s-cookies

name	s-cookies
description	Import browser cookies for authenticated testing - detects installed browsers and imports sessions

/s:cookies - Browser Cookie Import

Import cookies from installed browsers to enable authenticated testing with /s:browse and /s:qa. Allows testing logged-in states without manual authentication flows.

Security Rules

These rules are non-negotiable:

1. NEVER log, print, or display cookie values in output. Show cookie names and domains only.
2. NEVER commit cookie files to git. Verify .gitignore contains the entry before saving.
3. NEVER include cookie data in brainstorms, plans, solutions, or any docs/ file.
4. If .gitignore does not contain .claude-stack/cookies.json, add it before proceeding.
5. Warn the user if .gitignore is missing entirely.

Browser Detection (macOS)

Scan for installed browsers by checking these paths:

Browser	Profile Path
Chrome	~/Library/Application Support/Google/Chrome/
Chrome Canary	~/Library/Application Support/Google/Chrome Canary/
Arc	~/Library/Application Support/Arc/
Brave	~/Library/Application Support/BraveSoftware/Brave-Browser/
Edge	~/Library/Application Support/Microsoft Edge/
Firefox	~/Library/Application Support/Firefox/
Safari	Not supported (sandboxed keychain access)

Check each path with a directory existence test. Build a list of detected browsers.

Platform note: These paths are macOS-specific. On Linux, Chrome cookies are typically at ~/.config/google-chrome/. On Windows, %LOCALAPPDATA%\Google\Chrome\User Data\. Inform the user if running on a non-macOS platform and provide the expected paths.

Workflow

Step 1: List Detected Browsers

Show the user which browsers were found:

Detected browsers:
  1. Chrome (~/Library/Application Support/Google/Chrome/)
  2. Arc (~/Library/Application Support/Arc/)
  3. Brave (~/Library/Application Support/BraveSoftware/Brave-Browser/)

Which browser do you want to import cookies from? (number or name)

If no browsers are detected, inform the user and exit.

Step 2: Ask for Target Domains

Ask the user which domain(s) to import cookies for:

Which domain(s) should I import cookies for?
Examples: localhost, myapp.com, *.example.com
(comma-separated for multiple)

Step 3: Extract Cookies

For Chromium-based browsers (Chrome, Arc, Brave, Edge):

• Cookie database is at {profile_path}/Default/Cookies (SQLite)
• The database may be locked if the browser is running. Copy to a temp file first.
• Query: SELECT host_key, name, path, expires_utc, is_secure, is_httponly FROM cookies WHERE host_key LIKE '%{domain}%'
• Encrypted values require the OS keychain. Use security find-generic-password -s "Chrome Safe Storage" -w for the decryption key.
• If decryption fails (permissions), instruct the user to export cookies manually via browser DevTools.

For Firefox:

• Cookie database is at {profile_path}/Profiles/{profile}/cookies.sqlite
• Find the default profile from profiles.ini.
• Query: SELECT host, name, path, expiry, isSecure, isHttpOnly FROM moz_cookies WHERE host LIKE '%{domain}%'
• Firefox cookies are not encrypted on disk.

Step 4: Save Cookies

Store extracted cookies at ~/.claude-stack/cookies.json:

{
  "source": "Chrome",
  "imported_at": "2026-03-16T12:00:00Z",
  "domains": ["localhost", "myapp.com"],
  "cookies": [
    {
      "name": "session_id",
      "domain": "localhost",
      "path": "/",
      "secure": false,
      "httpOnly": true,
      "expires": 1742000000
    }
  ]
}

Ensure the directory exists: mkdir -p ~/.claude-stack

Verify .gitignore includes .claude-stack/ or .claude-stack/cookies.json before writing. If not, add it.

Step 5: Verify Cookies Work

Make a test request using the imported cookies against the target domain:

• Use curl with the cookie jar or the browser tool.
• Check if the response indicates an authenticated session (e.g., 200 vs 401/403, presence of user-specific content).
• Report: "Cookie verification: {domain} - authenticated session confirmed" or "Cookie verification: {domain} - session appears expired or invalid."

Session Management Commands

Accept these subcommands:

Command	Description
/s:cookies	Default: detect browsers and import flow
/s:cookies list	Show active imported sessions (domains + expiry, NOT values)
/s:cookies clear	Delete ~/.claude-stack/cookies.json
/s:cookies refresh	Re-import from same browser and domains as last import
/s:cookies verify	Test if current cookies are still valid

List Output Format

Active Cookie Sessions:
  Domain: localhost (3 cookies, expires: 2026-03-17)
  Domain: myapp.com (5 cookies, expires: 2026-04-01)
  Source: Chrome
  Imported: 2026-03-16 12:00 UTC

Clear Confirmation

Before clearing, confirm with the user:

"This will delete all imported cookie sessions. You will need to re-import for authenticated testing. Proceed? (y/n)"

Integration with Other Skills

• /s:browse automatically loads cookies from ~/.claude-stack/cookies.json if the file exists.
• /s:qa and /s:qa-only use the same cookie file for authenticated route testing.
• If cookies are expired or invalid during QA, suggest: "Run /s:cookies refresh to update your session."

Error Handling

• Browser database locked: "Browser database is locked (browser may be running). Copied to temp file for reading."
• Keychain access denied: "Cannot decrypt cookies - keychain access denied. Grant terminal access in System Settings > Privacy > Full Disk Access, or export cookies manually from browser DevTools (Application > Cookies)."
• No cookies found for domain: "No cookies found for '{domain}' in {browser}. Make sure you are logged in to {domain} in {browser} first."
• Expired session: "Imported cookies for {domain} appear expired. Log in again in your browser and run /s:cookies refresh."