Fix Settings sign-in by using the default browser

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to cmux are documented here.
 
+## [Unreleased]
+
+### Fixed
+- Open Settings > Account sign-in in the user's default browser, complete through the cmux auth callback, and guard malformed native auth handoffs ([#3617](https://github.com/manaflow-ai/cmux/issues/3617))
+
 ## [0.64.10] - 2026-05-23
 
 ### Added

Resources/Info.plist

@@ -53,19 +53,6 @@
 	<string>A program running within cmux would like to use AppleScript.</string>
 	<key>CFBundleURLTypes</key>
 	<array>
-		<dict>
-			<key>CFBundleTypeRole</key>
-			<string>Viewer</string>
-			<key>CFBundleURLName</key>
-			<string>$(PRODUCT_BUNDLE_IDENTIFIER).web</string>
-			<key>LSHandlerRank</key>
-			<string>Default</string>
-			<key>CFBundleURLSchemes</key>
-			<array>
-				<string>http</string>
-				<string>https</string>
-			</array>
-		</dict>
 		<dict>
 			<key>CFBundleTypeRole</key>
 			<string>Viewer</string>

Resources/Localizable.xcstrings

@@ -120943,6 +120943,35 @@
         }
       }
     },
+    "settings.account.error.signInTimedOut": {
+      "extractionState": "manual",
+      "localizations": {
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Sign in timed out. Try again."
+          }
+        },
+        "ja": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "サインインがタイムアウトしました。もう一度お試しください。"
+          }
+        },
+        "uk": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Час очікування входу минув. Спробуйте ще раз."
+          }
+        },
+        "ko": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "로그인 시간이 초과되었습니다. 다시 시도하세요."
+          }
+        }
+      }
+    },
     "remote.state.connected.vmNoProxy": {
       "extractionState": "manual",
       "localizations": {

Sources/Auth/AuthCallbackRouter.swift

@@ -3,6 +3,7 @@ import Foundation
 struct CMUXAuthCallbackPayload: Equatable, Sendable {
     let refreshToken: String
     let accessToken: String
+    let state: String?
 }
 
 enum AuthCallbackRouter {
@@ -29,10 +30,19 @@ enum AuthCallbackRouter {
 
         return CMUXAuthCallbackPayload(
             refreshToken: refreshToken,
-            accessToken: accessToken
+            accessToken: accessToken,
+            state: callbackState(in: components)
         )
     }
 
+    static func callbackState(from url: URL) -> String? {
+        guard isAuthCallbackURL(url),
+              let components = URLComponents(url: url, resolvingAgainstBaseURL: false) else {
+            return nil
+        }
+        return callbackState(in: components)
+    }
+
     private static func isAllowedScheme(_ scheme: String?) -> Bool {
         guard let normalized = scheme?.lowercased() else { return false }
         if normalized == "cmux" || normalized == "cmux-nightly" || normalized == "cmux-dev" {
@@ -63,6 +73,11 @@ enum AuthCallbackRouter {
             .value
     }
 
+    private static func callbackState(in components: URLComponents) -> String? {
+        queryValue(named: "state", in: components)?
+            .trimmingCharacters(in: .whitespacesAndNewlines)
+    }
+
     private static func decodeAccessToken(from accessCookie: String) -> String? {
         guard accessCookie.hasPrefix("[") else {
             return accessCookie

Sources/Auth/AuthEnvironment.swift

@@ -26,7 +26,20 @@ enum AuthEnvironment {
     }
 
     static var callbackURL: URL {
-        URL(string: "\(callbackScheme)://auth-callback")!
+        authCallbackURL()
+    }
+
+    static func authCallbackURL(state: String? = nil) -> URL {
+        var components = URLComponents()
+        components.scheme = callbackScheme
+        components.host = "auth-callback"
+        if let state,
+           !state.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty {
+            components.queryItems = [
+                URLQueryItem(name: "state", value: state),
+            ]
+        }
+        return components.url!
     }
 
     static var websiteOrigin: URL {
@@ -191,7 +204,7 @@ enum AuthEnvironment {
         )
     }
 
-    static func signInURL() -> URL {
+    static func signInURL(callbackURL: URL = AuthEnvironment.callbackURL) -> URL {
         // Build the after-sign-in callback URL that includes the native app return scheme.
         // The after-sign-in handler extracts tokens from the Stack Auth session
         // and redirects to the native app via the cmux:// callback scheme.