fix(desktop): sign-in and captchas work again in desktop browser tabs

[juliusmarminge]

Since #15328, signing in to Google (and passing captchas or Cloudflare Turnstile) fails in desktop browser tabs: Google shows "Couldn't sign you in — the browser you're using doesn't support JavaScript, or has JavaScript turned off."

Cause. When the server drives a desktop tab through the CDP relay, Playwright auto-attaches with waitForDebuggerOnStart, so Chromium pauses every new cross-site iframe and worker until it receives Runtime.runIfWaitingForDebugger. The relay answered that command itself for every session, including child sessions, so those frames stayed paused forever. Sign-in checks and captchas run in exactly such frames.

Fix. The relay still answers Runtime.runIfWaitingForDebugger for the page's own session (the page is already running) and now forwards it to child sessions, so their frames start.

Verified

• In real Chrome, a cross-site iframe on a page with waitForDebuggerOnStart auto-attach never loads when the resume is swallowed, and loads when it is forwarded.
• Google sign-in in real Chrome with Playwright attached over CDP reaches the account lookup.
• New relay test: the page-session resume is answered locally, the child-session resume reaches the tab's debugger. 9 relay/host tests pass; desktop typecheck and lint are clean.
• Confirmed in the desktop app with this fix: signing in to Google and to OpenAI (behind Cloudflare Turnstile) both work in a desktop browser tab.

Made with Claude Opus 5.5 in Claude Code.

🤖 Generated with Claude Code

---

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The change is a focused CDP relay fix with a targeted regression test, forwarding debugger-resume commands only for paused child frames while preserving the existing page-session behavior. It directly changes authentication-related browser flows, so human review is required.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Team
• Run ID: 563fbe9f-53ed-41d0-9347-f63cff4f719e

📥 Commits

Reviewing files that changed from the base of the PR and between 468ade3 and 27fc914.

📒 Files selected for processing (2)

• apps/desktop/src/preview/CdpRelay.test.ts
• apps/desktop/src/preview/CdpRelay.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

---

📝 Walkthrough

Walkthrough

The relay now ignores Runtime.runIfWaitingForDebugger for the root page session and forwards it for child sessions. A test checks forwarding behavior for both session types.

Changes

CDP relay command forwarding

Layer / File(s)	Summary
Route resume commands by session apps/desktop/src/preview/CdpRelay.ts, apps/desktop/src/preview/CdpRelay.test.ts	The relay keeps Runtime.runIfWaitingForDebugger as a no-op for the root page session and forwards the command for child sessions. The test verifies both outcomes.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: maria-rcks

Merge Risk: ⚪ Minimal · up to 27fc9

The change is ready to merge; no concrete current-head risk remains.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise, specific, and accurately summarizes the primary desktop browser fix. It also follows the repository's conventional commit format.
Description check	✅ Passed	The description clearly covers the problem, cause, fix, and focused verification results. It omits the explicit “Scope and approval” heading, but it references the related change and describes a focus…

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	4.9 KiB	5.0 KiB	+30 B (+0.6%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	+30 B (+2.5%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.8 KiB	20.9 KiB	+41 B (+0.2%)	29.3 KiB	✅
Codex	Live turn messages	1	2	+1 (+100.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	−17 B (−0.3%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	−17 B (−1.4%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 250e052 · PR result: 27fc914 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.