[gunalak]

Fixes #222 — macOS generation 401

Re: dropping the seed as "disproven" in 98bd455 — I think the seed actually works; the dropped version just sourced cookies from browser_cookie3 (which fails on macOS) and read them at path /. With two corrections, generation succeeds on macOS (Apple Silicon, verified end-to-end).

1. Read flow cookies by domain, not root-path URL (unconditional bug fix)

_get_chrome_cookies_playwright used ctx.cookies(["https://labs.google"]), which only returns cookies whose path matches / — silently dropping __Secure-next-auth.session-token (scoped to /fx, where the Flow app + createProject live). Switched to the full jar filtered by domain. This alone fixes verification / pre-read capturing the session (preread_count went 2 → 5–8, now including the session token).

2. Pre-read + seed the session into the headed context (safety net)

On macOS the headed generation context's native cookie decrypt is intermittent:

• sometimes it loads 0 cookies (context_cookie_count=0, flow_session_cookie_present=False) → createProject 401s;
• sometimes it loads them fine (context_cookie_count=7, present=True).

When it loads nothing, we seed the session from a snapshot read pre-launch via the headless --password-store=basic reader (the one path that decrypts on macOS; done pre-launch to avoid the profile singleton-lock deadlock). Restores _ensure_context_session_cookie (log + seed). No-op where the context loads the cookie itself (Windows, or the successful-decrypt runs).

Verified on macOS (Apple Silicon) — both paths

# seed fires (headed decrypt loaded nothing):
context_cookie_count=0  flow_session_cookie_present=False
preread_count=8  preread_session=True
context_cookies_seeded  seeded_session=True   → createProject + batchGenerateImages 200 → image written

# native decrypt (seed is a no-op):
context_cookie_count=7  flow_session_cookie_present=True   → 200 → image written

Full suite: 1906 passed, 6 skipped, 1 xfailed. Added 3 tests for the seed path.

Separate finding (worth its own follow-up)

The 401 was also masked by a login-capture bug: on macOS, if Chrome is already running, gflow auth login --browser chrome is hijacked by the running instance and the sign-in lands in the user's default profile, so the session is never persisted to the gflow profile (the profile had __Host-next-auth.csrf-token + callback-url but no session-token/SAPISID). Quitting Chrome before auth login fixed capture. gflow could detect a running Chrome at login and warn/relaunch — happy to file separately.

[github-actions]

Thanks for the contribution. This PR has been marked as an external contribution and routed for maintainer review.

Before merge, please make sure:

• The PR targets develop.
• Commits use a real Git identity or GitHub noreply email.
• External commits include a DCO sign-off: git commit -s.
• The PR does not include secrets, cookies, account tokens, signed URLs, or private captured data.
• Focused tests/docs are included for behavior changes.

GitHub Copilot code review may be requested as an advisory first pass, but maintainer approval is still required.