Sign-in no longer opens a dedicated extension tab. The popup asks the worker, which hosts BrowserOAuthClient in an offscreen document (it needs DOM storage), opens the consent URL in a small popup window, and watches that tab for the redirect back to the chromiumapp.org URL. Replacing chrome.identity.launchWebAuthFlow with a self-managed window gives us control over the consent window size and drops the identity permission; the redirect URI is unchanged, so the hosted client metadata still matches. Flow state lives in storage.session and the listeners are top-level, so consent can outlive the worker. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>