@melaya/runner 1.0.21 → 1.0.24

package/dist/connection.js

@@ -19,6 +19,7 @@ import { join } from "path";
 import { tmpdir } from "os";
 import { startLocalRelay, setActiveProject } from "./localRelay.js";
 import { ensureSharedModules, getSharedDir } from "./sharedVendor.js";
+import { startLumaBrowserBridge } from "./lumaBrowserBridge.js";
 const HEARTBEAT_INTERVAL = 30_000;
 const activeProcesses = new Map();
 export async function connect(opts) {
@@ -36,6 +37,25 @@ export async function connect(opts) {
         reconnectionAttempts: Infinity,
     });
     let relay = null;
+    // Luma browser bridge — only started after a successful Luma sign-in
+    // (storage state file exists). Reset to a fresh bridge after each
+    // luma:login-result so cookie rotation is picked up immediately.
+    let lumaBridge = null;
+    const _ensureLumaBridge = async () => {
+        if (lumaBridge)
+            return;
+        try {
+            lumaBridge = await startLumaBrowserBridge({
+                log: (m) => {
+                    if (opts.verbose)
+                        console.log(chalk.gray(`  [luma-bridge] ${m}`));
+                },
+            });
+        }
+        catch (e) {
+            console.log(chalk.yellow(`  ⚠ Luma browser bridge failed to start: ${e?.message || e}`));
+        }
+    };
     socket.on("connect", async () => {
         spinner.succeed(chalk.green("Connected to Melaya"));
         // Report detected models
@@ -47,6 +67,10 @@ export async function connect(opts) {
                 console.log(chalk.gray(`  [relay] Listening on 127.0.0.1:${relay.port} (nonce: ${relay.nonce})`));
             }
         }
+        // Start the Luma browser bridge if a saved session exists. Best-
+        // effort — failure here means Luma POSTs fall back to aiohttp
+        // (which 403s under the bot rule) but reads still work.
+        await _ensureLumaBridge();
         console.log(chalk.gray("  Waiting for pipeline runs...\n"));
     });
     socket.on("connect_error", (err) => {
@@ -112,6 +136,16 @@ export async function connect(opts) {
                 OLLAMA_BASE_URL: "http://127.0.0.1:11434",
                 // Inject per-pipeline credentials (already scoped by the server)
                 ...payload.credentials,
+                // If a Luma browser bridge is up (i.e. the user has signed in
+                // via this runner), inject its localhost URL + bearer token so
+                // shared/tools/luma.py routes /event/register through Playwright
+                // and bypasses Cloudflare's bot rule. Reads keep using aiohttp.
+                ...(lumaBridge
+                    ? {
+                        MEL_LUMA_BROWSER_URL: lumaBridge.url,
+                        MEL_LUMA_BROWSER_TOKEN: lumaBridge.token,
+                    }
+                    : {}),
             };
             // Spawn Python subprocess
             const proc = spawn(opts.pythonPath, ["-u", join(runDir, "main.py")], {
@@ -207,6 +241,20 @@ export async function connect(opts) {
             const outcome = await runLumaLoginFlow(emitProgress);
             console.log(describeOutcome(outcome));
             socket.emit("luma:login-result", { session_id: sid, ...outcome });
+            // Successful sign-in just wrote a fresh storage-state.json. If the
+            // bridge is already up, force the next forward to re-read state
+            // from disk; if it isn't up (first sign-in on this runner), boot
+            // it now so the very next pipeline run has Cloudflare bypass.
+            if (outcome.ok) {
+                if (lumaBridge) {
+                    lumaBridge.invalidateState();
+                    if (opts.verbose)
+                        console.log(chalk.gray("  [luma-bridge] storage state invalidated; next call will re-read."));
+                }
+                else {
+                    await _ensureLumaBridge();
+                }
+            }
         }
         catch (e) {
             const msg = e?.message || "luma_login_unhandled_error";
@@ -240,6 +288,12 @@ export async function connect(opts) {
             socket.emit("runner:runComplete", { runId: id, status: "failed" });
         }
         relay?.close();
+        // Best-effort Chromium teardown. The bridge's shutdown is async but
+        // we can't await inside a SIGINT handler — fire and forget; the
+        // process.exit below kills any lingering child processes anyway.
+        if (lumaBridge) {
+            lumaBridge.shutdown().catch(() => { });
+        }
         socket.disconnect();
         process.exit(0);
     };

package/dist/lumaBrowserBridge.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Luma browser bridge — localhost HTTP server that tunnels HTTP requests
+ * through a Playwright Chromium context loaded from the user's saved
+ * Luma sign-in state.
+ *
+ * Why this exists
+ * ───────────────
+ *
+ * Cloudflare's bot rule on `POST /event/register` (and a handful of other
+ * write endpoints) is much stricter than on reads. It checks:
+ *   1. cf_clearance cookie issued by a managed challenge.
+ *   2. cf_bm cookie value freshly minted by JS executed on the page.
+ *   3. JA3/JA4 TLS fingerprint matching a real browser.
+ *   4. sec-ch-ua / sec-fetch-* header set matching same.
+ *
+ * Replaying cookies through aiohttp from Python misses #2-#4 and gets a
+ * 403 even with a valid session — see run cd0d03d05e684e0f. The reliable
+ * fix is to issue the request from inside the SAME Chromium context that
+ * captured the session: the JS runs, cookies refresh, headers and TLS
+ * fingerprint match, and the bot rule clears.
+ *
+ * How it works
+ * ────────────
+ *
+ * 1. At Luma sign-in, the Playwright `storageState` (full cookie jar +
+ *    localStorage + sessionStorage) is saved to `<runner-state-dir>/
+ *    luma-storage-state.json`. This is the source of truth for the
+ *    browser session — separate from the cookies persisted to the
+ *    server's DB (which feed the env-var path used by aiohttp reads).
+ * 2. At runner startup, if the storage-state file exists, this module
+ *    starts a small HTTP server bound to 127.0.0.1 on a random free
+ *    port, mints a per-session token, and exposes both via env vars
+ *    `MEL_LUMA_BROWSER_URL` + `MEL_LUMA_BROWSER_TOKEN` to the spawned
+ *    Python pipeline subprocess.
+ * 3. Python's `luma_register_event` POSTs the registration body to
+ *    `${MEL_LUMA_BROWSER_URL}/luma/forward` with
+ *    `Authorization: Bearer ${MEL_LUMA_BROWSER_TOKEN}`. The bridge:
+ *      a. Spawns / reuses a headless Chromium with the saved storage
+ *         state, freshly reloaded from disk so a recent reconnect's
+ *         cookies are picked up immediately.
+ *      b. Navigates to `https://luma.com/${eid}` so Cloudflare's JS
+ *         executes and refreshes cf_bm/cf_clearance.
+ *      c. Calls `fetch(url, init)` from inside `page.evaluate(...)`
+ *         so the request inherits the page's full browser context.
+ *      d. Returns `{ status, body }` to Python.
+ *
+ * Security
+ * ────────
+ *
+ * - Server binds to 127.0.0.1 only — never accessible off the host.
+ * - Random per-session token in the Authorization header — even other
+ *   processes on the same machine can't fire requests without it
+ *   (the env var is only injected into the runner-spawned pipeline
+ *   subprocess).
+ * - Endpoint is narrow: the URL must be a luma.com / api.luma.com /
+ *   api2.luma.com / lu.ma origin and the method must be GET / POST.
+ *   Anything else is rejected with 400.
+ * - Body size is capped at 64 KB.
+ *
+ * Cleanup
+ * ───────
+ *
+ * The browser is started lazily on the first request and torn down on
+ * runner exit. If the runner is killed mid-request, the next request
+ * relaunches.
+ */
+export interface LumaBrowserBridge {
+    url: string;
+    token: string;
+    shutdown: () => Promise<void>;
+    /** Called from connection.ts after a successful luma:login-result so
+     *  the next forward picks up the freshly-saved storage state. The
+     *  bridge always re-reads from disk, so this is purely a hint to
+     *  drop any reusable browser context (forces re-create on next call). */
+    invalidateState: () => void;
+}
+export declare function lumaStorageStatePath(): string;
+/**
+ * Starts the bridge if a saved Luma storage state exists. Returns null
+ * when no state is present so the runner stays in legacy aiohttp-only
+ * mode and Python's diagnostic path correctly reports
+ * `cf_cookies_present: []`.
+ */
+export declare function startLumaBrowserBridge(opts: {
+    log: (msg: string) => void;
+}): Promise<LumaBrowserBridge | null>;

package/dist/lumaBrowserBridge.js

@@ -0,0 +1,326 @@
+/**
+ * Luma browser bridge — localhost HTTP server that tunnels HTTP requests
+ * through a Playwright Chromium context loaded from the user's saved
+ * Luma sign-in state.
+ *
+ * Why this exists
+ * ───────────────
+ *
+ * Cloudflare's bot rule on `POST /event/register` (and a handful of other
+ * write endpoints) is much stricter than on reads. It checks:
+ *   1. cf_clearance cookie issued by a managed challenge.
+ *   2. cf_bm cookie value freshly minted by JS executed on the page.
+ *   3. JA3/JA4 TLS fingerprint matching a real browser.
+ *   4. sec-ch-ua / sec-fetch-* header set matching same.
+ *
+ * Replaying cookies through aiohttp from Python misses #2-#4 and gets a
+ * 403 even with a valid session — see run cd0d03d05e684e0f. The reliable
+ * fix is to issue the request from inside the SAME Chromium context that
+ * captured the session: the JS runs, cookies refresh, headers and TLS
+ * fingerprint match, and the bot rule clears.
+ *
+ * How it works
+ * ────────────
+ *
+ * 1. At Luma sign-in, the Playwright `storageState` (full cookie jar +
+ *    localStorage + sessionStorage) is saved to `<runner-state-dir>/
+ *    luma-storage-state.json`. This is the source of truth for the
+ *    browser session — separate from the cookies persisted to the
+ *    server's DB (which feed the env-var path used by aiohttp reads).
+ * 2. At runner startup, if the storage-state file exists, this module
+ *    starts a small HTTP server bound to 127.0.0.1 on a random free
+ *    port, mints a per-session token, and exposes both via env vars
+ *    `MEL_LUMA_BROWSER_URL` + `MEL_LUMA_BROWSER_TOKEN` to the spawned
+ *    Python pipeline subprocess.
+ * 3. Python's `luma_register_event` POSTs the registration body to
+ *    `${MEL_LUMA_BROWSER_URL}/luma/forward` with
+ *    `Authorization: Bearer ${MEL_LUMA_BROWSER_TOKEN}`. The bridge:
+ *      a. Spawns / reuses a headless Chromium with the saved storage
+ *         state, freshly reloaded from disk so a recent reconnect's
+ *         cookies are picked up immediately.
+ *      b. Navigates to `https://luma.com/${eid}` so Cloudflare's JS
+ *         executes and refreshes cf_bm/cf_clearance.
+ *      c. Calls `fetch(url, init)` from inside `page.evaluate(...)`
+ *         so the request inherits the page's full browser context.
+ *      d. Returns `{ status, body }` to Python.
+ *
+ * Security
+ * ────────
+ *
+ * - Server binds to 127.0.0.1 only — never accessible off the host.
+ * - Random per-session token in the Authorization header — even other
+ *   processes on the same machine can't fire requests without it
+ *   (the env var is only injected into the runner-spawned pipeline
+ *   subprocess).
+ * - Endpoint is narrow: the URL must be a luma.com / api.luma.com /
+ *   api2.luma.com / lu.ma origin and the method must be GET / POST.
+ *   Anything else is rejected with 400.
+ * - Body size is capped at 64 KB.
+ *
+ * Cleanup
+ * ───────
+ *
+ * The browser is started lazily on the first request and torn down on
+ * runner exit. If the runner is killed mid-request, the next request
+ * relaunches.
+ */
+import { createServer } from "node:http";
+import { randomBytes } from "node:crypto";
+import { promises as fs } from "node:fs";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import os from "node:os";
+const ALLOWED_HOSTNAMES = new Set([
+    "luma.com",
+    "www.luma.com",
+    "lu.ma",
+    "api.luma.com",
+    "api2.luma.com",
+]);
+const MAX_BODY_BYTES = 64 * 1024;
+const PAGE_GOTO_TIMEOUT_MS = 20_000;
+const PAGE_SETTLE_MS = 1500;
+// ── State-file location ─────────────────────────────────────────────────────
+/** Resolves the same `melaya-runner` state dir the rest of the runner uses.
+ *  We can't share a constant because connection.ts doesn't expose its dir,
+ *  but the convention is well-defined: ~/.melaya/<sub> on every OS. */
+function _stateDir() {
+    return path.join(os.homedir(), ".melaya", "luma");
+}
+export function lumaStorageStatePath() {
+    return path.join(_stateDir(), "storage-state.json");
+}
+// ── Public starter ──────────────────────────────────────────────────────────
+/**
+ * Starts the bridge if a saved Luma storage state exists. Returns null
+ * when no state is present so the runner stays in legacy aiohttp-only
+ * mode and Python's diagnostic path correctly reports
+ * `cf_cookies_present: []`.
+ */
+export async function startLumaBrowserBridge(opts) {
+    const statePath = lumaStorageStatePath();
+    if (!existsSync(statePath)) {
+        opts.log("Luma browser bridge: no saved storage state, skipping.");
+        return null;
+    }
+    // Lazy-load Playwright. If the user installed @melaya/runner without
+    // chromium ever being needed (e.g. legacy local-model only), we don't
+    // want to crash on startup.
+    let playwright;
+    try {
+        playwright = await import("playwright");
+    }
+    catch {
+        opts.log("Luma browser bridge: playwright module unavailable, skipping.");
+        return null;
+    }
+    const token = randomBytes(24).toString("hex");
+    // Persistent browser handle. We launch on first request, not at boot,
+    // so the Chromium binary cost (~250 MB resident) is only paid by users
+    // who actually run a Luma pipeline. Subsequent requests reuse the
+    // browser; only the per-call context is fresh.
+    let browser = null;
+    let browserLaunching = null;
+    let stateMtime = 0;
+    async function _ensureBrowser() {
+        if (browser && browser.isConnected())
+            return browser;
+        if (browserLaunching)
+            return browserLaunching;
+        browserLaunching = (async () => {
+            const b = await playwright.chromium.launch({
+                headless: true,
+                args: [
+                    "--disable-blink-features=AutomationControlled",
+                    "--disable-dev-shm-usage",
+                ],
+            });
+            browser = b;
+            browserLaunching = null;
+            return b;
+        })();
+        return browserLaunching;
+    }
+    async function _readStorageState() {
+        const stat = await fs.stat(statePath);
+        stateMtime = stat.mtimeMs;
+        const txt = await fs.readFile(statePath, "utf-8");
+        return JSON.parse(txt);
+    }
+    async function _forward(req) {
+        let parsed;
+        try {
+            parsed = new URL(req.url);
+        }
+        catch {
+            return { ok: false, status: 0, body: "", error: "invalid_url" };
+        }
+        if (!ALLOWED_HOSTNAMES.has(parsed.hostname)) {
+            return { ok: false, status: 0, body: "", error: `host_not_allowed: ${parsed.hostname}` };
+        }
+        const method = (req.method || "POST").toUpperCase();
+        if (method !== "GET" && method !== "POST") {
+            return { ok: false, status: 0, body: "", error: `method_not_allowed: ${method}` };
+        }
+        const b = await _ensureBrowser();
+        let ctx = null;
+        try {
+            const storageState = await _readStorageState();
+            ctx = await b.newContext({
+                storageState: storageState,
+                userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 " +
+                    "(KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36",
+                viewport: { width: 1280, height: 820 },
+            });
+            const page = await ctx.newPage();
+            const warmup = req.warmupUrl || `https://luma.com/`;
+            try {
+                await page.goto(warmup, {
+                    waitUntil: "domcontentloaded",
+                    timeout: req.navigationTimeoutMs || PAGE_GOTO_TIMEOUT_MS,
+                });
+            }
+            catch (e) {
+                // Don't fail the whole request — Cloudflare 403s during goto can
+                // happen for events that return 404 on the web shell but accept
+                // the API POST. Surface the error and keep going.
+                opts.log(`[luma-bridge] warmup goto failed (${e?.message || e}); proceeding to fetch.`);
+            }
+            // Settle: let the page's JS finish (Cloudflare token refresh, etc.)
+            await page.waitForTimeout(PAGE_SETTLE_MS);
+            // Fire the request from INSIDE the page so JA3 + headers + cookies
+            // are all browser-native. We pass init through page.evaluate so we
+            // don't have to maintain a parallel header set in this module.
+            const init = {
+                url: req.url,
+                method,
+                headers: req.headers,
+                body: typeof req.body === "string" ? req.body : (req.body ? JSON.stringify(req.body) : undefined),
+            };
+            const result = await page.evaluate(async (init) => {
+                const fetchInit = {
+                    method: init.method,
+                    headers: init.headers,
+                    credentials: "include",
+                };
+                if (init.body !== undefined)
+                    fetchInit.body = init.body;
+                const r = await fetch(init.url, fetchInit);
+                const text = await r.text();
+                return { status: r.status, body: text };
+            }, init);
+            return { ok: true, status: result.status, body: result.body };
+        }
+        catch (e) {
+            return { ok: false, status: 0, body: "", error: `bridge_error: ${e?.message || e}` };
+        }
+        finally {
+            if (ctx) {
+                try {
+                    await ctx.close();
+                }
+                catch { /* ignore */ }
+            }
+        }
+    }
+    // ── HTTP server ──────────────────────────────────────────────────────────
+    const server = createServer(async (req, res) => {
+        res.setHeader("X-Frame-Options", "DENY");
+        res.setHeader("Cache-Control", "no-store");
+        if (req.method !== "POST") {
+            res.statusCode = 405;
+            res.end(JSON.stringify({ ok: false, error: "method_not_allowed" }));
+            return;
+        }
+        // Auth — bearer token must match what we minted. Reject any request
+        // missing or mismatched. Drop in constant time isn't critical for
+        // local-only IPC but cheap to do anyway.
+        const auth = String(req.headers["authorization"] || "");
+        const expected = `Bearer ${token}`;
+        if (auth.length !== expected.length || auth !== expected) {
+            res.statusCode = 401;
+            res.end(JSON.stringify({ ok: false, error: "unauthorized" }));
+            return;
+        }
+        if (req.url !== "/luma/forward") {
+            res.statusCode = 404;
+            res.end(JSON.stringify({ ok: false, error: "not_found" }));
+            return;
+        }
+        // Read JSON body with a hard size cap.
+        const chunks = [];
+        let total = 0;
+        let oversized = false;
+        for await (const chunk of req) {
+            total += chunk.length;
+            if (total > MAX_BODY_BYTES) {
+                oversized = true;
+                break;
+            }
+            chunks.push(chunk);
+        }
+        if (oversized) {
+            res.statusCode = 413;
+            res.end(JSON.stringify({ ok: false, error: "payload_too_large" }));
+            return;
+        }
+        let payload;
+        try {
+            payload = JSON.parse(Buffer.concat(chunks).toString("utf-8"));
+        }
+        catch {
+            res.statusCode = 400;
+            res.end(JSON.stringify({ ok: false, error: "invalid_json" }));
+            return;
+        }
+        if (!payload || typeof payload !== "object" || !payload.url) {
+            res.statusCode = 400;
+            res.end(JSON.stringify({ ok: false, error: "missing_url" }));
+            return;
+        }
+        const out = await _forward(payload);
+        res.statusCode = 200;
+        res.setHeader("Content-Type", "application/json");
+        res.end(JSON.stringify(out));
+    });
+    // Bind to 127.0.0.1 with port 0 — OS picks a free port. Promise resolves
+    // after listen() so we can return the URL.
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => resolve());
+    });
+    const addr = server.address();
+    if (!addr || typeof addr === "string") {
+        server.close();
+        return null;
+    }
+    // Read the state mtime upfront so invalidateState() has a baseline.
+    try {
+        const stat = await fs.stat(statePath);
+        stateMtime = stat.mtimeMs;
+    }
+    catch { /* ignore */ }
+    opts.log(`Luma browser bridge ready on http://127.0.0.1:${addr.port} (storage state from ${new Date(stateMtime).toISOString()}).`);
+    return {
+        url: `http://127.0.0.1:${addr.port}`,
+        token,
+        shutdown: async () => {
+            try {
+                server.close();
+            }
+            catch { /* ignore */ }
+            if (browser) {
+                try {
+                    await browser.close();
+                }
+                catch { /* ignore */ }
+            }
+        },
+        invalidateState: () => {
+            // Force a fresh context on the next call. We don't tear down the
+            // browser itself — just the cached state mtime so the next read
+            // re-loads from disk.
+            stateMtime = 0;
+        },
+    };
+}

package/dist/lumaLogin.d.ts

@@ -27,6 +27,7 @@ export interface LumaLoginResult {
         auth_session_key: string;
         user_id?: string;
     };
+    extraCookies?: Record<string, string>;
     profileName?: string;
 }
 export interface LumaLoginError {

package/dist/lumaLogin.js

@@ -133,14 +133,39 @@ export async function runLumaLoginFlow(progress) {
         if (!succeeded) {
             return { ok: false, error: "login_timeout", detail: "5-minute sign-in window expired." };
         }
-        // Cookie names captured 2026-05-01 from luma.com after signin:
-        //   luma.auth-session-key  — required for every api2.luma.com call
-        //   luma.user-id           — informational, lets tools short-circuit /me
-        // Read both luma.com and api2.luma.com cookies — the session is shared
-        // across both subdomains via the registrable parent.
+        // Cookie names we replay on every api2.luma.com call:
+        //   luma.auth-session-key  — load-bearing session token (required)
+        //   luma.user-id           — informational; short-circuits /me lookups
+        //   cf_clearance           — Cloudflare bot-challenge clearance token.
+        //                            Issued only after a Turnstile / managed
+        //                            challenge passes. Reads work without it
+        //                            (served from CF edge cache); WRITES like
+        //                            POST /event/register fail with 403 when
+        //                            it's absent — see run cd0d03d05e684e0f.
+        //   __cf_bm                — Cloudflare bot-management cookie. Rotates
+        //                            every ~30min; not strictly required but
+        //                            having it reduces the false-positive rate
+        //                            on the bot heuristic.
+        //   _cfuvid                — Cloudflare unique-visitor id; same role.
+        // Cookies are scoped to luma.com / lu.ma / api.luma.com — Playwright's
+        // context.cookies() returns them all; we filter by name, not domain.
         const allCookies = await context.cookies();
         const auth_c = allCookies.find((c) => c.name === "luma.auth-session-key");
         const uid_c = allCookies.find((c) => c.name === "luma.user-id");
+        const CLOUDFLARE_COOKIE_NAMES = ["cf_clearance", "__cf_bm", "_cfuvid"];
+        const extraCookies = {};
+        for (const name of CLOUDFLARE_COOKIE_NAMES) {
+            // Pick the most-recently-set value (Playwright orders by insertion
+            // but a single name can have multiple entries across subdomains).
+            // The api2.luma.com one takes priority since that's the request
+            // target; fall back to luma.com if api isn't set yet.
+            const matches = allCookies.filter((c) => c.name === name);
+            const apiCookie = matches.find((c) => c.domain.includes("api.luma.com") || c.domain.includes("api2.luma.com"));
+            const webCookie = matches.find((c) => c.domain.endsWith("luma.com") || c.domain.endsWith("lu.ma"));
+            const picked = apiCookie?.value || webCookie?.value || matches[0]?.value;
+            if (picked)
+                extraCookies[name] = picked;
+        }
         if (!auth_c?.value) {
             return {
                 ok: false, error: "cookies_not_found",
@@ -161,12 +186,37 @@ export async function runLumaLoginFlow(progress) {
             });
         }
         catch { /* swallow */ }
-        progress(profileName ? `Captured session for ${profileName}.` : "Captured session.");
+        const cfNames = Object.keys(extraCookies);
+        const cfSummary = cfNames.length > 0 ? ` + ${cfNames.length} Cloudflare cookie${cfNames.length > 1 ? "s" : ""} (${cfNames.join(", ")})` : "";
+        // Persist the FULL Playwright storage state so the runner's browser
+        // bridge (lumaBrowserBridge.ts) can replay the same session for
+        // bot-rule-gated POSTs like /event/register. Cookies alone aren't
+        // enough — Cloudflare also fingerprints cf_bm freshness, JS
+        // execution, headers, and TLS — all of which the bridge gets for
+        // free by reusing this state inside a real Chromium context.
+        let bridgeStateNote = "";
+        try {
+            const path = await import("node:path");
+            const os = await import("node:os");
+            const fs = await import("node:fs/promises");
+            const stateDir = path.join(os.homedir(), ".melaya", "luma");
+            const statePath = path.join(stateDir, "storage-state.json");
+            await fs.mkdir(stateDir, { recursive: true });
+            // Playwright's storageState() returns cookies + localStorage +
+            // sessionStorage + indexedDB-flavored entries. We persist as-is.
+            await context.storageState({ path: statePath });
+            bridgeStateNote = " · browser session saved for bot-rule bypass";
+        }
+        catch (e) {
+            bridgeStateNote = ` · WARN: could not save browser session (${e?.message || e})`;
+        }
+        progress((profileName ? `Captured session for ${profileName}` : "Captured session") + cfSummary + bridgeStateNote + ".");
         await context.close();
         await browser.close();
         return {
             ok: true,
             cookies: { auth_session_key: auth_c.value, user_id: uid_c?.value },
+            extraCookies: Object.keys(extraCookies).length > 0 ? extraCookies : undefined,
             profileName,
         };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.0.21",
+  "version": "1.0.24",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,