Desktop app built-in browser: no FIDO2 PIN prompt for security keys on Linux (WebAuthn NotAllowedError)

Summary

In the Claude desktop app's built-in browser pane on Linux, signing in with a FIDO2 security key (YubiKey) that has a PIN fails silently. The key blinks, I touch it, and the page's passkey button becomes clickable again with no error and no PIN prompt.

Environment

• Claude desktop app 2.9939.4 (Code tab), built-in browser pane (mcp__Claude_Browser__*)
• Embedded Chromium 152.0.7977.130
• Linux x86_64 (Arch, kernel 6.18 LTS)
• YubiKey with a FIDO2 PIN set; the same key works in regular Chrome

Steps to reproduce

1. Open a site that requires a passkey or security key with user verification in the built-in browser pane (I hit it at auth.openai.com/auth_challenge/passkey).
2. Click "Continue with passkey".
3. The YubiKey starts blinking. Touch it.

Expected

A PIN entry dialog appears (as in Chrome), and the sign-in completes after the PIN and touch.

Actual

No PIN prompt appears. About 1.6 seconds after the touch, navigator.credentials.get() rejects and the page resets.

Instrumenting the call on the page showed:

{
  "info": { "rpId": "openai.com", "uv": "required", "timeout": 600000, "allowLen": 3, "hasSignal": true },
  "ok": false,
  "name": "NotAllowedError",
  "msg": "The operation either timed out or was not allowed. ...",
  "ms": 1639
}

Feature detection in the same page:

• PublicKeyCredential is defined
• navigator.usb and navigator.hid are present
• isUserVerifyingPlatformAuthenticatorAvailable() returns false (expected on this machine)
• isSecureContext is true

Analysis

The request reaches the authenticator (the key blinks) and the touch is accepted, but the request fails because userVerification: "required" can't be satisfied: the key has a PIN, and the pane has no UI to collect it. The generic NotAllowedError hides the cause. This is my inference; I haven't confirmed it at the CTAP level.

Impact

Accounts that enforce hardware security keys, such as OpenAI Advanced Account Security (which disables email and SMS recovery), can't be signed in from the pane. The only in-pane alternative is a recovery key, which is single-use and starts a 48-hour lockout.

Suggested fix

Show a FIDO2 PIN prompt in the built-in browser for CTAP2 user verification, matching Chrome's behavior. Failing that, surface a clear error saying a PIN is required and the pane can't collect it.