fix(auth): keep Safari callback sign-in alive in NEXT

Merged
TE
9d ago
+102-6

Safari can report its sign-in popup cancelled after opening the callback through LaunchServices. If that callback is still storing tokens or validating the user, NEXT currently ends the attempt and discards the successful sign-in. The callback now owns the browser-session continuation until it completes.

This selectively ports the continuation ownership repair and two regression tests from #20364, by Austin Wang and Seongho Bak. The callback state policy is unchanged. The tests use a manual clock advanced past the instant-cancel fallback window so they exercise the cancellation race consistently.

User request: “Also, we need to be fixing authentication issues, like the whole onboarding situation. Is that in? What does you improve? What does you fix? The edge cases, like you guys need to be comprehensively brainstorming all the onboarding edge cases: foot guns, paper cuts, snags, clips, whatever the fuck.”

Validation

Focused command: scripts/ci/package-test-lane.sh suite Packages/Shared/CmuxAuthRuntime HostBrowserSignInFlowHandoffTests.

  • Regression-only commit 1cb08d5f6dc72639b4c1ffce93778ea643039375: fleet job 86206350063939eb0e352cfc, failed as expected: both new cancellation tests fail (7 assertions); the other 6 tests pass.
  • Fixed head 25c4faa8c6a9556ed45b70483583ee5f89c7f328: fleet job 1f8b68c32cb535f0adbe759e, passed: all 8 tests, with package and test-target compilation.
  • Full Release compile at final 25c4faa8c6a9556ed45b70483583ee5f89c7f328: controller job 51936016deecf5e31d7f9b34, run 40623671764, app passed (184s), daemon passed (106s).
  • git diff --check and python3 scripts/cmux-next/prepush-gate.py pass.

Observed / Not run

Observed: source-level ownership race and upstream regression coverage; final diff is 3 files, 102 additions and 6 removals. Independent Codex/Astra review passed at the fixed head. The corrected regression-only version fails both new tests; the fixed version passes all 8. No live Safari UI reproduction was run. Local Swift parsing was unavailable because this agent host has no Swift compiler.

Review (Codex/Astra): SHIP at 25c4faa8c6a9556ed45b70483583ee5f89c7f328. Primary review confirms the final diff and exact before/after receipts.

Risk: auth callback concurrency. The existing generation checks continue to fence sign-out and replacement. No capture: this changes callback lifecycle, with no visual layout or copy change.

Changelog

Fixed: Safari sign-in callbacks survive the popup closing while the app completes sign-in.

Agent session: agent session