typst-mcp 1.0.2 → 1.2.0

package/README.md

@@ -4,91 +4,39 @@
 
 **Model Context Protocol (MCP) server for [`https://typst.app`](https://typst.app) — cloud projects, Yjs CRDT editing, and Typst compiler diagnostics**
 
-Install from npm as [`typst-mcp`](https://www.npmjs.com/package/typst-mcp). Source repo: [`typst-web-mcp`](https://github.com/caphefalumi/typst-web-mcp).
-
 [![npm version](https://img.shields.io/npm/v/typst-mcp.svg?style=flat-square)](https://www.npmjs.com/package/typst-mcp)
 [![Downloads](https://img.shields.io/npm/dt/typst-mcp.svg?style=flat-square)](https://www.npmjs.com/package/typst-mcp)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg?style=flat-square)](./LICENSE)
-[![CI](https://github.com/caphefalumi/typst-web-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/caphefalumi/typst-web-mcp/actions/workflows/ci.yml)
 [![Node.js Package](https://github.com/caphefalumi/typst-web-mcp/actions/workflows/npm-publish.yml/badge.svg)](https://github.com/caphefalumi/typst-web-mcp/actions/workflows/npm-publish.yml)
-[![Runtime: Bun](https://img.shields.io/badge/Runtime-Bun_%E2%89%A51.2-f9f1e1?style=flat-square&logo=bun&logoColor=black)](https://bun.sh)
-[![TypeScript](https://img.shields.io/badge/TypeScript-5.8-3178C6?style=flat-square&logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
-[![MCP SDK](https://img.shields.io/badge/MCP-2024--11--05-10a37f?style=flat-square)](https://modelcontextprotocol.io)
-[![Protocol: Yjs + lib0](https://img.shields.io/badge/CRDT-Yjs_%2B_lib0_v3-ff69b4?style=flat-square)](./docs/PROTOCOL.md)
-[![Tests](https://img.shields.io/badge/Tests-7_Passing_(57_Assertions)-2ea44f?style=flat-square)](./test/typst-mcp.test.ts)
 
 </div>
 
 ---
 
-## Overview
-
-`typst-web-mcp` connects AI coding and writing agents directly to collaborative [**typst.app**](https://typst.app) cloud projects. Instead of relying on brittle browser DOM scraping, it implements the native `typst.app` client protocol:
-
-- **Native Yjs CRDT Text Sync:** Decodes and mutates multiplayer `Y.Doc` (`doc.getText("text")`) state vectors so surgical edits preserve collaborator cursors and version history.
-- **Binary `/editing/v3` WebSocket Wire Protocol:** Encodes and decodes `lib0` variable-length binary frames (`Subscribe`, `TextUpdate`, `Pong`, `Refresh`, `Presence`, `Cursor`, `Leave`) with REST `/v1/files/:projectId/:fileId/yjs` persistence.
-- **GraphQL & REST Project Management:** Full project CRUD, file tree inspection, rename/move, delete, and binary figure/asset uploads (`PNG`, `JPG`, `SVG`, `PDF`, fonts).
-- **Direct Authentication + Fallback:** Authenticates via `GET /v1/to-signin` + `POST /v1/auth/signin` (`__Http-typst-session`), with persistent session caching and automatic cookie/Playwright fallback on challenge.
-- **Compiler Diagnostics, Preview Screenshots & PDF Export:** Synchronizes cloud Yjs text and binary assets into an isolated workspace and runs the Typst compiler to return structured line/column diagnostics, high-DPI PNG preview screenshots (`typst_capture_screenshot`), and compiled PDFs (`typst_export_pdf`).
-
----
-
-## Architecture
-
-```mermaid
-flowchart LR
-    Agent["AI Agent\n(Pi / Claude / Cursor)"] <-->|"JSON-RPC (stdio)"| MCP["typst-mcp\n(Node / TypeScript)"]
-    MCP <-->|"GraphQL (/v1/graphql)\n+ X-Typst-Preflight"| API["https://api.typst.app"]
-    MCP <-->|"REST Yjs & Blobs\n(/v1/files/:pid/:fid/yjs)"| API
-    MCP <-->|"Binary lib0 WebSocket\n(wss://api.typst.app/editing/v3)"| WS["typst.app Real-Time Sync"]
-    MCP -->|"Workspace Sync + Compile"| TypstCLI["Typst Compiler\n(Diagnostics & PDF)"]
-```
-
-See [`docs/PROTOCOL.md`](./docs/PROTOCOL.md) for the complete reverse-engineered protocol specification.
-
----
-
-## MCP Tools (16 Tools)
-
-| Category | Tool Name | Description |
-|:---|:---|:---|
-| **Auth** | `typst_auth_login` | Authenticate with `https://typst.app` via email/password (`POST /v1/auth/signin`) or `__Http-typst-session` cookie, with browser fallback. |
-| **Auth** | `typst_auth_status` | Check active authentication state, login method, and stored session cookies. |
-| **Projects** | `typst_list_projects` | List all owned and shared/external projects in the user's `typst.app` dashboard (`DashboardContent`). |
-| **Projects** | `typst_get_project` | Retrieve full project metadata, access permissions, pinned compiler version, and file tree (`ProjectFiles`). |
-| **Projects** | `typst_create_project` | Create a new `typst.app` cloud project with initial `.typ`/`.bib` files and pinned compiler version. |
-| **Projects** | `typst_delete_project` | Permanently delete a `typst.app` project by ID (`DeleteProjectMutation`). |
-| **Files & CRDT** | `typst_list_files` | List all multiplayer Yjs text files and binary asset blobs in a project. |
-| **Files & CRDT** | `typst_read_file` | Read any project file — decodes binary Yjs CRDT state (`doc.getText("text")`) into UTF-8 text or base64 for binary assets. |
-| **Files & CRDT** | `typst_write_file` | Create or overwrite a `.typ`/`.bib`/`.toml` file, syncing Yjs state diffs over `/editing/v3` WebSocket and REST. |
-| **Files & CRDT** | `typst_edit_file` | Apply non-overlapping surgical `oldText -> newText` replacements directly to the `Y.Text("text")` CRDT. |
-| **Assets & Tree** | `typst_upload_asset` | Upload or replace binary assets (`PNG`, `JPG`, `SVG`, `PDF`, fonts) from a local path or base64 payload. |
-| **Assets & Tree** | `typst_rename_file` | Rename or move a file inside a `typst.app` project (`UpdatesFileMutation`). |
-| **Assets & Tree** | `typst_delete_file` | Delete a file or binary asset from a project (`DeleteFilesMutation`). |
-| **Compiler** | `typst_get_diagnostics` | Sync all cloud files and run `typst compile` to return structured errors, warnings, line/column spans, and hints. |
-| **Compiler** | `typst_export_pdf` | Sync all cloud text & binary assets, compile the project to PDF, and save to `outputPath`. |
-| **Preview** | `typst_capture_screenshot` | Capture high-DPI PNG preview screenshots (`mode="pages"` renders compiled PNG pages; `mode="browser"` screenshots the live `typst.app` web UI). |
-
----
-
 ## Quick Start
 
 ### Prerequisites
 
 - [**Node.js**](https://nodejs.org/) `>= 18` (for `npx` install) or [**Bun**](https://bun.sh) `>= 1.2` (for local development)
-- [**Typst CLI**](https://github.com/typst/typst) (`typst` on `PATH` for `typst_get_diagnostics` and `typst_export_pdf`)
+- [**Typst CLI**](https://github.com/typst/typst) (optional: `typst` on `PATH` for local CLI compilation speed; if not installed, `typst_get_diagnostics` automatically uses Typst Web cloud compiler diagnostics)
 
 ### Installation
 
-**Recommended — no clone, no global install:**
+**Option 1: Quick start (no clone, no global install):**
 
 ```bash
 npx -y typst-mcp
 ```
 
-Runs the published [`typst-mcp`](https://www.npmjs.com/package/typst-mcp) package (Node `>= 18`). Use the same command in MCP config below. `-y` skips the npx install prompt.
+**Option 2: Always run latest release (bypasses local `npx` cache):**
 
-**From source (development):**
+```bash
+npx -y typst-mcp@latest
+```
+
+Runs the published [`typst-mcp`](https://www.npmjs.com/package/typst-mcp) package (Node `>= 18`). `-y` skips the npx confirmation prompt.
+
+**Option 3: From source (development):**
 
 ```bash
 git clone https://github.com/caphefalumi/typst-web-mcp.git
@@ -116,10 +64,49 @@ Add `typst-mcp` to your MCP client configuration (`.pi/agent/mcp-adapter.json`,
 }
 ```
 
+> **Tip:** You can also set `"args": ["-y", "typst-mcp@latest"]` to guarantee your MCP client automatically pulls and runs the newest version on launch.
+
 > **Session Persistence:** Once authenticated via `typst_auth_login` (or environment variables), the `__Http-typst-session` cookie is cached locally at `~/.pi/agent/typst-mcp-session.json` so subsequent tool calls authenticate automatically without re-signing in.
 
 ---
 
+## Overview
+
+`typst-web-mcp` connects AI coding and writing agents directly to collaborative [**typst.app**](https://typst.app) cloud projects. Instead of relying on brittle browser DOM scraping, it implements the native `typst.app` client protocol:
+
+- **Native Yjs CRDT Text Sync:** Decodes and mutates multiplayer `Y.Doc` (`doc.getText("text")`) state vectors so surgical edits preserve collaborator cursors and version history.
+- **Binary `/editing/v3` WebSocket Wire Protocol:** Encodes and decodes `lib0` variable-length binary frames (`Subscribe`, `TextUpdate`, `Pong`, `Refresh`, `Presence`, `Cursor`, `Leave`) with REST `/v1/files/:projectId/:fileId/yjs` persistence.
+- **GraphQL & REST Project Management:** Full project CRUD, file tree inspection, rename/move, delete, and binary figure/asset uploads (`PNG`, `JPG`, `SVG`, `PDF`, fonts).
+- **Direct Authentication + Fallback:** Authenticates via `GET /v1/to-signin` + `POST /v1/auth/signin` (`__Http-typst-session`), with persistent session caching and automatic cookie/Playwright fallback on challenge.
+- **Compiler Diagnostics, Preview Screenshots & PDF Export:** Synchronizes cloud Yjs text and binary assets into an isolated workspace and runs the Typst compiler to return structured line/column diagnostics, high-DPI PNG preview screenshots (`typst_capture_screenshot`), and compiled PDFs (`typst_export_pdf`).
+
+---
+
+## MCP Tools (18 Tools)
+
+| Category | Tool Name | Description |
+|:---|:---|:---|
+| **Auth** | `typst_auth_login` | Authenticate with `https://typst.app` via email/password (`POST /v1/auth/signin`) or `__Http-typst-session` cookie, with browser fallback. |
+| **Auth** | `typst_auth_status` | Check active authentication state, login method, and stored session cookies. |
+| **Projects** | `typst_list_projects` | List all owned and shared/external projects in the user's `typst.app` dashboard (`DashboardContent`). |
+| **Projects** | `typst_get_project` | Retrieve full project metadata, access permissions, pinned compiler version, and file tree (`ProjectFiles`). |
+| **Projects** | `typst_create_project` | Create a new `typst.app` cloud project with initial `.typ`/`.bib` files and pinned compiler version. |
+| **Projects** | `typst_delete_project` | Permanently delete a `typst.app` project by ID (`DeleteProjectMutation`). |
+| **Files & CRDT** | `typst_list_files` | List all multiplayer Yjs text files and binary asset blobs in a project. |
+| **Files & CRDT** | `typst_read_file` | Read any project file with offset/limit pagination, optional line numbering, truncation limits (2,000 lines/50KB), and multimodal MCP image content blocks (`PNG`, `JPG`, `SVG`, `WebP`). |
+| **Files & CRDT** | `typst_write_file` | Create or overwrite a `.typ`/`.bib`/`.toml` file, protected by per-file mutation queue serialization, syncing Yjs state diffs over `/editing/v3` WebSocket and REST. |
+| **Files & CRDT** | `typst_edit_file` | Apply surgical `oldText -> newText` replacements directly to the `Y.Text("text")` CRDT with CRLF/BOM resilience, fuzzy quote/dash matching, unified diff & patch output, and per-file mutation serialization. |
+| **Search & Replace** | `typst_grep_project` | Search for text or regular expressions across project files, returning file paths, line numbers, and optional surrounding context lines. |
+| **Search & Replace** | `typst_find_and_replace` | Find and replace text or regex across a single file or project-wide with regex capture groups (`$1`), dry-run preview diffs, and per-file mutation serialization. |
+| **Assets & Tree** | `typst_upload_asset` | Upload or replace binary assets (`PNG`, `JPG`, `SVG`, `PDF`, fonts) from a local path or base64 payload. |
+| **Assets & Tree** | `typst_rename_file` | Rename or move a file inside a `typst.app` project (`UpdatesFileMutation`). |
+| **Assets & Tree** | `typst_delete_file` | Delete a file or binary asset from a project (`DeleteFilesMutation`). |
+| **Compiler** | `typst_get_diagnostics` | Retrieve compiler diagnostics (errors, warnings, line/column numbers, and hints). Supports both local Typst CLI (`mode="cli"`) and Typst Web cloud compiler (`mode="web"`), with automatic fallback (`mode="auto"`). |
+| **Compiler** | `typst_export_pdf` | Sync all cloud text & binary assets, compile the project to PDF, and save to `outputPath`. |
+| **Preview** | `typst_capture_screenshot` | Capture high-DPI PNG preview screenshots (`mode="pages"` renders compiled PNG pages; `mode="browser"` screenshots the live `typst.app` web UI). |
+
+---
+
 ## Development & Verification
 
 ```bash
@@ -149,31 +136,6 @@ Same flow as [Canvas-CLI](https://github.com/caphefalumi/Canvas-CLI):
 
 **Trusted publisher (maintainers):** package [`typst-mcp`](https://www.npmjs.com/package/typst-mcp) → Settings → Trusted publishing → GitHub Actions — user/org `caphefalumi`, repo `typst-web-mcp`, workflow file `npm-publish.yml`, environment `npm-publish`, allow **npm publish**.
 
-### Project Structure
-
-```text
-typst-web-mcp/
-├── docs/
-│   └── PROTOCOL.md              # Reverse-engineered typst.app REST, GraphQL, Yjs & WS v3 spec
-├── src/
-│   ├── protocol/
-│   │   ├── ws-codec.ts          # Binary lib0 /editing/v3 WebSocket encoder & decoder
-│   │   ├── yjs-doc.ts           # Yjs CRDT text decoding, replacement & surgical patching
-│   │   └── graphql.ts           # GraphQL queries, mutations, fragments & types
-│   ├── client/
-│   │   ├── auth.ts              # Direct /v1/auth/signin login, cookie jar & Playwright fallback
-│   │   ├── compiler.ts          # Typst binary resolver, diagnostic parser, PDF & PNG preview compiler
-│   │   ├── errors.ts            # Structured TypstLoadError & error formatting helpers
-│   │   └── typst-client.ts      # TypstCloudClient (REST, GraphQL, WebSocket v3, Compiler facade)
-│   ├── tools/
-│   │   └── definitions.ts       # MCP JSON Schema definitions for all 16 tools
-│   └── index.ts                 # MCP stdio server entrypoint (dev); npm bin runs dist/index.js
-├── test/
-│   └── typst-mcp.test.ts        # 7 test suites (57 assertions) covering codecs, CRDTs & E2E
-├── LICENSE                      # MIT License
-└── package.json
-```
-
 ---
 
 ## License

package/dist/client/compiler.js

@@ -29,6 +29,52 @@ export function resolveTypstBinary(explicitBin) {
     }
     return "typst";
 }
+export function hasTypstBinary(explicitBin) {
+    try {
+        const bin = resolveTypstBinary(explicitBin);
+        if (bin !== "typst" && existsSync(bin)) {
+            return true;
+        }
+        const proc = spawnSync(bin, ["--version"], {
+            stdio: "ignore",
+            encoding: "utf8",
+        });
+        return proc.status === 0 && !proc.error;
+    }
+    catch {
+        return false;
+    }
+}
+export function resolvePythonBinary() {
+    if (process.env.PYTHON_BIN) {
+        return process.env.PYTHON_BIN;
+    }
+    for (const cmd of ["python", "python3", "py"]) {
+        try {
+            const res = spawnSync(cmd, ["--version"], { stdio: "ignore" });
+            if (res.status === 0) {
+                return cmd;
+            }
+        }
+        catch { }
+    }
+    return "python";
+}
+export function offsetToPosition(text, offset) {
+    let line = 1;
+    let column = 1;
+    const target = Math.min(Math.max(0, offset), text.length);
+    for (let i = 0; i < target; i++) {
+        if (text[i] === "\n") {
+            line++;
+            column = 1;
+        }
+        else {
+            column++;
+        }
+    }
+    return { line, column };
+}
 function hasValidPngSignature(bytes) {
     return (bytes.byteLength >= 8 &&
         bytes[0] === 0x89 &&
@@ -95,6 +141,9 @@ export function compileWorkspaceDiagnostics(params) {
         cwd: params.workspaceDir,
         encoding: "utf8",
     });
+    if (proc.error) {
+        throw new TypstLoadError(["TYPST_EXECUTION_FAILED"], `Failed to execute Typst compiler binary '${params.typstBin}': ${proc.error.message}`);
+    }
     const combinedOutput = `${proc.stderr ?? ""}\n${proc.stdout ?? ""}`;
     const diagnostics = parseShortDiagnostics(combinedOutput).map((d) => ({
         ...d,
@@ -130,6 +179,9 @@ export function compileWorkspacePdf(params) {
         cwd: params.workspaceDir,
         encoding: "utf8",
     });
+    if (proc.error) {
+        throw new TypstLoadError(["TYPST_EXECUTION_FAILED"], `Failed to execute Typst compiler binary '${params.typstBin}': ${proc.error.message}`);
+    }
     const combinedOutput = `${proc.stderr ?? ""}\n${proc.stdout ?? ""}`;
     const diagnostics = parseShortDiagnostics(combinedOutput);
     if (proc.status !== 0) {
@@ -148,12 +200,169 @@ export function compileWorkspacePdf(params) {
         diagnostics,
     };
 }
+export function captureWebDiagnostics(params) {
+    const pythonBin = resolvePythonBinary();
+    const timeoutSec = ((params.timeoutMs ?? 25000) / 1000).toFixed(1);
+    const pyScript = `
+import os, sys, json, time
+from playwright.sync_api import sync_playwright
+
+app_url = os.environ.get("TYPST_APP_URL", "https://typst.app")
+proj_id = os.environ["TYPST_PROJ_ID"]
+raw_cookie = os.environ.get("TYPST_COOKIE", "")
+timeout_sec = float(os.environ.get("TYPST_TIMEOUT_SEC", "25.0"))
+
+cookies = []
+for part in raw_cookie.split(";"):
+    part = part.strip()
+    if "=" in part:
+        k, v = part.split("=", 1)
+        name = k.strip()
+        val = v.strip()
+        is_session = "__Http" in name or "session" in name
+        cookies.append({
+            "name": name,
+            "value": val,
+            "domain": ".typst.app",
+            "path": "/",
+            "httpOnly": is_session,
+            "secure": True,
+            "sameSite": "Strict" if is_session else "Lax",
+        })
+
+with sync_playwright() as p:
+    browser = None
+    for channel in ["msedge", "chrome", None]:
+        try:
+            if channel:
+                browser = p.chromium.launch(channel=channel, headless=True)
+            else:
+                browser = p.chromium.launch(headless=True)
+            break
+        except Exception:
+            continue
+
+    if browser is None:
+        sys.stderr.write("NO_BROWSER_FOUND")
+        sys.exit(2)
+
+    ctx = browser.new_context(viewport={"width": 1920, "height": 1080})
+    if cookies:
+        ctx.add_cookies(cookies)
+
+    ctx.add_init_script("""
+        window.__typst_diagnostics = null;
+        window.__typst_status = 'starting';
+        const OrigWorker = window.Worker;
+        window.Worker = function(url, opts) {
+            const w = new OrigWorker(url, opts);
+            w.addEventListener('message', (ev) => {
+                try {
+                    if (ev.data && ev.data.tag === 'notification') {
+                        if (ev.data.name === 'diagnostics') {
+                            window.__typst_diagnostics = ev.data.notification?.diagnostics || [];
+                        } else if (ev.data.name === 'status') {
+                            window.__typst_status = ev.data.notification?.status || 'idle';
+                        }
+                    }
+                } catch(e) {}
+            });
+            return w;
+        };
+    """)
+
+    page = ctx.new_page()
+    page.goto(f"{app_url}/project/{proj_id}", wait_until="commit", timeout=45000)
+
+    start_time = time.time()
+    diags = None
+    while time.time() - start_time < timeout_sec:
+        data = page.evaluate("({ diag: window.__typst_diagnostics, status: window.__typst_status, url: window.location.href })")
+        if "signin" in data.get("url", ""):
+            browser.close()
+            sys.stderr.write(f"AUTH_REQUIRED: Redirected to {data.get('url')}")
+            sys.exit(3)
+        if data.get("diag") is not None:
+            diags = data.get("diag")
+            if data.get("status") == "idle":
+                break
+        page.wait_for_timeout(300)
+
+    browser.close()
+    print(json.dumps(diags or []))
+`;
+    const proc = spawnSync(pythonBin, ["-c", pyScript], {
+        env: {
+            ...process.env,
+            TYPST_APP_URL: params.appUrl,
+            TYPST_PROJ_ID: params.projectId,
+            TYPST_COOKIE: params.cookieHeader,
+            TYPST_TIMEOUT_SEC: timeoutSec,
+        },
+        encoding: "utf8",
+        timeout: (params.timeoutMs ?? 25000) + 15000,
+    });
+    if (proc.error || proc.status !== 0) {
+        const stderr = (proc.stderr || proc.error?.message || "").trim();
+        if (stderr.includes("NO_BROWSER_FOUND")) {
+            throw new TypstLoadError(["NO_BROWSER_FOUND"], "No compatible browser (Edge, Chrome, or Chromium) found for Playwright web diagnostics.");
+        }
+        if (stderr.includes("AUTH_REQUIRED")) {
+            throw new TypstLoadError(["UNAUTHENTICATED"], `Typst Web cloud session expired or invalid: ${stderr}`);
+        }
+        throw new TypstLoadError(["WEB_DIAGNOSTICS_FAILED"], `Failed to capture Typst Web cloud diagnostics: ${stderr || "Ensure python with playwright is installed ('pip install playwright && playwright install')"}`);
+    }
+    const rawJson = (proc.stdout || "").trim();
+    let rawList = [];
+    try {
+        rawList = JSON.parse(rawJson);
+    }
+    catch (err) {
+        throw new TypstLoadError(["WEB_DIAGNOSTICS_PARSE_FAILED"], `Failed to parse Typst Web diagnostics output: ${err.message}`);
+    }
+    const mainFileName = params.mainFile ?? "main.typ";
+    const diagnostics = rawList.map((raw) => {
+        let line = 1;
+        let column = 1;
+        const filePath = raw.path || mainFileName;
+        const fileText = params.fileContents?.[filePath];
+        if (fileText && raw.range?.start !== undefined) {
+            const pos = offsetToPosition(fileText, raw.range.start);
+            line = pos.line;
+            column = pos.column;
+        }
+        return {
+            path: filePath,
+            line,
+            column,
+            severity: raw.severity === "error" ? "error" : "warning",
+            message: raw.message,
+            hints: Array.isArray(raw.hints) ? raw.hints : [],
+            package: raw.package ?? null,
+            range: raw.range
+                ? { start: raw.range.start, end: raw.range.end }
+                : undefined,
+        };
+    });
+    const errorCount = diagnostics.filter((d) => d.severity === "error").length;
+    const warningCount = diagnostics.filter((d) => d.severity === "warning").length;
+    return {
+        projectId: params.projectId,
+        mainFile: mainFileName,
+        mode: "web",
+        success: errorCount === 0,
+        errorCount,
+        warningCount,
+        diagnostics,
+    };
+}
 export function captureBrowserPreviewScreenshot(params) {
     const outputDir = resolveOutputDirectory(params.outputDir, `typst-preview-ui-${params.projectId}-`);
     mkdirSync(outputDir, { recursive: true });
     const screenshotPath = join(outputDir, `typst-app-${params.projectId}.png`);
+    const pythonBin = resolvePythonBinary();
     const pyScript = `
-import os
+import os, sys
 from playwright.sync_api import sync_playwright
 
 app_url = os.environ["TYPST_PREVIEW_APP_URL"]
@@ -166,16 +375,35 @@ for part in raw_cookie.split(";"):
     part = part.strip()
     if "=" in part:
         k, v = part.split("=", 1)
+        name = k.strip()
+        val = v.strip()
+        is_session = "__Http" in name or "session" in name
         cookies.append({
-            "name": k.strip(),
-            "value": v.strip(),
-            "domain": "typst.app",
+            "name": name,
+            "value": val,
+            "domain": ".typst.app",
             "path": "/",
+            "httpOnly": is_session,
             "secure": True,
+            "sameSite": "Strict" if is_session else "Lax",
         })
 
 with sync_playwright() as p:
-    browser = p.chromium.launch(channel="msedge", headless=True)
+    browser = None
+    for channel in ["msedge", "chrome", None]:
+        try:
+            if channel:
+                browser = p.chromium.launch(channel=channel, headless=True)
+            else:
+                browser = p.chromium.launch(headless=True)
+            break
+        except Exception:
+            continue
+
+    if browser is None:
+        sys.stderr.write("NO_BROWSER_FOUND")
+        sys.exit(2)
+
     ctx = browser.new_context(viewport={"width": 1920, "height": 1080}, device_scale_factor=2)
     if cookies:
         ctx.add_cookies(cookies)
@@ -185,7 +413,7 @@ with sync_playwright() as p:
     page.screenshot(path=out_path, full_page=False)
     browser.close()
 `;
-    const proc = spawnSync("python", ["-c", pyScript], {
+    const proc = spawnSync(pythonBin, ["-c", pyScript], {
         env: {
             ...process.env,
             TYPST_PREVIEW_APP_URL: params.appUrl,