doordash-cli 0.4.0 → 0.4.2

package/dist/direct-api.js

@@ -2,6 +2,7 @@ import { spawn } from "node:child_process";
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
+import { createInterface } from "node:readline";
 import { chromium } from "playwright";
 import { getBrowserImportBlockPath, getCookiesPath, getStorageStatePath } from "./session-storage.js";
 const BASE_URL = "https://www.doordash.com";
@@ -9,7 +10,168 @@ const AUTH_BOOTSTRAP_URL = `${BASE_URL}/home`;
 const AUTH_BOOTSTRAP_TIMEOUT_MS = 180_000;
 const AUTH_BOOTSTRAP_POLL_INTERVAL_MS = 2_000;
 const AUTH_BOOTSTRAP_NO_DISCOVERY_GRACE_MS = 10_000;
+const ATTACHED_BROWSER_CDP_REACHABILITY_TIMEOUT_MS = 2_000;
+const ATTACHED_BROWSER_CDP_CONNECT_TIMEOUT_MS = 5_000;
 const DEFAULT_USER_AGENT = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36";
+const LINUX_CHROMIUM_COOKIE_IMPORT_SCRIPT = String.raw `
+import json
+import os
+import sqlite3
+import hashlib
+import sys
+
+try:
+    import secretstorage
+    from Crypto.Cipher import AES
+except Exception as exc:
+    raise SystemExit(f"missing python support for Chromium cookie import: {exc}")
+
+browser_label = os.environ.get("DD_BROWSER_LABEL", "Chromium")
+user_data_dir = os.environ.get("DD_BROWSER_USER_DATA_DIR", "")
+safe_storage_application = os.environ.get("DD_BROWSER_SAFE_STORAGE_APP", "")
+
+if not user_data_dir or not safe_storage_application:
+    raise SystemExit("missing browser metadata")
+
+
+def chromium_utc_to_unix_seconds(value):
+    if not value:
+        return -1
+    return max(-1, (int(value) / 1000000) - 11644473600)
+
+
+def samesite_to_playwright(value):
+    mapping = {
+        -1: "Lax",
+        0: "None",
+        1: "Lax",
+        2: "Strict",
+    }
+    try:
+        return mapping.get(int(value), "Lax")
+    except Exception:
+        return "Lax"
+
+
+def get_safe_storage_secret(application):
+    bus = secretstorage.dbus_init()
+    for collection in secretstorage.get_all_collections(bus):
+        for item in collection.get_all_items():
+            attrs = item.get_attributes()
+            if attrs.get("xdg:schema") == "chrome_libsecret_os_crypt_password_v2" and attrs.get("application") == application:
+                secret = item.get_secret()
+                return secret.decode("utf-8") if isinstance(secret, bytes) else str(secret)
+    return None
+
+
+def decrypt_cookie_value(encrypted_value, host_key, secret):
+    payload = encrypted_value[3:] if encrypted_value.startswith((b"v10", b"v11")) else encrypted_value
+    key = hashlib.pbkdf2_hmac("sha1", secret.encode("utf-8"), b"saltysalt", 1, dklen=16)
+    decrypted = AES.new(key, AES.MODE_CBC, b" " * 16).decrypt(payload)
+    pad = decrypted[-1]
+    if isinstance(pad, str):
+        pad = ord(pad)
+    if 1 <= pad <= 16:
+        decrypted = decrypted[:-pad]
+    host_hash = hashlib.sha256(host_key.encode("utf-8")).digest()
+    if decrypted.startswith(host_hash):
+        decrypted = decrypted[len(host_hash):]
+    return decrypted.decode("utf-8")
+
+
+def profile_names_for_user_data_dir(root):
+    local_state_path = os.path.join(root, "Local State")
+    entries = []
+    try:
+        with open(local_state_path, "r", encoding="utf-8") as handle:
+            info_cache = ((json.load(handle).get("profile") or {}).get("info_cache") or {})
+        for profile_name, info in info_cache.items():
+            if not isinstance(profile_name, str) or not profile_name.strip():
+                continue
+            active_time = 0.0
+            if isinstance(info, dict):
+                try:
+                    active_time = float(info.get("active_time") or 0)
+                except Exception:
+                    active_time = 0.0
+            entries.append((0 if profile_name == "Default" else 1, -active_time, profile_name))
+    except Exception:
+        pass
+
+    entries.sort()
+    names = [profile_name for _, _, profile_name in entries]
+    if "Default" not in names:
+        names.append("Default")
+    return names
+
+
+safe_storage_secret = get_safe_storage_secret(safe_storage_application)
+if not safe_storage_secret:
+    print("[]")
+    raise SystemExit(0)
+
+imports = []
+for profile_name in profile_names_for_user_data_dir(user_data_dir):
+    cookies_db_path = os.path.join(user_data_dir, profile_name, "Cookies")
+    if not os.path.exists(cookies_db_path):
+        continue
+
+    connection = None
+    try:
+        connection = sqlite3.connect(f"file:{cookies_db_path}?mode=ro", uri=True)
+        cursor = connection.cursor()
+        rows = cursor.execute(
+            """
+            select host_key, name, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite
+            from cookies
+            where host_key like '%doordash%'
+            order by host_key, name
+            """
+        ).fetchall()
+    except Exception:
+        if connection is not None:
+            connection.close()
+        continue
+
+    cookies = []
+    for host_key, name, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite in rows:
+        try:
+            decrypted_value = decrypt_cookie_value(encrypted_value, host_key, safe_storage_secret)
+        except Exception:
+            continue
+        cookies.append({
+            "name": name,
+            "value": decrypted_value,
+            "domain": host_key,
+            "path": path or "/",
+            "expires": chromium_utc_to_unix_seconds(expires_utc),
+            "httpOnly": bool(is_httponly),
+            "secure": bool(is_secure),
+            "sameSite": samesite_to_playwright(samesite),
+        })
+
+    connection.close()
+    if cookies:
+        imports.append({
+            "browserLabel": browser_label,
+            "profileName": profile_name,
+            "cookies": cookies,
+        })
+
+print(json.dumps(imports))
+`;
+const LINUX_CHROMIUM_COOKIE_IMPORT_BROWSERS = [
+    {
+        browserLabel: "Brave",
+        safeStorageApplication: "brave",
+        userDataDir: join(homedir(), ".config", "BraveSoftware", "Brave-Browser"),
+    },
+    {
+        browserLabel: "Google Chrome",
+        safeStorageApplication: "chrome",
+        userDataDir: join(homedir(), ".config", "google-chrome"),
+    },
+];
 const GRAPHQL_HEADERS = {
     accept: "*/*",
     "content-type": "application/json",
@@ -864,6 +1026,42 @@ function buildAuthBootstrapFailure(auth, message) {
         message,
     };
 }
+function canPromptForManagedBrowserConfirmation() {
+    return Boolean(process.stdin.isTTY);
+}
+function createManagedBrowserManualConfirmationHandle() {
+    if (!canPromptForManagedBrowserConfirmation()) {
+        return {
+            isEnabled: false,
+            consumeRequested: () => false,
+            close: () => { },
+        };
+    }
+    const rl = createInterface({
+        input: process.stdin,
+        output: process.stderr,
+        terminal: true,
+    });
+    let requested = false;
+    const onLine = () => {
+        requested = true;
+    };
+    rl.on("line", onLine);
+    return {
+        isEnabled: true,
+        consumeRequested: () => {
+            if (!requested) {
+                return false;
+            }
+            requested = false;
+            return true;
+        },
+        close: () => {
+            rl.off("line", onLine);
+            rl.close();
+        },
+    };
+}
 export async function checkAuthDirect() {
     const data = await session.graphql("consumer", CONSUMER_QUERY, {});
     return buildAuthResult(data.consumer ?? null);
@@ -891,11 +1089,11 @@ export async function bootstrapAuthSessionWithDeps(deps) {
         });
         const openedDefaultBrowser = openedAttachedBrowser ? false : await deps.openUrlInDefaultBrowser(AUTH_BOOTSTRAP_URL);
         deps.log(openedAttachedBrowser
-            ? `Opened DoorDash in the reusable browser session I'm watching: ${AUTH_BOOTSTRAP_URL}`
+            ? `Opened DoorDash in the attachable browser session I'm watching: ${AUTH_BOOTSTRAP_URL}`
             : openedDefaultBrowser
-                ? `Found a reusable browser connection, but couldn't drive it directly, so I opened DoorDash in your default browser: ${AUTH_BOOTSTRAP_URL}`
-                : `Detected a reusable browser connection, but couldn't open DoorDash automatically. Open this URL in that watched browser to continue: ${AUTH_BOOTSTRAP_URL}`);
-        deps.log(`Detected ${reachableCandidates.length} reusable browser connection(s). Finish the sign-in in that browser window and I'll import it automatically for up to ${Math.round(AUTH_BOOTSTRAP_TIMEOUT_MS / 1000)} seconds.`);
+                ? `Found an attachable browser session, but couldn't drive it directly, so I opened DoorDash in your default browser: ${AUTH_BOOTSTRAP_URL}`
+                : `Detected an attachable browser session, but couldn't open DoorDash automatically. Open this URL in that watched browser to continue: ${AUTH_BOOTSTRAP_URL}`);
+        deps.log(`Detected ${reachableCandidates.length} attachable browser session(s). Finish the sign-in in that browser window and I'll import it automatically for up to ${Math.round(AUTH_BOOTSTRAP_TIMEOUT_MS / 1000)} seconds.`);
         const importedAfterWait = await deps.waitForAttachedBrowserSessionImport({
             timeoutMs: AUTH_BOOTSTRAP_TIMEOUT_MS,
             pollIntervalMs: AUTH_BOOTSTRAP_POLL_INTERVAL_MS,
@@ -903,29 +1101,43 @@ export async function bootstrapAuthSessionWithDeps(deps) {
         const auth = await deps.checkAuthDirect();
         if (importedAfterWait) {
             return auth.isLoggedIn
-                ? buildAuthBootstrapSuccess(auth, "Opened DoorDash in a reusable browser session, detected the signed-in consumer state, and saved it for direct API use.")
+                ? buildAuthBootstrapSuccess(auth, "Opened DoorDash in an attachable browser session, detected the signed-in consumer state, and saved it for direct API use.")
                 : buildAuthBootstrapFailure(auth, "Detected browser session state in the watched browser, but the consumer still appears logged out or guest-only.");
         }
         return buildAuthBootstrapFailure(auth, openedAttachedBrowser || openedDefaultBrowser
-            ? `Opened DoorDash and watched reusable browser connections for ${Math.round(AUTH_BOOTSTRAP_TIMEOUT_MS / 1000)} seconds, but no signed-in DoorDash session was imported. Finish the login in that watched browser and rerun dd-cli login.`
-            : `Watched reusable browser connections for ${Math.round(AUTH_BOOTSTRAP_TIMEOUT_MS / 1000)} seconds without importing a signed-in DoorDash session. Open ${AUTH_BOOTSTRAP_URL} manually in the watched browser, finish signing in, then rerun dd-cli login.`);
-    }
-    deps.log("I couldn't find a reusable browser connection, so I'm opening a temporary Chromium login window that the CLI can watch directly.");
+            ? `Opened DoorDash and watched attachable browser sessions for ${Math.round(AUTH_BOOTSTRAP_TIMEOUT_MS / 1000)} seconds, but no signed-in DoorDash session was imported. Finish the login in that watched browser and rerun dd-cli login.`
+            : `Watched attachable browser sessions for ${Math.round(AUTH_BOOTSTRAP_TIMEOUT_MS / 1000)} seconds without importing a signed-in DoorDash session. Open ${AUTH_BOOTSTRAP_URL} manually in the watched browser, finish signing in, then rerun dd-cli login.`);
+    }
+    const desktopBrowserReuseGap = await deps.describeDesktopBrowserReuseGap().catch(() => null);
+    if (desktopBrowserReuseGap) {
+        deps.log(desktopBrowserReuseGap);
+    }
+    const manualManagedConfirmationAvailable = deps.canPromptForManagedBrowserConfirmation();
+    deps.log("I couldn't find an attachable browser session I can reuse, so I'm opening a temporary Chromium login window that the CLI can watch directly.");
+    deps.log(manualManagedConfirmationAvailable
+        ? `Finish signing in in that window. I'll keep checking automatically for up to ${Math.round(AUTH_BOOTSTRAP_TIMEOUT_MS / 1000)} seconds. If the page already shows you're signed in and the CLI still hasn't finished, press Enter here to force an immediate recheck.`
+        : `Finish signing in in that window. I'll keep checking automatically for up to ${Math.round(AUTH_BOOTSTRAP_TIMEOUT_MS / 1000)} seconds.`);
     const managedAuth = await deps.waitForManagedBrowserLogin({
         targetUrl: AUTH_BOOTSTRAP_URL,
         timeoutMs: AUTH_BOOTSTRAP_TIMEOUT_MS,
         pollIntervalMs: AUTH_BOOTSTRAP_POLL_INTERVAL_MS,
+        log: deps.log,
     });
-    if (managedAuth) {
-        return managedAuth.isLoggedIn
-            ? buildAuthBootstrapSuccess(managedAuth, "Opened a temporary Chromium login window, detected the signed-in session there, and saved it for direct API use.")
-            : buildAuthBootstrapFailure(managedAuth, `Opened a temporary Chromium login window and watched for ${Math.round(AUTH_BOOTSTRAP_TIMEOUT_MS / 1000)} seconds, but no authenticated DoorDash session was established.`);
+    if (managedAuth.status === "completed") {
+        return buildAuthBootstrapSuccess(managedAuth.auth, managedAuth.completion === "manual"
+            ? "Opened a temporary Chromium login window. After you pressed Enter to confirm the browser login was complete, the CLI rechecked the signed-in session there and saved it for direct API use."
+            : "Opened a temporary Chromium login window, detected the signed-in session there automatically, and saved it for direct API use.");
+    }
+    if (managedAuth.status === "timed-out") {
+        return buildAuthBootstrapFailure(managedAuth.auth, manualManagedConfirmationAvailable
+            ? `Opened a temporary Chromium login window and watched for ${Math.round(AUTH_BOOTSTRAP_TIMEOUT_MS / 1000)} seconds, but I still couldn't prove an authenticated DoorDash session. If the browser already looks signed in, press Enter sooner next time to force an immediate recheck, or rerun dd-cli login.`
+            : `Opened a temporary Chromium login window and watched for ${Math.round(AUTH_BOOTSTRAP_TIMEOUT_MS / 1000)} seconds, but no authenticated DoorDash session was established.`);
     }
     const openedBrowser = await deps.openUrlInDefaultBrowser(AUTH_BOOTSTRAP_URL);
     deps.log(openedBrowser
         ? `I couldn't launch the temporary Chromium login window, so I opened DoorDash in your default browser instead: ${AUTH_BOOTSTRAP_URL}`
         : `Couldn't open the temporary Chromium login window or your default browser automatically. Open this URL to continue: ${AUTH_BOOTSTRAP_URL}`);
-    deps.log("This environment still isn't exposing a reusable browser session the CLI can import, so I won't keep you waiting for the full login timeout. Once you've exposed a compatible browser session, rerun `dd-cli login`.");
+    deps.log("This environment still isn't exposing an attachable browser session the CLI can import, so I won't keep you waiting for the full login timeout. Once you've exposed an attachable browser session, rerun `dd-cli login`.");
     const importedAfterGrace = await deps.waitForAttachedBrowserSessionImport({
         timeoutMs: AUTH_BOOTSTRAP_NO_DISCOVERY_GRACE_MS,
         pollIntervalMs: AUTH_BOOTSTRAP_POLL_INTERVAL_MS,
@@ -933,12 +1145,12 @@ export async function bootstrapAuthSessionWithDeps(deps) {
     const auth = await deps.checkAuthDirect();
     if (importedAfterGrace) {
         return auth.isLoggedIn
-            ? buildAuthBootstrapSuccess(auth, "A reusable browser session appeared a few seconds later and was saved for direct API use.")
+            ? buildAuthBootstrapSuccess(auth, "An attachable browser session appeared a few seconds later and was saved for direct API use.")
             : buildAuthBootstrapFailure(auth, "Detected browser session state after opening the browser, but the consumer still appears logged out or guest-only.");
     }
     return buildAuthBootstrapFailure(auth, openedBrowser
-        ? "Opened DoorDash in your default browser, but this environment still isn't exposing a reusable browser session the CLI can import. Finish signing in there, make a compatible browser session discoverable, then rerun `dd-cli login`."
-        : "Couldn't open a watchable browser automatically, and this environment still isn't exposing a reusable browser session the CLI can import. Open the DoorDash home page manually, make a compatible browser session discoverable, then rerun `dd-cli login`.");
+        ? "Opened DoorDash in your default browser, but this environment still isn't exposing an attachable browser session the CLI can import. Finish signing in there, make an attachable browser session discoverable, then rerun `dd-cli login`."
+        : "Couldn't open a watchable browser automatically, and this environment still isn't exposing an attachable browser session the CLI can import. Open the DoorDash home page manually, make an attachable browser session discoverable, then rerun `dd-cli login`.");
 }
 export async function bootstrapAuthSession() {
     return bootstrapAuthSessionWithDeps({
@@ -948,10 +1160,12 @@ export async function bootstrapAuthSession() {
         markBrowserImportAttempted: () => session.markBrowserImportAttempted(),
         getAttachedBrowserCdpCandidates,
         getReachableCdpCandidates,
+        describeDesktopBrowserReuseGap,
         openUrlInAttachedBrowser,
         openUrlInDefaultBrowser,
         waitForAttachedBrowserSessionImport,
         waitForManagedBrowserLogin,
+        canPromptForManagedBrowserConfirmation,
         checkAuthDirect,
         log: (message) => console.error(message),
     });
@@ -1660,8 +1874,45 @@ export function selectAttachedBrowserImportMode(input) {
     }
     return "skip";
 }
+export function preferredBrowserSessionImportStrategies(platform) {
+    return platform === "linux"
+        ? ["local-linux-chromium-profile", "attached-browser-cdp"]
+        : ["attached-browser-cdp"];
+}
 async function importBrowserSessionIfAvailable() {
-    return await importBrowserSessionFromCdpCandidates(await getAttachedBrowserCdpCandidates());
+    for (const strategy of preferredBrowserSessionImportStrategies(process.platform)) {
+        if (strategy === "local-linux-chromium-profile") {
+            if (await importBrowserSessionFromLocalChromiumProfiles()) {
+                return true;
+            }
+            continue;
+        }
+        if (await importBrowserSessionFromCdpCandidates(await getAttachedBrowserCdpCandidates())) {
+            return true;
+        }
+    }
+    return false;
+}
+async function importBrowserSessionFromLocalChromiumProfiles() {
+    if (process.platform !== "linux") {
+        return false;
+    }
+    const originalArtifacts = await snapshotStoredSessionArtifacts();
+    for (const browser of LINUX_CHROMIUM_COOKIE_IMPORT_BROWSERS) {
+        const profileImports = await readLinuxChromiumCookieImports(browser);
+        for (const profileImport of profileImports) {
+            if (!hasDoorDashCookies(profileImport.cookies)) {
+                continue;
+            }
+            await writeStoredSessionArtifacts(profileImport.cookies);
+            const persistedAuth = await getPersistedAuthDirect();
+            if (persistedAuth?.isLoggedIn) {
+                return true;
+            }
+            await restoreStoredSessionArtifacts(originalArtifacts);
+        }
+    }
+    return false;
 }
 async function importBrowserSessionFromCdpCandidates(candidates) {
     for (const cdpUrl of candidates) {
@@ -1671,7 +1922,7 @@ async function importBrowserSessionFromCdpCandidates(candidates) {
         let browser = null;
         let tempPage = null;
         try {
-            browser = await chromium.connectOverCDP(cdpUrl);
+            browser = await chromium.connectOverCDP(cdpUrl, { timeout: ATTACHED_BROWSER_CDP_CONNECT_TIMEOUT_MS });
             const context = browser.contexts()[0];
             if (!context) {
                 continue;
@@ -1731,6 +1982,26 @@ async function fetchConsumerViaPage(page) {
     });
     return parseGraphQlResponse("attachedBrowserConsumerImport", raw.status, raw.text);
 }
+async function readLiveManagedBrowserAuth(page) {
+    if (!page || page.isClosed()) {
+        return buildAuthResult(null);
+    }
+    const consumerData = await fetchConsumerViaPage(page).catch(() => null);
+    return buildAuthResult(consumerData?.consumer ?? null);
+}
+async function confirmManagedBrowserAuth(context, page) {
+    const liveAuth = await readLiveManagedBrowserAuth(page);
+    if (liveAuth.isLoggedIn) {
+        if (context) {
+            await saveContextState(context).catch(() => { });
+        }
+        return liveAuth;
+    }
+    if (context) {
+        await saveContextState(context).catch(() => { });
+    }
+    return (await getPersistedAuthDirect().catch(() => null)) ?? liveAuth;
+}
 async function saveContextState(context, cookies = null) {
     const storageStatePath = getStorageStatePath();
     await ensureConfigDir();
@@ -1742,42 +2013,16 @@ async function getPersistedAuthDirect() {
     if (!(await hasPersistedSessionArtifacts())) {
         return null;
     }
-    let browser = null;
-    let context = null;
-    let page = null;
+    await session.close().catch(() => { });
+    session.markBrowserImportAttempted();
     try {
-        browser = await chromium.launch({
-            headless: true,
-            args: ["--disable-blink-features=AutomationControlled", "--no-sandbox", "--disable-setuid-sandbox"],
-        });
-        const storageStatePath = getStorageStatePath();
-        const hasStorage = await hasStorageState();
-        context = await browser.newContext({
-            userAgent: DEFAULT_USER_AGENT,
-            locale: "en-US",
-            viewport: { width: 1280, height: 900 },
-            ...(hasStorage ? { storageState: storageStatePath } : {}),
-        });
-        if (!hasStorage) {
-            const cookies = await readStoredCookies();
-            if (cookies.length === 0) {
-                return null;
-            }
-            await context.addCookies(cookies);
-        }
-        page = await context.newPage();
-        await page.goto(`${BASE_URL}/home`, { waitUntil: "domcontentloaded", timeout: 90_000 }).catch(() => { });
-        await page.waitForTimeout(1_000);
-        const consumerData = await fetchConsumerViaPage(page).catch(() => null);
-        return buildAuthResult(consumerData?.consumer ?? null);
+        return await checkAuthDirect();
     }
     catch {
         return null;
     }
     finally {
-        await page?.close().catch(() => { });
-        await context?.close().catch(() => { });
-        await browser?.close().catch(() => { });
+        await session.close().catch(() => { });
     }
 }
 async function validatePersistedDirectSessionArtifacts() {
@@ -1869,7 +2114,7 @@ async function openUrlInDefaultBrowser(targetUrl) {
 async function openUrlInAttachedBrowser(input) {
     let browser = null;
     try {
-        browser = await chromium.connectOverCDP(input.cdpUrl);
+        browser = await chromium.connectOverCDP(input.cdpUrl, { timeout: ATTACHED_BROWSER_CDP_CONNECT_TIMEOUT_MS });
         const context = browser.contexts()[0];
         if (!context) {
             return false;
@@ -1893,6 +2138,7 @@ async function waitForManagedBrowserLogin(input) {
     let browser = null;
     let context = null;
     let page = null;
+    const manualConfirmation = createManagedBrowserManualConfirmationHandle();
     try {
         browser = await chromium.launch({
             headless: false,
@@ -1917,10 +2163,25 @@ async function waitForManagedBrowserLogin(input) {
         await page.bringToFront().catch(() => { });
         const deadline = Date.now() + input.timeoutMs;
         while (Date.now() <= deadline) {
-            await saveContextState(context).catch(() => { });
-            const auth = await getPersistedAuthDirect();
-            if (auth?.isLoggedIn) {
-                return auth;
+            const liveAuth = await readLiveManagedBrowserAuth(page);
+            if (liveAuth.isLoggedIn) {
+                await saveContextState(context).catch(() => { });
+                return {
+                    status: "completed",
+                    completion: "automatic",
+                    auth: liveAuth,
+                };
+            }
+            if (manualConfirmation.consumeRequested()) {
+                const confirmedAuth = await confirmManagedBrowserAuth(context, page);
+                if (confirmedAuth.isLoggedIn) {
+                    return {
+                        status: "completed",
+                        completion: "manual",
+                        auth: confirmedAuth,
+                    };
+                }
+                input.log("Still not seeing an authenticated DoorDash session yet. Finish signing in in the opened browser window, then press Enter again or keep waiting for automatic detection.");
             }
             if (page.isClosed()) {
                 break;
@@ -1930,16 +2191,27 @@ async function waitForManagedBrowserLogin(input) {
             }
             await wait(input.pollIntervalMs);
         }
-        await saveContextState(context).catch(() => { });
-        return (await getPersistedAuthDirect()) ?? buildAuthResult(null);
+        const finalAuth = await confirmManagedBrowserAuth(context, page);
+        if (finalAuth.isLoggedIn) {
+            return {
+                status: "completed",
+                completion: "automatic",
+                auth: finalAuth,
+            };
+        }
+        return {
+            status: "timed-out",
+            auth: finalAuth,
+        };
     }
     catch (error) {
         if (isPlaywrightBrowserInstallMissingError(error)) {
-            return null;
+            return { status: "launch-failed" };
         }
-        return null;
+        return { status: "launch-failed" };
     }
     finally {
+        manualConfirmation.close();
         await page?.close().catch(() => { });
         await context?.close().catch(() => { });
         await browser?.close().catch(() => { });
@@ -1952,6 +2224,40 @@ function isPlaywrightBrowserInstallMissingError(error) {
     const message = error.message.toLowerCase();
     return message.includes("executable doesn't exist") || message.includes("please run the following command") || message.includes("playwright install");
 }
+const KNOWN_DESKTOP_BROWSERS = [
+    {
+        label: "Brave",
+        processMatchers: [/\bbrave-browser(?:-stable)?\b/i, /\/brave(?:$|\s)/i],
+        devToolsActivePortPaths: [
+            join(homedir(), ".config", "BraveSoftware", "Brave-Browser", "DevToolsActivePort"),
+            join(homedir(), "Library", "Application Support", "BraveSoftware", "Brave-Browser", "DevToolsActivePort"),
+        ],
+    },
+    {
+        label: "Google Chrome",
+        processMatchers: [/\bgoogle-chrome(?:-stable|-beta|-unstable)?\b/i, /\/google-chrome(?:$|\s)/i],
+        devToolsActivePortPaths: [
+            join(homedir(), ".config", "google-chrome", "DevToolsActivePort"),
+            join(homedir(), "Library", "Application Support", "Google", "Chrome", "DevToolsActivePort"),
+        ],
+    },
+    {
+        label: "Microsoft Edge",
+        processMatchers: [/\bmicrosoft-edge(?:-stable|-beta|-dev)?\b/i, /\/microsoft-edge(?:$|\s)/i],
+        devToolsActivePortPaths: [
+            join(homedir(), ".config", "microsoft-edge", "DevToolsActivePort"),
+            join(homedir(), "Library", "Application Support", "Microsoft Edge", "DevToolsActivePort"),
+        ],
+    },
+    {
+        label: "Chromium",
+        processMatchers: [/\bchromium-browser\b/i, /\bchromium\b/i],
+        devToolsActivePortPaths: [
+            join(homedir(), ".config", "chromium", "DevToolsActivePort"),
+            join(homedir(), "Library", "Application Support", "Chromium", "DevToolsActivePort"),
+        ],
+    },
+];
 function normalizeCdpCandidate(value) {
     return value.trim().replace(/\/$/, "");
 }
@@ -2001,6 +2307,91 @@ function wait(ms) {
         setTimeout(resolve, ms);
     });
 }
+function detectRunningDesktopBrowser(processCommands) {
+    const filteredCommands = processCommands
+        .map((command) => command.trim())
+        .filter((command) => command.length > 0)
+        .filter((command) => !/chrome-devtools-mcp/i.test(command));
+    for (const browser of KNOWN_DESKTOP_BROWSERS) {
+        const preferredMatch = filteredCommands.some((command) => !/--type=|crashpad|zygote/i.test(command) && browser.processMatchers.some((matcher) => matcher.test(command)));
+        if (preferredMatch) {
+            return browser;
+        }
+    }
+    for (const browser of KNOWN_DESKTOP_BROWSERS) {
+        if (filteredCommands.some((command) => browser.processMatchers.some((matcher) => matcher.test(command)))) {
+            return browser;
+        }
+    }
+    return null;
+}
+function hasRemoteDebuggingSignal(processCommands) {
+    return processCommands.some((command) => /--remote-debugging-(?:port|pipe)(?:=|\b)/i.test(command));
+}
+export function summarizeDesktopBrowserReuseGap(input) {
+    const browser = detectRunningDesktopBrowser(input.processCommands);
+    if (!browser) {
+        return null;
+    }
+    if (hasRemoteDebuggingSignal(input.processCommands) || input.hasAnyDevToolsActivePort) {
+        return null;
+    }
+    return `I can see ${browser.label} is already running on this desktop, but dd-cli still couldn't reuse it automatically. It is not exposing an attachable browser automation session right now, and no importable signed-in DoorDash browser profile state was found.`;
+}
+async function captureCommandStdout(command, args, options = {}) {
+    return await new Promise((resolve, reject) => {
+        const child = spawn(command, args, {
+            env: options.env,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        const stdout = [];
+        const stderr = [];
+        child.once("error", reject);
+        child.stdout?.on("data", (chunk) => {
+            stdout.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderr.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+        });
+        child.stdin?.end(options.stdin ?? "");
+        child.once("close", (code) => {
+            if (code === 0) {
+                resolve(Buffer.concat(stdout).toString("utf8"));
+                return;
+            }
+            const stderrText = Buffer.concat(stderr).toString("utf8").trim();
+            reject(new Error(`${command} exited with code ${code ?? "null"}${stderrText ? `: ${stderrText}` : ""}`));
+        });
+    });
+}
+async function listProcessCommands(targetPlatform = process.platform) {
+    if (targetPlatform === "win32") {
+        return [];
+    }
+    const args = targetPlatform === "darwin" ? ["-axo", "command="] : ["-eo", "command="];
+    const stdout = await captureCommandStdout("ps", args).catch(() => "");
+    return stdout
+        .split(/\r?\n/)
+        .map((command) => command.trim())
+        .filter((command) => command.length > 0);
+}
+async function hasAnyKnownDevToolsActivePort() {
+    for (const browser of KNOWN_DESKTOP_BROWSERS) {
+        for (const path of browser.devToolsActivePortPaths) {
+            if ((await readFile(path, "utf8").catch(() => null)) !== null) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+async function describeDesktopBrowserReuseGap() {
+    const processCommands = await listProcessCommands();
+    return summarizeDesktopBrowserReuseGap({
+        processCommands,
+        hasAnyDevToolsActivePort: await hasAnyKnownDevToolsActivePort(),
+    });
+}
 async function readOpenClawBrowserConfigCandidates(input) {
     try {
         const raw = await readFile(join(homedir(), ".openclaw", "openclaw.json"), "utf8");
@@ -2021,7 +2412,9 @@ async function readOpenClawBrowserConfigCandidates(input) {
 }
 async function isCdpEndpointReachable(cdpUrl) {
     try {
-        const response = await fetch(`${cdpUrl.replace(/\/$/, "")}/json/version`);
+        const response = await fetch(`${cdpUrl.replace(/\/$/, "")}/json/version`, {
+            signal: AbortSignal.timeout(ATTACHED_BROWSER_CDP_REACHABILITY_TIMEOUT_MS),
+        });
         return response.ok;
     }
     catch {
@@ -2656,6 +3049,89 @@ function truncate(value, length) {
 async function ensureConfigDir() {
     await mkdir(dirname(getCookiesPath()), { recursive: true });
 }
+async function snapshotStoredSessionArtifacts() {
+    const [cookiesRaw, storageStateRaw] = await Promise.all([
+        readFile(getCookiesPath(), "utf8").catch(() => null),
+        readFile(getStorageStatePath(), "utf8").catch(() => null),
+    ]);
+    return { cookiesRaw, storageStateRaw };
+}
+async function restoreStoredSessionArtifacts(snapshot) {
+    await ensureConfigDir();
+    if (snapshot.cookiesRaw === null) {
+        await rm(getCookiesPath(), { force: true }).catch(() => { });
+    }
+    else {
+        await writeFile(getCookiesPath(), snapshot.cookiesRaw);
+    }
+    if (snapshot.storageStateRaw === null) {
+        await rm(getStorageStatePath(), { force: true }).catch(() => { });
+    }
+    else {
+        await writeFile(getStorageStatePath(), snapshot.storageStateRaw);
+    }
+}
+async function writeStoredSessionArtifacts(cookies) {
+    await ensureConfigDir();
+    await writeFile(getCookiesPath(), JSON.stringify(cookies, null, 2));
+    await writeFile(getStorageStatePath(), JSON.stringify({ cookies, origins: [] }, null, 2));
+}
+async function readLinuxChromiumCookieImports(input) {
+    try {
+        const stdout = await captureCommandStdout("python3", ["-c", LINUX_CHROMIUM_COOKIE_IMPORT_SCRIPT], {
+            env: {
+                ...process.env,
+                DD_BROWSER_LABEL: input.browserLabel,
+                DD_BROWSER_SAFE_STORAGE_APP: input.safeStorageApplication,
+                DD_BROWSER_USER_DATA_DIR: input.userDataDir,
+            },
+        });
+        const parsed = JSON.parse(stdout);
+        if (!Array.isArray(parsed)) {
+            return [];
+        }
+        return parsed.flatMap((entry) => {
+            const object = asObject(entry);
+            const browserLabel = typeof object.browserLabel === "string" ? object.browserLabel.trim() : "";
+            const profileName = typeof object.profileName === "string" ? object.profileName.trim() : "";
+            if (!browserLabel || !profileName || !Array.isArray(object.cookies)) {
+                return [];
+            }
+            const cookies = object.cookies.flatMap((cookie) => {
+                const parsedCookie = asObject(cookie);
+                const name = typeof parsedCookie.name === "string" ? parsedCookie.name : "";
+                const value = typeof parsedCookie.value === "string" ? parsedCookie.value : "";
+                const domain = typeof parsedCookie.domain === "string" ? parsedCookie.domain : "";
+                const path = typeof parsedCookie.path === "string" && parsedCookie.path ? parsedCookie.path : "/";
+                const sameSiteRaw = typeof parsedCookie.sameSite === "string" ? parsedCookie.sameSite : "Lax";
+                const sameSite = sameSiteRaw === "Strict" || sameSiteRaw === "None" || sameSiteRaw === "Lax" ? sameSiteRaw : "Lax";
+                const expires = typeof parsedCookie.expires === "number" && Number.isFinite(parsedCookie.expires) ? parsedCookie.expires : -1;
+                if (!name || !domain) {
+                    return [];
+                }
+                return [
+                    {
+                        name,
+                        value,
+                        domain,
+                        path,
+                        expires,
+                        httpOnly: Boolean(parsedCookie.httpOnly),
+                        secure: Boolean(parsedCookie.secure),
+                        sameSite,
+                    },
+                ];
+            });
+            if (cookies.length === 0) {
+                return [];
+            }
+            return [{ browserLabel, profileName, cookies }];
+        });
+    }
+    catch {
+        return [];
+    }
+}
 async function hasBlockedBrowserImport() {
     try {
         await readFile(getBrowserImportBlockPath(), "utf8");