feat: publish xianyu hunter hermes skill package

2026-05-06 19:26:45 +08:00
commit 6384156097
59 changed files with 9627 additions and 0 deletions
@@ -0,0 +1,68 @@
+# Cookie JSON Import Panel and Timeout Pitfall — 2026-05
+
+Context: while adding Web UI account controls for the local BOSS `xianyu-hunter` fork, `POST /api/login/import-cookies` initially timed out even for valid Cookie JSON.
+
+## Durable lesson
+
+Do **not** make the Cookie JSON import endpoint perform a real Goofish page navigation immediately after `ctx.addCookies()`. In practice this can hang for 20–30s+ because the persistent Playwright context may already have a stale/blocked tab, Goofish network verification may stall, or the login probe page may hit a login wall/captcha.
+
+Instead, import should be a fast local persistence operation:
+
+1. Parse payload as either `[...]`, `{ "cookies": [...] }`, or `{ "data": [...] }`.
+2. Normalize cookie fields for Playwright (`name`, `value`, `domain`, `path`, `secure`, `httpOnly`, `sameSite`, optional `expires`).
+3. `await ctx.addCookies(cookies)`.
+4. Return local status from `await ctx.cookies()` only: imported count, relevant Goofish/Taobao/Alibaba cookie count, timestamp, and storage path.
+5. Tell the UI/user to click **检测登录状态** for the slower network probe.
+
+## Known-good response shape
+
+For valid import, return quickly with JSON similar to:
+
+```json
+{
+  "ok": true,
+  "imported": 1,
+  "loggedIn": true,
+  "cookieCount": 10,
+  "url": "cookie-import://local",
+  "title": "Cookie 已导入，点击“检测登录状态”可联网验证",
+  "storage": "browser-data/"
+}
+```
+
+`loggedIn` here is only a heuristic from cookie count, not a real network login verification.
+
+## Verification commands
+
+Run from `/Users/chick/.Hermes/workspace/research/xianyu-hunter`:
+
+```bash
+node --check lib/login.mjs && node --check server.mjs && node --check public/app.js
+
+curl -sS -i -m 10 -X POST http://127.0.0.1:3000/api/login/import-cookies \
+  -H 'Content-Type: application/json' \
+  -d '{}' | sed -n '1,60p'
+
+curl -sS -i -m 10 -X POST http://127.0.0.1:3000/api/login/import-cookies \
+  -H 'Content-Type: application/json' \
+  -d '{"cookies":[{"name":"test_cookie_for_import_probe","value":"1","domain":".goofish.com","path":"/"}]}' | sed -n '1,120p'
+
+curl -sS -m 10 http://127.0.0.1:3000/ | grep -E '上传 Cookie JSON|账号登录 / Cookie'
+```
+
+Expected:
+
+- Invalid payload returns HTTP 400 with the Chinese format error.
+- Valid payload returns HTTP 200 within 10 seconds.
+- UI contains `账号登录 / Cookie` and `上传 Cookie JSON`.
+
+## Restart pitfall
+
+If changes appear not to take effect, kill the exact listener PID on port 3000. The wrapper/background shell may leave a stale `node server.mjs` and Playwright Chromium process alive, so a normal restart can accidentally leave the old code serving requests.
+
+```bash
+for p in $(lsof -tiTCP:3000 -sTCP:LISTEN 2>/dev/null); do kill "$p" 2>/dev/null || true; done
+sleep 1
+for p in $(lsof -tiTCP:3000 -sTCP:LISTEN 2>/dev/null); do kill -9 "$p" 2>/dev/null || true; done
+PORT=3000 node server.mjs
+```