potiuk opened a new pull request, #54:
URL: https://github.com/apache/comdev/pull/54
## What
`login` no longer asks you to dig the session cookie out of DevTools. It
opens
the lists.apache.org login page in a Chrome / Edge / Brave / Chromium window
with its own profile; you log in there as usual, and the MCP server picks up
the session cookie from that window, validates it, caches it and closes the
window.
## Why not a normal OAuth redirect?
ASF OAuth only redirects back to registered ASF hosts — `redirect_uri`
pointing at `localhost` / `127.0.0.1` (or any non-ASF host) is refused — and
the `ponymail` cookie is HttpOnly, so page scripts and bookmarklets cannot
read
it. The browser's DevTools protocol can, so the MCP server launches the
window
with `--remote-debugging-pipe` (a private pipe, no port) and reads only the
`ponymail` cookie for the PonyMail host.
## Details
- **Temporary profile by default**, deleted after login — your everyday
browser
profile is never touched.
- **Opt-in kept profile:** `PONYMAIL_BROWSER_PROFILE=persistent` (or an
absolute
path) keeps the profile in `~/.ponymail-mcp/browser-profile` (0700), so the
login and a password saved in the browser survive between sessions. A kept
profile uses the OS credential store (macOS Keychain / Linux keyring), so
its
cookies and passwords are encrypted at rest. The README spells out what
this
does and does not protect against.
- `PONYMAIL_BROWSER` selects the browser; `none` keeps the old paste form,
which also stays the fallback when no Chromium-family browser is available.
- No new dependencies; works on Node >= 20.
## Testing
- `npm test`: 91 passing, including end-to-end tests of the browser login
against a fake browser that speaks the DevTools pipe protocol (success,
window closed, timeout, launch failure, kept profile).
- Smoke-tested against real Chrome (headless): pipe connection,
`Storage.getCookies` and `Browser.close` work.
- Not yet exercised: a full interactive login with ASF credentials.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
