feat(desktop): upgrade to Electron 41 and enable macOS Touch ID passkeys - #3460
Merged
benjaminshafii merged 2 commits intoAug 3, 2026
Merged
Conversation
Electron only gained a working WebAuthn platform authenticator in 41.5.0 via app.configureWebAuthn; 35.x had no authenticator at all. - Electron 35.7.5 -> 41.10.3 (Chromium 146, Node 24, native ABI 141->145) - force native rebuilds so better-sqlite3 and node-pty match the new ABI - add the keychain-access-groups entitlement, kept in sync with the signing Team ID from a single source of truth - call configureWebAuthn first inside whenReady(); calling it earlier trips a native SIGTRAP Touch ID credentials are device-bound and macOS-only: iCloud, 1Password, phone and USB-key passkeys are still not usable, so the fast-fail fallback stays in place for them.
Chromium 146 enforces that clipboard writes come from a focused document, which exposed that hiding the overlay never handed focus back to the page. Copy actions from the page context menu silently failed on Electron 41.
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
benjaminshafii
merged commit Aug 3, 2026
79138dc
into
fix/browser-passkeys-context-menu
17 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #3459 — review/merge that first.
Why an upgrade is required
Electron gained a working WebAuthn platform authenticator only in 41.5.0, via
app.configureWebAuthn. Verified by diffingdocs/api/app.mdacross tags: absent in 40.x and 41.0.0, present from 41.5.0. OpenWork was on 35.7.5, which has no authenticator at all — itsElectronWebAuthenticationDelegateimplements onlySupportsResidentKeys(). No Chromium feature flag changes this.35.7.5 → 41.10.3 (Chromium 146, Node 24, native ABI 141 → 145). Picked ≥ 41.6.0 because 41.6.0 fixed a Touch ID prompt crash.
Read this before promising users anything
Touch ID credentials are device-bound, stored in the macOS keychain and not synced via iCloud. So:
The fast-fail fallback from #3459 therefore stays, and covers every case above.
Changes
better-sqlite3andnode-ptymatch ABI 145keychain-access-groupsentitlement, kept in sync with the signing Team ID from a single source of truth inpackage.jsonconfigureWebAuthncalled first insidewhenReady()— calling it earlier trips a nativeSIGTRAPdarwin+ API existence + try/catch, so non-Secure-Enclave Macs and Windows/Linux degrade silentlyBreaking changes that actually bit
configureWebAuthnbefore app-ready → native SIGTRAP — fixed by calling it first inwhenReady().No removed v36–v41 Electron API applied to this codebase.
Regression sweep
Every failure was classified against an Electron 35 baseline (parent commit
658f842ef) rather than assumed.app-smokefirst-run-localapp-den-tls-faultmodels-availablelibrary-state-tabsbuiltin-browser-context-menu-passkeyskills-localtestkit-app-boot,testkit-selftestDATABASE_HOSTOPENWORK_EVAL_DEN_API_URLetc.Runtime probes on Electron 41: node-pty spawned/resized a real PTY and exited 0; better-sqlite3 opened and queried; browser panel loaded, navigated back/forward/reload with all menus working. Two further failures (blueprint materialization
Too many parameter values, cookie persistence across restart) reproduce identically on Electron 35 — pre-existing, not ABI regressions.pnpm --filter @openwork/desktop test180 passed / 1 skipped; both typechecks exit 0.Unproven — needs a human
Signed packaging and Touch ID itself are not proven. Local
codesignfailed witherrSecInternalComponentaccessing the private key. Someone must, on a Secure Enclave Mac with the signing cert:keychain-access-groupsentitlement is present,Given the upgrade's blast radius, I'd suggest an alpha build before this reaches everyone.