Use paarrot://desktop SSO redirect so consent identifies the app.

src/app/hooks/usePathWithOrigin.ts

@@ -1,12 +1,30 @@
 import { useMemo } from 'react';
 import { useClientConfig } from './useClientConfig';
 import { trimLeadingSlash, trimSlash, trimTrailingSlash } from '../utils/common';
+import { isElectron } from '../utils/tauri';
 
+/** Authority shown on Matrix SSO consent ("Continue to paarrot://desktop"). */
+export const ELECTRON_PROTOCOL_HOST = 'desktop';
+
+/**
+ * Build an absolute URL for the given in-app path.
+ *
+ * In Electron, SSO (and other browser handoffs) must return via paarrot://desktop/...
+ * — a named host so consent UI identifies the desktop app, and a real pathname
+ * (not a hash) because browsers strip fragments when launching custom protocols.
+ */
 export const usePathWithOrigin = (path: string): string => {
   const { hashRouter } = useClientConfig();
   const { origin } = window.location;
 
   const pathWithOrigin = useMemo(() => {
+    if (isElectron()) {
+      const basename = trimSlash(hashRouter?.basename ?? '');
+      const routeParts = [basename, trimLeadingSlash(path)].filter(Boolean);
+      const route = `/${routeParts.join('/')}`.replace(/\/{2,}/g, '/');
+      return `paarrot://${ELECTRON_PROTOCOL_HOST}${route}`;
+    }
+
     let url: string = trimSlash(origin);
 
     url += `/${trimSlash(import.meta.env.BASE_URL ?? '')}`;