fix(desktop): contain sign-in handoff failures when no window is available

`handleCallback` awaited `deps.ensureMainWindow()` as its first statement with
no try/catch, and index.ts dispatches it fire-and-forget as
`void authFlow.handleCallback(callback)`. The wired `ensureMainWindow` throws
`Main window unavailable`, and main registers no `unhandledRejection` handler,
so a user who closed the window while signing in through their browser turned
the loopback callback into an unhandled rejection. `beginLoginHandoff` had the
same shape, so both are fixed rather than one.

Both entry points now resolve the window through a helper that records the
failure via the existing `handoff_redeem_fail` event and returns null, and the
two `void` dispatch sites carry a `.catch()` backstop for anything the flows do
not record themselves. Not attacker-triggerable: `onLogin` fires only after
`matchesPending()` validates the state that only the user's own browser holds.

Author: waleedlatif1

apps/desktop/src/main/handoff.test.ts

@@ -4,8 +4,10 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 vi.mock('electron', () => import('@/test/electron-mock'))
 
 import {
+  type AuthFlowDeps,
   buildRedeemScript,
   type ConnectHandoffCallback,
+  createAuthFlow,
   createHandoffManager,
   type HandoffCallback,
   type HandoffCallbacks,
@@ -270,3 +272,51 @@ describe('connect handoff account pinning', () => {
     manager.clear()
   })
 })
+
+describe('createAuthFlow window failures', () => {
+  function makeAuthDeps(ensureMainWindow: () => Promise<never>) {
+    const events = makeEvents()
+    return {
+      deps: {
+        handoff: {
+          begin: vi.fn(async () => true),
+          consume: vi.fn(() => true),
+        } as unknown as AuthFlowDeps['handoff'],
+        origin: () => 'https://sim.ai',
+        events,
+        ensureMainWindow,
+      } satisfies AuthFlowDeps,
+      events,
+    }
+  }
+
+  it('records rather than rejects when no window can be opened for the callback', async () => {
+    const { deps, events } = makeAuthDeps(async () => {
+      throw new Error('Main window unavailable')
+    })
+    const flow = createAuthFlow(deps)
+
+    await expect(
+      flow.handleCallback({ state: VALID_STATE, token: VALID_TOKEN } as HandoffCallback)
+    ).resolves.toBeUndefined()
+    expect(events.record).toHaveBeenCalledWith('handoff_redeem_fail', {
+      reason: 'callback_window',
+      error: 'Main window unavailable',
+    })
+    expect(deps.handoff.consume).not.toHaveBeenCalled()
+  })
+
+  it('records rather than rejects when no window can be opened to report a failed begin', async () => {
+    const { deps, events } = makeAuthDeps(async () => {
+      throw new Error('Main window unavailable')
+    })
+    deps.handoff.begin = vi.fn(async () => false)
+    const flow = createAuthFlow(deps)
+
+    await expect(flow.beginLoginHandoff()).resolves.toBeUndefined()
+    expect(events.record).toHaveBeenCalledWith('handoff_redeem_fail', {
+      reason: 'begin_window',
+      error: 'Main window unavailable',
+    })
+  })
+})

apps/desktop/src/main/handoff.ts

@@ -2,6 +2,7 @@ import type { Server } from 'node:http'
 import { createServer } from 'node:http'
 import { createLogger } from '@sim/logger'
 import { safeCompare } from '@sim/security/compare'
+import { getErrorMessage } from '@sim/utils/errors'
 import { generateShortId } from '@sim/utils/id'
 import type { BrowserWindow } from 'electron'
 import { app, dialog } from 'electron'
@@ -364,6 +365,28 @@ export interface AuthFlow {
  * back on /login.
  */
 export function createAuthFlow(deps: AuthFlowDeps): AuthFlow {
+  /**
+   * The main window, or null when one cannot be obtained.
+   *
+   * Both entry points below are dispatched fire-and-forget from index.ts, and
+   * the wired `ensureMainWindow` throws when no window can be created or
+   * restored — which is reachable if the user closed the window while signing
+   * in through their browser. With no global `unhandledRejection` handler in
+   * main, letting that escape turned it into an unhandled rejection raised from
+   * the loopback callback. Recorded rather than swallowed: a sign-in that
+   * cannot present itself is exactly what the event log is for.
+   */
+  const resolveWindow = async (reason: string): Promise<BrowserWindow | null> => {
+    try {
+      return await deps.ensureMainWindow()
+    } catch (error) {
+      const message = getErrorMessage(error, 'Main window unavailable')
+      deps.events.record('handoff_redeem_fail', { reason, error: message })
+      logger.error('No window available for the sign-in handoff', { reason, error: message })
+      return null
+    }
+  }
+
   const failInWindow = async (win: BrowserWindow, reason: string, status?: number) => {
     deps.events.record(
       'handoff_redeem_fail',
@@ -383,7 +406,8 @@ export function createAuthFlow(deps: AuthFlowDeps): AuthFlow {
     async beginLoginHandoff() {
       const opened = await deps.handoff.begin()
       if (!opened) {
-        const win = await deps.ensureMainWindow()
+        const win = await resolveWindow('begin_window')
+        if (!win) return
         void dialog.showMessageBox(win, {
           type: 'error',
           message: 'Couldn’t start sign-in',
@@ -392,7 +416,8 @@ export function createAuthFlow(deps: AuthFlowDeps): AuthFlow {
       }
     },
     async handleCallback(callback: HandoffCallback) {
-      const win = await deps.ensureMainWindow()
+      const win = await resolveWindow('callback_window')
+      if (!win) return
       if (!deps.handoff.consume(callback.state, 'login')) {
         await failInWindow(win, 'state')
         return

apps/desktop/src/main/index.ts

@@ -1,5 +1,6 @@
 import { join } from 'node:path'
 import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
 import type { Session, WebContents } from 'electron'
 import { app, BrowserWindow, crashReporter, net, session } from 'electron'
 import { newChatRoute, settingsRoute } from '@/main/app-routes'
@@ -55,6 +56,16 @@ import { attachWindowOpenPolicy, isPopupContents } from '@/main/windows'
 
 const logger = createLogger('DesktopMain')
 
+/**
+ * Backstop for the sign-in flows, which are dispatched fire-and-forget from a
+ * loopback callback and a navigation guard. The flows record their own expected
+ * failures; this catches anything they do not, so a rejection cannot surface as
+ * an unhandled one — main registers no `unhandledRejection` handler.
+ */
+function reportHandoffFailure(error: unknown): void {
+  logger.error('Sign-in handoff failed', { error: getErrorMessage(error) })
+}
+
 const OFFLINE_PAGE = 'static/offline.html'
 const DOCK_ICON_FOR_CHANNEL = {
   prod: 'dock-icon.png',
@@ -138,7 +149,7 @@ function main(): void {
       currentUserId: () => readSessionUserId(ensureAppSession(), appOrigin()),
     },
     {
-      onLogin: (callback) => void authFlow.handleCallback(callback),
+      onLogin: (callback) => void authFlow.handleCallback(callback).catch(reportHandoffFailure),
       onConnect: (callback) => connectFlow.handleCallback(callback),
     }
   )
@@ -173,7 +184,7 @@ function main(): void {
     isPackaged: app.isPackaged,
     allowHttpLocalhost,
     isPopupContents,
-    onLoginHandoff: () => void authFlow.beginLoginHandoff(),
+    onLoginHandoff: () => void authFlow.beginLoginHandoff().catch(reportHandoffFailure),
     onConnectIntercept: (contents) => void handleConnectIntercept(contents, allowHttpLocalhost()),
   })