Show the private sign-in button while a Bot waits in the open chat

[davidmckayv]

Problem

When a Bot calls computer_request_sign_in in the open chat, the card shows "Waiting for you to sign in" but never shows Open private sign-in. The request is pending on the server with the call's toolCallId, but the person can't reach the form from the chat.

Reproduction (main): open a chat with any Bot that has a computer, ask it to log into a site that needs a login. The card shows the waiting line and the site, with no button. GET /api/sign-in-requests lists the pending request with the matching toolCallId.

Cause

The card read its request id from pending[toolCallId], state that the tool handler set. useFrontendTool in @copilotkit/react-core/v2 registers the renderer in a layout effect keyed on the tool's name, availability and deps, not on render, so the renderer it keeps closes over the first render's empty pending and never sees the id. This is the same SDK behaviour approval-tools.tsx documents for handlers.

Fix

SignInCard finds its request on the server: while the call is running and has no result, it polls GET /api/sign-in-requests (new pendingSignInRequestsQueryOptions) for the open request whose toolCallId matches, and stops polling once found. The pending state is removed. The handler also invalidates that query once it has opened the request, because the card can draw before the request exists and a background tab does not run the poll.

Tests

• New app/tests/sign-in-card.test.tsx uses the real CopilotKitProvider and useFrontendTool (no SDK mocks), draws the call through the renderer the SDK kept before the request exists, takes window focus away (no polling), runs the kept handler, and expects the button and the dialog it opens. Fails on main (Unable to find role="button" and name /Open private sign-in/), passes with the fix.
• app/tests/approval-tools.test.tsx now uses restorable spyOn on the SDK namespace instead of mock.module. Bun can't undo a module mock, so it replaced the SDK for every later test file in the run, including the new test.
• bun run lint, format:check, typecheck, bun test app (only environmental failures, the DB-backed suites without TEST_DATABASE_URL), bun run build. Also checked by hand in a running app: the button shows, the form opens, and the Bot carries on after sign-in.