Handle TLS auth challenges to fix Microsoft device compliance

[ConnorCallison]

Summary

• Implements webView(_:didReceive:completionHandler:) on BrowserNavigationDelegate with .performDefaultHandling disposition

Problem

When signing into GitHub (or any Microsoft Entra ID-protected resource) via the cmux browser on an MDM-enrolled Mac, Microsoft's Conditional Access shows "this device needs to be under policy" — even though Safari and Chrome on the same machine work fine.

Root Cause

WKWebView silently rejects all TLS authentication challenges when the navigation delegate doesn't implement webView(_:didReceive:completionHandler:). Apple's default disposition is .rejectProtectionSpace, not .performDefaultHandling.

This means:

1. Microsoft's server issues a TLS client-certificate challenge to verify device compliance
2. WKWebView rejects it (no delegate method → reject)
3. The TLS handshake completes without a client certificate
4. Microsoft sees an unmanaged device → blocks access with "device needs to be under policy"

Safari and Chrome handle this automatically because they implement their own authentication challenge handling that searches the system keychain for matching device identity certificates.

Fix

Add the delegate method and return .performDefaultHandling, which tells WebKit to use the system's standard URL-loading behavior:

• Searches the system keychain for matching client identities (device certificates installed by MDM)
• Trusts MDM-installed root CAs during server trust evaluation
• Allows configured SSO extensions (e.g. Microsoft Enterprise SSO plug-in) to intercept and handle challenges

Test plan

• On an MDM-enrolled Mac, open cmux browser and navigate to github.com (or any Microsoft Entra ID-protected SSO)
• Sign in with corporate credentials — should no longer show "this device needs to be under policy"
• Verify regular HTTPS sites still load normally (no regressions in server trust handling)
• Verify non-MDM Macs are unaffected (.performDefaultHandling gracefully falls through when no client certificates exist)

🤖 Generated with Claude Code

---

Summary by cubic

Fixes Microsoft Entra ID sign-in showing "device needs to be under policy" in the cmux browser on MDM-enrolled Macs by handling TLS auth challenges in WKWebView. We now let WebKit perform its default handling so device certificates and SSO plugins work.

• Bug Fixes
  • Implemented webView(_:didReceive:completionHandler:) in BrowserNavigationDelegate and return .performDefaultHandling.
  • Restores TLS client-certificate flows (uses system keychain and MDM roots) and allows Enterprise SSO plugins to intercept.
  • No change for non-MDM Macs; standard HTTPS sites behave as before.

^{Written for commit 577dd7c. Summary will update on new commits.}

Summary by CodeRabbit

Bug Fixes

• Improved handling of browser authentication challenges to properly support TLS connections, client certificate authentication, and single sign-on flows through enhanced system integration.

[vercel]

@ConnorCallison is attempting to deploy a commit to the Manaflow Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

📝 Walkthrough

Walkthrough

A new WKNavigationDelegate method is added to BrowserNavigationDelegate to handle TLS and authentication challenges from WKWebView by performing default system handling with nil credentials.

Changes

Cohort / File(s)	Summary
WKNavigationDelegate Challenge Handler Sources/Panels/BrowserPanel.swift	Added a new delegate method to handle TLS/authentication challenges from WKWebView, configured to use .performDefaultHandling for system-level certificate validation and SSO extensions.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 A delegate springs forth with gentle care,
To let the system's defaults handle there,
TLS handshakes meet their destined way,
As challenges are passed without delay! 🔐

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Handle TLS auth challenges to fix Microsoft device compliance' clearly and concisely describes the main change: implementing TLS authentication challenge handling for Microsoft device compliance issues.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cubic-dev-ai]

No issues found across 1 file

[greptile-apps]

Greptile Summary

This PR implements TLS authentication challenge handling in the cmux browser to fix Microsoft Entra ID device compliance verification on MDM-enrolled Macs.

Key Changes:

• Added webView(_:didReceive:completionHandler:) delegate method to BrowserNavigationDelegate
• Returns .performDefaultHandling to delegate authentication to the system's URL loading behavior
• Enables WKWebView to search the system keychain for MDM-installed client certificates
• Allows Microsoft's Conditional Access to verify device compliance via TLS client certificates

Impact:
This change aligns cmux's WKWebView behavior with Safari and Chrome, which already handle authentication challenges through the system. Without this method, WKWebView's default behavior is to reject all authentication challenges (.rejectProtectionSpace), breaking TLS client-certificate flows needed for enterprise SSO and device compliance verification.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The implementation is minimal, well-documented, and uses Apple's recommended approach (.performDefaultHandling) which delegates to the system's secure URL loading behavior. The change only improves compatibility without introducing security risks or breaking existing functionality. No authentication challenges were handled before this PR, so the change is purely additive.
• No files require special attention

Important Files Changed

Filename	Overview
Sources/Panels/BrowserPanel.swift	Added TLS authentication challenge handler with .performDefaultHandling to enable MDM client certificate flows for Microsoft Entra ID compliance

_{Last reviewed commit: 577dd7c}