doordash-cli 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -9,6 +9,18 @@ All notable changes to `doordash-cli` will be documented in this file.
 
 See [docs/releasing.md](docs/releasing.md) for the maintainer release flow.
 
+## [0.4.2](https://github.com/LatencyTDH/doordash-cli/compare/v0.4.1...v0.4.2) (2026-04-10)
+
+### Bug Fixes
+
+* import signed-in linux browser profile state for login reuse ([#40](https://github.com/LatencyTDH/doordash-cli/issues/40)) ([97feddc](https://github.com/LatencyTDH/doordash-cli/commit/97feddc68ce0ebc882737dfad69d5e908f20d250))
+
+## [0.4.1](https://github.com/LatencyTDH/doordash-cli/compare/v0.4.0...v0.4.1) (2026-04-10)
+
+### Bug Fixes
+
+* bound auth-check and restore login completion flow ([#39](https://github.com/LatencyTDH/doordash-cli/issues/39)) ([5166944](https://github.com/LatencyTDH/doordash-cli/commit/51669444dc124e39ece719624c997ab9f46acd93))
+
 ## [0.4.0](https://github.com/LatencyTDH/doordash-cli/compare/v0.3.3...v0.4.0) (2026-04-10)
 
 ### Features

package/README.md

@@ -9,7 +9,7 @@ It stops before checkout.
 ## Highlights
 
 - **Cart-safe by design** — browse, inspect existing orders, and manage a cart; no checkout, payment, or order mutation.
-- **Browser-first login** — `dd-cli login` reuses saved local auth or a discoverable signed-in browser session when possible, and otherwise opens a temporary login window.
+- **Browser-first login** — `dd-cli login` reuses saved local auth, then same-machine Linux Brave/Chrome profile state, then attachable signed-in browser sessions when possible, and otherwise opens a temporary login window.
 - **Direct API first** — auth, discovery, existing-order, and cart commands use DoorDash consumer-web GraphQL/HTTP rather than DOM clicking.
 - **JSON-friendly** — every command prints structured output.
 - **Fail-closed** — unsupported commands, flags, or unsafe payload shapes are rejected.
@@ -70,13 +70,13 @@ If you are running from a checkout without `npm link`, replace `doordash-cli` wi
 
 ## Login and session reuse
 
-`login` reuses saved local auth when it is still valid. Otherwise it tries to import a discoverable signed-in browser session. If neither is available, it opens a temporary Chromium login window and saves the session there. If authentication still is not established, `login` exits non-zero.
+`login` reuses saved local auth when it is still valid. Otherwise it first tries to import signed-in same-machine Linux Brave/Chrome profile state, then falls back to a discoverable attachable signed-in browser session, and finally opens a temporary Chromium login window it can watch directly. If authentication still is not established, `login` exits non-zero.
 
-`auth-check` reports whether the saved state appears logged in and can quietly import a discoverable signed-in browser session unless `logout` disabled that auto-reuse.
+`auth-check` reports whether the saved state appears logged in and can quietly import same-machine Linux Brave/Chrome profile state or a discoverable attachable signed-in browser session unless `logout` disabled that auto-reuse.
 
-`logout` clears persisted cookies and stored browser state, then keeps automatic browser-session reuse disabled until you explicitly run `dd-cli login` again.
+`logout` clears persisted cookies and stored browser state, then keeps passive browser-session reuse disabled until your next explicit `dd-cli login` attempt.
 
-If `login` opens a temporary Chromium window, finish signing in there and let the CLI save the session. If you expect reuse from another browser, make sure it exposes a compatible CDP endpoint, then rerun `dd-cli login`.
+If `login` opens a temporary Chromium window, the CLI now keeps checking automatically and also tells you that you can press Enter to force an immediate recheck once the page already shows you are signed in. That restores the old effective manual-completion path without giving up automatic completion when it works. On Linux, a signed-in local Brave or Google Chrome profile on the same machine is the preferred browser-reuse path and does not need CDP/remote debugging. If that same-machine profile import is unavailable or not signed in, the next reuse path is an attachable browser automation session.
 
 ## Command surface
 

package/dist/cli.js

@@ -42,10 +42,11 @@ export function usage() {
         "  - Installed command names are lowercase only: dd-cli and doordash-cli.",
         "  - install-browser downloads the bundled Playwright Chromium runtime used when the CLI needs a local browser.",
         "  - Manual pages ship with the project: man dd-cli or man doordash-cli.",
-        "  - login reuses saved local auth when possible, otherwise imports a signed-in browser session or opens a temporary Chromium login window.",
+        "  - login reuses saved local auth when possible, otherwise first tries same-machine Linux Brave/Chrome profile import, then attachable signed-in browser sessions, then a temporary Chromium login window.",
+        "  - login auto-detects completion when it can; in the temporary-browser fallback you can also press Enter to force an immediate recheck once the page shows you are signed in.",
         "  - login exits non-zero if authentication is still not established.",
-        "  - auth-check reports saved-session status and can quietly reuse/import a signed-in browser session unless logout disabled that auto-reuse.",
-        "  - logout clears saved session files and keeps automatic browser-session reuse off until the next login.",
+        "  - auth-check reports saved-session status and can quietly reuse/import same-machine Linux Brave/Chrome profile state or an attachable signed-in browser session unless logout disabled that auto-reuse.",
+        "  - logout clears saved session files and keeps passive browser-session reuse off until the next explicit login attempt.",
         "  - configurable items require explicit --options-json selections.",
         "  - unsupported option trees fail closed.",
         "",

package/dist/cli.test.js

@@ -113,10 +113,11 @@ test("help output shows the direct read-only/cart-safe command surface", () => {
     assert.match(result.stdout, /options-json/);
     assert.match(result.stdout, /--version, -v/);
     assert.match(result.stdout, /man dd-cli/);
-    assert.match(result.stdout, /login reuses saved local auth when possible, otherwise imports a signed-in browser session or opens a temporary Chromium login window\./);
+    assert.match(result.stdout, /login reuses saved local auth when possible, otherwise first tries same-machine Linux Brave\/Chrome profile import, then attachable signed-in browser sessions, then a temporary Chromium login window\./);
+    assert.match(result.stdout, /login auto-detects completion when it can; in the temporary-browser fallback you can also press Enter to force an immediate recheck once the page shows you are signed in\./);
     assert.match(result.stdout, /login exits non-zero if authentication is still not established\./);
-    assert.match(result.stdout, /auth-check reports saved-session status and can quietly reuse\/import a signed-in browser session unless logout disabled that auto-reuse\./);
-    assert.match(result.stdout, /logout clears saved session files and keeps automatic browser-session reuse off until the next login\./);
+    assert.match(result.stdout, /auth-check reports saved-session status and can quietly reuse\/import same-machine Linux Brave\/Chrome profile state or an attachable signed-in browser session unless logout disabled that auto-reuse\./);
+    assert.match(result.stdout, /logout clears saved session files and keeps passive browser-session reuse off until the next explicit login attempt\./);
     assert.match(result.stdout, /Out-of-scope commands remain intentionally unsupported/);
     assert.doesNotMatch(result.stdout, /auth-bootstrap/);
     assert.doesNotMatch(result.stdout, /auth-clear/);
@@ -130,8 +131,9 @@ test("repository ships man pages for the supported lowercase command names", ()
     assert.match(readFileSync(ddManPath, "utf8"), /\.B login/);
     assert.doesNotMatch(readFileSync(ddManPath, "utf8"), /auth-bootstrap/);
     assert.doesNotMatch(readFileSync(ddManPath, "utf8"), /auth-clear/);
-    assert.match(readFileSync(ddManPath, "utf8"), /automatic\s+browser-session reuse stays disabled until the next explicit/i);
-    assert.match(readFileSync(ddManPath, "utf8"), /temporary Chromium.*window/i);
+    assert.match(readFileSync(ddManPath, "utf8"), /passive\s+browser-session reuse stays disabled until the next explicit/i);
+    assert.match(readFileSync(ddManPath, "utf8"), /same-machine Linux Brave\/Chrome browser profile/i);
+    assert.match(readFileSync(ddManPath, "utf8"), /temporary\s+Chromium\s+window/i);
     assert.doesNotMatch(readFileSync(ddManPath, "utf8"), /Dd-cli/);
     assert.equal(readFileSync(aliasManPath, "utf8").trim(), ".so man1/dd-cli.1");
 });

package/dist/direct-api.d.ts

@@ -24,6 +24,16 @@ export type AuthBootstrapResult = (AuthResult & {
     isLoggedIn: false;
     message: string;
 });
+type ManagedBrowserLoginResult = {
+    status: "completed";
+    completion: "automatic" | "manual";
+    auth: AuthResult;
+} | {
+    status: "timed-out";
+    auth: AuthResult;
+} | {
+    status: "launch-failed";
+};
 export type SearchRestaurantResult = {
     id: string;
     name: string;
@@ -469,6 +479,7 @@ type BootstrapAuthSessionDeps = {
     markBrowserImportAttempted: () => void;
     getAttachedBrowserCdpCandidates: () => Promise<string[]>;
     getReachableCdpCandidates: (candidates: string[]) => Promise<string[]>;
+    describeDesktopBrowserReuseGap: () => Promise<string | null>;
     openUrlInAttachedBrowser: (input: {
         cdpUrl: string;
         targetUrl: string;
@@ -482,7 +493,9 @@ type BootstrapAuthSessionDeps = {
         targetUrl: string;
         timeoutMs: number;
         pollIntervalMs: number;
-    }) => Promise<AuthResult | null>;
+        log: (message: string) => void;
+    }) => Promise<ManagedBrowserLoginResult>;
+    canPromptForManagedBrowserConfirmation: () => boolean;
     checkAuthDirect: () => Promise<AuthResult>;
     log: (message: string) => void;
 };
@@ -557,11 +570,17 @@ export declare function selectAttachedBrowserImportMode(input: {
     pageUrls: readonly string[];
     cookies: ReadonlyArray<Pick<Cookie, "domain">>;
 }): "page" | "cookies" | "skip";
+export type BrowserSessionImportStrategy = "local-linux-chromium-profile" | "attached-browser-cdp";
+export declare function preferredBrowserSessionImportStrategies(platform: NodeJS.Platform): readonly BrowserSessionImportStrategy[];
 export declare function resolveAttachedBrowserCdpCandidates(env: NodeJS.ProcessEnv, configCandidates?: string[]): string[];
 export declare function resolveSystemBrowserOpenCommand(targetUrl: string, targetPlatform?: NodeJS.Platform): {
     command: string;
     args: string[];
 } | null;
+export declare function summarizeDesktopBrowserReuseGap(input: {
+    processCommands: readonly string[];
+    hasAnyDevToolsActivePort: boolean;
+}): string | null;
 export declare function parseSearchRestaurants(body: unknown[]): SearchRestaurantResult[];
 export declare function parseSearchRestaurantRow(entry: unknown): SearchRestaurantResult | null;
 export declare function parseExistingOrderLifecycleStatus(orderRoot: unknown): ExistingOrderLifecycleStatus;