[Bug]: Preview browser cannot open native apps via custom-scheme deep links #16251

Activity

1. tensorcopy

   closed this as completedon Oct 5, 2026
2. tensorcopy

   changed the title [-][Bug]: Preview browser silently drops custom-scheme deep links, so SSO-to-desktop-app handoffs hang forever (slack://, zoom://, teams:// …)[/-] [+][Bug]: Preview browser cannot open native apps via custom-scheme deep links[/+] on Oct 5, 2026
3. tensorcopy

   reopened this on Oct 5, 2026
4. juliusmarminge commented on Oct 5, 2026

   

   juliusmarminge

   on Oct 5, 2026

   Member

   More actions

   Note

   Grok responding on behalf of Julius.

   Triage

   Thanks for the clear repro, @tensorcopy!

   What I found

   • location.href = "slack://…" inside a preview guest is an external-protocol navigation. Electron 44 asks the session for the openExternal permission before launching the OS handler. The preview partition's permission handler in apps/desktop/src/preview/BrowserSession.ts allows clipboard read/write, notifications, and geolocation, but not openExternal, so the request is denied and Electron treats the navigation as handled. The page stays where it is, nothing is logged, and did-fail-load doesn't surface it (that handler also ignores ERR_ABORTED).
   • POPUP_PROTOCOLS / previewWindowOpenAction only decide whether window.open gets a popup. A slack:// target is classified as "navigate" and loaded back into the same guest, hitting the same denial.
   • setWindowOpenHandler and will-navigate in DesktopWindow.ts run on the app window, not the preview guest. parseSafeExternalUrl rejects slack:// there and also hides Copy Link in the guest context menu, so custom-scheme links can't be copied out either.
   • The address bar can't be used as a fallback: normalizePreviewUrl accepts only http:/https:, and the submit handler swallows that error. The hover-only "Open in system browser" button opens the current https page, though cookies stay in the preview partition. The preview ⋮ menu has no equivalent item (see closed PR feat(web): open the preview page in the system browser from the menu #10833).
   • Related but separate: fix(markdown): make known app deep links clickable #15722 (allowlist for chat markdown links), [Bug]: Integrated browser denies Local Network Access, so Okta FastPass (and other loopback SSO helpers) cannot authenticate #9724 and [Bug]: Integrated browser reaches Google unsupported-browser page after sign-in and 2FA #14815 (loopback SSO and external-browser handoff).

   Likely fix area

   • Granting openExternal for every scheme would let any preview page launch arbitrary OS handlers without a prompt, so that's worth weighing against convenience.
   • Options include surfacing the denial visibly in the preview, with a user-initiated "Open" that routes through shell.openExternal (possibly scoped per scheme or per origin), and making "Open in system browser" and Copy Link available for custom-scheme links from the ⋮ and context menus.

   A maintainer will decide on the fix direction.
5. juliusmarminge

   added

   bugSomething is broken or behaving incorrectly.Something is broken or behaving incorrectly.

   via-triageFiled through npx t3 triageFiled through npx t3 triage

   on Oct 5, 2026
6. juliusmarminge

   closed this as completedin #16961on Oct 8, 2026