Skip to content

Use the shared browser order for Raycast cookie import - #887

Merged
Finesssee merged 4 commits into
mainfrom
fix/cookie-import-audit-075
Oct 15, 2026
Merged

Finesssee merged 4 commits into
mainfrom
fix/cookie-import-audit-075

Conversation

@Finesssee

@Finesssee Finesssee commented Oct 15, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

v0.75.0 cookie-import audit (upstream steipete#4443 0aef66c, steipete#4442, steipete#4478).

  • Raycast (fixed): no longer pinned to Chrome. Auto-import walks the shared browser order, groups sessions per browser, skips browsers without a session, moves past browsers whose sessions are all rejected (401), stops at the first accepted session, and stops on any other error. Manual header / Off unchanged. Help text "from Chrome" → "from your installed browsers" in all 10 locales (translations need native review). 6 new tests.
  • Firefox Developer Edition: already detected on Windows (default substring matches dev-edition-default); regression test added.
  • TypeSafe: already uses the shared browser order; no change.
  • Ego Lite: skipped; macOS-only browser, no verified Windows build or profile path.
  • Narrow browser lists: Raycast was the only Chrome-pinned cookie provider. DeepSeek stays Chrome-only (LevelDB token, matches upstream).
  • Known gap, follow-up: the shared browser_cookie_header / get_cookies_for_domain take the first browser with any cookie, so a stale browser can hide a later valid one, and extract_domain_candidates decrypts every browser up front. Fixing that touches ~20 providers.

Commands

  • cargo test both manifests (rust 4520, tauri 721), cargo clippy both --all-targets -- -D warnings, cargo fmt --all -- --check

UI proof

Only locale strings changed in the UI; no CUA run.

Summary by CodeRabbit

  • New Features
    • Raycast sign-in can now automatically import cookies from supported browsers, trying them in order until a valid session is found. Manual cookie entry remains available.
  • Bug Fixes
    • When a browser’s session is expired, automatic sign-in can continue to another browser. Service errors still stop the process.

@coderabbitai

coderabbitai Bot commented Oct 15, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository: nesszer/Win-CodexBar/.coderabbit.yaml
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 62f50cac-cf37-4152-b48c-7f947c4b5d7d
📥 Commits

Reviewing files that changed from the base of the PR and between 7383bf8 and 8abb123.

📒 Files selected for processing: 16
  • CHANGELOG.md
  • README.md
  • rust/src/browser/detection.rs
  • rust/src/locale/en-US.ftl
  • rust/src/locale/es-MX.ftl
  • rust/src/locale/ja-JP.ftl
  • rust/src/locale/ko-KR.ftl
  • rust/src/locale/pt-BR.ftl
  • rust/src/locale/ru-RU.ftl
  • rust/src/locale/tr-TR.ftl
  • rust/src/locale/uk-UA.ftl
  • rust/src/locale/zh-CN.ftl
  • rust/src/locale/zh-TW.ftl
  • rust/src/providers/raycast/cookies.rs
  • rust/src/providers/raycast/mod.rs
  • rust/src/providers/raycast/tests.rs

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 0 remain after this review.

📝 Walkthrough

Raycast automatic cookie import now checks detected browsers in shared order and uses the first accepted session. The change also updates browser detection coverage, provider tests, and user-facing descriptions.

Changes: Raycast browser cookie import

Layer / File(s) Summary
Browser cookie groups
rust/src/browser/detection.rs, rust/src/providers/raycast/cookies.rs, rust/src/providers/raycast/tests.rs
Cookie candidates are grouped in browser scan order, including empty groups. The Firefox detection test covers .dev-edition-default and .default-release profiles.
Raycast browser fetch
rust/src/providers/raycast/mod.rs, rust/src/providers/raycast/tests.rs, CHANGELOG.md, README.md, rust/src/locale/*.ftl
The provider tries non-empty groups in order. It advances after HTTP 401 responses and stops on success or another error. Tests cover these outcomes. Documentation and localized help now describe import from installed browsers.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant RaycastProvider
  participant BrowserCookieScan
  participant RaycastEndpoint
  RaycastProvider->>BrowserCookieScan: Scan browsers for cookie candidates
  BrowserCookieScan-->>RaycastProvider: Return candidates grouped in scan order
  loop Each non-empty browser group
    RaycastProvider->>RaycastEndpoint: Check candidate session
    RaycastEndpoint-->>RaycastProvider: Return success, HTTP 401, or another error
  end
Loading

Suggested reviewers: pasharm

Merge Risk: ⚪ Minimal · up to 8abb1

Raycast cookie import now checks installed browsers in the shared order instead of Chrome only. No actionable merge-blocking risk was identified; the translations still need native review.

Pre-merge checks: Passed 7 · Failed 1

Failed Failed checks: 1 warning

Check name Status Explanation Resolution
Ui Changes Include Windows Proof Warning The PR changes the visible Raycast cookie help text in 10 locale files. apps/desktop-tauri/src-tauri/src/commands/provider_settings.rs:821-835 uses ProviderRaycastAutoImportHelp for the Raycast se… Add screenshots or a proof note from a fresh Windows build showing the updated Raycast settings help text, and include that evidence in the PR description.
Passed Passed checks: 7 passed
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title is a short imperative summary that accurately describes the main change: using shared browser order for Raycast cookie import.
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Provider Data Stays Siloed Passed PASS: The change keeps Raycast cookie handling inside rust/src/providers/raycast/ and sends only Raycast session cookies to the Raycast endpoint. The new browser source label is a browser name, not …
Secrets Handled Safely Passed PASS. The changed Raycast path keeps cookie values in memory and sends them only as the HTTP Cookie header. The diff adds no logging, user-facing error interpolation, snapshots, or plaintext credentia…
No Unapproved Dependencies Passed The pull-request diff changes 16 source, documentation, locale, and test files. It does not change any Cargo.toml or package.json, add an npm/yarn lockfile, or change pnpm packageManager metadata. No …
Full details: Ui Changes Include Windows Proof

Explanation

The PR changes the visible Raycast cookie help text in 10 locale files. apps/desktop-tauri/src-tauri/src/commands/provider_settings.rs:821-835 uses ProviderRaycastAutoImportHelp for the Raycast settings UI. The description says only locale strings changed and no CUA run; it does not provide screenshots or proof from a fresh Windows build.

  • Fix all pre-merge checks with AI
✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@Finesssee
Finesssee merged commit 1f56851 into main Oct 15, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant