xianyu-hunter-hermes-skill/skill/xianyu-hunter-monitor/references/cookie-json-import-timeout-2026-05.md

Cookie JSON Import Panel and Timeout Pitfall — 2026-05

Context: while adding Web UI account controls for the local BOSS xianyu-hunter fork, POST /api/login/import-cookies initially timed out even for valid Cookie JSON.

Durable lesson

Do not make the Cookie JSON import endpoint perform a real Goofish page navigation immediately after ctx.addCookies(). In practice this can hang for 20–30s+ because the persistent Playwright context may already have a stale/blocked tab, Goofish network verification may stall, or the login probe page may hit a login wall/captcha.

Instead, import should be a fast local persistence operation:

1. Parse payload as either [...], { "cookies": [...] }, or { "data": [...] }.
2. Normalize cookie fields for Playwright (name, value, domain, path, secure, httpOnly, sameSite, optional expires).
3. await ctx.addCookies(cookies).
4. Return local status from await ctx.cookies() only: imported count, relevant Goofish/Taobao/Alibaba cookie count, timestamp, and storage path.
5. Tell the UI/user to click 检测登录状态 for the slower network probe.

Known-good response shape

For valid import, return quickly with JSON similar to:

{
  "ok": true,
  "imported": 1,
  "loggedIn": true,
  "cookieCount": 10,
  "url": "cookie-import://local",
  "title": "Cookie 已导入，点击“检测登录状态”可联网验证",
  "storage": "browser-data/"
}

loggedIn here is only a heuristic from cookie count, not a real network login verification.

Verification commands

Run from /Users/chick/.Hermes/workspace/research/xianyu-hunter:

node --check lib/login.mjs && node --check server.mjs && node --check public/app.js

curl -sS -i -m 10 -X POST http://127.0.0.1:3000/api/login/import-cookies \
  -H 'Content-Type: application/json' \
  -d '{}' | sed -n '1,60p'

curl -sS -i -m 10 -X POST http://127.0.0.1:3000/api/login/import-cookies \
  -H 'Content-Type: application/json' \
  -d '{"cookies":[{"name":"test_cookie_for_import_probe","value":"1","domain":".goofish.com","path":"/"}]}' | sed -n '1,120p'

curl -sS -m 10 http://127.0.0.1:3000/ | grep -E '上传 Cookie JSON|账号登录 / Cookie'

Expected:

• Invalid payload returns HTTP 400 with the Chinese format error.
• Valid payload returns HTTP 200 within 10 seconds.
• UI contains 账号登录 / Cookie and 上传 Cookie JSON.

Restart pitfall

If changes appear not to take effect, kill the exact listener PID on port 3000. The wrapper/background shell may leave a stale node server.mjs and Playwright Chromium process alive, so a normal restart can accidentally leave the old code serving requests.

for p in $(lsof -tiTCP:3000 -sTCP:LISTEN 2>/dev/null); do kill "$p" 2>/dev/null || true; done
sleep 1
for p in $(lsof -tiTCP:3000 -sTCP:LISTEN 2>/dev/null); do kill -9 "$p" 2>/dev/null || true; done
PORT=3000 node server.mjs