Provider login tabs

The Threads login dialog keeps the hosted CLI authentication session alive while the provider opens in a separate browser tab. Repeated clicks on the same active challenge focus the tab that this portal page opened for that provider. The platform's existing FluentAnchor opts into this shared behavior with data-mw-auth-provider, using the registered provider id, not a URL or credential. Other links keep their normal navigation behavior.

The native handler lives in MeshWeaver.Blazor and runs synchronously inside the browser click, not after a server round-trip. It creates a blank tab, clears window.opener before external navigation, and follows a self-targeted link with no-referrer. The provider never receives an opener reference or a Referer header. Challenge URLs remain in page memory and the existing link; they are not written to browser storage, window names, or logs.

The browser's security boundary

A normal website cannot enumerate or take over a Claude tab the user opened independently. Furthermore, once the new tab's opener is cleared, the portal can focus its retained handle but cannot redirect the now cross-origin tab to a different challenge. A changed authorization URL, a closed tab, or a provider's Cross-Origin-Opener-Policy that severs the handle therefore opens a fresh isolated tab. Reloading the portal also loses the in-memory handle. This is intentional: retaining an opener to force broader tab reuse would let the provider navigate the portal tab.

The original target="_blank" rel="noopener noreferrer" remains the secure fallback before the initializer loads and for modified clicks. Merely replacing _blank with a named target is not a reuse implementation: noopener makes ordinary named targets behave like _blank.

e2e/authentication-links.spec.ts runs against local synthetic origins, not a signed-in provider. It verifies actual browser handles, repeated-click reuse, changed challenge/provider separation, closed and COOP-severed handles, and opener/referrer isolation using the shipped handler.