+        guard let error else {
+            return .failed(reason: "missing_callback")
+        }
+        let nsError = error as NSError
+        if nsError.domain == ASWebAuthenticationSessionError.errorDomain {
+            switch nsError.code {
+            case ASWebAuthenticationSessionError.Code.canceledLogin.rawValue:
+                return .cancelled(reason: "canceled_login")
+            case ASWebAuthenticationSessionError.Code.presentationContextInvalid.rawValue:
+                return .failed(reason: "presentation_context_invalid")
+            case ASWebAuthenticationSessionError.Code.presentationContextNotProvided.rawValue:
+                return .failed(reason: "presentation_context_not_provided")
+            default:
+                return .failed(reason: "aswebauthentication_\(nsError.code)")
+            }
+        }
+        if nsError.domain == NSURLErrorDomain {
+            return .failed(reason: "network_\(nsError.code)")
+        }
+        return .failed(reason: "error_\(nsError.code)")
+    }
 }
 
 /// Wraps one `ASWebAuthenticationSession` as a ``HostBrowserAuthSession``.

Packages/Shared/CmuxAuthRuntime/Sources/CmuxAuthRuntime/BrowserSignIn/HostBrowserAuthSession.swift

@@ -21,10 +21,10 @@ public protocol HostBrowserAuthSessionFactory {
     ///   - signInURL: The hosted sign-in page URL.
     ///   - callbackScheme: The custom scheme the callback redirect uses.
     ///   - completion: Delivered exactly once on the main actor with the
-    ///     callback URL, or `nil` on error/cancellation.
+    ///     browser session's terminal result.
     func makeSession(
         signInURL: URL,
         callbackScheme: String,
-        completion: @escaping @MainActor (URL?) -> Void
+        completion: @escaping @MainActor (HostBrowserAuthSessionResult) -> Void
     ) -> any HostBrowserAuthSession
 }

Packages/Shared/CmuxAuthRuntime/Sources/CmuxAuthRuntime/BrowserSignIn/HostBrowserAuthSessionResult.swift

@@ -0,0 +1,11 @@
+public import Foundation
+
+/// The terminal result of one hosted-browser auth attempt.
+public enum HostBrowserAuthSessionResult: Equatable, Sendable {
+    /// The hosted page redirected to the app's auth callback URL.
+    case callback(URL)
+    /// The user or app deliberately cancelled the browser session.
+    case cancelled(reason: String)
+    /// The browser session failed before returning a usable callback.
+    case failed(reason: String)
+}