From 7d7eb72ea8bef59a7e365731c966b5b922f26f93 Mon Sep 17 00:00:00 2001 From: Nicholai Date: Mon, 16 Feb 2026 23:45:26 -0700 Subject: [PATCH] fix(auth): open OAuth popup before async PKCE Browsers block window.open after an await because the user gesture is lost. Open a blank tab synchronously first, then set the URL after PKCE generation completes. --- src/components/settings/ai-model-tab.tsx | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/components/settings/ai-model-tab.tsx b/src/components/settings/ai-model-tab.tsx index 25cfef3..8bedda5 100755 --- a/src/components/settings/ai-model-tab.tsx +++ b/src/components/settings/ai-model-tab.tsx @@ -317,10 +317,13 @@ function ProviderConfigSection({ } const handleOAuthConnect = async (): Promise => { + // Open window immediately in the click handler to avoid + // popup blockers (async gap kills the user gesture) + const popup = window.open("about:blank", "_blank", "noopener") const { verifier, challenge } = await generatePKCE() const url = buildAuthUrl(challenge) + if (popup) popup.location.href = url setOAuth({ step: "connecting", verifier }) - window.open(url, "_blank", "noopener") } const handleOAuthSubmit = async (): Promise => {