fix(desktop): keep built-in browser logins across app restarts

Author: TheodoreSpeaks

apps/desktop/src/main/browser-agent/session-cookies.test.ts

@@ -0,0 +1,105 @@
+/**
+ * @vitest-environment node
+ */
+import type { OnHeadersReceivedListenerDetails, Session } from 'electron'
+import { describe, expect, it, vi } from 'vitest'
+import {
+  keepSessionCookiesAcrossRestarts,
+  SESSION_COOKIE_LIFETIME_SECONDS,
+  withSessionCookieLifetime,
+  withSessionCookieMaxAge,
+} from '@/main/browser-agent/session-cookies'
+
+vi.mock('electron', () => import('@/test/electron-mock'))
+
+const NOW = 1_800_000_000
+const MAX_AGE = `Max-Age=${SESSION_COOKIE_LIFETIME_SECONDS}`
+
+describe('withSessionCookieLifetime', () => {
+  it('gives an expiry-less cookie the bounded lifetime', () => {
+    expect(withSessionCookieLifetime({ url: 'https://example.com/', name: 'a' }, NOW)).toEqual({
+      url: 'https://example.com/',
+      name: 'a',
+      expirationDate: NOW + SESSION_COOKIE_LIFETIME_SECONDS,
+    })
+  })
+
+  it('leaves a cookie that already expires untouched', () => {
+    const cookie = { url: 'https://example.com/', name: 'a', expirationDate: NOW + 60 }
+    expect(withSessionCookieLifetime(cookie, NOW)).toBe(cookie)
+  })
+})
+
+describe('withSessionCookieMaxAge', () => {
+  it('adds Max-Age to a session cookie', () => {
+    expect(withSessionCookieMaxAge('sid=abc; Path=/; Secure; HttpOnly')).toBe(
+      `sid=abc; Path=/; Secure; HttpOnly; ${MAX_AGE}`
+    )
+    expect(withSessionCookieMaxAge('sid=abc')).toBe(`sid=abc; ${MAX_AGE}`)
+  })
+
+  it('leaves cookies with an expiry or a deletion untouched', () => {
+    for (const value of [
+      'sid=abc; Expires=Wed, 21 Oct 2030 07:28:00 GMT',
+      'sid=abc; max-age=60',
+      'sid=; Path=/; Max-Age=0',
+      'sid=abc;EXPIRES=Thu, 01 Jan 1970 00:00:00 GMT',
+    ]) {
+      expect(withSessionCookieMaxAge(value)).toBe(value)
+    }
+  })
+
+  it('reads attributes only, never the cookie value', () => {
+    expect(withSessionCookieMaxAge('max-age=1')).toBe(`max-age=1; ${MAX_AGE}`)
+  })
+})
+
+describe('keepSessionCookiesAcrossRestarts', () => {
+  type Listener = (
+    details: Pick<OnHeadersReceivedListenerDetails, 'responseHeaders'>,
+    callback: (response: { responseHeaders?: Record<string, string[]> }) => void
+  ) => void
+
+  function install(): Listener {
+    let listener: Listener | undefined
+    const ses = {
+      webRequest: {
+        onHeadersReceived: vi.fn((handler: Listener) => {
+          listener = handler
+        }),
+      },
+    }
+    keepSessionCookiesAcrossRestarts(ses as unknown as Session)
+    if (!listener) throw new Error('listener not installed')
+    return listener
+  }
+
+  it('rewrites every Set-Cookie value and keeps the other headers', () => {
+    const callback = vi.fn()
+    install()(
+      {
+        responseHeaders: {
+          'content-type': ['text/html'],
+          'Set-Cookie': ['sid=abc; HttpOnly', 'keep=1; Max-Age=60'],
+        },
+      },
+      callback
+    )
+
+    expect(callback).toHaveBeenCalledWith({
+      responseHeaders: {
+        'content-type': ['text/html'],
+        'Set-Cookie': [`sid=abc; HttpOnly; ${MAX_AGE}`, 'keep=1; Max-Age=60'],
+      },
+    })
+  })
+
+  it('leaves responses without cookies untouched', () => {
+    const callback = vi.fn()
+    install()({ responseHeaders: { 'content-type': ['text/html'] } }, callback)
+    install()({}, callback)
+
+    expect(callback).toHaveBeenNthCalledWith(1, {})
+    expect(callback).toHaveBeenNthCalledWith(2, {})
+  })
+})

apps/desktop/src/main/browser-agent/session-cookies.ts

@@ -0,0 +1,60 @@
+import type { CookiesSetDetails, Session } from 'electron'
+
+/**
+ * Session cookies in the browser partition get this lifetime instead of dying
+ * with the process.
+ *
+ * Electron hard-codes Chromium's `persist_session_cookies` and
+ * `restore_old_session_cookies` to false, so a `persist:` partition still drops
+ * every expiry-less cookie on quit — which signs the user out of any site that
+ * keeps its login in one, whether it was imported from Chrome or set here.
+ * Chrome keeps them across restarts under "continue where you left off"; this
+ * matches that, bounded. The site re-sending the cookie renews the window, so
+ * only a login left untouched for this long lapses.
+ */
+export const SESSION_COOKIE_LIFETIME_SECONDS = 30 * 24 * 60 * 60
+
+/** Gives an expiry-less cookie the bounded lifetime; cookies that already expire are unchanged. */
+export function withSessionCookieLifetime(
+  cookie: CookiesSetDetails,
+  nowSeconds: number
+): CookiesSetDetails {
+  if (cookie.expirationDate !== undefined) return cookie
+  return { ...cookie, expirationDate: nowSeconds + SESSION_COOKIE_LIFETIME_SECONDS }
+}
+
+/**
+ * Adds `Max-Age` to a `Set-Cookie` value that has neither `Expires` nor
+ * `Max-Age`. Deletions carry one of the two, so they pass through untouched.
+ */
+export function withSessionCookieMaxAge(setCookie: string): string {
+  const attributes = setCookie.split(';').slice(1)
+  const expires = attributes.some((attribute) => {
+    const name = attribute.split('=', 1)[0].trim().toLowerCase()
+    return name === 'expires' || name === 'max-age'
+  })
+  return expires ? setCookie : `${setCookie}; Max-Age=${SESSION_COOKIE_LIFETIME_SECONDS}`
+}
+
+/**
+ * Makes session cookies a site sets over HTTP survive an app restart.
+ *
+ * The rewrite happens on the response headers, before Chromium stores the
+ * cookie, so it is created persistent in the same order as every other cookie
+ * write — a later deletion from the site still wins. Rewriting stored cookies
+ * after the fact would race exactly that: login redirects set and clear
+ * short-lived cookies milliseconds apart. Cookies set from page script
+ * (`document.cookie`) are not covered; they cannot be `HttpOnly`, so session
+ * logins rarely live in them.
+ */
+export function keepSessionCookiesAcrossRestarts(ses: Session): void {
+  ses.webRequest.onHeadersReceived((details, callback) => {
+    const headers = details.responseHeaders
+    const key = headers && Object.keys(headers).find((name) => name.toLowerCase() === 'set-cookie')
+    if (!headers || !key) {
+      callback({})
+      return
+    }
+    callback({ responseHeaders: { ...headers, [key]: headers[key].map(withSessionCookieMaxAge) } })
+  })
+}

apps/desktop/src/main/browser-agent/session.test.ts

@@ -2277,6 +2277,26 @@ describe('importAgentCookies', () => {
     sameSite: 'lax' as const,
   })
 
+  it('gives session cookies a bounded lifetime so they survive a restart', async () => {
+    vi.useFakeTimers({ now: new Date('2026-09-26T00:00:00Z') })
+    try {
+      const set = vi.fn(async () => {})
+      const session = withCookieJar(set)
+      const expiring = { ...cookie('kept'), expirationDate: 1_900_000_000 }
+
+      await session.importAgentCookies([cookie('session'), expiring])
+
+      const nowSeconds = Date.parse('2026-09-26T00:00:00Z') / 1000
+      expect(set).toHaveBeenNthCalledWith(1, {
+        ...cookie('session'),
+        expirationDate: nowSeconds + 30 * 24 * 60 * 60,
+      })
+      expect(set).toHaveBeenNthCalledWith(2, expiring)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
   it('counts a rejected cookie without losing the rest', async () => {
     // Chromium refuses cookies whose attributes are inconsistent. That
     // rejection must cost one cookie, not the whole import.

apps/desktop/src/main/browser-agent/session.ts

@@ -72,6 +72,10 @@ import {
   registerAgentWebContents,
 } from '@/main/browser-agent/registry'
 import { handleBrowserRequest } from '@/main/browser-agent/request-policy'
+import {
+  keepSessionCookiesAcrossRestarts,
+  withSessionCookieLifetime,
+} from '@/main/browser-agent/session-cookies'
 import { clearHostVerdictCache } from '@/main/browser-agent/url-guard'
 import type { BrowserSessionSnapshot } from '@/main/desktop-chat-session-store'
 import { suggestedFilename, uniqueDownloadPath } from '@/main/downloads'
@@ -1327,17 +1331,19 @@ export async function listAgentCookieSignals(): Promise<BrowserCookieSignal[]> {
  * here and is counted rather than being quietly relaxed.
  *
  * Failures are per-cookie: one rejected cookie must not cost the user the
- * rest. Nothing about a cookie is logged.
+ * rest. Nothing about a cookie is logged. Session cookies get the bounded
+ * lifetime from {@link withSessionCookieLifetime} so they survive a restart.
  */
 export async function importAgentCookies(
   cookies: CookiesSetDetails[]
 ): Promise<{ imported: number; failed: number }> {
   const jar = electronSession.fromPartition(AGENT_PARTITION).cookies
+  const nowSeconds = Date.now() / 1000
   let imported = 0
   let failed = 0
   for (const cookie of cookies) {
     try {
-      await jar.set(cookie)
+      await jar.set(withSessionCookieLifetime(cookie, nowSeconds))
       imported += 1
     } catch {
       failed += 1
@@ -1594,6 +1600,7 @@ const browserPermissions: BrowserPermissionHandlers = {
 function configureAgentPartition(ses: Session): void {
   if (configuredPartitions.has(ses)) return
   configuredPartitions.add(ses)
+  keepSessionCookiesAcrossRestarts(ses)
   ses.setPermissionRequestHandler(browserPermissions.request)
   ses.setPermissionCheckHandler(browserPermissions.check)
   ses.webRequest.onBeforeRequest((details, callback) => {

apps/desktop/src/test/electron-mock.ts

@@ -241,7 +241,7 @@ function createWebContentsMock() {
       setPermissionRequestHandler: vi.fn(),
       setPermissionCheckHandler: vi.fn(),
       setUserAgent: vi.fn(),
-      webRequest: { onBeforeRequest: vi.fn() },
+      webRequest: { onBeforeRequest: vi.fn(), onHeadersReceived: vi.fn() },
       on: vi.fn(),
     },
   }