# Cookie JSON Import Panel and Timeout Pitfall — 2026-05

Context: while adding Web UI account controls for the local BOSS `xianyu-hunter` fork, `POST /api/login/import-cookies` initially timed out even for valid Cookie JSON.

## Durable lesson

Do **not** make the Cookie JSON import endpoint perform a real Goofish page navigation immediately after `ctx.addCookies()`. In practice this can hang for 20–30s+ because the persistent Playwright context may already have a stale/blocked tab, Goofish network verification may stall, or the login probe page may hit a login wall/captcha.

Instead, import should be a fast local persistence operation:

1. Parse payload as either `[...]`, `{ "cookies": [...] }`, or `{ "data": [...] }`.
2. Normalize cookie fields for Playwright (`name`, `value`, `domain`, `path`, `secure`, `httpOnly`, `sameSite`, optional `expires`).
3. `await ctx.addCookies(cookies)`.
4. Return local status from `await ctx.cookies()` only: imported count, relevant Goofish/Taobao/Alibaba cookie count, timestamp, and storage path.
5. Tell the UI/user to click **检测登录状态** for the slower network probe.

## Known-good response shape

For valid import, return quickly with JSON similar to:

```json
{
  "ok": true,
  "imported": 1,
  "loggedIn": true,
  "cookieCount": 10,
  "url": "cookie-import://local",
  "title": "Cookie 已导入，点击“检测登录状态”可联网验证",
  "storage": "browser-data/"
}
```

`loggedIn` here is only a heuristic from cookie count, not a real network login verification.

## Verification commands

Run from `/Users/chick/.Hermes/workspace/research/xianyu-hunter`:

```bash
node --check lib/login.mjs && node --check server.mjs && node --check public/app.js

curl -sS -i -m 10 -X POST http://127.0.0.1:3000/api/login/import-cookies \
  -H 'Content-Type: application/json' \
  -d '{}' | sed -n '1,60p'

curl -sS -i -m 10 -X POST http://127.0.0.1:3000/api/login/import-cookies \
  -H 'Content-Type: application/json' \
  -d '{"cookies":[{"name":"test_cookie_for_import_probe","value":"1","domain":".goofish.com","path":"/"}]}' | sed -n '1,120p'

curl -sS -m 10 http://127.0.0.1:3000/ | grep -E '上传 Cookie JSON|账号登录 / Cookie'
```

Expected:

- Invalid payload returns HTTP 400 with the Chinese format error.
- Valid payload returns HTTP 200 within 10 seconds.
- UI contains `账号登录 / Cookie` and `上传 Cookie JSON`.

## Restart pitfall

If changes appear not to take effect, kill the exact listener PID on port 3000. The wrapper/background shell may leave a stale `node server.mjs` and Playwright Chromium process alive, so a normal restart can accidentally leave the old code serving requests.

```bash
for p in $(lsof -tiTCP:3000 -sTCP:LISTEN 2>/dev/null); do kill "$p" 2>/dev/null || true; done
sleep 1
for p in $(lsof -tiTCP:3000 -sTCP:LISTEN 2>/dev/null); do kill -9 "$p" 2>/dev/null || true; done
PORT=3000 node server.mjs
```