fix(linux): open external links in the system browser

[csmashe]

Problem

On the Linux client, clicking an external link inside the app window does nothing at all — no popup, no browser, no error. Most visible on the Service Status page, where every provider card is a link to that provider's status page, but it affects every target="_blank" link in the dashboard (leaderboard profiles, the sidebar GitHub link, docs links).

Cause: wry only connects WebKitGTK's create signal when a new-window handler is registered (wry/src/webkitgtk/mod.rs), and the Tauri window in main.rs registered none. WebKitGTK's default create returns no webview, so the click is silently dropped.

The other two desktop clients already handle this explicitly:

• macOS — WKUIDelegate.createWebViewWith → NSWorkspace.shared.open (DashboardWindowController.swift:507)
• Windows — CoreWebView2.NewWindowRequested → OpenInBrowser (DashboardWindow.cs:364)

Fix

New src-tauri/src/external.rs:

• is_internal_url() — loopback hosts, *.localhost, and non-http(s) schemes (tauri://, about:, blob:) stay in the window. Port-agnostic, since the bundled server picks its port dynamically. Lookalike hosts such as https://127.0.0.1.evil.com/ are treated as external.
• open_in_browser() — hands the URL to xdg-open, matching how oauth.rs already launches the browser.

Wired into the window builder:

• .on_new_window(...) → open externally, NewWindowResponse::Deny. This is the reported bug.
• .on_navigation(...) → mirrors the Windows navigation guard. The app window has no browser chrome, so a top-level navigation off the dashboard would otherwise strand the user with no way back.

Testing

• cargo test — all suites pass, including the new tests/external.rs and the unit tests in external.rs.
• cargo fmt --check clean.
• Ran the app on Fedora / GNOME Wayland and clicked through the Service Status cards: each opens the provider's status page in the default browser and the app window stays put.

Summary by CodeRabbit

• New Features

  • External links now open in the system browser on Linux.
  • Internal dashboard links, loopback addresses, and supported application URLs remain inside the app.
  • Links opened in new windows and navigation away from the dashboard are routed appropriately.

• Bug Fixes

  • Prevents third-party pages and potentially misleading domains from opening within the app.

• Tests

  • Added coverage for internal dashboard navigation, provider status pages, and external domains.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 94065278-930c-47de-9e9a-5f8b2883d960

📥 Commits

Reviewing files that changed from the base of the PR and between 13bca6e and 0fa6ab5.

📒 Files selected for processing (4)

• TokenTrackerLinux/src-tauri/src/external.rs
• TokenTrackerLinux/src-tauri/src/lib.rs
• TokenTrackerLinux/src-tauri/src/main.rs
• TokenTrackerLinux/src-tauri/tests/external.rs

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The Linux Tauri application now keeps internal URLs in the webview and opens external HTTP(S) URLs with xdg-open. New-window and navigation handlers apply this routing, with tests covering dashboard and provider URLs.

Changes

Linux external-link routing

Layer / File(s)	Summary
URL classification and browser launching TokenTrackerLinux/src-tauri/src/external.rs	Adds internal URL detection for non-HTTP(S), loopback, localhost, and hostless URLs. External URLs use xdg-open, with failures logged and reported.
Webview navigation integration TokenTrackerLinux/src-tauri/src/lib.rs, TokenTrackerLinux/src-tauri/src/main.rs	Exports the external module. The main webview routes new-window links and external top-level navigation to the system browser while keeping internal navigation in-app.
Navigation classification tests TokenTrackerLinux/src-tauri/tests/external.rs	Tests internal dashboard and Tauri URLs, plus external provider status pages and lookalike domains.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: 🟡 Moderate · up to 0fa6a

External links will open in the system browser, but the new navigation policy also permits unapproved schemes and broadly trusts loopback origins inside the app. Tightening or validating those boundaries is recommended before merge.

Sequence Diagram(s)

sequenceDiagram
  participant MainWebview
  participant external
  participant xdg_open
  MainWebview->>external: classify navigation URL
  alt Internal URL
    external-->>MainWebview: allow in-app navigation
  else External URL
    MainWebview->>external: open_in_browser(URL)
    external->>xdg_open: launch external URL
    xdg_open-->>external: process result
    external-->>MainWebview: block in-app navigation
  end

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: Linux external links now open in the system browser.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}