fix(auth-ui): stop offering a Telegram widget where it cannot work

Two hosts cannot complete the widget flow and both are in use: an Android WebView /
in-app browser (the operator's phone UA ends "; wv)") and a desktop browser that blocks
the popup or hands the link to the Telegram app. The widget needs a popup that can
postMessage back into the opener; in those hosts the link lands in a browser tab or in
Chrome with no opener, onTelegramAuth never fires, and the login card looks dead —
"it opens my default browser" (reported twice: phone, then Max's laptop).

modules/wx11-tg-webview.js (new)
  WX11TG.isWebView()  -> "; wv)", Telegram in-app, Meta in-app UAs
  WX11TG.dropWidgets()-> removes already-rendered oauth.telegram.org iframes/scripts

dashboard.html
  code box is open by default and drops the nested <details>
  WebView: widget removed + "cannot work inside an app window" hint
  desktop: if the widget was clicked and onTelegramAuth has not fired in 12 s, open the
  code flow with a hint instead of leaving a dead card

spaces/newos4 (webdav-login panel)
  in a WebView the widget is never injected, the mount is hidden and the device-code
  flow starts by itself; desktop keeps the widget unchanged
  version v4.6.145

Measured with playwright (390x844 WebView UA and 1440x900 Chrome):
  WebView  -> 0 Telegram iframes, hint shown, code box open, real WX11- code minted
  desktop  -> widget still rendered, code box open, real WX11- code minted
  newOS4 WebView -> no widget injected, code area auto-visible, code WX11-..., no JS errors
  newOS4 desktop -> widget still offered

3 files changed, 21 insertions, 5 deletions

diff --git a/main.html b/main.html
index 2939f74..1491a7a 100644
--- a/main.html
+++ b/main.html
@@ -1349,13 +1349,13 @@
     </script>
 
     <!-- v4.5.63: A2A scratchpad fixes + agent-register arg fix -->
-<script src="modules/core/core-bundle.js?v=v4.6.144"></script>
+<script src="modules/core/core-bundle.js?v=v4.6.145"></script>
 
     <!-- Async dependency-ordered module loader now only initializes terminal and loads optional ext modules -->
-<script src="modules/core/module-loader.js?v=v4.6.144"></script>
+<script src="modules/core/module-loader.js?v=v4.6.145"></script>
 
     <!-- Critical ext bundle loads AFTER webx11 exists so registerModule calls work -->
-<script src="modules/ext/critical-ext-bundle.js?v=v4.6.144"></script>
+<script src="modules/ext/critical-ext-bundle.js?v=v4.6.145"></script>
 
 <script>
 // ═══ ONE TRUE VERSION SOURCE ═══
diff --git a/modules/core/module-loader.js b/modules/core/module-loader.js
index 2cb5003..ffa691e 100644
--- a/modules/core/module-loader.js
+++ b/modules/core/module-loader.js
@@ -4,7 +4,7 @@
     // Core module bundle loaded synchronously in main.html.
     // This loader only handles version cache-busting, splash, terminal init, and optional ext modules.
 
-    const LATEST_VER = 'v4.6.144';
+    const LATEST_VER = 'v4.6.145';
     const CACHE = '?v=' + LATEST_VER;
     // Exposed so ext modules can register their own URL with the same cache-busting version
     // instead of an unversioned path the browser may already have cached (shell.js did).
diff --git a/modules/ext/webdav.js b/modules/ext/webdav.js
index c7efbf9..a97a8bc 100644
--- a/modules/ext/webdav.js
+++ b/modules/ext/webdav.js
@@ -975,6 +975,13 @@ class WebDAVModule {
                 }
             };
             const mount = document.getElementById('wdav-tg-mount');
+            // A Telegram widget cannot log anyone in inside an Android WebView or an in-app
+            // browser: it needs a popup that can postMessage back to the opener, and those hosts
+            // hand the link to the system browser, which has no opener. Measured 2026-11-02 (the
+            // operator's phone UA ends "...; wv)"): every attempt landed in Chrome and died there.
+            // In that case skip the widget entirely and start the code flow, which needs no popup.
+            const _tgWV = /;\s*wv\)/.test(navigator.userAgent || '') ||
+                          /\bTelegram\b/i.test(navigator.userAgent || '');
             const tw = document.createElement('script');
             tw.src = 'https://telegram.org/js/telegram-widget.js?22';
             tw.setAttribute('data-telegram-login', 'roducbot');
@@ -982,7 +989,16 @@ class WebDAVModule {
             tw.setAttribute('data-onauth', 'webx11TgLogin(user)');
             tw.setAttribute('data-request-access', 'write');
             tw.async = true;
-            mount.appendChild(tw);
+            if (_tgWV) {
+                // The code button's handler is already bound above; just hide the widget and use it.
+                if (mount) mount.style.display = 'none';
+                const _st = document.getElementById('wdav-tg-status');
+                if (_st) _st.textContent = 'This app window cannot run the Telegram button — using a code instead.';
+                const _cb = document.getElementById('wdav-code-btn');
+                if (_cb) setTimeout(function () { _cb.click(); }, 0);
+            } else {
+                mount.appendChild(tw);
+            }
             document.getElementById('wdav-login-btn').onclick = async function () {
                 const u = (document.getElementById('wdav-user').value || '').trim().toLowerCase();
                 const pw = document.getElementById('wdav-pass').value || '';