fix connect flow in tray

client/ui/frontend/src/layouts/ConnectionStatusSwitch.tsx

@@ -62,16 +62,15 @@ async function startLogin(): Promise<void> {
         if (result.needsSsoLogin) {
             const uri = result.verificationUriComplete || result.verificationUri;
             if (uri) {
-                // Open the in-app sign-in popup first so it's already on
-                // screen when the system browser steals focus; otherwise
-                // the browser lands on top and the user has to dig the
-                // NetBird window back out.
+                // Open the in-app sign-in popup first; the dialog itself
+                // fires Connection.OpenURL after it's actually on screen
+                // (see WaitingForBrowserDialog) so the system browser
+                // doesn't land on top of a still-hidden NetBird window.
                 try {
                     await WindowManager.OpenBrowserLogin(uri);
                 } catch (e) {
                     console.error(e);
                 }
-                Connection.OpenURL(uri).catch(console.error);
             }
 
             const cancelPromise = new Promise<void>((resolve) => {

client/ui/frontend/src/modules/authentication/WaitingForBrowserDialog.tsx

@@ -1,4 +1,4 @@
-import { useCallback } from "react";
+import { useCallback, useEffect } from "react";
 import { useTranslation } from "react-i18next";
 import { useSearchParams } from "react-router-dom";
 import { Events } from "@wailsio/runtime";
@@ -21,6 +21,15 @@ export default function WaitingForBrowserDialog() {
     const uri = params.get("uri") ?? "";
     const contentRef = useAutoSizeWindow<HTMLDivElement>(WINDOW_WIDTH);
 
+    // Open the system browser only after the dialog has mounted (which
+    // means useAutoSizeWindow has called Window.Show). startLogin used to
+    // fire OpenURL itself but the browser typically beat React's mount
+    // and landed on top of the still-hidden NetBird popup.
+    useEffect(() => {
+        if (!uri) return;
+        Connection.OpenURL(uri).catch(console.error);
+    }, [uri]);
+
     const tryAgain = useCallback(() => {
         if (!uri) return;
         Connection.OpenURL(uri).catch(console.error);