Repository navigation
fix(api): keep --password-store=basic at generation to fix macOS 401 (#222) - #225
Merged
Merged
Conversation
…222) auth login (auth/real_chrome.py) launches Chrome with --password-store=basic, sealing the profile's cookies with the *basic* store. Generation suppressed that flag via ignore_default_args, so on macOS Chrome fell back to the keychain ("Chrome Safe Storage") to read those basic-sealed cookies -> decrypt failure -> logged-out context -> 401 on project.createProject. Windows is immune (DPAPI ignores the flag), which is why it reproduced only on macOS and why auth login/verify (which never hit this path) succeeded. Fix: stop suppressing Playwright's default --password-store=basic at generation so it is symmetric with login. Updates the launch-kwargs pin test and adds a regression assertion (unit-level proxy; the runtime failure only reproduces on a headed Chrome on macOS). Refs #222
Owner
Author
|
Two low-severity follow-ups (non-blocking, not hotfix scope): the scattered Merge decision: merging to |
ffroliva
marked this pull request as ready for review
June 29, 2026 17:10
This was referenced Jun 29, 2026
ffroliva
added a commit
that referenced
this pull request
Jun 29, 2026
The shared generation context in FlowApiClient._persistent_context_kwargs was
the ONLY Chrome launch site that did not explicitly pass --password-store=basic
— it merely relied on Playwright's internal default. auth login
(auth/real_chrome.py) and verification (auth/verification.py) seal/read the
profile cookies with Chrome's *basic* store, as do every other launch site
(auth/cookies.py, auth/internal_chromium.py, browser_manager.py,
ui_automation.py). On macOS, letting the generation context fall back to the OS
Keychain ("Chrome Safe Storage") means it cannot decrypt the basic-sealed
cookies -> logged-out context -> HTTP 401 at project.createProject, while login
and verification (which DO pass the flag) succeed. #225 added a comment about
this but never the flag itself.
- _persistent_context_kwargs: add --password-store=basic to args (explicit
symmetry with all other launch paths; no longer relies on Playwright defaults).
- _log_and_guard_launch: also log launch_args, ignore_default_args, and a
password_store_basic boolean, so the reporter's macOS run confirms the flag is
present on the failing path and whether the 401 clears.
- Update the launch-kwargs + recording-client tests to pin the flag in args.
Awaiting macOS verification from the reporter (credit-free) before claiming
fixed. Refs #222
15990166686ll-crypto
pushed a commit
to 15990166686ll-crypto/gflow-cli
that referenced
this pull request
Aug 24, 2026
…rd-store fix(api): keep --password-store=basic at generation to fix macOS 401 (ffroliva#222)
15990166686ll-crypto
pushed a commit
to 15990166686ll-crypto/gflow-cli
that referenced
this pull request
Aug 24, 2026
…iva#222) The shared generation context in FlowApiClient._persistent_context_kwargs was the ONLY Chrome launch site that did not explicitly pass --password-store=basic — it merely relied on Playwright's internal default. auth login (auth/real_chrome.py) and verification (auth/verification.py) seal/read the profile cookies with Chrome's *basic* store, as do every other launch site (auth/cookies.py, auth/internal_chromium.py, browser_manager.py, ui_automation.py). On macOS, letting the generation context fall back to the OS Keychain ("Chrome Safe Storage") means it cannot decrypt the basic-sealed cookies -> logged-out context -> HTTP 401 at project.createProject, while login and verification (which DO pass the flag) succeed. ffroliva#225 added a comment about this but never the flag itself. - _persistent_context_kwargs: add --password-store=basic to args (explicit symmetry with all other launch paths; no longer relies on Playwright defaults). - _log_and_guard_launch: also log launch_args, ignore_default_args, and a password_store_basic boolean, so the reporter's macOS run confirms the flag is present on the failing path and whether the 401 clears. - Update the launch-kwargs + recording-client tests to pin the flag in args. Awaiting macOS verification from the reporter (credit-free) before claiming fixed. Refs ffroliva#222
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the macOS
401 AuthExpiredErroronproject.createProjectreported in #222, wheregflow image t2iopened a logged-out browser despite a verifiedauth login.Root cause — a
--password-storeasymmetry between login and generation:auth login(auth/real_chrome.py:69) launches Chrome with--password-store=basic, sealing the profile's cookies with Chrome's basic store (not the macOS Keychain).api/client.py:_persistent_context_kwargs) listed--password-store=basicinignore_default_args, stripping the flag Playwright adds by default — so that Chrome used the macOS Keychain ("Chrome Safe Storage") to read the cookies.401. macOS/Linux-only; Windows uses DPAPI and ignores the flag (why it never reproduced on Windows, and whyauth login/auth status— which don't hit this path — succeeded).Fix: stop suppressing
--password-store=basicat generation so it is symmetric with login.tests/api/test_client_launch_kwargs.py) — 2 passedruff check+ruff format --checkclean;pyright src/gflow_cli/api/client.py0 errorsgflow image t2ion macOS confirming the 401 is gone — NOT DONEauth login(still basic) + generation (now basic) round-trip on macOSThis cannot be verified on CI (headless Linux) or on Windows — #222 is a macOS-Keychain-specific failure. Held as draft pending a maintainer macOS run. Auth-surface change — please review the symmetry argument before promoting.
Refs #222(notCloses) — do not auto-close until macOS-verified.🤖 Generated with Claude Code