fix(tauri): forward hot-instance OAuth deep links

[NgoQuocViet2001]

Summary

• Enable the deep-link feature on tauri-plugin-single-instance.
• Update app/src-tauri/Cargo.lock so the single-instance plugin links against tauri-plugin-deep-link.
• Document why the feature is required for Windows/Linux second-launch OAuth callback forwarding.

Problem

Closes #2228. On Windows, OAuth completes in the system browser, but when OpenHuman is already running the openhuman://oauth/... second launch only focuses the primary instance. The live renderer never receives the callback, while cold-start and simulated deep links still work.

tauri-plugin-single-instance was installed to prevent secondary CEF launches, but without its deep-link feature the second-launch deep-link payload is not forwarded into the primary app on Windows/Linux.

Validation

• cargo metadata --manifest-path app/src-tauri/Cargo.toml --format-version 1 --no-deps + assertion that tauri-plugin-single-instance includes deep-link -> passed.
• cargo fmt --manifest-path app/src-tauri/Cargo.toml -p OpenHuman --check -> passed.
• git diff --check -> passed.
• cargo check --manifest-path app/src-tauri/Cargo.toml -> attempted; blocked by local native toolchain gaps unrelated to this change: missing cmake for cef-dll-sys and missing libclang/LIBCLANG_PATH for whisper-rs-sys. Cargo reached dependency resolution and native build scripts before failing.

Duplicate check

Searched existing PRs for #2228, "Windows desktop OAuth callbacks", and single-instance + deep-link feature; no open or recent PR covers this fix. Prior #1510 added the single-instance guard but did not enable the deep-link forwarding feature.

Summary by CodeRabbit

• New Features
  • Deep-link payload forwarding for second-instance app launches is now supported.
• Tests
  • Added a regression test to verify the deep-link feature is declared and remains enabled.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ffcc7c44-8cc2-4f3d-b7de-605f4ba5c9c8

📥 Commits

Reviewing files that changed from the base of the PR and between 56bcb9f and 4065975.

📒 Files selected for processing (2)

• app/src-tauri/Cargo.toml
• app/src-tauri/src/lib.rs

🚧 Files skipped from review as they are similar to previous changes (1)

• app/src-tauri/Cargo.toml

---

📝 Walkthrough

Walkthrough

Enables the deep-link feature for tauri-plugin-single-instance in app/src-tauri/Cargo.toml and adds a regression test that parses that Cargo.toml to assert the dependency includes the "deep-link" feature.

Changes

Deep-link support for OAuth callbacks

Layer / File(s)	Summary
Enable deep-link feature on single-instance plugin app/src-tauri/Cargo.toml	tauri-plugin-single-instance dependency gains features = ["deep-link"] and comments clarifying second-launch deep-link payload forwarding.
Regression test validating Cargo.toml app/src-tauri/src/lib.rs	Adds single_instance_dep_enables_deep_link_feature test that parses app/src-tauri/Cargo.toml and asserts the tauri-plugin-single-instance dependency includes the "deep-link" feature.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐇 I peeked through Cargo's fold,
Found a flag to make links bold,
Deep links hop to one warm den,
No stray instances again,
OAuth finishes—happy end!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(tauri): forward hot-instance OAuth deep links' directly describes the main change—enabling deep-link feature forwarding in the single-instance plugin to fix OAuth callbacks. It is clear, concise, and accurately reflects the primary objective.
Linked Issues check	✅ Passed	The PR enables the deep-link feature on tauri-plugin-single-instance and adds a regression test to verify it, meeting issue #2228's core requirements. Both the Cargo.toml change and the test directly address the root cause of hot-instance OAuth callbacks failing on Windows/Linux.
Out of Scope Changes check	✅ Passed	All changes—enabling the deep-link feature, updating Cargo.lock, adding documentation, and the regression test—are directly scoped to fixing the hot-instance OAuth deep-link forwarding issue. No unrelated modifications are present.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Warning

Review ran into problems

🔥 Problems

Stopped waiting for pipeline failures after 30000ms. One of your pipelines takes longer than our 30000ms fetch window to run, so review may not consider pipeline-failure results for inline comments if any failures occurred after the fetch window. Increase the timeout if you want to wait longer or run a @coderabbit review after the pipeline has finished.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[graycyrus]

Nice find — enabling the deep-link feature on tauri-plugin-single-instance is the correct fix, and the inline comment documenting the why is appreciated.

One thing holding this back: issue #2228 acceptance criteria explicitly require regression test coverage and ≥ 80 % diff coverage. The PR currently adds no tests. Since the change is a Cargo feature flag, a lightweight cargo metadata assertion (verifying the feature is present) or an integration-level deep-link forwarding test would satisfy the gate without being heavy.

Otherwise the Cargo.toml + lockfile change itself looks correct — just needs the test coverage to land.

[graycyrus]

[major] Missing regression test required by #2228 acceptance criteria.

The issue explicitly lists:

• Regression safety — Unit, integration, or E2E coverage added or updated so the single-instance deep-link wiring is verified.
• Diff coverage ≥ 80 %

Suggestion: add a build-time assertion that tauri-plugin-single-instance includes the deep-link feature, e.g.:

#[cfg(test)]
#[test]
fn single_instance_has_deep_link_feature() {
    // cargo metadata already verified this in CI validation,
    // but a compiled test catches regressions if someone removes the feature.
    assert!(cfg!(feature = "deep-link") || cfg!(target_os = "macos"),
            "tauri-plugin-single-instance must enable the deep-link feature on Windows/Linux");
}

Alternatively, a CI script assertion using cargo metadata --no-deps works too — the PR's own validation section already describes the command.

[senamakel]

Added a regression test in 4065975 — tests::single_instance_dep_enables_deep_link_feature in app/src-tauri/src/lib.rs parses Cargo.toml at test time and asserts the deep-link feature is present on tauri-plugin-single-instance. This fails fast if anyone removes the feature flag in the future (issue #2228 regression safety + diff coverage). I went with a Cargo.toml-parse test rather than the suggested cfg!(feature = "deep-link") form because cfg! checks features of this crate (OpenHuman), not the transitive plugin crate, so it wouldn't actually catch the regression we care about.

[NgoQuocViet2001]

@graycyrus thanks again for the review. The requested regression coverage was added in 4065975 via tests::single_instance_dep_enables_deep_link_feature, which parses app/src-tauri/Cargo.toml and asserts that tauri-plugin-single-instance keeps the deep-link feature enabled.

I noticed the original review thread may still appear unresolved after merge. If there is anything still missing from the #2228 acceptance criteria, happy to follow up in a separate PR.