Adom Hydrogen

Found it. New users who create an account by email never reach the Approve page.

1. How the sign-in comes back. No callback and no deep link: Hydrogen polls Carbon for the intent (/auth/intents/{token}) every 2 to 5 s. The poll only succeeds after the person presses Approve on /auth/intent?token=.... Signed out, that page sends them to /auth/login?redirect=/auth/intent?token=.... From there:

• Log in (email or Google): the redirect is followed back to Approve. Fine.
• Sign up with Google: fine. Carbon keeps the redirect on the pending signup, and complete-signup follows it.
• "Create an account" (email): broken. The login footer links to plain /auth/signup, dropping the redirect, and signup ends with goto('/'). The new user lands on the home page, never sees Approve, and Hydrogen waits forever. That matches both installs here: account created, no sign-in.

Fix: adom-inc/hydrogen#401. The footer links carry ?redirect=, and signup returns to it on success (same-site paths only). It needs a review from the cloud Hydrogen owners.

2. Does the 15-minute reopen invalidate the request in progress? No. It only mints a new intent when the old one has expired (Carbon's intents live about 900 s). The old one cannot be approved by then anyway. But someone still mid-signup in the old tab would come back to an expired request, so the card needs to point them at the new one (below).

3. Telemetry, in the next Hydrogen build. signin_screen now also sends:

• approved: Carbon reports the Approve.
• token_saved, with reason: backend or frontend.
• failed, with reason one of link_expired_unapproved, no_approval_before_expiry, carbon_unreachable or token_not_written.

The "I already signed in" path: the card's existing sign-in button reopens the same link while it is alive, which goes straight to Approve once the person is signed in, and a fresh link after expiry. It now has a line under it: "Just created your Adom account? Press this, then Approve."

Not done:

• Fully automatic: "gets the person into the editor without them doing anything else" still needs them to press Approve once. With #401, that is the page they land on.
• Not tested end to end: I could not create a fresh account.

Evidence video: a new user signing up by email from Hydrogen's sign-in tab (recorded on ConfRoomROG, production hydrogen.adom.inc, a clean browser with no Adom session, a Hydrogen sign-in request created exactly as the app does).

1. Hydrogen opens its sign-in; signed out, it lands on Log in.
2. Create an account links to plain /auth/signup: the way back to Hydrogen is gone.
3. After Sign Up the page says "You're all set. Head back to the Adom Hydrogen installer to continue."
4. Hydrogen's sign-in request, checked live right after: {"state":"pending"}. Nothing will ever approve it, so the installer waits forever.

Fix in progress: adom-inc/hydrogen#401, plus Hydrogen Desktop changes.

signup-email-evidence.mp4

Google sign-up, recorded on production for comparison (new account [email protected], fresh Hydrogen auth intent):

Log in page, Sign in with Google, Google account + password, consent, choose username, Create Account, and it lands straight on Authorize Application / Approve. Pressing Approve flips the intent to authenticated (checked live). So the Google path keeps the redirect and works.

Only the email sign-up path loses the user (video in the comment above): it drops them on "You're all set, head back to the installer" and the intent stays pending forever. Fix: adom-inc/hydrogen#401, waiting for review.

signup-google-evidence.mp4

Narrated versions of both recordings (about a minute each; the Google one has the idle waits cut out):

1. Email sign-up: lands on "You're all set", no Approve, Hydrogen's sign-in stays pending. This is where we lose people.
2. Google sign-up: lands on Approve, sign-in completes.

signup-email-narrated.mp4

signup-google-narrated.mp4

Re-tested on production 2026-10-11 05:05 UTC with a brand-new email account ([email protected]), from a fresh Hydrogen sign-in intent:

Log in page, Create an account (the link now carries the redirect), fill the form, Sign Up, and it lands straight on Authorize Application / Approve. Pressed Approve and the intent read back authenticated (checked live against Carbon).

So new email users now get back to Hydrogen. Fixed by Kyle's 147ae5c "fix auth redirect flows" on hydrogen cloud main (Footer + signup page + signup server). PR #401 is superseded by it.

Related, from last night's setup test run: the fleet's ~12 installs "stuck at activate-editor" are this same problem. activate-editor is the step where setup waits for the Adom Approve, so those were people who never finished signing in.

Closing: fixed in production and verified end to end.

Kyle's 147ae5c ("fix auth redirect flows") keeps the way back to Hydrogen through Create an account. On 2026-10-11 a brand-new account signed up from a fresh Hydrogen 1.0.600 install on a clean Windows PC: the sign-up page carried the redirect, landed on Approve, setup finished, and Kel posted "got Hydrogen running" in User Signups (h600saddle, 16:19). Hydrogen 1.0.596+ also tells someone who just made an account to press the sign-in button and Approve.