# v0.10.2 — popups open as tabs, not unclosable windows

**2026-08-14**

- **`window.open()` now lands in a tab** — both compose files set `browser.link.open_newwindow=3` and `browser.link.open_newwindow.restriction=0`. On a single-canvas VNC browser a real popup window rendered undecorated and full-screen, with no titlebar and no way to close it. Every OAuth sign-in flow hit this.
- **`restriction=0` is the load-bearing half** — Firefox defaults it to `2`, which routes new windows into tabs *except* when the page passes window features. OAuth popups always pass `width`/`height`, so the default exempted exactly the case that hurt.
- **The OAuth handoff survives the change** — verified against a live popup: `window.opener` still resolves to the caller, and the container's window server reports a single X11 window while the popup tab is open, so nothing became a second window.
- **Not fixable at the window manager** — openbox cannot tell a Firefox popup from the main Firefox window; every property it can match on is identical between them. The browser preference is the only lever.
- **Config only** — no server code changed. Delivered through the base image's `FF_PREF_<NAME>="pref.name=value"` convention, which writes user preferences before Firefox launches.
- **Upgrading:** preferences bind only when the container is recreated. `cd docker && docker compose up -d` — editing the compose file on its own changes nothing.