[sambitcreate]

Requested by sbt · project thread

Before: signing in to Google in the Tools panel browser ended at accounts.google.com with "Couldn't sign you in. This browser or app may not be secure." That happened even though Aiden already strips the Electron and Aiden tokens from the user agent.

After: requests to https://accounts.google.com carry a current Firefox user agent and no UA Client Hints. Every other host, including other Google hosts, keeps the Chromium identity. The guest Chrome version is also reduced to its major (Chrome/150.0.0.0), the way shipping Chrome reports it, because a full build number is an embedded-browser tell.

How: applyBrowserGuestIdentityHeaders in main/services/browser/core.ts already rewrites every guest request. It now special-cases the exact accounts.google.com HTTPS host, the same approach Min browser uses (main/UASwitcher.js). T3 Code has no Google-specific handling: it keeps Electron's native user agent so Cloudflare Turnstile passes (pingdotgg/t3code#7110). The Firefox version follows the four-week release train from Firefox 91, with a slightly longer step so it never claims an unreleased version. Profiles, partitions, permissions and OAuth popups are unchanged. Popups share the tab's session, so they get the same headers.

Verification: core.test.ts covers the sign-in identity, the look-alike and other-Google-host exclusions, the reduced version and the Firefox version window. I ran npm run type-check and eslint on the touched files, and both are clean. npm run test:browser passes except files-browser.test.ts, which can't launch Playwright's headless shell in this sandbox. Google's check runs server-side and can't be reached from the sandbox or CI, so the sign-in has to be confirmed on a real Mac. docs/environment-browser.md is updated.

---

Generated by Claude Code

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the guest browser identity changes, their session/popup integration, focused tests, and documentation.

• Google sign-in exception: HTTPS requests to exactly accounts.google.com receive a platform-appropriate Firefox user agent without UA Client Hints; other destinations retain the Chromium identity.
• Chromium version reduction: Guest user agents now expose only the Chrome major version while continuing to omit Electron and Aiden product tokens.
• Coverage and documentation: Tests exercise header preservation, host/scheme exclusions, and Firefox identity generation; the browser guide describes the exception and manual verification limit.

Validation: all 193 browser tests passed, along with desktop TypeScript and scoped ESLint. The initial browser run lacked Playwright's Chromium executable; installing it resolved that prerequisite. Live Google sign-in remains unverified in this environment, so this review confirms the implementation and automated checks, not successful authentication against Google.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[very-hermes-bot]

Hermes Review Bot

Confidence: 4

Engine: agy/gemini-3.8-flash-high
Review mode: full
Head: 437ccb655ca493b18999838b497a3be5d1087d06
Generated: 2026-10-20T04:11:45+00:00
Reviews: 1

Summary

Prevents Google authentication rejections ("Couldn't sign you in. This browser or app may not be secure") in the built-in browser by selectively rewriting outgoing request headers destined for https://accounts.google.com to use a modern Firefox User-Agent while stripping all Sec-CH-UA* Client Hints. All other hosts—including other Google services such as mail.google.com—retain their standard Chromium identity, while the guest Chromium User-Agent is reduced to its major version (Chrome/<major>.0.0.0) to align with shipping Chrome and eliminate embedded-build tells. A deterministic calculation pegged to Firefox 91 and a conservative four-week release step generates valid Firefox version numbers that advance over time without getting ahead of Mozilla's release train. Maintainers should perform an interactive verification of Google sign-in and OAuth popup handoffs on a physical macOS machine, as Google's abuse heuristics are evaluated server-side and cannot be triggered in CI or sandboxed test environments.

Confidence Score: 4/5

4/5 — The implementation, header transformations, URL scoping, version math, and test cases have been fully traced across callers and prior art, but live Google sign-in flow validation requires an interactive desktop session on a physical machine.

📁 Important Files Changed

• main/services/browser/core.ts: Adds browserGoogleSignInUserAgent with an advancing release calculation, adds browserGoogleSignInRequest to strictly scope overrides to HTTPS accounts.google.com, branches applyBrowserGuestIdentityHeaders to omit Client Hints on sign-in requests, and updates browserGuestUserAgent to reduce Chromium build numbers to 0.0.0.
• main/services/browser/core.test.ts: Covers Google sign-in User-Agent replacement and header cleanup, verifies that other Google hosts, HTTP schemes, and lookalike domains keep the Chromium identity, checks multi-platform OS tokens, and tests the version progression bounds.
• docs/environment-browser.md: Documents the Chrome User-Agent reduction and the isolated Firefox header substitution for Google's sign-in host.

Findings

No findings.

Sequence Diagram

sequenceDiagram
    autonumber
    actor User as User / Tab
    participant Guest as WebContentsView (Guest)
    participant Session as Session onBeforeSendHeaders
    participant Transform as applyBrowserGuestIdentityHeaders
    participant Google as accounts.google.com
    participant Origin as Target / Other Origin

    User->>Guest: Navigate / Open Google Sign-In
    Guest->>Session: Outgoing HTTP Request
    Session->>Transform: Evaluate request URL and headers
    alt Request URL is https://accounts.google.com/*
        Transform-->>Session: Firefox UA (matching OS) & omit Sec-CH-UA*
        Session->>Google: Forward request (Firefox identity, no Client Hints)
        Google-->>Guest: Return login challenge / set .google.com cookies
    else Request URL is other host (e.g., mail.google.com, app callback)
        Transform-->>Session: Reduced Chrome UA (major.0.0.0) & Sec-CH-UA*
        Session->>Origin: Forward request (Chromium identity + Client Hints)
        Origin-->>Guest: Standard page response
    end

Loading

[]

---

Last reviewed commit: 437ccb655ca4
Reviews (1) · Comment /hermes review to trigger a new review · /hermes review full for full re-review