Safari SSO login fails when configured via granted browser set-sso, but works when configured via granted browser set

[ryodocx]

Issue Description

When Safari is configured using granted browser set-sso, granted sso login fails before the AWS device authorization page is displayed.

Safari immediately shows the following error:

Ignoring request to load this main resource because it is outside the sandbox
(WebKitInternal:0)

I investigated the issue and found that the behavior differs depending on how Safari is configured.
When Safari is configured via granted browser set, SSO login works correctly.

The generated AWS device authorization URL is valid, and the issue appears to be specific to how Safari is launched during the SSO flow.

Expected Behavior

Configuring Safari via either:

granted browser set

or

granted browser set-sso

should allow granted sso login to successfully open the AWS device authorization page. Both commands should provide equivalent Safari behavior during SSO login.

Actual Behavior

When Safari is configured using:

granted browser set-sso

running:

granted sso login

immediately opens Safari displaying:

Ignoring request to load this main resource because it is outside the sandbox
(WebKitInternal:0)

The AWS device authorization page never opens.

When Safari is configured using:

granted browser set

SSO login works as expected.

Reproduction Steps

1. Configure Safari as the browser

   $ granted browser set
   
   ? Select one of the browsers from the list Safari
   [✔] Granted will default to using Safari

2. granted sso login -> The AWS device authorization page opens successfully.

   $ granted sso login --sso-start-url <url> --sso-region <region>
   > [i] If the browser does not open automatically, please open this link: https://xxx/start/#/device?user_code=XXXX-XXXX
   > [i] Awaiting AWS authentication in the browser
   > [i] You will be prompted to authenticate with AWS in the browser, then you will be prompted to 'Allow'
   > [i] Code: XXXX-XXXX
   > [✔] Successfully logged into Start URL: https://xxx/start/#/

3. Configure Safari as the SSO browser

   $ granted browser set-sso
   > [i] Select your SSO default browser
   ?
   Select one of the browsers from the list Safari
   [✔] Granted will default to using /Applications/Safari.app/Contents/MacOS/Safari for SSO flows.

4. granted sso login -> fail

   $ granted sso login --sso-start-url <url> --sso-region <region>

   Safari immediately displays:

   Ignoring request to load this main resource because it is outside the sandbox
   (WebKitInternal:0)
   

Granted Logs

No response

Granted Version

$ granted --version
v0.39.0

OS Version Information

macOS 26.5.2

Minimal Granted & AWS Config Configuration

Generated by granted browser set (works):

DefaultBrowser = "SAFARI"
CustomBrowserPath = "/Applications/Safari.app/Contents/MacOS/Safari"
CustomSSOBrowserPath = ""
Ordering = ""

[Keyring]
Backend = "keychain"

Generated by granted browser set-sso (fails):

DefaultBrowser = "SAFARI"
CustomBrowserPath = "/Applications/Safari.app/Contents/MacOS/Safari"
CustomSSOBrowserPath = "/Applications/Safari.app/Contents/MacOS/Safari"
Ordering = ""

[Keyring]
Backend = "keychain"

Additional Relevant Configuration

The generated AWS device authorization URL is valid. Opening it using Launch Services works correctly:

open "https://<aws-device-auth-url>"

The same URL also works when pasted directly into Safari.

Launching Safari directly reproduces the same error:

/Applications/Safari.app/Contents/MacOS/Safari "https://<aws-device-auth-url>"

As a workaround, replacing CustomSSOBrowserPath with the following allows granted sso login to work correctly:

[SSOBrowserLaunchTemplate]
UseForkProcess = false
Command = "/usr/bin/open -a Safari {{.URL}}"

This makes me wonder whether granted browser set and granted browser set-sso intentionally use different launch mechanisms for Safari. If not, I'd be happy to open a GitHub issue after confirming this behavior.

I acknowledge that:

• I have reviewed the FAQ and confirm that my issue is NOT among them.
• I have searched the Granted repository (both open and closed Discussions and Issues) and confirm this is not a duplicate of an existing issue or discussion.
• I have checked the "Preview" tab on all text fields to ensure that everything looks right, and have wrapped all configuration and code in code blocks with a group of three backticks (```) on separate lines.