mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-05 00:03:15 +01:00
Garry Tanandcapy-ai[bot]
635535d3c1
* feat(evals): Opus 5.5 is the paid gate's model under test; judge stays Fable (GSTA-49 TM1) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: re-baseline old-model paid pins onto the current generation (TM3) Repair the prosons capture prompt that tripped the reasoning_extraction classifier, and restructure /setup-browser-cookies so the Aside probe, decisions and target order are unambiguous. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs: CHANGELOG entry for the TM3 re-baseline under [Unreleased] Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * chore: stamp v1.91.150.0 Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
83 lines
5.3 KiB
Cheetah
83 lines
5.3 KiB
Cheetah
---
|
|
name: setup-browser-cookies
|
|
preamble-tier: 1
|
|
version: 1.0.0
|
|
description: |
|
|
Import cookies from your real Chromium browser into the headless browse session.
|
|
Opens an interactive picker UI where you select which cookie domains to import.
|
|
Use before QA testing authenticated pages. Use when asked to "import cookies",
|
|
"login to the site", or "authenticate the browser". (gstack)
|
|
triggers:
|
|
- import browser cookies
|
|
- login to test site
|
|
- setup authenticated session
|
|
allowed-tools:
|
|
- Bash
|
|
- Read
|
|
- AskUserQuestion
|
|
---
|
|
|
|
{{PREAMBLE}}
|
|
|
|
# Setup Browser Cookies
|
|
|
|
## 1. Check for Aside
|
|
|
|
Use this checkout as the gstack root if it contains `BROWSER.md` and `browse/SKILL.md`; otherwise use the installed root containing `bin/gstack-skill-start`, never a generated host stub. Read that root's `browse/SKILL.md` **BROWSER SETUP** section and run its Aside probe.
|
|
|
|
- **Aside probe prints `READY`:** no import is needed, because Aside already has the user's signed-in sessions. Tell the user to use Aside, or to sign in there, and end this skill.
|
|
- **Any other result:** continue with gstack's own headless browser (`$B`).
|
|
|
|
## 2. Get every decision from the user first
|
|
|
|
Ask these together, before running any `$B` command. Never guess an answer or treat the default Comet browser as consent.
|
|
|
|
1. **Source browser and profile.** `--profile` takes the profile's directory (`Default`, `Profile 2`), not its display name. A profile that cannot be read is unknown, not empty.
|
|
2. **Domains to import,** and the **target**: one page on a chosen domain that the session should open, by URL.
|
|
3. **Sign-in verification (`--verify-auth`)?** Default no. It reloads the target and reports **verified** only after a successful same-origin response with exactly one visible element, found by a CSS selector, whose whitespace-normalized text equals the expected identity. If yes, the user supplies the selector and the expected identity privately.
|
|
4. **Clear stale storage (`--clear-storage`)?** Default no; needs explicit approval. Chromium only. It clears localStorage for the target's origin (shared by that origin's tabs) and sessionStorage for the target tab, and nothing else; other browser engines reject the reset but still import. A failed reset may already have cleared some storage and is not rolled back.
|
|
5. **Every cookie in the profile (`--all`)?** Default no; needs explicit consent. It cannot be combined with a domain or with clearing storage.
|
|
|
|
Use the picker when any of answers 1-2 is still open; it asks for them. Use direct import when the user has named the browser, the profile directory and the domains.
|
|
|
|
## 3. Prepare gstack's browser
|
|
|
|
1. If the user wants verification, have them set `GSTACK_COOKIE_AUTH_SELECTOR` and `GSTACK_COOKIE_AUTH_EXPECTED_IDENTITY` privately in the shell that runs `$B`. The browser daemon reads them only when it starts, so if a gstack daemon is already running, run `$B stop` first. Never invent the values.
|
|
2. Follow `browse/SKILL.md`'s **Browser fallback** section to find `$B`, building it if the check prints `NEEDS_SETUP`.
|
|
3. Run `$B status`. If it reports `Mode: cdp`, `$B` is attached to the user's real browser and already has its sessions: tell the user no import is needed and end this skill.
|
|
4. Open the target URL from answer 2 and leave that tab alone until the import finishes:
|
|
|
|
```bash
|
|
$B goto "<url>"
|
|
```
|
|
|
|
## 4. Import
|
|
|
|
Picker (the user confirms the browser, profile and domains there, ticks verification if they asked for it, then tells you when done; the link works once, for five minutes, so rerun the command if it expires):
|
|
|
|
```bash
|
|
$B cookie-import-browser
|
|
```
|
|
|
|
Direct import: run `$B cookie-import-browser` with the chosen browser name, one `--domain` per run and `--profile` set to the profile directory (not its display name); add `--verify-auth` or `--clear-storage` only if the user said yes in step 2.
|
|
|
|
If the import rejects because verification settings are missing, nothing changed: tell the user which variable is missing and return to step 3. Read that same root's `BROWSER.md`, **Choosing a source and checking sign-in**, for other errors and receipt failure reasons; it has the error tables, examples, profile labels, supported sources and platform setup.
|
|
|
|
## 5. Report honestly
|
|
|
|
Report from the import receipt, not from raw `$B cookies`, as three lines:
|
|
|
|
- `Imported: <count> (<imported|partial|empty|failed>, as the receipt says) from <browser> for <domains>`
|
|
- `Storage reset: <done|failed|not requested>`
|
|
- `Sign-in: <verified|not verified|not checked>`
|
|
|
|
**Not checked** means verification was not requested; **not verified** means it ran and failed; **verified** needs the identity match. Cookie counts, zero imports and HTTP 200 never prove sign-in. Imported cookies apply to the whole browser context, not one tab.
|
|
|
|
Never request or publish cookie values, passwords, identity or profile text, session details, or raw errors in public logs.
|
|
|
|
## Platform boundaries
|
|
|
|
Dia is macOS-only. Keychain approval is the user's choice. Database retries are bounded; permission denial needs user action, not repeated prompts.
|
|
|
|
Windows supports DPAPI-compatible cookies, not all App-Bound Encryption; native extraction stays disabled pending qualification. Closing Chrome cannot bypass Chrome 136+ default-directory protection, including numbered profiles. No TCP fallback or real-profile copies. Offer headed manual sign-in only with a display available.
|