dsh-inner-browser-use 0.42.0 → 0.44.0

package/README.md

@@ -21,7 +21,7 @@ live picture of that browser, and your own cursor keeps working on the picture.
 | `browser_scroll` | Scrolls the wheel at the centre of the page, or at `x`/`y`. `dy: 600` is about a screen down. |
 | `browser_shot` | Saves a full-size PNG into `~/.dsh-inner-browser-use/screenshots` and returns the path. |
 | `browser_media` | Lists the video and sound the page already fetched, with sizes, the one its own player shows first and marked `main`; `save: <row>`, `save: main` or part of the address keeps one. Ads and beacons stay out unless `all: true`; `watch: false` stops remembering the page. A stream is followed to its pieces and joined, so nothing has to be installed. |
-| `browser_login` | Keeps a sign-in by name: `save` stores this window's cookies and each site's local storage, `list` shows what is kept, `use` signs that account back in and reopens the page, `drop` forgets it. Names survive a restart and belong to the browser rather than to one chat, so two accounts on one site are two names. What sits on disk is encrypted, with the key in the system keychain. |
+| `browser_login` | Keeps a sign-in by name: `save` stores this window's cookies and each site's local storage, `list` shows what is kept, `use` signs that account back in and reopens the page, `import` takes a sign-in that is already in Chrome, Brave, Edge or Chromium on this Mac and keeps it under a name, `drop` forgets it. Names survive a restart and belong to the browser rather than to one chat, so two accounts on one site are two names. What sits on disk is encrypted, with the key in the system keychain. |
 | `browser_state` | Reports whether the browser runs, which profile it uses, its address and title, how many columns are showing it, how much memory it holds right now and when it would close on its own if left alone. |
 
 `browser_read` on the same page is the words only, in Markdown (measured: 4,520

package/README.zh.md

@@ -20,7 +20,7 @@ profile，不是产品自带的那个浏览页签：右栏放的是它的画面
 | `browser_scroll` | 在页面中心滚轮，也可以指定 `x`/`y`。`dy: 600` 约一屏。 |
 | `browser_shot` | 存一张 PNG 到 `~/.dsh/inner-browser-use/screenshots`，返回路径；`region: [x, y, w, h]` 只截一块（游戏、图表、看局部）。 |
 | `browser_media` | 列出页面已经请求过的视频和声音（带大小），页面自己播放器里那个排第一、标 `main`；`save: <行号>`、`save: main` 或地址片段存下来。广告和统计默认不出现（`all: true` 才看），`watch: false` 关掉这个页面的记录。流会顺着播放列表把片段取回拼好，不用装任何东西。 |
-| `browser_login` | 按名字留住登录：`save` 存下当前窗口的 cookie 和各站的 localStorage，`list` 看有哪些，`use` 切回那个账号并重开页面，`drop` 忘掉。名字跟着浏览器走、不跟着一个会话走，重启也在；同一站点两个账号就存两个名字。磁盘上那一份是加密的，钥匙在系统钥匙串里。 |
+| `browser_login` | 按名字留住登录：`save` 存下当前窗口的 cookie 和各站的 localStorage，`list` 看有哪些，`use` 切回那个账号并重开页面，`import` 把本机 Chrome/Brave/Edge 里已经登着的站直接留成一个名字，`drop` 忘掉。名字跟着浏览器走、不跟着一个会话走，重启也在；同一站点两个账号就存两个名字。磁盘上那一份是加密的，钥匙在系统钥匙串里。 |
 | `browser_state` | 报浏览器在不在跑、用的哪个 profile、地址、标题、有几个右栏在看它，以及它此刻占多少内存、没人用的话还有多久关闭。 |
 
 点、输入、按键之后的那一行会多一句结果：`· navigated to …`（换页了）、`· content changed`（页内有变化）、`· no visible change`（点了没动）、Flash 页则是 `· screen updated` / `· no frame change`；`read: true` 时不再多说。

package/chromecookies.js

@@ -0,0 +1,310 @@
+/**
+ * A sign-in that is already on this Mac, brought into the vault without an
+ * extension, a pairing code, or a copy of anybody's profile: the cookie store
+ * the browser itself keeps, opened, filtered to the one site being asked about
+ * and sealed again by the vault. Nothing here talks to the network.
+ *
+ * The store is read from a copy, never from the live file: the browser holds a
+ * lock on it, and a lock is not a reason to ask somebody to quit their browser.
+ *
+ * @module dsh-inner-browser-use/chromecookies
+ */
+
+import { createDecipheriv, createHash, pbkdf2Sync } from 'node:crypto'
+import { existsSync, mkdtempSync, copyFileSync, readdirSync, statSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+/** The browsers this can read, most likely first. */
+export const BROWSERS = [
+  { id: 'chrome', label: 'Chrome', root: 'Google/Chrome' },
+  { id: 'brave', label: 'Brave', root: 'BraveSoftware/Brave-Browser' },
+  { id: 'edge', label: 'Edge', root: 'Microsoft Edge' },
+  { id: 'chromium', label: 'Chromium', root: 'Chromium' },
+]
+
+/**
+ * @param {any} error - a failed file operation.
+ * @returns {boolean} whether the system refused a directory the app exists beside.
+ */
+function denied(error) {
+  const code = String(error?.code ?? '')
+  return code === 'EPERM' || code === 'EACCES'
+}
+
+/** Profile directories that are not a person's browser. */
+const NOT_A_PROFILE = new Set(['System Profile', 'Guest Profile', 'Crashpad', 'ShaderCache', 'GrShaderCache', 'BrowserMetrics', 'component_crx_cache', 'extensions_crx_cache', 'Snapshots'])
+
+/**
+ * @param {string} id - a browser id.
+ * @returns {string} where its profiles live, or '' on a platform this cannot read.
+ */
+export function browserRoot(id = 'chrome') {
+  const one = BROWSERS.find((row) => row.id === id)
+  if (one === undefined) return ''
+  /* A profile root other than the standard one is only ever set by someone
+     testing this, or by a person who moved their browser data. */
+  const home = String(process.env.DSH_INNER_BROWSER_CHROME_HOME ?? process.env.HOME ?? '')
+  if (process.platform === 'darwin') return join(home, 'Library', 'Application Support', one.root)
+  if (process.platform === 'win32') return join(String(process.env.LOCALAPPDATA ?? ''), one.root.replace(/\//gu, '\\'))
+  return join(home, '.config', one.root.replace('Google/', 'google-').replace('BraveSoftware/Brave-Browser', 'BraveSoftware/Brave-Browser'))
+}
+
+/**
+ * Every profile of a browser that keeps cookies, newest use first.
+ * @param {string} id - a browser id.
+ * @returns {Array<{profile: string, db: string, at: number}>} what can be read.
+ */
+export function cookieStores(id = 'chrome') {
+  const root = browserRoot(id)
+  if (root === '' || !existsSync(root)) return []
+  let names = []
+  try {
+    names = readdirSync(root)
+  } catch (error) {
+    if (denied(error)) throw new Error('macOS will not let this app read the browser’s cookies: give it Full Disk Access, then try again')
+    return []
+  }
+  const rows = []
+  for (const name of names) {
+    if (NOT_A_PROFILE.has(name) || name.startsWith('.')) continue
+    const dir = join(root, name)
+    /* Chrome 96 moved the store under Network/; older ones kept it beside the profile. */
+    for (const rel of ['Network/Cookies', 'Cookies']) {
+      const db = join(dir, rel)
+      try {
+        const stat = statSync(db)
+        rows.push({ profile: name, db, at: Number(stat.mtimeMs) })
+        break
+      } catch {
+        /* this profile does not keep its cookies here */
+      }
+    }
+  }
+  return rows.sort((a, b) => b.at - a.at)
+}
+
+/**
+ * The password the browser used for its cookie encryption, from the macOS
+ * keychain. Linux and Windows keep theirs elsewhere; this refuses rather than
+ * guessing.
+ * @returns {string} the password, or '' when it cannot be had.
+ */
+export function safeStorageKey() {
+  if (process.platform !== 'darwin') return ''
+  for (const args of [['find-generic-password', '-w', '-s', 'Chrome Safe Storage', '-a', 'Chrome'], ['find-generic-password', '-w', '-s', 'Chrome Safe Storage']]) {
+    const out = spawnSync('security', args, { encoding: 'utf8', timeout: 5000 })
+    const password = String(out.stdout ?? '').trim()
+    if (out.status === 0 && password !== '') return password
+  }
+  return ''
+}
+
+/**
+ * @param {string} password - the browser's safe-storage password.
+ * @returns {Buffer} the AES key it derives.
+ */
+export function storeKey(password) {
+  return pbkdf2Sync(String(password), 'saltysalt', 1003, 16, 'sha1')
+}
+
+/**
+ * One stored cookie value, decrypted. Chrome prefixes the ciphertext with the
+ * scheme; from v24 the plaintext also starts with the site's host hash. // ui-copy-ignore
+ * @param {Buffer} blob - the encrypted_value bytes.
+ * @param {Buffer} key - from storeKey.
+ * @param {string} host - the cookie's host_key. // ui-copy-ignore
+ * @returns {string} the value, or '' when this browser sealed it beyond reach.
+ */
+export function unsealCookie(blob, key, host) { // ui-copy-ignore
+  if (!Buffer.isBuffer(blob) || blob.length === 0) return ''
+  const scheme = String(blob.subarray(0, 3).toString('latin1'))
+  if (scheme !== 'v10' && scheme !== 'v11') return ''
+  const iv = Buffer.alloc(16, ' ')
+  let plain = Buffer.alloc(0)
+  try {
+    const decipher = createDecipheriv('aes-128-cbc', key, iv)
+    plain = Buffer.concat([decipher.update(blob.subarray(3)), decipher.final()])
+  } catch {
+    return ''
+  }
+  const printed = createHash('sha256').update(String(host)).digest() // ui-copy-ignore
+  if (plain.length > 32 && plain.subarray(0, 32).equals(printed)) plain = plain.subarray(32)
+  return plain.toString('utf8')
+}
+
+/**
+ * Copies a store somewhere it can be read while the browser is running, and
+ * takes the copy away again even when the read fails.
+ * @param {string} db - the live store.
+ * @param {(copy: string) => any} work - what to do with the copy.
+ * @returns {any} whatever work returned.
+ */
+function onCopy(db, work) {
+  const dir = mkdtempSync(join(tmpdir(), 'dshib-cookies-'))
+  try {
+    const copy = join(dir, 'Cookies')
+    copyFileSync(db, copy)
+    for (const extra of ['-wal', '-shm']) {
+      if (existsSync(`${db}${extra}`)) copyFileSync(`${db}${extra}`, `${copy}${extra}`)
+    }
+    return work(copy)
+  } finally {
+    rmSync(dir, { recursive: true, force: true })
+  }
+}
+
+/**
+ * @param {string} copy - the store copy.
+ * @param {string} sql - one SELECT.
+ * @returns {Array<object>} rows.
+ */
+function query(copy, sql) {
+  try {
+    /* Node 22+ ships SQLite; the CLI is the fallback so an older host still works. */ // ui-copy-ignore
+    const mod = process.getBuiltinModule?.('node:sqlite')
+    if (typeof mod?.DatabaseSync === 'function') {
+      const db = new mod.DatabaseSync(copy, { readOnly: true })
+      try {
+        return db.prepare(sql).all()
+      } finally {
+        db.close()
+      }
+    }
+  } catch {
+    /* fall through to the command line */
+  }
+  const out = spawnSync('/usr/bin/sqlite3', ['-readonly', '-json', copy, sql], { encoding: 'utf8', timeout: 8000, maxBuffer: 4_000_000 })
+  if (out.status !== 0) return []
+  try {
+    const rows = JSON.parse(String(out.stdout ?? '[]'))
+    return Array.isArray(rows) ? rows : []
+  } catch {
+    return []
+  }
+}
+
+/**
+ * @param {number} micro - Chrome's expiry, microseconds since 1601.
+ * @returns {number} milliseconds since 1970, or 0 for a session cookie.
+ */
+function expiresAt(micro) {
+  const value = Number(micro ?? 0)
+  if (!Number.isFinite(value) || value <= 0) return 0
+  return Math.round(value / 1000) - 11644473600000
+}
+
+/** @param {number} value - Chrome's samesite column. @returns {string|undefined} the CDP name. */
+function sameSite(value) {
+  const at = Number(value ?? -1)
+  if (at === 0) return 'None'
+  if (at === 1) return 'Lax'
+  if (at === 2) return 'Strict'
+  return undefined
+}
+
+/**
+ * The cookies of one site, ready for the vault. Values never leave this call.
+ * @param {string} db - a store path.
+ * @param {Buffer} key - from storeKey.
+ * @param {string} host - the site, without a leading www. or a port. // ui-copy-ignore
+ * @param {number} [cap] - how many to keep.
+ * @returns {{cookies: object[], sealed: number}} the cookies and how many could not be opened.
+ */
+export function cookiesFor(db, key, host, cap = 80) { // ui-copy-ignore
+  const site = String(host).replace(/^\./u, '').toLowerCase() // ui-copy-ignore
+  if (site === '') return { cookies: [], sealed: 0 }
+  const rows = onCopy(db, (copy) =>
+    query(copy, 'SELECT host_key, name, value, encrypted_value, path, expires_utc, is_secure, is_httponly, samesite FROM cookies'),
+  )
+  const cookies = []
+  let sealed = 0
+  for (const row of rows) {
+    const domain = String(row?.host_key ?? '').replace(/^\./u, '').toLowerCase()
+    if (domain === '' || !(site === domain || site.endsWith(`.${domain}`) || domain.endsWith(`.${site}`))) continue
+    const raw = String(row?.name ?? '')
+    if (raw === '') continue
+    let value = String(row?.value ?? '')
+    if (value === '') value = unsealCookie(normalizeBlob(row?.encrypted_value), key, String(row?.host_key ?? ''))
+    if (value === '') {
+      sealed += 1
+      continue
+    }
+    const expires = expiresAt(row?.expires_utc)
+    const cookie = {
+      name: raw,
+      value,
+      domain,
+      path: String(row?.path ?? '/'),
+      secure: Number(row?.is_secure ?? 0) === 1,
+      httpOnly: Number(row?.is_httponly ?? 0) === 1,
+      session: expires === 0,
+    }
+    const same = sameSite(row?.samesite)
+    if (same !== undefined) cookie.sameSite = same
+    if (expires !== 0) cookie.expires = expires
+    cookies.push(cookie)
+    if (cookies.length >= cap) break
+  }
+  return { cookies, sealed }
+}
+
+/** @param {any} value - a blob column, from either SQLite driver. @returns {Buffer} its bytes. */
+function normalizeBlob(value) {
+  if (Buffer.isBuffer(value)) return value
+  if (value instanceof Uint8Array) return Buffer.from(value)
+  if (typeof value === 'string') return Buffer.from(value, 'latin1')
+  if (value !== null && typeof value === 'object' && value?.data !== undefined) return Buffer.from(value.data)
+  return Buffer.alloc(0)
+}
+
+/**
+ * @param {string} url - the page a sign-in is wanted for.
+ * @returns {string} its host, without www., or ''. // ui-copy-ignore
+ */
+export function siteOf(url) {
+  try {
+    return String(new URL(String(url)).hostname).replace(/^www\./u, '').toLowerCase()
+  } catch {
+    return ''
+  }
+}
+
+/**
+ * Reads a site's sign-in out of the browser already on this Mac and says what
+ * it found. Refuses with a reason when macOS will not let the cookie store be
+ * read, which is the one failure a person can actually fix.
+ * @param {{browser?: string, url?: string, host?: string, cap?: number}} options - which site, which browser. // ui-copy-ignore
+ * @returns {{cookies: object[], browser: string, label: string, profile: string, sealed: number, at: number}} what was read.
+ */
+export function readBrowserCookies(options = {}) {
+  const id = String(options.browser ?? 'chrome')
+  const host = String(options.host ?? siteOf(String(options.url ?? ''))).toLowerCase() // ui-copy-ignore
+  if (host === '') throw new Error('there is no site to import: open the page first') // ui-copy-ignore
+  const stores = cookieStores(id)
+  if (stores.length === 0) {
+    const one = BROWSERS.find((row) => row.id === id)
+    const where = browserRoot(id)
+    const blocked = where !== '' && existsSync(where) === false
+    throw new Error(blocked ? `${one?.label ?? id} is not installed on this Mac` : `no ${one?.label ?? id} profile keeps cookies here`)
+  }
+  /* The password the browser derived its key from. It is only ever taken from
+     the keychain, or handed in by someone who keeps the key elsewhere. */
+  const password = String(process.env.DSH_INNER_BROWSER_COOKIE_KEY ?? '') || safeStorageKey()
+  if (password === '') throw new Error('the browser’s key is not in the keychain, so its cookies cannot be opened')
+  const key = storeKey(password)
+  for (const store of stores) {
+    let read = { cookies: [], sealed: 0 }
+    try {
+      read = cookiesFor(store.db, key, host, Number(options.cap ?? 80)) // ui-copy-ignore
+    } catch (error) {
+      if (denied(error)) throw new Error('macOS will not let this app read the browser’s cookies: give it Full Disk Access, then try again')
+      throw error
+    }
+    if (read.cookies.length === 0) continue
+    const one = BROWSERS.find((row) => row.id === id)
+    return { cookies: read.cookies, browser: id, label: one?.label ?? id, profile: store.profile, sealed: read.sealed, at: Date.now() }
+  }
+  throw new Error(`no ${BROWSERS.find((row) => row.id === id)?.label ?? id} profile is signed in to ${host}`) // ui-copy-ignore
+}

package/docs/ARCHITECTURE.md

@@ -168,8 +168,12 @@ window) costs one round trip on an animation-heavy page instead of one per frame
 ## Reading for an answer
 
 `browser_read` with a `query` does not return the page; it returns the sentences that answer the
-question. The page-side block reader already returns paragraphs with their heading and link
-density, so the work stays in `read.js` and costs no extra round trip.
+question. The page-side block reader already returns paragraphs with their heading trail
+(`Plans \u203a Trial`), their link density, a 0-1 quality score and table rows as one
+`column: value | column: value` line, so the work stays in `read.js` and costs no extra round trip.
+When the page's own menu would eat the budget, the blocks past the ceiling are chosen by quality and
+then put back in page order, so prose survives where document order would have spent everything
+above it.
 
 Paragraphs are ranked first (BM25 over the question's terms, link-heavy menus down-weighted), then
 split into sentences. Each sentence is scored on its own with the same saturation and length
@@ -177,7 +181,9 @@ normalisation, and that score is multiplied by three priors: the words of its he
 the paragraph it sits in, and inverse link density. Words the page says everywhere are dropped
 before scoring — a term in most sentences cannot point at anything — and a sentence that matches
 only part of the question is scaled by the share of the question's idf weight it actually covers,
-which is what stops a paragraph containing "to" from competing with one containing "refund".
+which is what stops a paragraph containing "to" from competing with one containing "refund". The
+block's quality score and its being a table row are priors as well, so a menu that repeats the
+question's words cannot outrank the sentence that explains them.
 
 Selection is not "the top N scores": each pick subtracts its Jaccard overlap with what is already
 chosen (MMR), selection stops when the best remaining sentence is worth nothing, and picked
@@ -223,6 +229,14 @@ Three layers, each adding one thing the previous cannot do:
   browser closes, and put back on the next launch. A cookie the browser already holds is
   never overwritten from the jar — a rotation happened in the live browser, and the jar is
   the older truth.
+- **`chromecookies.js`** reads a browser's own cookie store off disk, in memory only: copy `Cookies`
+  (with `-wal`/`-shm`, since the browser holds the lock) to a temp dir, then `node:sqlite` or
+  `/usr/bin/sqlite3 -readonly`. Values are sealed with the browser's Safe Storage password from the
+  macOS keychain: PBKDF2-SHA1 (1003 iterations, `saltysalt`) → AES-128-CBC with a space IV, and the
+  SHA-256 host prefix newer Chromium builds prepend is checked and stripped. Values it cannot open
+  (Chrome 127+ app-bound `v20`) are counted, never guessed; cookie values are never returned to the
+  model or logged. On macOS the process needs Full Disk Access for the profile root, and the tool says
+  exactly that instead of pretending there is no profile.
 - **`browser_login`** (`vault.js`) turns that state into named snapshots a chat can call
   back: cookies plus per-origin `localStorage`, saved under a name, listed, restored, or
   dropped. `list` is a directory read, so it costs nothing while the browser is down.

package/docs/BENCH.md

@@ -1,3 +1,31 @@
+## 读页先读正文（0.44.0，本地页面，`scripts/bench.mjs`）
+
+同一台机器、同一档预算。旧法是按页面顺序把预算灌满的整页读。
+
+| 页面 | 旧法字符 | 新法字符 | 省下 | 答案 |
+| --- | --- | --- | --- | --- |
+| 九成是菜单、答案在正文（900 字预算） | 1500 | 88 | 94% | 旧法读不到，新法读到 |
+| 定价表（900 字预算） | 679 | 109 | 84% | 价格与列名同一行 |
+
+- `read-noise` 2 ms、`read-table` 2 ms，两项预算 300 ms 全过（26 项全过）
+- 表格行形如 `Plan: Pro | Price per month: $84`，列名来自表头，一行就是一条记录
+- 标题路径 `Plans \u203a Trial` 印在证据上方；与最近标题相同、或超过 90 字时退回最近标题
+- 既有数字没有回退：`read-answer` 90 字 / 92%、`read-miss` 438 字 / 79%、`read-tabs` 90 字 / 90%（与 0.43.0 相同）
+
+## 一次读穿过登录墙（0.43.0，本地页面，`scripts/bench.mjs`）
+
+同一页：带 cookie 时是账户页，不带时是一个只有密码框的登录页。留一个登录（vault），清掉页面的 cookie 与 localStorage 后读它。
+
+| 路径 | 调用 | 毫秒 | 字 |
+| --- | --- | --- | --- |
+| 撞墙后读→list→use→再读 | 4 | 217 | 139 |
+| 撞墙后只读一次 | 1 | 112 | 220 |
+
+- 一路上 `recovered: true`：内容来自恢复后的页面（「forty two days」），不是墙上的文字
+- 两个名字都覆盖这个站时：`namesBoth: true`、`guessed: false`——名字都列出来，一个都不放回去
+- 导入本机浏览器登录（合成库，真实钥匙串路径）：`login-import` 1 次调用 / 111 毫秒 / 1 个 cookie 封存 / 回复里不含任何 cookie 值
+- 预算：`login-wall: 1600 ms`、`login-import: 700 ms`，24 项全过
+
 ## 答案在另一个页签（0.42.0）
 
 两个页签：前台一页在讲别的事，后台另一页才有答案。左边是旧做法——切过去、再读一遍；
@@ -9,7 +37,7 @@
 | 回来的字符数 | 879 | 90 |
 | 省下 | — | 90% |
 | 出处 | 要自己记 | 每段标页签标题 |
-| 读这一趟 | 7 ms | 6 ms |
+| 读这一趟 | 7 ms | 5–6 ms |
 
 跨页只在当前页答不上来时发生，正常命中路径的延迟不变（`read-answer` 仍是 1172 → 90 字）。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-inner-browser-use",
-  "version": "0.42.0",
+  "version": "0.44.0",
   "description": "An agent-owned Chromium sidecar mirrored into the DeepSeek Harness right column: the agent drives it, the person watches and can take the mouse, and logins survive restarts.",
   "type": "module",
   "main": "index.js",
@@ -19,6 +19,7 @@
     "review.js",
     "media.js",
     "vault.js",
+    "chromecookies.js",
     "client.js",
     "locale/*.json",
     "cordis.patch.yml",
@@ -50,7 +51,7 @@
     "dsh": ">=0.2.0"
   },
   "scripts": {
-    "test": "node --test test/artifacts.test.mjs test/client.test.mjs test/cookies.test.mjs test/diff.test.mjs test/fresh.test.mjs test/host.test.mjs test/input.test.mjs test/isolation.test.mjs test/keyboard.test.mjs test/leak.test.mjs test/login.test.mjs test/media.test.mjs test/no-duplicate.test.mjs test/package.test.mjs test/readfault.test.mjs test/refs.test.mjs test/review.test.mjs test/session.test.mjs test/settle.test.mjs test/sidecar.test.mjs test/swf.test.mjs test/tabs.test.mjs test/trouble.test.mjs test/vault.test.mjs",
+    "test": "node --test test/artifacts.test.mjs test/client.test.mjs test/cookies.test.mjs test/diff.test.mjs test/fresh.test.mjs test/host.test.mjs test/input.test.mjs test/isolation.test.mjs test/keyboard.test.mjs test/leak.test.mjs test/login.test.mjs test/media.test.mjs test/no-duplicate.test.mjs test/package.test.mjs test/blocks.test.mjs test/readfault.test.mjs test/refs.test.mjs test/review.test.mjs test/session.test.mjs test/settle.test.mjs test/sidecar.test.mjs test/swf.test.mjs test/tabs.test.mjs test/trouble.test.mjs test/vault.test.mjs",
     "doctor": "node scripts/doctor.mjs",
     "breadth": "node scripts/breadth.mjs",
     "live": "node scripts/live.mjs",

package/read.js

@@ -1124,10 +1124,12 @@ export async function findOnPage(page, query, options = {}) {
 }
 
 /**
- * Collect the page as blocks of prose, each with the heading it sits under and
- * how much of it is links. Navigation, sidebars and footers are mostly links;
- * Readability's oldest signal is that such a block is not the content, and it
- * costs one number to carry instead of a guess.
+ * Collect the page as blocks of prose. Each block carries the trail of headings
+ * it sits under, how much of it is links, and one number for how much of it
+ * reads like written content: navigation, sidebars and footers are mostly links
+ * and mostly short, which is Readability's oldest signal. A table row is one
+ * block, with its column names written into it, so a fact that lives in a table
+ * costs a line instead of a page.
  * @param {number} budget - characters of block text to collect.
  * @returns {string} an expression to evaluate.
  */
@@ -1136,32 +1138,66 @@ export function blocks(budget) {
   const root = document.querySelector('article, main, [role="main"]') || document.body
   if (!root) return JSON.stringify({ blocks: [] })
   const limit = ${budget}
-  const BLOCK = new Set(['P', 'LI', 'TD', 'TH', 'BLOCKQUOTE', 'PRE', 'FIGCAPTION', 'DD', 'DT', 'SUMMARY'])
+  const guard = limit * 6
+  const BLOCK = new Set(['P', 'LI', 'BLOCKQUOTE', 'PRE', 'FIGCAPTION', 'DD', 'DT', 'SUMMARY'])
   const SKIP = new Set(['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEMPLATE', 'SVG', 'IFRAME', 'CANVAS', 'VIDEO', 'HEADER', 'FOOTER', 'NAV', 'ASIDE', 'FORM', 'BUTTON', 'SELECT', 'TEXTAREA'])
   const out = []
   const seen = new Set()
+  const stack = []
   let chars = 0
-  let heading = ''
   const flatten = (text) => String(text ?? '').replace(/\\s+/g, ' ').trim()
+  const trail = () => stack.filter((one) => one !== '').join(' \\u203a ')
+  const said = () => stack.filter((one) => one !== '').pop() ?? ''
+  /* How much of a block reads like prose rather than a list of links: ends of
+     sentences per word, plus a length floor. One number, no dictionary. */
+  const written = (text) => {
+    const words = text.toLowerCase().match(/[a-z0-9]+|[\\u3400-\\u9fff]/g) ?? []
+    if (words.length === 0) return 0
+    const ends = text.match(/[.!?\\u3002\\uff01\\uff1f;\\uff1b]/g) ?? []
+    return Math.min(1, (ends.length / words.length) * 12)
+  }
+  const quality = (text, density) => Math.round((0.45 * (1 - density) + 0.35 * written(text) + 0.2 * Math.min(1, text.length / 180)) * 100) / 100
   const push = (el) => {
-    if (chars >= limit) return
+    if (chars >= guard) return
     const text = flatten(el.innerText ?? el.textContent ?? '')
     if (text === '' || text.length > 4000) return
     let linkChars = 0
     for (const link of el.querySelectorAll('a')) linkChars += flatten(link.innerText ?? '').length
     if (el.tagName === 'A') linkChars += text.length
-    const density = text.length === 0 ? 0 : Math.min(1, linkChars / text.length)
-    out.push({ h: heading, t: text, d: Math.round(density * 100) / 100 })
+    const density = Math.min(1, linkChars / text.length)
+    /* A block that is almost all link and short is a menu item, not a sentence;
+       carrying it only spends the budget. */
+    if (density >= 0.8 && text.length < 80) return
+    const path = trail()
+    out.push({ h: said(), p: path, t: text, d: Math.round(density * 100) / 100, q: quality(text, density) })
     chars += text.length
   }
+  const row = (tr) => {
+    if (chars >= guard) return
+    const cells = Array.from(tr.children).filter((cell) => cell.tagName === 'TD' || cell.tagName === 'TH')
+    const words = cells.map((cell) => flatten(cell.innerText ?? ''))
+    if (words.filter((one) => one !== '').length < 2) return
+    const table = tr.closest('table')
+    const first = table === null ? null : table.querySelector('tr')
+    const head = first === null || first === tr ? [] : Array.from(first.children).map((cell) => flatten(cell.innerText ?? ''))
+    const line = words.map((one, at) => (head[at] === undefined || head[at] === '' || head[at] === one ? one : head[at] + ': ' + one)).join(' | ')
+    out.push({ h: said(), p: trail(), t: line, d: 0, q: 0.95, r: 1 })
+    chars += line.length
+  }
   const walk = (el) => {
-    if (chars >= limit || el === null) return
+    if (el === null || chars >= guard) return
     const tag = el.tagName
     if (SKIP.has(tag) || el.hidden === true || el.getAttribute?.('aria-hidden') === 'true') return
     const style = getComputedStyle(el)
     if (style.display === 'none' || style.visibility === 'hidden') return
     if (/^H[1-6]$/.test(tag)) {
-      heading = flatten(el.innerText ?? '')
+      const level = Number(tag.slice(1))
+      stack.length = level
+      stack[level - 1] = flatten(el.innerText ?? '')
+      return
+    }
+    if (tag === 'TR') {
+      if (!seen.has(el)) { seen.add(el); row(el) }
       return
     }
     if (BLOCK.has(tag)) {
@@ -1172,7 +1208,23 @@ export function blocks(budget) {
   }
   walk(root)
   const title = document.title
-  return JSON.stringify({ title, blocks: out })
+  /* The page arrives in document order, so a menu at the top would spend the
+     whole budget before the article starts. Keep the blocks that read like
+     content, still in page order, until the budget is spent. */
+  let kept = out
+  const total = out.reduce((sum, block) => sum + block.t.length, 0)
+  if (total > limit) {
+    const byQuality = out.map((block, at) => ({ block, at })).sort((a, b) => b.block.q - a.block.q || a.at - b.at)
+    const keep = new Set()
+    let used = 0
+    for (const one of byQuality) {
+      if (used + one.block.t.length > limit) continue
+      keep.add(one.at)
+      used += one.block.t.length
+    }
+    kept = out.filter((block, at) => keep.has(at))
+  }
+  return JSON.stringify({ title, blocks: kept })
 })()`
 }
 
@@ -1217,6 +1269,20 @@ function brief(value) {
   return body.length > 260 ? `${body.slice(0, 260).replace(/\s+\S*$/, '')}…` : body
 }
 
+/**
+ * The trail of headings a block sits under, when it says more than the nearest
+ * one: "Pricing › Refunds" tells a caller where a fact lives, which a bare
+ * sentence cannot. Kept short so location never costs more than it explains.
+ * @param {{h?: string, p?: string}} block - the block.
+ * @returns {string} what to print above the passage.
+ */
+export function trailOf(block) {
+  const path = String(block?.p ?? '')
+  const near = String(block?.h ?? '')
+  if (path === '' || path === near || path.length > 90) return near
+  return path
+}
+
 /**
  * Rank blocks against a query the way a search engine ranks a passage: BM25,
  * with the heading counted as a place a term can match. Then read only the
@@ -1228,7 +1294,7 @@ function brief(value) {
 export function rank(blocks, query) {
   const asked = terms(query)
   if (asked.length === 0) return []
-  const docs = blocks.map((block) => ({ block, terms: terms(`${block.h ?? ''} ${block.t}`) }))
+  const docs = blocks.map((block) => ({ block, terms: terms(`${block.p ?? ''} ${block.h ?? ''} ${block.t}`) }))
   const average = docs.reduce((sum, one) => sum + one.terms.length, 0) / Math.max(1, docs.length)
   const seen = new Map()
   for (const one of docs) for (const term of new Set(one.terms)) seen.set(term, (seen.get(term) ?? 0) + 1)
@@ -1250,6 +1316,9 @@ export function rank(blocks, query) {
     /* A block that is nearly all link is a menu: it matches words without
        saying anything about them. */
     score *= 1 - 0.8 * Number(one.block.d ?? 0)
+    /* Prose that answers a question outranks a fragment of navigation that
+       happens to contain the same words; the quality number says which. */
+    score *= 0.85 + 0.15 * Number(one.block.q ?? 0.5)
     if (score > 0) scored.push({ block: one.block, score })
   }
   scored.sort((a, b) => b.score - a.score)
@@ -1297,7 +1366,7 @@ export function evidence(blocks, query, options = {}) {
   const near = rank(blocks, query).slice(0, Math.max(1, Math.min(60, Number(options.blocks ?? 40))))
   const units = []
   for (const row of near) {
-    const heading = String(row.block.h ?? '')
+    const heading = trailOf(row.block)
     const body = String(row.block.t ?? '')
     const parts = sentences(body)
     for (let step = 0; step < parts.length; step += 1) {
@@ -1339,8 +1408,9 @@ export function evidence(blocks, query, options = {}) {
        both say "this is the right place", so they lift their sentences. */
     const headingHit = asked.filter((term) => terms(unit.heading).includes(term)).length
     /* A menu sentence can match the words without saying anything about them;
-       the paragraph's link density is what tells the two apart. */
-    const linkish = 1 - 0.8 * Number(unit.block?.d ?? 0)
+       the paragraph's link density and how much it reads like prose tell the
+       two apart, and a table row is data rather than a sentence to distrust. */
+    const linkish = (1 - 0.8 * Number(unit.block?.d ?? 0)) * (unit.block?.r === 1 ? 1 : 0.9 + 0.1 * Number(unit.block?.q ?? 0.5))
     unit.score = score * linkish * (1 + 0.25 * headingHit) * (1 + 0.5 * (unit.prior > 0 ? 1 : 0))
   }
   /* Below a fifth of the best sentence, a match is coincidence rather than
@@ -1424,7 +1494,7 @@ export async function readRelevant(page, query, options = {}) {
     for (const row of pieces.slice(0, limit)) {
       const body = String(row.block.t ?? '')
       if (used + body.length > budget) continue
-      const heading = String(row.block.h ?? '')
+      const heading = trailOf(row.block)
       if (heading !== '' && heading !== lastHeading) { lines.push(`## ${heading}`); lastHeading = heading }
       lines.push(body)
       used += body.length

package/tools.js

@@ -16,7 +16,8 @@ import { basename, join } from 'node:path'
 import { mkdir, readdir, stat, unlink, writeFile } from 'node:fs/promises'
 import { VIEW, DESKTOP_UA } from './sidecar.js?v=1'
 import { planOf, gather, sizeText, coreRows } from './media.js?m=2'
-import { dropLogin, listLogins, readLogin, saveLogin, vaultState } from './vault.js'
+import { dropLogin, listLogins, readLogin, saveLogin, signInsFor, vaultState } from './vault.js'
+import { readBrowserCookies, siteOf } from './chromecookies.js'
 import { readPage, renderPage, readArticle, readRelevant, readTabs, findOnPage, locate, locateFirst, FRAME_BASE, covering, contextFor, identityOf, sameThing, differs, labelSpot, selectSpot, bounds, pictures, clickInDom, writeInDom, REF_GONE } from './read.js?v=1'
 import { brief as askBrief, recordRound, lastRoundNote, lastRound, markRound, MARK_STATUS } from './review.js?v=1'
 
@@ -966,6 +967,106 @@ async function evaluate(page, expression, route, raceMs = 2000) {
   return result?.value
 }
 
+/**
+ * A password field and little else is the one shape of page that can never
+ * answer a read: it is the site asking who this is, not the site's content.
+ * @param {any} page - sidecar page.
+ * @returns {Promise<boolean>} whether the page is asking for a sign-in.
+ */
+async function signInWall(page) {
+  const raw = await evaluate(
+    page,
+    '(() => { try { if (document.querySelector("input[type=password]") === null) return "0"; const text = document.body === null ? "" : String(document.body.innerText); return text.length > 3000 ? "0" : "1" } catch { return "0" } })()',
+    null,
+    2000,
+  )
+  return String(raw ?? '') === '1'
+}
+
+/**
+ * Puts a kept sign-in back on the page: cookies first, then the local storage of
+ * the sites it kept, which is where some sites keep the sign-in itself.
+ * @param {any} page - sidecar page.
+ * @param {any} held - what the vault opened.
+ * @returns {Promise<{put: number, stored: number}>} cookies and storage entries written.
+ */
+async function applySignIn(page, held) {
+  let put = 0
+  for (const cookie of (Array.isArray(held?.cookies) ? held.cookies : []).slice(0, 400)) {
+    const domain = String(cookie?.domain ?? '').replace(/^\./u, '')
+    if (domain === '' || cookie?.name === undefined) continue
+    try {
+      await page.setCookie({
+        name: String(cookie.name),
+        value: String(cookie.value ?? ''),
+        domain,
+        path: String(cookie.path ?? '/'),
+        secure: cookie.secure === true,
+        httpOnly: cookie.httpOnly === true,
+        sameSite: cookie.sameSite,
+        expires: cookie.session === true ? undefined : Number(cookie.expires) || undefined,
+      })
+      put += 1
+    } catch {
+      /* one cookie a site refuses is not a reason to stop */
+    }
+  }
+  let stored = 0
+  for (const row of (Array.isArray(held?.storage) ? held.storage : []).slice(0, 4)) stored += await restoreStorage(page, row)
+  return { put, stored }
+}
+
+/**
+ * Waits, briefly, for a navigation to actually land: the page reports its own
+ * address and load state, so a read after it never runs against the page being
+ * left behind.
+ * @param {any} page - sidecar page.
+ * @param {string} url - where it was sent.
+ * @returns {Promise<boolean>} whether it got there.
+ */
+async function arrived(page, url, was) {
+  for (let i = 0; i < 20; i += 1) {
+    const raw = await evaluate(page, 'JSON.stringify([location.href, document.readyState, performance.timeOrigin])', null, 1500)
+    if (typeof raw === 'string' && raw !== '') {
+      try {
+        const [here, state, born] = JSON.parse(raw)
+        if (String(here) === String(url) && String(state) === 'complete' && Number(born) !== Number(was)) return true
+      } catch {
+        /* a page mid-navigation can answer with half a document; ask again */
+      }
+    }
+    await new Promise((settle) => setTimeout(settle, 100))
+  }
+  return false
+}
+
+/**
+ * A sign-in form answers nothing, and the sign-in may already be kept. Putting
+ * it back and reading once is one call where naming the account, using it and
+ * reading again is three. Never guesses: one site with one kept sign-in only.
+ * @param {any} page - sidecar page.
+ * @param {string} url - the address that showed the form.
+ * @param {boolean} [wall] - already known to be a sign-in form.
+ * @returns {Promise<{name: string, note: string, wall: boolean}>} the account put back, what to say when none was, and whether a form is what is there.
+ */
+async function signInFor(page, url, wall) {
+  if (page === null || page === undefined) return { name: '', note: '', wall: false }
+  const form = wall === undefined ? await signInWall(page) : wall === true
+  if (!form) return { name: '', note: '', wall: false }
+  const matches = signInsFor(String(url ?? page.url ?? ''))
+  const names = matches.map((one) => one.name)
+  if (names.length === 0) return { name: '', note: '', wall: true }
+  if (names.length > 1) return { name: '', note: ` (${String(names.length)} saved sign-ins cover this site: ${names.join(', ')} — browser_login {action:"use", name:"…"} picks one)`, wall: true }
+  const held = readLogin(names[0])
+  if (held === null) return { name: '', note: '', wall: true }
+  const { put } = await applySignIn(page, held)
+  if (put === 0) return { name: '', note: ` (the saved sign-in "${names[0]}" had nothing this site accepts)`, wall: true }
+  const born = await evaluate(page, 'performance.timeOrigin', null, 1500).catch(() => undefined)
+  await page.navigate(String(url ?? page.url ?? held.url ?? ''))
+  await arrived(page, String(url ?? page.url ?? held.url ?? ''), born)
+  return { name: names[0], note: '', wall: true }
+}
+
 /**
  * The local storage a page is holding, per origin: some sites keep the sign-in
  * itself there and cookies alone would come back signed out.
@@ -2234,6 +2335,7 @@ export function sidecarTools(sidecar, refs, host = {}) { // ui-copy-ignore
           query: { type: 'string', description: 'What you want to know. With a query, only the passages that answer it come back, ranked — the cheapest way to read a long page. Without one, the whole page comes back.' },
           force: { type: 'boolean', description: 'Read again even if the page has not changed since this chat last read it.' },
           across: { type: 'boolean', description: 'When this tab has no answer, also read the other tabs this chat holds and answer from whichever has it. Default true; pass false to stay on this one.' },
+          signin: { type: 'boolean', description: 'When the page is showing a sign-in form and the vault holds exactly one sign-in for the site, put it back and read once. Default true; pass false to read the form itself.' },
         },
         additionalProperties: false,
       },
@@ -2264,7 +2366,29 @@ export function sidecarTools(sidecar, refs, host = {}) { // ui-copy-ignore
             /* The answer may be in the tab behind this one. Reading every tab
                this chat holds is one call, where switching and reading again is
                two, so the miss tries the others before it gives up. */
+            /* A sign-in form is the one page that can never answer: it is asking
+               who this is. If the vault holds exactly one sign-in for the site,
+               put it back and read once, where looking it up, using it and
+               reading again is three calls. */
+            const wall = await signInWall(page)
             let note = ''
+            if (wall && args?.signin !== false) {
+              const put = await signInFor(page, String(found.url ?? ''), true)
+              if (put.name !== '') {
+                const after = await readRelevant(page, asked, { maxChars: ceiling })
+                if (after.text !== '') {
+                  return `${after.url}\n# ${after.title === '' ? '(untitled)' : after.title}\n\nsigned back in as "${put.name}" before reading (the page was showing a sign-in form):\n\n${after.text}\n\n(${String(after.matched)} of ${String(after.total)} blocks, ranked for ${JSON.stringify(asked)})`
+                }
+                note = ` (put the saved sign-in "${put.name}" back, and the page still does not answer)`
+              } else {
+                note = put.note
+              }
+            }
+            /* A page still showing a sign-in form is not worth remembering as
+               read: the same text on the next call would hide that the form is
+               all that is there, and a sign-in that arrives later would never be
+               tried. Only the miss on a real page is kept. */
+            const save = (text) => (wall ? text : keep(text))
             if (args?.across !== false) {
               const others = await sidecar.elsewhere(currentSession()).catch(() => [])
               if (others.length > 0) {
@@ -2291,11 +2415,11 @@ export function sidecarTools(sidecar, refs, host = {}) { // ui-copy-ignore
               const body = closest
                 .map((row) => `${row.heading === '' ? '' : `## ${String(row.heading)}\n`}${String(row.text)}`)
                 .join('\n\n')
-              return keep(`${found.url}\n# ${found.title === '' ? '(untitled)' : found.title}\n\nnothing directly answers ${JSON.stringify(asked)} (${String(found.total)} blocks read).${note} The closest passages:\n\n${body}\n\nask for the whole page with browser_view, or try other words.`)
+              return save(`${found.url}\n# ${found.title === '' ? '(untitled)' : found.title}\n\nnothing directly answers ${JSON.stringify(asked)} (${String(found.total)} blocks read).${note} The closest passages:\n\n${body}\n\nask for the whole page with browser_view, or try other words.`)
             }
             const whole = await readArticle(page, { maxChars: ceiling })
             if (whole.fault === undefined && whole.text !== '') {
-              return keep(`${whole.url}\n# ${whole.title === '' ? '(untitled)' : whole.title}\n\nnothing here answers ${JSON.stringify(asked)} (${String(found.total)} blocks read).${note} so the whole page follows:\n\n${whole.text}${whole.truncated ? `\n\n(cut at ${String(whole.chars)} characters; raise max_chars for more)` : ''}`)
+              return save(`${whole.url}\n# ${whole.title === '' ? '(untitled)' : whole.title}\n\nnothing here answers ${JSON.stringify(asked)} (${String(found.total)} blocks read).${note} so the whole page follows:\n\n${whole.text}${whole.truncated ? `\n\n(cut at ${String(whole.chars)} characters; raise max_chars for more)` : ''}`)
             }
             return `${found.url}\n# ${found.title === '' ? '(untitled)' : found.title}\n\nnothing here answers ${JSON.stringify(asked)} (${String(found.total)} blocks read).${note} Call browser_view for the whole page, or try other words.`
           }
@@ -2306,6 +2430,16 @@ export function sidecarTools(sidecar, refs, host = {}) { // ui-copy-ignore
         if (read.text === '') {
           const pdf = await pdfNote(page)
           if (pdf !== '') return `${read.url}\n# ${read.title === '' ? '(untitled)' : read.title}${pdf}`
+          if (args?.signin !== false) {
+            const put = await signInFor(page, String(read.url ?? ''))
+            if (put.name !== '') {
+              const again = await readArticle(page, { maxChars: ceiling })
+              if (again.text !== '') {
+                const tail2 = again.truncated ? `\n\n(cut at ${String(again.chars)} characters; raise max_chars for more)` : ''
+                return `${again.url}\n# ${again.title === '' ? '(untitled)' : again.title}\n\nsigned back in as "${put.name}" before reading (the page was showing a sign-in form):\n\n${again.text}${tail2}`
+              }
+            }
+          }
           return `${read.url}\n# ${read.title === '' ? '(untitled)' : read.title}\n\nnothing to read here: the page draws its content, or it is still loading. Call browser_view to see what is on screen.`
         }
         const head = `${read.url}\n# ${read.title === '' ? '(untitled)' : read.title}`
@@ -3145,12 +3279,13 @@ export function sidecarTools(sidecar, refs, host = {}) { // ui-copy-ignore
 
     {
       name: 'browser_login', // ui-copy-ignore
-      description: 'Sign-ins belong to the browser, not to a chat: every chat uses them and they survive a restart. "save" keeps the sign-in showing right now under a name, "list" shows what is kept, "use" signs the browser back in as that account and reopens the page, "drop" forgets it. What is written is sealed, and the key is the one in the system keystore. One site can hold several accounts: save them under different names and switch with "use".',
+      description: 'Sign-ins belong to the browser, not to a chat: every chat uses them and they survive a restart. "save" keeps the sign-in showing right now under a name, "list" shows what is kept, "use" signs the browser back in as that account and reopens the page, "drop" forgets it, "import" takes a sign-in that is already in Chrome on this Mac and keeps it under a name. What is written is sealed, and the key is the one in the system keystore. One site can hold several accounts: save them under different names and switch with "use".',
       parameters: { // ui-copy-ignore
         type: 'object',
         properties: {
-          action: { type: 'string', enum: ['list', 'save', 'use', 'drop'], description: 'list, save, use or drop.' },
-          name: { type: 'string', description: 'Account name, for example "work" or "personal". Needed by save, use and drop.' },
+          action: { type: 'string', enum: ['list', 'save', 'use', 'drop', 'import'], description: 'list, save, use, drop or import.' },
+          name: { type: 'string', description: 'Account name, for example "work" or "personal". Needed by save, use, drop and import.' },
+          browser: { type: 'string', enum: ['chrome', 'brave', 'edge', 'chromium'], description: 'Where import looks for the sign-in. Default chrome.' },
         },
         required: ['action'], // ui-copy-ignore
         additionalProperties: false,
@@ -3179,6 +3314,25 @@ export function sidecarTools(sidecar, refs, host = {}) { // ui-copy-ignore
         if (action === 'drop') {
           return { text: dropLogin(name) ? `Forgot "${name}".` : `Nothing saved as "${name}".` }
         }
+        if (action === 'import') {
+          if (name === '') return { text: 'Name the account: browser_login {action:"import", name:"work"}.' }
+          const page = await sidecar.ensure({ session: currentSession() })
+          const url = String(page.url ?? '')
+          if (!/^https?:/u.test(url)) return { text: 'Open the site first, then import its sign-in.' }
+          let found
+          try {
+            found = readBrowserCookies({ browser: String(args?.browser ?? 'chrome'), url })
+          } catch (error) {
+            return { text: String(error?.message ?? error) }
+          }
+          const kept = saveLogin(name, { cookies: found.cookies, storage: [], url })
+          const was = await evaluate(page, 'performance.timeOrigin', null, 1500).catch(() => undefined)
+          await applySignIn(page, readLogin(name))
+          await page.navigate(url)
+          await arrived(page, url, was)
+          const skipped = found.sealed === 0 ? '' : ', ' + String(found.sealed) + ' could not be opened'
+          return { text: 'Imported "' + kept.name + '" from ' + found.label + ': ' + String(kept.cookieCount) + ' cookies for ' + siteOf(url) + skipped + ', sealed on disk. The page is open again.' }
+        }
         if (action === 'save') {
           const page = await sidecar.ensure({ session: currentSession() })
           const cookies = await page.cookies()
@@ -3191,35 +3345,14 @@ export function sidecarTools(sidecar, refs, host = {}) { // ui-copy-ignore
           const held = readLogin(name)
           if (held === null) return { text: `Nothing saved as "${name}". browser_login {action:"list"} shows what is kept.` }
           const page = await sidecar.ensure({ session: currentSession() })
-          let put = 0
-          for (const cookie of (Array.isArray(held.cookies) ? held.cookies : []).slice(0, 400)) {
-            const domain = String(cookie?.domain ?? '').replace(/^\./u, '')
-            if (domain === '' || cookie?.name === undefined) continue
-            try {
-              await page.setCookie({
-                name: String(cookie.name),
-                value: String(cookie.value ?? ''),
-                domain,
-                path: String(cookie.path ?? '/'),
-                secure: cookie.secure === true,
-                httpOnly: cookie.httpOnly === true,
-                sameSite: cookie.sameSite,
-                expires: cookie.session === true ? undefined : Number(cookie.expires) || undefined,
-              })
-              put += 1
-            } catch {
-              /* one cookie a site refuses is not a reason to stop */
-            }
-          }
-          let stored = 0
-          for (const row of (Array.isArray(held.storage) ? held.storage : []).slice(0, 4)) stored += await restoreStorage(page, row)
+          const { put, stored } = await applySignIn(page, held)
           const back = String(held.url ?? '')
           if (back !== '') await page.navigate(back)
           else await page.reload()
           const said = stored === 0 ? '' : `, ${stored} local storage entries`
           return { text: `Signed in as "${name}": ${put} cookies${said}, page reopened.` }
         }
-        return { text: 'Pass action "list", "save", "use" or "drop".' }
+        return { text: 'Pass action "list", "save", "use", "drop" or "import".' }
       },
     },
 

package/vault.js

@@ -305,6 +305,51 @@ export function dropLogin(name) {
   return true
 }
 
+/** @param {string} value - an address. @returns {string} its host, without a leading www. */ // ui-copy-ignore
+function hostOf(value) {
+  try {
+    return new URL(String(value)).hostname.replace(/^www\./u, '').toLowerCase()
+  } catch {
+    return ''
+  }
+}
+
+/** @param {string} host - the page. @param {string} domain - a cookie domain or an address host. @returns {boolean} whether the page is on it. */ // ui-copy-ignore
+function onSite(host, domain) { // ui-copy-ignore
+  const bare = String(domain ?? '').replace(/^\./u, '').toLowerCase()
+  if (bare === '' || host === '') return false // ui-copy-ignore
+  return host === bare || host.endsWith(`.${bare}`) // ui-copy-ignore
+}
+
+/**
+ * The kept sign-ins that could sign this address in: a cookie domain of the
+ * page's host or its parent, or the very site it was saved on. Names and counts // ui-copy-ignore
+ * only — the cookies stay sealed until one of them is actually put back.
+ * @param {string} url - the page asking.
+ * @returns {Array<{name: string, savedAt: number, cookieCount: number}>} matches, newest first.
+ */
+export function signInsFor(url) {
+  const host = hostOf(url) // ui-copy-ignore
+  if (host === '') return [] // ui-copy-ignore
+  const dir = loginDir()
+  let names = []
+  try {
+    names = readdirSync(dir).filter((name) => name.endsWith('.json'))
+  } catch {
+    return []
+  }
+  const rows = []
+  for (const name of names) {
+    const held = readSealed(join(dir, name))
+    if (held === null || typeof held !== 'object') continue
+    const cookies = Array.isArray(held.cookies) ? held.cookies : []
+    const covers = cookies.some((cookie) => onSite(host, String(cookie?.domain ?? ''))) || onSite(host, hostOf(held.url)) // ui-copy-ignore
+    if (!covers) continue
+    rows.push({ name: String(held.name ?? name.replace(/\.json$/u, '')), savedAt: Number(held.savedAt ?? 0), cookieCount: cookies.length })
+  }
+  return rows.sort((a, b) => b.savedAt - a.savedAt)
+}
+
 /**
  * How big the vault is, and whether the key is outside it: the two facts a
  * person wants when deciding whether a sign-in is safe to leave here.