improvement(desktop): sign-in prompts for the agent browser — site passwords, passkey accounts, client certificates, and app links (#9521)

* improvement(desktop): sign-in prompts for the agent browser — site passwords, passkey accounts, client certificates, and app links

* fix(desktop): require an explicit accept for every sign-in prompt answer and arm prompts only while visible

* fix(desktop): refuse window.open app links, gate every launch on a prompt-capable renderer, and keep page-raised prompts from taking focus

* fix(desktop): clearing browsing data forgets the agent browser's certificate and app-launch choices

Author: waleedlatif1

apps/desktop/build/entitlements.mac.plist

@@ -14,10 +14,5 @@
          Hardened Runtime denies the camera no matter what the user allowed. -->
     <key>com.apple.security.device.camera</key>
     <true/>
-    <!-- WebAuthn hybrid transport (passkey on the user's phone via QR) rides
-         Bluetooth proximity; without this the QR option silently never
-         completes in signed builds. -->
-    <key>com.apple.security.device.bluetooth</key>
-    <true/>
   </dict>
 </plist>

apps/desktop/e2e/browser-sign-in-prompts.spec.ts

@@ -72,7 +72,6 @@ mac:
     NSScreenCaptureUsageDescription: Mothership captures approved app windows to understand and verify computer-use actions.
     NSMicrophoneUsageDescription: Sim uses your microphone for voice input in Chat and for meetings you join in the built-in browser.
     NSCameraUsageDescription: Sim uses your camera for meetings you join in the built-in browser, such as Google Meet.
-    NSBluetoothAlwaysUsageDescription: Sim uses Bluetooth to complete passkey sign-ins with a nearby phone in the built-in browser.
   entitlements: build/entitlements.mac.plist
   entitlementsInherit: build/entitlements.mac.plist
   notarize: true

apps/desktop/electron-builder.yml

@@ -81,6 +81,11 @@ import {
   setFocusedInputValue,
   typeIntoElement,
 } from '@/main/browser-agent/page-functions'
+import {
+  appLaunchNoticeForContents,
+  pagePromptForContents,
+  respondToPagePrompt,
+} from '@/main/browser-agent/page-prompts'
 import { isPanelVisible, panelWindow } from '@/main/browser-agent/panel'
 import {
   withFailedPostActionObservation,
@@ -560,6 +565,8 @@ function pageStateFor(contents: WebContents, tabId: string): BrowserPageState {
   const issue = session.pageIssueForContents(contents)
   const mediaPermissionRequest = session.mediaPermissionRequestForContents(contents)
   const dialog = session.pageDialogForContents(contents)
+  const prompt = pagePromptForContents(contents)
+  const appLaunchNotice = appLaunchNoticeForContents(contents)
   return {
     scopeId: session.getBrowserScopeId(),
     tabId,
@@ -571,6 +578,8 @@ function pageStateFor(contents: WebContents, tabId: string): BrowserPageState {
     ...(issue ? { issue } : {}),
     ...(mediaPermissionRequest ? { mediaPermissionRequest } : {}),
     ...(dialog ? { dialog } : {}),
+    ...(prompt ? { prompt } : {}),
+    ...(appLaunchNotice ? { appLaunchNotice } : {}),
   }
 }
 
@@ -809,6 +818,7 @@ export function initDriver(
         })
       },
       onDownloadsChanged: (state) => callbacks.onDownloadsChanged?.(state),
+      onAgentNotice: recordNotice,
     },
     getMainWindow,
     persistence,
@@ -5505,6 +5515,11 @@ export async function handlePanelAction(
     }
     if (action.action === 'enable-page-dialogs') {
       session.enablePageDialogs()
+      if (action.pagePrompts === true) session.enablePagePrompts()
+      return
+    }
+    if (action.action === 'respond-prompt') {
+      respondToPagePrompt(session.getBrowserScopeId(), action)
       return
     }
     if (action.action === 'respond-dialog') {