feat: Native PKCE Auth for Tetrate via Custom URL Scheme by raj-subhankar · Pull Request #6445 · block/goose

raj-subhankar · 2026-01-12T16:00:46Z

Summary

This PR moves Tetrate authentication from a server-driven flow (Rust PKCE + localhost callback) to a client-driven flow (Electron PKCE + goose:// deep-link callback).
It also adds a /tetrate/verify endpoint so the Electron client can send the authorization code and PKCE verifier for server-side token exchange.

Type of Change

AI Assistance

This PR was created or reviewed with AI assistance

Testing

Related Issues

Relates to #ISSUE_ID
Discussion: LINK (if any)

Screenshots/Demos (for UX changes)

Before:

Goose.Tetrate.login.before.mov

After:

Custom.url.mov

Copilot

Pull request overview

This PR implements native PKCE (Proof Key for Code Exchange) authentication for Tetrate using macOS's ASWebAuthenticationSession API, with a fallback to browser-based authentication on other platforms. The implementation eliminates the need for a temporary callback server by leveraging the native OS authentication flow.

Changes:

Adds a new TypeScript authentication module implementing PKCE flow with state validation and timeout handling
Implements a native macOS Node.js addon using Objective-C++ to interface with ASWebAuthenticationSession
Updates Rust backend to support PKCE code verification through a new /tetrate/verify endpoint
Configures the macOS app bundle to handle goose:// URL scheme for OAuth callbacks

Reviewed changes

Copilot reviewed 17 out of 18 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
ui/desktop/src/tetrateAuth.ts	Core authentication logic implementing PKCE flow, callback handling, and native session integration
ui/desktop/src/tetrateAuth.test.ts	Unit tests covering PKCE pair creation, URL parsing, and callback handling
ui/desktop/src/native/auth_session/src/auth_session.mm	Native macOS module wrapping ASWebAuthenticationSession with N-API bindings
ui/desktop/src/native/auth_session/binding.gyp	Build configuration for the native module targeting macOS 12.0+
ui/desktop/scripts/build-auth-session.js	Build script to compile the native addon during development and packaging
ui/desktop/src/preload.ts	Adds IPC bridge for startTetrateAuth electron API
ui/desktop/src/main.ts	Integrates callback URL handling in protocol handler and adds IPC handler for auth initiation
ui/desktop/src/utils/tetrateSetup.ts	Simplified to call native auth through electron API instead of backend
ui/desktop/package.json	Adds native build scripts and @electron/node-gyp dependency
ui/desktop/forge.config.ts	Configures URL scheme handler and includes native modules in build artifacts
crates/goose/src/config/signup_tetrate/mod.rs	Adds static method for code exchange accepting external verifier
crates/goose-server/src/routes/setup.rs	Adds new verify endpoint accepting code and code_verifier
ui/desktop/openapi.json	OpenAPI schema additions for TetrateVerifyRequest endpoint
ui/desktop/src/api/*.gen.ts	Auto-generated API client types and functions

Files not reviewed (1)

ui/desktop/package-lock.json: Language not supported

ui/desktop/src/tetrateAuth.ts

ui/desktop/src/native/auth_session/src/auth_session.mm

ui/desktop/scripts/build-auth-session.js

ui/desktop/src/tetrateAuth.ts

ui/desktop/src/native/auth_session/src/auth_session.mm

ui/desktop/package.json

johnlanda · 2026-01-16T16:18:22Z

ui/desktop/src/native/auth_session/binding.gyp

+      "defines": ["NAPI_DISABLE_CPP_EXCEPTIONS"],
+      "xcode_settings": {
+        "CLANG_ENABLE_OBJC_ARC": "YES",
+        "MACOSX_DEPLOYMENT_TARGET": "12.0",


Let's make sure this is aligned with the Mac OSX versions supported by goose.

Goose uses Electron 39, which has a minimum macOS 12 requirement, so this should be fine.

johnlanda · 2026-01-16T16:19:31Z

crates/goose-server/src/routes/setup.rs

+        match TetrateAuth::exchange_code_with_verifier(request.code, request.code_verifier).await {
+            Ok(api_key) => api_key,
+            Err(e) => {
+                return Ok(Json(SetupResponse {


Should we return a different status code here rather than a 200 on failure?

Returning 200 with success: false was an existing behavior and matches the pattern used by the Openrouter setup flow.

johnlanda · 2026-01-16T16:20:38Z

ui/desktop/src/native/auth_session/src/auth_session.mm

+static NSMutableSet<ASWebAuthenticationSession *> *gActiveSessions = nil;
+static GooseAuthPresentationContextProvider *gPresentationContextProvider = nil;


Will these globals cause issues if multiple auth flows are triggered at the same time? Is it possible to trigger multiple at the same time?

ASWebAuthenticationSession only supports a single login session at a time, so I think this should be fine.

michaelneale · 2026-01-19T05:50:45Z

oh interesting, looks like some merge conflicts (most are generated code though). I didn't know about this on macos - is there an example of this? seems a fair bit of work, but macos is pretty common so may be ok (OTOH spinning up a little server isn't the end of the world if smooth enough)

raj-subhankar · 2026-01-19T07:36:03Z

hey @michaelneale 👋

Yeah, spinning up a server for auth is totally fine. The main goal here was to keep the user in the app, instead of opening a browser tab and leaving them there. To make that work, we had to change the server based approach as well.
Claude Desktop comes to mind as a good example of this.

Also I’ve fixed the conflicts and updated the PR description.

Copilot

Pull request overview

Copilot reviewed 18 out of 19 changed files in this pull request and generated no new comments.

Files not reviewed (1)

ui/desktop/package-lock.json: Language not supported

michaelneale · 2026-01-21T23:47:06Z

yeah this did work when I tried it - is nice. May be overkill as I think previous was was similarly smooth (but with native browser I guess)

raj-subhankar · 2026-01-22T03:33:13Z

@michaelneale I agree this is a significant change, and for most cases the previous login flow did feel smooth.

That said, I do run into issues on when using Goose alongside local dev projects. Since Goose spins up the login server on localhost:3000, if you already have something running on that port the login just fails silently, with no indication of why.

While we could fix this by not hardcoding the port, the new flow addresses it as well and has the added benefit of feeling more native.

michaelneale · 2026-01-28T21:24:01Z

@raj-subhankar is there a way to do it with a dynamic port (or this macos native way) but use the native browser vs a window?

raj-subhankar · 2026-02-04T03:08:19Z

@michaelneale Yes, we could do this with a custom URL scheme using the external browser.

However, I’m advocating for ASWebAuthenticationSession because it’s the best of both worlds.

To clarify: on macOS this uses the user’s default browser (Chrome, Safari, etc.), not an embedded webview, and it shares the browser’s cookies, so you still get the same SSO experience.

The “window” you see is the OS delegating the auth request to the default browser. The key advantage is lifecycle management: the system lets us automatically dismiss the window as soon as authentication completes.

With a external browser flow, the user is left with a “Success” tab they have to manually close before returning to the app.

Given that this is Apple’s recommended approach for native app authentication, and the standard used by apps like Slack and VS Code, is there a specific UX concern you have with the modal window?

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

github-actions · 2026-02-14T06:37:32Z

🔍 Recipe Security Scan Results

✅ Status: APPROVED - All recipes passed security scan

📊 Scan Summary:

Total recipes scanned: 4

📋 Individual Recipe Results:
✅ Recipe 1: APPROVED (LOW risk)
✅ Recipe 2: APPROVED (LOW risk)
✅ Recipe 3: APPROVED (LOW risk)
✅ Recipe 4: APPROVED (LOW risk)

🔗 View detailed scan results in the workflow artifacts.

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

michaelneale · 2026-02-15T23:40:51Z

I think we can close this, with a port fix and possibly #7166 for responding to low balance I think we could be in a good place.

Copilot AI review requested due to automatic review settings January 12, 2026 16:00

raj-subhankar marked this pull request as draft January 12, 2026 16:00

Copilot started reviewing on behalf of raj-subhankar January 12, 2026 16:01 View session

raj-subhankar force-pushed the feat/tetrate-native-auth branch from 24bc358 to f6b9fd9 Compare January 12, 2026 16:05

Copilot AI reviewed Jan 12, 2026

View reviewed changes

DOsinga requested a review from michaelneale January 12, 2026 16:13

raj-subhankar force-pushed the feat/tetrate-native-auth branch 3 times, most recently from 53ce7e1 to 9336b80 Compare January 13, 2026 08:53

johnlanda reviewed Jan 16, 2026

View reviewed changes

raj-subhankar force-pushed the feat/tetrate-native-auth branch 2 times, most recently from 66bd6e9 to 33a51fd Compare January 19, 2026 06:22

raj-subhankar marked this pull request as ready for review January 19, 2026 07:36

Copilot AI review requested due to automatic review settings January 19, 2026 07:36

Copilot started reviewing on behalf of raj-subhankar January 19, 2026 07:36 View session

Copilot AI reviewed Jan 19, 2026

View reviewed changes

raj-subhankar requested a review from johnlanda January 20, 2026 06:22

raj-subhankar force-pushed the feat/tetrate-native-auth branch from 5d502ad to b074a82 Compare January 22, 2026 03:14

DOsinga assigned michaelneale Jan 29, 2026

raj-subhankar marked this pull request as draft February 10, 2026 09:57

raj-subhankar force-pushed the feat/tetrate-native-auth branch from f7d15a8 to eecf26c Compare February 14, 2026 06:26

raj-subhankar added 3 commits February 14, 2026 12:03

Update Tetrate login flow

02935e8

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

Update

4451c41

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

UpdatE

0ab31f8

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

raj-subhankar added 11 commits February 14, 2026 12:03

Update

3fa0e03

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

Update

2ceeec7

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

Update

4e0b972

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

Address feedback

b01852a

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

Address feedback

c1eebb7

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

Update

710e4db

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

Fix generated files

f009af4

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

Address feedback

8e36721

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

Update

7932e85

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

remove auth

01174a4

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

update

5ba1688

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

raj-subhankar force-pushed the feat/tetrate-native-auth branch from eecf26c to 5ba1688 Compare February 14, 2026 06:36

cleanup

a807094

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

raj-subhankar force-pushed the feat/tetrate-native-auth branch from ad83134 to a807094 Compare February 14, 2026 07:04

raj-subhankar added 3 commits February 14, 2026 12:37

chore: revert unintended lockfile churn

2d60102

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

update

b9a855c

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

clean

154507a

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

raj-subhankar changed the title ~~feat: Native auth flow for Tetrate on macOS~~ feat: Native PKCE Auth for Tetrate via Custom URL Scheme Feb 14, 2026

update

dc3f2f5

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

raj-subhankar force-pushed the feat/tetrate-native-auth branch from 2210bca to dc3f2f5 Compare February 14, 2026 18:38

update

b25af59

Signed-off-by: raj-subhankar <subhankar.rj@gmail.com>

raj-subhankar force-pushed the feat/tetrate-native-auth branch from c48841f to b25af59 Compare February 15, 2026 05:17

raj-subhankar closed this Feb 16, 2026

		static NSMutableSet<ASWebAuthenticationSession > gActiveSessions = nil;
		static GooseAuthPresentationContextProvider *gPresentationContextProvider = nil;

Conversation

raj-subhankar commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

AI Assistance

Testing

Related Issues

Screenshots/Demos (for UX changes)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

johnlanda Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

raj-subhankar Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

johnlanda Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

raj-subhankar Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

johnlanda Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

raj-subhankar Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

michaelneale commented Jan 19, 2026

Uh oh!

raj-subhankar commented Jan 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

michaelneale commented Jan 21, 2026

Uh oh!

raj-subhankar commented Jan 22, 2026

Uh oh!

michaelneale commented Jan 28, 2026

Uh oh!

raj-subhankar commented Feb 4, 2026

Uh oh!

github-actions bot commented Feb 14, 2026

Uh oh!

michaelneale commented Feb 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

raj-subhankar commented Jan 12, 2026 •

edited

Loading