harnery 0.45.1 → 0.46.0

package/src/commands/agents.ts

@@ -78,6 +78,10 @@ import {
   readLiveCoordinationRows,
 } from "../core/agents/state/live-coordination-view.ts";
 import { forkRelationLabels, resolveForkAncestry } from "../core/agents/state/names.ts";
+import {
+  type AgentParentReference,
+  resolveAgentParentReference,
+} from "../core/agents/state/parent-reference.ts";
 import {
   type AgentActivity,
   foldSessionState,
@@ -114,6 +118,7 @@ import {
 import {
   listHookProducerStateRecordsV3,
   readHookProducerStateV3,
+  scanHookProducerStateRecordsV3,
 } from "../core/events/v3/producers/recorder.ts";
 import { readLedgerV3 } from "../core/events/v3/reader.ts";
 import { EVENT_V3_LEDGER_RELATIVE_ROOT } from "../core/events/v3/writer.ts";
@@ -124,7 +129,11 @@ import {
   readRuntimeContextUsage,
 } from "../core/hooks/adapter/runtime-telemetry.ts";
 import { HarneryInboxCapacityError } from "../core/inbox/contract.ts";
-import { peerInbox, sendPeerMessage } from "../core/inbox/peer-messages.ts";
+import {
+  type PeerRecipientResult,
+  peerInbox,
+  sendPeerMessage,
+} from "../core/inbox/peer-messages.ts";
 import { type RemoteMachine, readRemoteMachines } from "../core/presence/index.ts";
 import { formatResourceSummary, readResourceStatus } from "../core/resources/status.ts";
 import { registerContextCommand } from "./context.ts";
@@ -532,17 +541,31 @@ export function registerAgentsCommand(
     .command("ping <name> <message...>")
     .description(
       "Queue a durable message for one known task instance by name. Stale or " +
-        "done tasks receive it when that same task resumes. Ambiguous names " +
+        "done tasks receive it when that same task resumes. A recipient on " +
+        "another machine is reached through the shared origin. Ambiguous names " +
         "require an exact instance; receipts do not confirm attention.",
     )
     .option("--instance-id <id>", "Select the exact known recipient instance")
+    .option("--generation-id <id>", "Require the exact recipient generation")
+    .option("--operation-id <id>", "Reuse a frozen delivery operation after a caller retry")
+    .option(
+      "--operation-replay-only",
+      "Require an existing plan after an ambiguous caller dispatch",
+    )
     .option("--require-live", "Refuse a recipient outside live presence")
     .option("--json", "JSON output")
     .action(
       (
         name: string,
         message: string[],
-        opts: { json?: boolean; instanceId?: string; requireLive?: boolean },
+        opts: {
+          json?: boolean;
+          instanceId?: string;
+          generationId?: string;
+          operationId?: string;
+          operationReplayOnly?: boolean;
+          requireLive?: boolean;
+        },
       ) => {
         runPing(name, message.join(" "), opts);
       },
@@ -1754,6 +1777,7 @@ async function runShow(name: string, opts: { json?: boolean }): Promise<void> {
     tool_counts: report?.tool_counts ?? [],
     total_events: report?.total_events ?? 0,
     bq_error: bqError,
+    parent_reference: resolveAgentParentReference(root, hb),
   };
 
   if (opts.json) {
@@ -1774,6 +1798,7 @@ async function runShow(name: string, opts: { json?: boolean }): Promise<void> {
     `  session  ${formatAge(ageSecs)} old · kind=${data.kind} · session_id=${data.session_id.slice(0, 8)}…`,
   );
   lines.push(`  last heartbeat: ${formatAge(heartbeatAgeSecs)} ago`);
+  lines.push(`  parent:         ${describeParentReference(data.parent_reference)}`);
   lines.push(`  activity:       ${data.activity}`);
   lines.push(
     `  lifecycle:      ${data.task_state}${data.task_state === "blocked" && data.task_state_reason ? `: ${data.task_state_reason}` : ""}`,
@@ -2542,6 +2567,7 @@ function runStatus(opts: {
     name: displayName,
     instance_id: hb.instance_id,
     kind: normalizeKind(hb.kind),
+    parent_reference: resolveAgentParentReference(root, hb),
     session_age_secs: ageSecs,
     turn_elapsed_secs: turnElapsed ? turnElapsed.elapsed.secs : null,
     turn_complete: turnElapsed ? turnElapsed.elapsed.complete : null,
@@ -2596,6 +2622,7 @@ function runStatus(opts: {
     ["changes", turnChanges.value],
     ["activity", activityOf(hb)],
     ["lifecycle", lifecycleLabel(hb)],
+    ["parent", describeParentReference(data.parent_reference)],
     ["context", ctxStr],
     ["resources", formatResourceSummary(resources)],
     ["files", filesStr],
@@ -3299,7 +3326,13 @@ export function collectEventLedgerHealthV3(root: string, nowMs = Date.now()): Ev
     [];
   const spanPressure: Extract<EventLedgerHealthV3, { state: "live" }>["span_pressure"] = [];
   try {
-    for (const { state } of listHookProducerStateRecordsV3(root)) {
+    const scan = scanHookProducerStateRecordsV3(root);
+    for (const file of scan.invalid) {
+      collectionErrors.push(
+        `producer state skipped (${file.adapter}/${file.session_hash}.json): ${file.reason}`,
+      );
+    }
+    for (const { state } of scan.records) {
       if (state.spans.length >= SPAN_PRESSURE_SOFT_WATERMARK) {
         spanPressure.push({
           instance_id: state.instance_id,
@@ -4878,10 +4911,42 @@ function formatDuration(ms: number): string {
   return h > 0 ? `${d}d${h}h` : `${d}d`;
 }
 
+export function describeParentReference(reference: AgentParentReference): string {
+  return reference.state === "verified"
+    ? `${reference.parent_name ?? "unnamed"} (${reference.parent_instance_id}; ${reference.source}; ${reference.addressable ? "addressable" : "not addressable"})`
+    : `${reference.state}: ${reference.reason}`;
+}
+
+export function formatPeerRecipientReceipt(recipient: PeerRecipientResult): string {
+  if (!recipient.ok) return `${recipient.code}: ${recipient.message}`;
+  const address = `agent-${recipient.target.name} (${recipient.target.instance_id})`;
+  if (recipient.delivery_state === "delivered")
+    return `Previously acknowledged by the recipient machine for ${address}; task attention is not confirmed.`;
+  if (recipient.delivery_state === "expired")
+    return `The prior remote message for ${address} expired; no new delivery is established.`;
+  if (recipient.target.machine)
+    return (
+      `Stored for ${address} on ${recipient.target.machine} as ${recipient.message_id}. ` +
+      (recipient.published
+        ? "Published to origin; recipient-machine import is not confirmed."
+        : `Publication is not confirmed${recipient.publish_error ? ` (${recipient.publish_error})` : ""}.`)
+    );
+  return recipient.state === "duplicate"
+    ? `Previously stored for ${address} as ${recipient.message_id}; current surface state is not established by this receipt.`
+    : `Stored for ${address} as ${recipient.message_id}; task attention is not confirmed.`;
+}
+
 function runPing(
   name: string,
   message: string,
-  opts: { json?: boolean; instanceId?: string; requireLive?: boolean },
+  opts: {
+    json?: boolean;
+    instanceId?: string;
+    generationId?: string;
+    operationId?: string;
+    operationReplayOnly?: boolean;
+    requireLive?: boolean;
+  },
 ): void {
   if (!message || message.trim().length === 0) {
     emit.error({ code: "empty_message", message: "message is required (and non-empty)" });
@@ -4910,10 +4975,17 @@ function runPing(
   try {
     sent = sendPeerMessage({
       coordRoot,
-      target: { name, instanceId: opts.instanceId, requireLive: opts.requireLive },
+      target: {
+        name,
+        instanceId: opts.instanceId,
+        generationId: opts.generationId,
+        requireLive: opts.requireLive,
+      },
+      operationId: opts.operationId,
+      operationReplayOnly: opts.operationReplayOnly,
       senderName: fromName,
       senderInstanceId: myOwner,
-      body: message.trim(),
+      body: message,
     });
   } catch (error) {
     if (error instanceof HarneryInboxCapacityError) {
@@ -4922,51 +4994,84 @@ function runPing(
     }
     throw error;
   }
+  if (opts.json) emit.config({ format: "json" });
+  const routing = {
+    operation_id: sent.operation_id,
+    child: sent.child,
+    parent_reference: sent.parent_reference,
+    parent_copy: sent.parent_copy,
+    complete: sent.complete,
+  };
+  // Keep both actual recipient writes visible, including parent-only success.
+  for (const recipient of [sent.child, sent.parent_copy]) {
+    if (!("ok" in recipient) || !recipient.ok) continue;
+    emitEventV3({
+      owner: myOwner,
+      session: nativeSessionIdentity(myHb, myOwner),
+      adapter: normalizeAdapter(myHb?.platform),
+      observation: {
+        event_type: "coord.message_observed",
+        direction: "sent",
+        subject: recipient.target.instance_id,
+        message_id: recipient.message_id,
+        body:
+          recipient === sent.child
+            ? message
+            : `[Parent copy for agent-${sent.child.target?.name} (${sent.child.target?.instance_id})]\n${message}`,
+      },
+    });
+  }
   if (!sent.ok) {
-    emit.error({
+    emit.data({
+      ...routing,
+      ok: false,
       code: sent.code,
       message: sent.message,
+      from: fromName,
       ...(sent.candidates ? { candidates: sent.candidates } : {}),
     });
-    process.exit(1);
+    process.exitCode = 1;
+    return;
   }
 
-  // Canonical delivery record: sender is the envelope owner, recipient rides
-  // in data, so read-only observers can render the communication without
-  // joining journal files.
-  emitEventV3({
-    owner: myOwner,
-    session: nativeSessionIdentity(myHb, myOwner),
-    adapter: normalizeAdapter(myHb?.platform),
-    observation: {
-      event_type: "coord.message_observed",
-      direction: "sent",
-      subject: sent.target.instance_id,
-      message_id: sent.message_id,
-      body: message.trim(),
-    },
-  });
-
+  const remote = "published" in sent ? sent : null;
   const data = {
+    ...routing,
     peer: sent.target.name,
     peer_instance_id: sent.target.instance_id,
+    ...(sent.target.machine ? { peer_machine: sent.target.machine } : {}),
     state: sent.state,
     message_id: sent.message_id,
     synced: sent.synced,
     body_bytes: sent.body_bytes,
     from: fromName,
+    ...(remote
+      ? {
+          published: remote.published,
+          ...(remote.delivery_state ? { delivery_state: remote.delivery_state } : {}),
+          ...(remote.publish_error ? { publish_error: remote.publish_error } : {}),
+        }
+      : {}),
   };
 
   if (opts.json) {
     emit.config({ format: "json" });
     emit.data(data);
+    if (!sent.complete) process.exitCode = 1;
     return;
   }
   emit.data(data);
+  if (!sent.complete) process.exitCode = 1;
   emit.text(
-    `${data.state} for agent-${data.peer} (${data.peer_instance_id}); ` +
-      `stored as ${data.message_id}, pending until surfaced to that task.\n`,
+    `parent copy: ${
+      "ok" in sent.parent_copy
+        ? sent.parent_copy.ok
+          ? formatPeerRecipientReceipt(sent.parent_copy)
+          : `${sent.parent_copy.code}: ${sent.parent_copy.message}`
+        : `skipped (${sent.parent_copy.reason})`
+    }\n`,
   );
+  emit.text(`${formatPeerRecipientReceipt(sent.child)}\n`);
 }
 
 async function runWait(

package/src/commands/browse.ts

@@ -74,6 +74,7 @@ import {
 } from "../lib/browser/page-review-budget.ts";
 import {
   PAGE_REVIEW_CAPTURE_PLAN_SCHEMA,
+  PAGE_REVIEW_MAX_TILE_BUDGET,
   type PageReviewCapturePlan,
   type PageReviewContextAllocation,
   type PageReviewSourceEvidence,
@@ -137,10 +138,19 @@ import {
   keepWindowsChromeSession,
   stopWindowsChromeProfile,
   windowsChromePath,
+  windowsChromeProfileProcesses,
   windowsLocalAppData,
+  windowsPathToWsl,
   windowsPlainProfile,
   wslPathToWindows,
 } from "../lib/browser/windows-chrome.ts";
+import {
+  type LoginSyncDeps,
+  type LoginSyncResult,
+  profileCookieDbMtimeMs,
+  recordLoginSync,
+  syncLoginCookies,
+} from "../lib/browser/windows-login-sync.ts";
 import { applyExtraCookies, CookieJar, mergeCookies } from "../lib/cookies/index.ts";
 import { commandPaceGate } from "../lib/pace/index.ts";
 
@@ -216,6 +226,7 @@ interface BrowseOpts {
   collectOut?: string;
   networkHar?: string;
   login?: boolean;
+  syncLogin?: boolean;
   attached?: boolean;
   loginCloseFile?: string;
   controlFile?: string;
@@ -249,7 +260,9 @@ interface BrowseOpts {
   checkWidthAnnotate?: boolean;
   // `--check-runts [selector]`: true = whole body, string = scope selector.
   checkRunts?: boolean | string;
+  checkScanNodeBudget?: string;
   checkRuntsMinChars?: string;
+  checkRuntsMaxFindings?: string;
   checkRuntsFail?: boolean;
   checkRuntsAnnotate?: boolean;
   // Horizontal-overflow check
@@ -350,6 +363,7 @@ const VIEWPORT_PRESETS: Record<string, { width: number; height: number }> = {
 // cookies/read: the many helper functions in this large file close over
 // `emit` so action callbacks stay concise.
 let emit: EmitContext;
+let browseBinName = "harn";
 
 export function registerBrowseCommand(
   program: Command,
@@ -358,6 +372,7 @@ export function registerBrowseCommand(
   binName = resolveBinName(),
 ): void {
   emit = emitParam;
+  browseBinName = binName;
   program
     .command("browse <url>")
     .description(
@@ -469,9 +484,17 @@ export function registerBrowseCommand(
     .option(
       "--login",
       "Open the URL in the installed Google Chrome with nothing attached (no DevTools protocol, no " +
-        "Playwright) so a person can sign in; under WSL this is the Windows host's Chrome. Sign in, then " +
-        "close the window or create the --login-close-file; later browse and browse-session runs reuse " +
-        "the cookies. Sites cannot tell this window from the person's own browser.",
+        "Playwright) so a person can sign in; under WSL this is the Windows host's Chrome on a dedicated " +
+        "sign-in profile. Sign in, then close the window or create the --login-close-file; later browse " +
+        "and browse-session runs reuse the cookies. Under WSL the profile can also stay in use as an " +
+        "ordinary browser: each headless browse copies the target site's cookies from it when it changed " +
+        "and is closed, and an open profile is left alone (see --sync-login). Sites cannot tell this " +
+        "window from the person's own browser.",
+    )
+    .option(
+      "--sync-login",
+      "WSL only: copy the URL's site cookies from the Windows sign-in profile into the cookie store " +
+        "now, then exit without loading the page. Refuses while Chrome is open on that profile.",
     )
     .option(
       "--attached",
@@ -621,6 +644,12 @@ export function registerBrowseCommand(
       "Minimum block text length to scan (default 40; smaller labels can't meaningfully wrap).",
       "40",
     )
+    .option(
+      "--check-runts-max-findings <n>",
+      "Maximum runt findings to retain (integer 1..5000, default 50). Reaching the limit " +
+        "still marks the sweep incomplete; the separate 5000-block scan cap is unchanged.",
+      "50",
+    )
     .option(
       "--check-runts-fail",
       "Run a document-wide runt check when needed; exit 2 on a runt, missing scope, or incomplete sweep.",
@@ -710,6 +739,10 @@ export function registerBrowseCommand(
     )
     .option("--check-crowd-fail", "Exit 2 when a crowd target fails, is unknown, or is missing.")
     .option("--no-check-crowd-annotate", "Skip crowd screenshot annotations.")
+    .option(
+      "--check-scan-node-budget <n>",
+      "Explicit geometry/content traversal budget per scope (1–100000 nodes). Omit to keep each rule's existing limit; incomplete scans remain unknown.",
+    )
     .option(
       "--check-placeholder [selector]",
       "Scan rendered text for unrendered template tokens and bound-value tells: " +
@@ -786,7 +819,7 @@ export function registerBrowseCommand(
     )
     .option(
       "--check-critique-max-tiles <n>",
-      "Cap on tiles sent to the model, to bound cost (default 24).",
+      `Cap on tiles sent to the model, to bound cost (default 24, at most ${PAGE_REVIEW_MAX_TILE_BUDGET}).`,
       "24",
     )
     .option("--check-critique-rubric <text>", "Override the default critique rubric.")
@@ -1000,6 +1033,23 @@ async function runBrowse(
     "--check-overlap-threshold",
   );
   const crowdMin = parseNonNegativeNumber(opts.checkCrowdMin ?? "6", "--check-crowd-min");
+  const scanNodeBudget =
+    opts.checkScanNodeBudget === undefined
+      ? undefined
+      : parsePositiveInt(opts.checkScanNodeBudget, "--check-scan-node-budget");
+  if (
+    scanNodeBudget !== undefined &&
+    (!Number.isSafeInteger(scanNodeBudget) || scanNodeBudget > 100_000)
+  ) {
+    throw new Error("--check-scan-node-budget must be an integer from 1 to 100000.");
+  }
+  const runtsMaxFindings = parsePositiveInt(
+    opts.checkRuntsMaxFindings ?? "50",
+    "--check-runts-max-findings",
+  );
+  if (runtsMaxFindings > 5000) {
+    throw new Error("--check-runts-max-findings must be an integer from 1 to 5000.");
+  }
   const hitProfile = parseTargetSizeProfile(opts.checkHitProfile ?? "wcag-aa");
 
   // Commander: `--no-cookies` turns `opts.cookies` into `false`. Default is `true`.
@@ -1048,6 +1098,13 @@ async function runBrowse(
     );
   }
 
+  if (opts.syncLogin) {
+    if (opts.login) throw new Error("--sync-login cannot run with --login.");
+    if (!jar) throw new Error("--sync-login needs the cookie store; drop --no-cookies.");
+    runSyncLogin(url, jar.path);
+    return;
+  }
+
   const collectPlan = opts.collect ? buildCollectPlan(opts) : null;
 
   const pace = commandPaceGate(opts.pace !== false, (message) => emit.log(message, "info"));
@@ -1067,12 +1124,15 @@ async function runBrowse(
     return;
   }
 
+  if (jar && loginMode === "none") autoSyncLoginCookies(url, jar.path);
+
   const channel = resolveBrowserChannel(opts, Boolean(headed));
   const userAgent = resolveUserAgent({
     requested: opts.userAgent,
     env: process.env.HARNERY_BROWSER_UA,
     chromeMajor: launchedChromeMajor(channel),
   });
+  const cookieGuard = context?.cookieGuard?.();
   const browser = new Browser({
     profileDir: opts.profile ?? DEFAULT_PROFILE,
     headed,
@@ -1084,6 +1144,7 @@ async function runBrowse(
     waitUntil: opts.waitUntil as BrowseOpts["waitUntil"] as never,
     recordHarPath: opts.networkHar ? resolve(opts.networkHar) : undefined,
     extraHeaders: context?.extraHeaders,
+    ...(cookieGuard ? { cookieGuard } : {}),
     pace,
     launchArgs: resolveLaunchArgs(opts, Boolean(headed), Boolean(proxy)),
     ...(channel ? { channel } : {}),
@@ -1183,6 +1244,7 @@ async function runBrowse(
         runts = await browser.checkRunts({
           scope: typeof opts.checkRunts === "string" ? opts.checkRunts : null,
           minChars: Number.parseInt(opts.checkRuntsMinChars ?? "40", 10),
+          maxFindings: runtsMaxFindings,
         });
       }
       const hasLayoutLint =
@@ -1194,6 +1256,7 @@ async function runBrowse(
       let layoutLint: LayoutLintResult | undefined;
       if (hasLayoutLint) {
         layoutLint = await browser.checkLayoutLint({
+          scanNodeBudget,
           align: (opts.checkAlign ?? []).map((selector) => ({
             selector,
             axis: alignAxis,
@@ -1231,6 +1294,7 @@ async function runBrowse(
       let content: ContentChecksResult | undefined;
       if (hasContentChecks) {
         content = await browser.checkContent({
+          scanNodeBudget,
           placeholder:
             opts.checkPlaceholder !== undefined
               ? { scope: contentScope(opts.checkPlaceholder) }
@@ -1792,6 +1856,9 @@ async function runBrowse(
       }
       if (failed.length > 0) process.exitCode = 2;
     }
+  } catch (error) {
+    // A cookie guard that stopped the session is the real failure, not the closed-page errors it caused.
+    throw browser.cookieGuardFault ?? error;
   } finally {
     process.removeListener("SIGINT", handleSigint);
     process.removeListener("SIGTERM", handleSigterm);
@@ -1799,6 +1866,7 @@ async function runBrowse(
     await browser.close();
     if (receivedSignal) process.exitCode = receivedSignal === "SIGINT" ? 130 : 143;
   }
+  if (browser.cookieGuardFault) throw browser.cookieGuardFault;
 }
 
 // ---------------------------------------------------------------------------
@@ -2800,7 +2868,7 @@ async function runQaPlanning(
     );
     const band = Number.parseInt(opts.checkCritiqueBand ?? "1400", 10);
     const overlap = Number.parseInt(opts.checkCritiqueOverlap ?? "120", 10);
-    const maxTiles = Number.parseInt(opts.checkCritiqueMaxTiles ?? "24", 10);
+    const maxTiles = critiqueTilingKnobs(opts).maxTiles;
     const estimatedFullPageTiles = Math.min(
       maxTiles,
       Math.max(1, Math.ceil(pageHeight / Math.max(1, band - overlap))),
@@ -2833,7 +2901,12 @@ function critiqueTilingKnobs(
   opts: BrowseOpts,
   tileBudgetPx?: number,
 ): { maxTiles: number; band: number; overlap: number } {
-  const maxTiles = Math.max(1, Number.parseInt(opts.checkCritiqueMaxTiles ?? "24", 10));
+  // No flag value can exceed the hard per-invocation ceiling.
+  const requested = Number.parseInt(opts.checkCritiqueMaxTiles ?? "24", 10);
+  const maxTiles = Math.min(
+    PAGE_REVIEW_MAX_TILE_BUDGET,
+    Math.max(1, Number.isFinite(requested) ? requested : 24),
+  );
   const bandFlag = Math.max(200, Number.parseInt(opts.checkCritiqueBand ?? "1400", 10));
   const band = tileBudgetPx ? Math.max(200, Math.min(bandFlag, tileBudgetPx)) : bandFlag;
   const overlap = Math.max(0, Number.parseInt(opts.checkCritiqueOverlap ?? "120", 10));
@@ -3452,6 +3525,125 @@ async function runPlainLogin(
   emit.log(`[--login] Chrome closed; cookies persisted in ${profileDir}.`, "info");
 }
 
+/**
+ * The WSL sign-in profile and the operations the cookie sync needs, or
+ * `undefined` when this machine has none (not WSL, no Windows Chrome, or
+ * `HARNERY_BROWSER_WSL_PLAIN=linux`).
+ */
+function windowsLoginProfile(): { profileWindows: string; deps: LoginSyncDeps } | undefined {
+  if (!useWindowsPlainLogin()) return undefined;
+  const chromeLinux = windowsChromePath();
+  const localAppData = windowsLocalAppData();
+  if (!chromeLinux || !localAppData) return undefined;
+  const chromeWindows = wslPathToWindows(chromeLinux);
+  const profileWindows = windowsPlainProfile(localAppData);
+  const profileLinux = windowsPathToWsl(profileWindows);
+  return {
+    profileWindows,
+    deps: {
+      cookieDbMtimeMs: () => profileCookieDbMtimeMs(profileLinux),
+      profileProcesses: () => windowsChromeProfileProcesses(profileWindows),
+      harvest: (domain) =>
+        harvestWindowsChromeCookies({
+          chromeWindows,
+          profileWindows,
+          domain,
+          pageTimeoutSeconds: 0,
+        }),
+    },
+  };
+}
+
+/** One-line summary of a sync that read cookies. Names only, never values. */
+function loginSyncSummary(result: LoginSyncResult, storePath: string): string {
+  if (result.status === "synced") {
+    return `Copied ${result.merged} ${result.domain} cookies (${result.sessionCookies} browser-session) from the sign-in profile into ${storePath}: ${result.names.join(", ")}.`;
+  }
+  return `The sign-in profile's ${result.domain} cookies (${result.cookies}) match the last copy; the cookie store was left as it is.`;
+}
+
+/**
+ * Before a headless run under WSL, copy the target site's cookies from the
+ * sign-in profile when the profile changed since the last copy and no
+ * Chrome is open on it. Failures are warnings; the run continues.
+ * `HARNERY_BROWSER_LOGIN_SYNC=off` turns it off.
+ */
+function autoSyncLoginCookies(url: string, storePath: string): void {
+  if ((process.env.HARNERY_BROWSER_LOGIN_SYNC ?? "").toLowerCase() === "off") return;
+  let profile: ReturnType<typeof windowsLoginProfile>;
+  let domain: string;
+  try {
+    profile = windowsLoginProfile();
+    domain = harvestDomain(url);
+  } catch {
+    return;
+  }
+  if (!profile) return;
+  try {
+    const result = syncLoginCookies({ domain, storePath, deps: profile.deps });
+    if (result.status === "open") {
+      emit.log(
+        `[login-sync] The shared sign-in window (Windows Chrome on ${profile.profileWindows}) is open and changed since ${domain} cookies were last copied; this run uses the cookie store as it is. Its ${domain} session reaches headless runs after you close that window, or run \`${browseBinName} browse --sync-login ${url}\` once it is closed.`,
+        "info",
+      );
+    } else if (result.status === "busy") {
+      emit.log(
+        "[login-sync] Another run is copying sign-in cookies; this run did not wait.",
+        "debug",
+      );
+    } else if (result.status === "synced" || result.status === "unchanged") {
+      emit.log(`[login-sync] ${loginSyncSummary(result, storePath)}`, "info");
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    emit.log(
+      `[login-sync] Could not copy ${domain} cookies from the sign-in profile; continuing with the cookie store as it is. ${message}`,
+      "warn",
+    );
+  }
+}
+
+/** `--sync-login`: copy the URL's site cookies from the sign-in profile now. */
+function runSyncLogin(url: string, storePath: string): void {
+  const profile = windowsLoginProfile();
+  if (!profile) {
+    throw new Error(
+      "--sync-login needs WSL with the Windows Google Chrome; this machine has no Windows sign-in profile.",
+    );
+  }
+  const domain = harvestDomain(url);
+  const result = syncLoginCookies({ domain, storePath, deps: profile.deps, force: true });
+  if (result.status === "no-profile") {
+    throw new Error(
+      `The sign-in profile ${profile.profileWindows} has no cookies yet; sign in with \`${browseBinName} browse --login ${url}\` first.`,
+    );
+  }
+  if (result.status === "open") {
+    throw new Error(
+      `Chrome is open on the sign-in profile ${profile.profileWindows} (process ${result.processes.join(", ")}). Close that window, then run --sync-login again.`,
+    );
+  }
+  if (result.status === "busy") {
+    throw new Error("Another run is copying sign-in cookies right now; try again in a moment.");
+  }
+  if (result.cookies === 0) {
+    emit.log(`[--sync-login] No ${domain} cookies were found in the sign-in profile.`, "warn");
+  } else {
+    emit.log(`[--sync-login] ${loginSyncSummary(result, storePath)}`, "info");
+  }
+  emit.data({
+    loginSync: {
+      domain,
+      store: storePath,
+      status: result.status,
+      cookies: result.cookies,
+      merged: result.merged,
+      sessionCookies: result.sessionCookies,
+      names: result.names,
+    },
+  });
+}
+
 /**
  * Under WSL, `--login` opens the Windows host's Google Chrome when one
  * is installed. Some sign-in flows reject every browser running inside WSL,
@@ -3528,6 +3720,16 @@ async function runWindowsPlainLogin(
   await Promise.race([exited, new Promise((r) => setTimeout(r, 5000))]);
   const domain = harvestDomain(url);
   const { cookies, pages } = harvestWindowsChromeCookies({ chromeWindows, profileWindows, domain });
+  try {
+    recordLoginSync({
+      domain,
+      storePath,
+      cookies,
+      cookieDbMtimeMs: profileCookieDbMtimeMs(windowsPathToWsl(profileWindows)),
+    });
+  } catch {
+    // The record only saves the next headless run a repeat read.
+  }
   const lastPage = pages[0] ?? null;
   const names = [...new Set(cookies.map((cookie) => cookie.name))].sort();
   const sessionCookies = cookies.filter((cookie) => cookie.expires <= 0).length;

package/src/commands/fetch.ts

@@ -111,6 +111,7 @@ async function runFetch(
       signal: ac.signal,
       extraHeaders: context?.extraHeaders,
       extraCookies: context?.extraCookies,
+      clientRedirects: context?.clientRedirects?.() || undefined,
       responseType: "bytes",
     });
   } finally {