If this session was compacted, the copy of this skill in context may be cut off. Read ${CLAUDE_SKILL_DIR}/SKILL.md from disk and resume at the step you are on.

When to invoke

Use when asked to "import cookies", "login to the site", or "authenticate the browser".

Preamble

eval "$("${VIBESTACK_HOME:-$HOME/.vibestack}/bin/vibe-slug" 2>/dev/null)" 2>/dev/null || SLUG="unknown"
_LEARN_FILE="${VIBESTACK_HOME:-$HOME/.vibestack}/projects/${SLUG:-unknown}/learnings.jsonl"
if [ -f "$_LEARN_FILE" ]; then
  _LEARN_COUNT=$(wc -l < "$_LEARN_FILE" 2>/dev/null | tr -d ' ')
  echo "LEARNINGS: $_LEARN_COUNT entries loaded"
  if [ "$_LEARN_COUNT" -gt 5 ] 2>/dev/null; then
    "${VIBESTACK_HOME:-$HOME/.vibestack}/bin/vibe-learnings-search" --limit 5 2>/dev/null || true
  fi
else
  echo "LEARNINGS: none yet"
fi

{{include lib/snippets/session-host.md}}

{{include lib/snippets/decision-brief.md}}

{{include lib/snippets/working-protocols.md}}

{{include lib/snippets/state-protocols.md}}

Setup Browser Cookies

Import logged-in sessions from your real Chromium browser into the headless browse session.

How it works

1. Find the browse binary
2. Run cookie-import-browser to detect installed browsers and open the picker UI
3. User selects which cookie domains to import in their browser
4. Cookies are decrypted and loaded into the Playwright session

Steps

1. Find the browse binary

B="${CLAUDE_SKILL_DIR:-$HOME/.claude/skills/setup-browser-cookies}/../browse/bin/vibe-browse"
[ -x "$B" ] || B="$(command -v vibe-browse || true)"
if [ -n "$B" ] && [ -x "$B" ] && [ "$("$B" status 2>/dev/null)" != "BROWSE_NOT_AVAILABLE" ]; then
  echo "READY: $B"
  echo "BROWSE_BIN: $B"
else
  echo "NEEDS_SETUP"
fi

Every Bash call starts a fresh shell, so $B is unset in every later block. A block that runs a browse command starts with B='<BROWSE_BIN>': replace <BROWSE_BIN> with the path printed on the BROWSE_BIN: line.

If NEEDS_SETUP, stop and tell the user the browse binary could not be found or could not start — node is missing, or first-run setup was declined.

Cookie import needs the full browse daemon; the stateless fallback shim cannot decrypt a real browser's cookie store. If any command below answers NOT_SUPPORTED:cookie-import-browser, that is what happened: tell the user the full daemon is not running in this checkout and stop, rather than reporting a half-import that never occurred. Point them at /connect-chrome, which imports cookies into the shim from a Chrome started with a remote debugging port.

2. Open the cookie picker

B='<BROWSE_BIN>'
$B cookie-import-browser

This auto-detects installed Chromium browsers and opens an interactive picker UI in your default browser where you can:

• Switch between installed browsers
• Search domains
• Click "+" to import a domain's cookies
• Click trash to remove imported cookies

Tell the user: "Cookie picker opened — choose the browser, the profile, and the domains you want to import, then tell me when you're done."

The choice of browser, profile and domains is the user's. Never pick one for them, and never treat whichever browser the CLI falls back to as consent. A profile you could not read is unknown, not empty.

3. Direct import (alternative)

If the user names a domain directly (e.g., /setup-browser-cookies github.com), skip the UI — but only with a browser the user named. If they did not name one, ask via AskUserQuestion which browser to import from — this path skips the picker, so you have no detected list: name the supported ones (Chrome, Chromium, Arc, Brave, Edge, Comet) and let the user answer; never fill one in yourself. The import is scoped to the page the daemon is on, so navigate to the domain first:

B='<BROWSE_BIN>'
$B goto https://github.com
$B cookie-import-browser <browser> --domain github.com

<browser> is the one the user chose. --profile takes a profile directory (Default, Profile 1), not a display name; omit it only when the user's browser has a single relevant profile, otherwise use the picker. --all imports every non-expired cookie from the browser — run it only when the user asked for exactly that.

4. Report honestly

Report what the import itself returned: the receipt line (Imported N cookies for <domain> from <browser>, plus any failed to decrypt count) or the picker's per-domain counts, and say plainly when an import was partial, zero, or errored.

Never run $B cookies or $B storage to "show what was imported", and never put a cookie value, token, password, or session detail into the transcript or a report. Counts and domain names are the whole summary.

Keep three states apart, and name the one you are in:

• Not checked — cookies were copied; nobody looked at whether they sign you in.
• Not verified — you checked, and the target did not show a signed-in state.
• Verified — a page on the target showed positive signed-in evidence (an account-only page rendered instead of the sign-in wall).

An import count, a zero-error import, or an HTTP 200 never proves a login. Stop at Not checked unless the user asked you to check.

Notes

• On macOS, the first import per browser may trigger a Keychain dialog — click "Allow" / "Always Allow"
• On Linux, v11 cookies may require secret-tool/libsecret access; v10 cookies use Chromium's standard fallback key
• Cookie picker is served on the same port as the browse server (no extra process)
• Only domain names and cookie counts are shown in the UI — no cookie values are exposed
• The browse session persists cookies between commands, so imported cookies work immediately
• Imported cookies apply to the whole browser context: every tab, and any agent paired into this daemon, sends them