S288 Progress Report
Documentation for Sessions
S288: Fixing Vitto Desktop Sign-In — Progress Report
Date: March 30, 2026 Session: 288 For: Team overview — written in plain language
What Was Wrong
When users tried to sign in to the Vitto Desktop app using the "Sign in with GoGrab" button, the process would fail after 90 seconds with a "Browser sign-in timed out" error. Here's what was happening:
- The user clicks "Sign in with GoGrab" in the Vitto desktop app
- Their web browser opens to the GoGrab sign-in page
- The sign-in completes successfully in the browser
- The browser tries to send the login credentials back to the Vitto app
- This step silently fails — the browser never actually delivers the credentials
- After 90 seconds of waiting, Vitto gives up and shows the timeout error
The "Email" and "Phone" sign-in methods were not affected — only the "GoGrab" (browser-based) sign-in had this issue.
Why It Was Failing
The root cause is a security restriction in modern web browsers (Chrome, Safari, etc.).
When the GoGrab sign-in page tries to hand off credentials to the Vitto app, it does so using a special link (vitto://auth?token=...). Think of this like a private phone line between the browser and the desktop app.
The problem: browsers now block these special links unless the user actually clicks something. Our sign-in page was trying to send this link automatically in the background — no click required. Browsers saw this as potentially suspicious and silently blocked it. The page showed "Opening Vitto..." but the handoff never happened.
This is a relatively recent browser security change (2023+) that affects all desktop apps using this pattern, not just Vitto.
What We Fixed (Session 288)
We made 4 targeted fixes that address the immediate problem:
1. Added a "Click to Open" Button
The most important fix. Instead of trying to automatically send credentials back to Vitto (which the browser blocks), we now show a clear, prominent "Open Vitto" button. When the user clicks this button, the browser allows the handoff because the user initiated the action. We still try the automatic handoff as a bonus, but the button is the reliable path.
2. Added Diagnostic Logging
The native desktop code that receives the sign-in credentials had zero logging — if something went wrong, there was no way to see what happened. We added detailed logging at every step of the process, so future issues can be diagnosed from the app's console output.
3. Registered the App's Custom Link Properly
We added a configuration file (Info.plist) that explicitly tells macOS "the Vitto app handles vitto:// links." This was likely being done automatically during the build process, but making it explicit eliminates any risk of it being missed.
4. Fixed the "Try Again" Button
Previously, the "Try again" button only cleared the error message — the user still had to click "Sign in with GoGrab" again manually. Now "Try again" actually re-opens the browser, saving a step.
What's Planned Next (Session 290)
While the above fixes address the immediate issue, we also designed a more robust long-term solution that will be built in a separate session:
Server-Side Token Exchange: Instead of relying solely on the special vitto:// link to transfer credentials, we'll add a second channel. The desktop app and browser will communicate through our server:
- Desktop app creates a unique session ID
- Browser sends credentials to the server tagged with that ID
- Desktop app checks the server every 2 seconds for the credentials
- Whichever channel delivers first (direct link OR server) wins
This is the same approach used by VS Code, Slack, and other major desktop apps. It works even when browsers block the direct link, and it works during development testing (where the direct link method doesn't work at all).
The two sessions are independent — Session 290 can start immediately without waiting for Session 288 to be fully tested and deployed.
Timeline Summary
| Step | Status | What It Does |
|---|---|---|
| Investigate the problem | Done | Traced the full sign-in flow, identified the browser blocking issue |
| Fix 1: Click-to-open button | Done | Users can now reliably hand off credentials via a button click |
| Fix 2: Diagnostic logging | Done | Future issues will be visible in the app's console |
| Fix 3: macOS link registration | Done | Ensures the OS knows Vitto handles vitto:// links |
| Fix 4: "Try again" actually retries | Done | Better UX when the first attempt fails |
| Build and test on real app | Pending | Need to build the Tauri app and test on macOS |
| Session 290: Server fallback | Spec written | Adds a second, more reliable channel for credential delivery |
Impact
- Users affected: All Vitto Desktop users who sign in via the "GoGrab" tab
- Severity: High — this was the default sign-in method on desktop
- Risk of fixes: Low — changes are additive (new button, new logging) or minimal (retry behavior)
- Email/Phone sign-in: Confirmed working — unaffected by this issue
Files Changed
For non-developers, here's a simplified view of what was touched:
- Vitto Desktop native app (Rust): Added logging to the credential receiver + macOS configuration
- Sign-in page in the browser (Angular): Replaced auto-redirect with a clickable button
- Welcome screen in the desktop app (Angular): Made "Try again" actually retry
- Future plan document: Detailed specification for the server-side fallback (Session 290)