xianyu-hunter-hermes-skill/skill/xianyu-hunter-monitor/references/qr-login-screenshot-2026-05.md

Real QR Login Capture for Xianyu/Goofish

Session learning: BOSS found Cookie JSON import inconvenient and asked for the real login QR code directly in chat. The web app's POST /api/login/open opens a visible Chromium window on the Mac, but that is not enough for Feishu/mobile use; generating a screenshot and returning it as MEDIA:/tmp/xianyu-login-qr.png is more convenient.

Working pattern

From /Users/chick/.Hermes/workspace/research/xianyu-hunter:

1. Close the existing Playwright browser context through the app if it may hold the profile lock:

curl -sS -m 10 -X POST http://127.0.0.1:3000/api/login/close-browser \
  -H 'Content-Type: application/json' -d '{}'

2. Run a Playwright helper from inside the repo, not /tmp, so import { chromium } from 'playwright' resolves against the project dependencies.

3. Launch a persistent context using the real project profile:

const userDataDir = '/Users/chick/.Hermes/workspace/research/xianyu-hunter/browser-data';
const ctx = await chromium.launchPersistentContext(userDataDir, {
  headless: false,
  viewport: { width: 1100, height: 900 },
  locale: 'zh-CN',
  args: ['--disable-blink-features=AutomationControlled', '--no-first-run'],
});

4. Navigate to Taobao/Goofish login:

const loginUrl = 'https://login.taobao.com/member/login.jhtml?redirectURL=' + encodeURIComponent('https://www.goofish.com/');
await page.goto(loginUrl, { waitUntil: 'domcontentloaded', timeout: 45000 });

5. If possible, click QR-login affordances such as 扫码登录, 二维码登录, .icon-qrcode, or [class*=qrcode], wait a few seconds, then screenshot:

await page.screenshot({ path: '/tmp/xianyu-login-qr.png', fullPage: false });

6. Keep the process alive for about 5 minutes so the QR remains valid while BOSS scans:

await page.waitForTimeout(5 * 60 * 1000);

7. Reply with Feishu media syntax:

MEDIA:/tmp/xianyu-login-qr.png

After BOSS scans, call /api/login/status or run the normal task/login verification.

Pitfalls

• Running the helper from /tmp failed with ERR_MODULE_NOT_FOUND: Cannot find package 'playwright'; create/run the helper inside the xianyu-hunter repo or set module resolution explicitly.
• A persistent Chromium profile can be locked by the dashboard's existing browser context. Use /api/login/close-browser first or kill stale Goofish Playwright processes if navigation hangs.
• vision_analyze can fail due provider/API key issues; do not depend on it to validate the QR screenshot. If the screenshot exists and is recent, send it; BOSS can scan/confirm.
• Do not print or export raw cookies. QR login is a user-driven login flow and is preferable to asking BOSS to handle Cookie JSON when convenience is the goal.