fix(desktop): stop the passkey dialog from popping as soon as sign-in opens

[t3dotgg]

Opening sign-in on the desktop app immediately pops an OS passkey dialog. Nobody asked for it; it fires the moment the Clerk sign-in form mounts.

Root cause is upstream in @clerk/electron: its passkey provider tells clerk-js that quiet passkey autofill is supported, but then executes the autofill request as a modal prompt (native OS sheet on macOS/Windows, modal Chromium dialog on the renderer path). clerk-js auto-starts the autofill flow when the sign-in form mounts, so the dialog opens with zero user intent. Filed upstream: clerk/javascript#9496.

Until that's fixed, this wraps the provider and reports autofill as unsupported on desktop. clerk-js then never auto-starts the flow. The explicit "Use passkey" button still works, and web keeps its silent browser autofill.

No screenshots: the change removes an unprompted OS dialog, which the desktop UI itself never renders.

🤖 Change by Claude Code (Fable 5).

---

Note

Low Risk
Small Electron-only auth UX workaround with no change to web sign-in or passkey button behavior.

Overview
Desktop Electron no longer auto-opens an OS passkey prompt when the Clerk sign-in form mounts.

The app wraps @clerk/electron/passkeys and overrides isAutoFillSupported to always resolve to false, so clerk-js skips the quiet autofill flow that upstream currently runs as a modal. Explicit Use passkey on desktop is unchanged; web still uses the default provider without this wrapper.

^{Reviewed by Cursor Bugbot for commit 018ca8a. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Prevent passkey autofill dialog from appearing on sign-in mount in desktop app

Overrides isAutoFillSupported in main.tsx to always resolve false, stopping the OS passkey prompt from triggering automatically when the sign-in view mounts. Explicit passkey usage remains functional. This works around an upstream issue in @clerk/electron.

^{Macroscope summarized 018ca8a.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6c9bd640-6db3-49e1-af56-b40229a9a10a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	12.6 KiB	+9 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.3 KiB	+2 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+7 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	51.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	12.6 KiB	+31 B (+0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.3 KiB	+10 B (+0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.3 KiB	+21 B (+0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	52.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 26af903 · PR result: 018ca8a · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.