JinjingandOrca fe1486f011 fix(browser): narrow native popup allow to genuine OAuth popups ...

setWindowOpenHandler granted a native Electron child window for any
http(s) URL when the guest owned a registered browser tab. That gave
every embedded page the popup privilege OAuth needs, widening the
phishing / window-spam surface.

Gate the native child on Chromium's 'new-window' disposition — the
window.open(features) / shift-click popup pattern OAuth uses. Ordinary
target=_blank clicks and featureless window.open() (foreground-tab /
background-tab) now route to the OS browser like unregistered guests,
while file:/javascript: denial, SAFE_POPUP_WINDOW_OPTIONS, guest policy
inheritance, and the unregistered external fallback are preserved.

Co-authored-by: Orca <help@stably.ai>

2026-07-11 17:37:38 -07:00

..

cli

fix(linear): preserve mixed-version RPC filtering compatibility (#8192)

2026-07-10 19:23:12 -07:00

main

fix(browser): narrow native popup allow to genuine OAuth popups

2026-07-11 17:37:38 -07:00

preload

fix: reconcile SSH repo rows after host re-add (#8201)

2026-07-11 03:20:55 -07:00

relay

Fix git submodule path cache retention (#7687)

2026-07-11 01:30:19 -07:00

renderer

Remove host on mobile freeze the app (#8317)

2026-07-11 17:05:44 -07:00

shared

feat(terminal): expose right-click paste on every platform (#8322)

2026-07-11 15:02:46 -07:00

types

Update onboarding feature wall experience (#2652)

2026-05-23 12:21:13 -07:00