You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* feat(cookies): add build-tag-selectable cookie provider (kooky default, HackBrowserData opt-in)
Split internal/cookies into a provider-agnostic core plus two readers chosen at
build time, so the browser cookie backend can be swapped without touching the
selection logic.
- cookies.go keeps the pure, unit-tested selection pipeline (rawCookie,
groupCandidates, selectSession, chooseSession, annotateReadError).
- provider_kooky.go (//go:build !hbd) is the default: browserutils/kooky. A stock
`go build` links kooky and nothing from HackBrowserData.
- provider_hbd.go (//go:build hbd) reads via moond4rk/hackbrowserdata, with
per-OS retriever wiring (retrievers_hbd_*.go) deliberately kept to the benign
native path: no macOS login-password prompt, no Windows ABE reflective
injection, standard Linux keyring.
- browserReadHints and the provider tests move to the matching tagged files.
Both tag variants build (darwin/linux/windows), vet, and test clean. go.mod lists
both deps; only the tagged one is linked per build.
* docs: document the build-tag cookie provider and version/fork pinning
Update architecture.md's cookie section for the provider seam introduced with
the build tag (kooky default, hackbrowserdata via -tags hbd), refresh the file
tree, and add a short README note on selecting the provider and pinning any
commit or fork of either dependency.
* ci: exercise the hackbrowserdata provider (-tags hbd)
Add vet/test/build under -tags hbd plus darwin/windows cross-compiles, so the
opt-in cookie provider and its per-OS retriever files are covered and can't
silently rot alongside the default kooky build.
* fix(cookies): drop dead nil-error seed in hbd reader; recommend pinned HBD commit
- readRawCookies seeded errs with an always-nil err (early return precedes it);
use a plain nil slice (review finding).
- README: recommend go get hackbrowserdata@adfb6d9 for -tags hbd builds until the
next release — the first commit carrying both the macOS gcore-dump gate (#629)
and library log silencing (#632).
* refactor(cookies): align hbd reader error handling and hints with app idiom
- readRawCookies (hbd): join the DiscoverBrowsers error instead of early-returning,
matching the kooky reader's return-partial-plus-error pattern so chooseSession
arbitrates.
- Drop the hbd browserReadHints entry: HackBrowserData's Extract swallows per-cookie
decryption failures and only surfaces store read errors, so the hint could never
fire; the no-cookie case is already covered by noSessionMsg.
- Move the kooky-specific chooseSession hint assertion out of the shared test into
provider_kooky_test.go (it fails under -tags hbd, which has no such hint).
* feat(cookies): pin gated+quiet HBD, silence its logger, ship hbd release variant
- Pin hackbrowserdata to the commit carrying the macOS securityd-dump build-tag
gate (#629) and package-level log.SetLevel (#632), until upstream tags a release.
- Silence HackBrowserData's logger to fatal-only in the hbd build so Extract no
longer writes [INF]/[WRN] to stderr.
- goreleaser: add a second -tags hbd build published as hbd-<os>-<arch> assets
(gh extension install still resolves the default kooky binary); modernize the
archives block to the non-deprecated ids/formats keys; attest the hbd assets.
Verified from snapshot binaries: default links 0 hackbrowserdata / hbd links 0
kooky, and the hbd variant carries no gcore securityd-dump symbols.
* refactor(cookies): build hbd retrievers once, shared across browsers
Hoist nativeRetrievers() out of the per-browser loop. Matches HackBrowserData's
own injector (retrievers built once, SetRetrievers called per browser) and shares
SecurityCmdRetriever's Keychain cache, so macOS prompts at most once.
Copy file name to clipboardExpand all lines: README.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -60,6 +60,8 @@ gh extension install .
60
60
61
61
Requires Go 1.26+.
62
62
63
+
The cookie backend defaults to [`kooky`](https://github.com/browserutils/kooky); `go build -tags hbd` uses [`hackbrowserdata`](https://github.com/moonD4rk/HackBrowserData) instead, also shipped as `hbd-<os>-<arch>` release assets. The `hbd` build pins a hackbrowserdata commit carrying the macOS securityd-dump gate and library log silencing until its next release; override either dep with `go get <module>@<ref>` or a `go.mod``replace`.
│ │ ├── retrievers_hbd_*.go # Per-OS master-key retrievers for the hbd provider
19
22
│ │ ├── jar.go # GitHub cookie jar + same-site pair construction
20
23
│ │ └── jar_test.go
21
24
│ ├── session/
@@ -58,7 +61,7 @@ The session token is resolved with the following precedence (first match wins):
58
61
59
62
1.`--token <value>` flag
60
63
2.`GH_SESSION_TOKEN` environment variable
61
-
3. Browser cookie store (via `kooky`)
64
+
3. Browser cookie store (via the selected cookie provider — `kooky` by default)
62
65
63
66
The flag is convenient for one-off use; the env var is the recommended path for CI/CD and shared machines, since `--token` values are visible in process listings. Browser extraction is the zero-config path for local interactive use.
64
67
@@ -68,13 +71,13 @@ The flag is convenient for one-off use; the env var is the recommended path for
68
71
69
72
Reads the GitHub `user_session` cookie from local browser cookie stores.
70
73
71
-
**Dependency:**[`browserutils/kooky`](https://github.com/browserutils/kooky) — a pure Go library that handles:
72
-
- Locating each browser's cookie store on disk
73
-
- Retrieving encryption keys (macOS Keychain, Windows DPAPI, Linux GNOME Keyring / kwallet)
74
-
- AES decryption and cookie DB schema differences across versions
75
-
- Per-browser quirks for Chromium-family browsers, Firefox, Safari, and Opera
74
+
**Cookie provider (build-tag-selected):**`cookies.go` holds the pure selection logic; the browser read (`readRawCookies`) is delegated to one of two interchangeable backends, chosen at compile time. Only one is linked per binary:
-**`-tags hbd`** — [`moond4rk/hackbrowserdata`](https://github.com/moonD4rk/HackBrowserData), with per-OS master-key retrieval kept to the native path (no macOS login-password prompt, no Windows App-Bound-Encryption injection)
76
77
77
-
**Supported browsers** (registered via blank-imported kooky finders): Chrome, Brave, Edge, Chromium, Firefox, Opera, Safari. `GetGitHubSession` queries all of them in one pass, groups the `user_session` candidates per browser store, and prefers stores that are logged in. When more than one candidate survives, `validate` is used to pick a live one (pass nil to skip network validation).
78
+
Both handle store discovery, per-OS key retrieval (macOS Keychain, Windows DPAPI, Linux GNOME Keyring / kwallet), AES decryption, and per-browser schema quirks. The version or fork of the active provider is pinned in `go.mod`.
79
+
80
+
**Supported browsers:** Chrome, Brave, Edge, Chromium, Firefox, Opera, Safari — the kooky provider registers these via blank-imported finders; the hbd provider discovers them internally. `GetGitHubSession` queries all of them in one pass, groups the `user_session` candidates per browser store, and prefers stores that are logged in. When more than one candidate survives, `validate` is used to pick a live one (pass nil to skip network validation).
78
81
79
82
```go
80
83
// GetGitHubSession returns the best user_session cookie for github.com across
0 commit comments