Skip to content

desktop(browser): embedded browser never persists cookies - logins (e.g. Google) lost on every app restart #50382

Closed as not planned

Description

@Tomflame-4ever

Describe the bug

The OpenCode Desktop embedded browser keeps cookies only in memory and never writes them to its on-disk profile. Any login (e.g. a Google account) works within the running app process but disappears when OpenCode is fully quit and reopened, so every new session requires logging in again.

The on-disk profile at %APPDATA%\ai.opencode.desktop\ persists other Chromium data (Local Storage, Preferences, Network Persistent State, TransportSecurity), but the cookie store is never flushed: the Network\Cookies SQLite DB keeps its pristine creation-time size/mtime and no Cookies-wal file is ever created — i.e. the cookie store behaves like an off-the-record (in-memory) store.

To reproduce

  1. Open OpenCode Desktop (v1.18.31, Windows) and open a browser tab to a login-protected site (e.g. https://notebook.google.com).
  2. Complete the Google sign-in; confirm document.cookie is non-empty (SID, APISID, SAPISID, __Secure-* present → cookies set).
  3. While running, inspect %APPDATA%\ai.opencode.desktop\Network\ — the Cookies file shows the profile-creation timestamp and ~20 KB size, and there is no Cookies-wal file (no writes ever land on disk).
  4. Fully quit OpenCode and reopen it; restore/open the same URL → Google sign-in page appears again.

Expected behavior

Logins should persist across app restarts — cookies should be written to the existing persistent profile directory (like Local Storage is).

Actual behavior

Cookies live only in the browser process memory; the persistent Cookies DB is never modified, so all sessions are lost on restart.

Environment

  • opencode version: 1.18.31 (release)
  • OS: Windows 11 Pro Insider Preview, 10.0.28020
  • Client: OpenCode Desktop (OPENCODE_CLIENT=desktop; terminal xterm-256color, shell cmd.exe)
  • Active plugins: none configured; MCP servers only (windows-control, obsidian, chrome-devtools, …)

Evidence

  • Network\Cookies mtime = profile creation time (unchanged after successful logins); size 20480 bytes; Cookies-wal absent.
  • document.cookie on notebook.google.com during a session: 561 chars incl. SID, APISID, SAPISID, __Secure-1PAPISID, __Secure-3PAPISID — memory-only.
  • Same failure for the earlier "one-time" login on this machine (cookies were already absent before the retry).

Activity

  1. Hronom commented on Sep 21, 2026

    @Hronom

    One test detail that may make this easier to land: treat cookie persistence as a three-stage contract rather than a single profile-path check.

    1. During the session, prove that the browser is using the intended persistent profile and that the cookie store is writable.
    2. Before app exit, await browser/context shutdown and record a values-free flush/close receipt. If shutdown is interrupted, mark persistence as unknown.
    3. After relaunch, bind the restored browser to the same profile generation and verify a harmless public or localhost fixture plus an explicit user-owned origin check. Read back the post-restart state; do not infer persistence from the profile directory existing.

    The regression matrix should include clean quit, crash or kill, two profiles, a locked Cookies DB, profile migration, and concurrent app instances. If a cookie is present in memory but the flush receipt is missing, the safe result is not verified, not a retry of login or a claim that the session persisted.

    I maintain Hronaut, a local visible Browser/MCP workspace, and this is the boundary we use for workspace, tab, and storage continuity. AI-assisted; no cookie values or private site details are involved.

  2. Tomflame-4ever commented on Sep 22, 2026

    @Tomflame-4ever
    Author

    Stage-1 probe results (per the 3-stage contract): cookie store is not writable to disk

    Reproducing on opencode v2.0.12 (latest), Windows NT 10.0.28020 (x64). The embedded browser's Chromium profile is at %APPDATA%\ai.opencode.desktop.

    Observed while logged into Google in-session (browser tab active, cookies working in memory):

    File (profile dir) Last write Notes
    Network\Cookies app start time (07:15:23) never touched during the session — 20,480 bytes, frozen at launch
    Network\Cookies-journal app start time (07:15:23) 0 bytes, never written
    Network\Cookies-wal — does not exist
    Network Persistent State session time (21:43:50) ✅ written during session
    TransportSecurity session time (21:43:31) ✅ written during session
    drafts.sqlite-wal, SharedStorage-wal, DIPS-wal session time (21:33–21:41) ✅ other subsystem WALs are created and flushed

    So stage 1 fails: the browser is using the intended persistent profile, but the cookie store is never flushed to disk — no Cookies-wal is ever created despite successful logins, while other SQLite stores in the same profile write fine.

    Stage 3 already confirmed by report: after quitting and relaunching, Google login is required again → per the contract, result: not verified / session did not persist (and no "retry login or claim persisted" is warranted).

    Additional data point supporting the "in-memory cookie store" hypothesis in the issue body:

    • Network\Cookies LastWriteTime equals the app's start time and never advances, even minutes after a successful login flow completes in a tab.
    • Cookies-journal stays 0 bytes (no pending WAL/journal activity at shutdown checkpoint either).
    • The profile directory itself is fully writable (other stores update), so it is not a permissions/locking problem.

    Happy to capture stage-2 (flush/close receipt) timing on the next quit if it helps.

  3. thdxr commented on Oct 11, 2026

    @thdxr
    Member

    Thanks for the report! OpenCode 2.0 is now out and development is focused on V2, so we're closing issues filed against OpenCode 1. Please upgrade (opencode upgrade --major, details: https://anoma.ly/notes/opencode-2-0), and if this is still relevant on 2.0, reopen this issue or open a new one with your 2.0 version.

    — from 𝕺𝖕𝖊𝖓𝕮𝖔𝖉𝖊

  4. Tomflame-4ever commented on Oct 11, 2026

    @Tomflame-4ever
    Author

    What? But this issue was regarding the browser harness built on the OpenCode V2 desktop app...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions