You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
desktop(browser): embedded browser never persists cookies - logins (e.g. Google) lost on every app restart #50382
The OpenCode Desktop embedded browser keeps cookies only in memory and never writes them to its on-disk profile. Any login (e.g. a Google account) works within the running app process but disappears when OpenCode is fully quit and reopened, so every new session requires logging in again.
The on-disk profile at %APPDATA%\ai.opencode.desktop\ persists other Chromium data (Local Storage, Preferences, Network Persistent State, TransportSecurity), but the cookie store is never flushed: the Network\Cookies SQLite DB keeps its pristine creation-time size/mtime and no Cookies-wal file is ever created — i.e. the cookie store behaves like an off-the-record (in-memory) store.
To reproduce
Open OpenCode Desktop (v1.18.31, Windows) and open a browser tab to a login-protected site (e.g. https://notebook.google.com).
Complete the Google sign-in; confirm document.cookie is non-empty (SID, APISID, SAPISID, __Secure-* present → cookies set).
While running, inspect %APPDATA%\ai.opencode.desktop\Network\ — the Cookies file shows the profile-creation timestamp and ~20 KB size, and there is noCookies-wal file (no writes ever land on disk).
Fully quit OpenCode and reopen it; restore/open the same URL → Google sign-in page appears again.
Expected behavior
Logins should persist across app restarts — cookies should be written to the existing persistent profile directory (like Local Storage is).
Actual behavior
Cookies live only in the browser process memory; the persistent Cookies DB is never modified, so all sessions are lost on restart.
One test detail that may make this easier to land: treat cookie persistence as a three-stage contract rather than a single profile-path check.
During the session, prove that the browser is using the intended persistent profile and that the cookie store is writable.
Before app exit, await browser/context shutdown and record a values-free flush/close receipt. If shutdown is interrupted, mark persistence as unknown.
After relaunch, bind the restored browser to the same profile generation and verify a harmless public or localhost fixture plus an explicit user-owned origin check. Read back the post-restart state; do not infer persistence from the profile directory existing.
The regression matrix should include clean quit, crash or kill, two profiles, a locked Cookies DB, profile migration, and concurrent app instances. If a cookie is present in memory but the flush receipt is missing, the safe result is not verified, not a retry of login or a claim that the session persisted.
I maintain Hronaut, a local visible Browser/MCP workspace, and this is the boundary we use for workspace, tab, and storage continuity. AI-assisted; no cookie values or private site details are involved.
Stage-1 probe results (per the 3-stage contract): cookie store is not writable to disk
Reproducing on opencode v2.0.12 (latest), Windows NT 10.0.28020 (x64). The embedded browser's Chromium profile is at %APPDATA%\ai.opencode.desktop.
Observed while logged into Google in-session (browser tab active, cookies working in memory):
File (profile dir)
Last write
Notes
Network\Cookies
app start time (07:15:23)
never touched during the session — 20,480 bytes, frozen at launch
Network\Cookies-journal
app start time (07:15:23)
0 bytes, never written
Network\Cookies-wal
—
does not exist
Network Persistent State
session time (21:43:50)
✅ written during session
TransportSecurity
session time (21:43:31)
✅ written during session
drafts.sqlite-wal, SharedStorage-wal, DIPS-wal
session time (21:33–21:41)
✅ other subsystem WALs are created and flushed
So stage 1 fails: the browser is using the intended persistent profile, but the cookie store is never flushed to disk — no Cookies-wal is ever created despite successful logins, while other SQLite stores in the same profile write fine.
Stage 3 already confirmed by report: after quitting and relaunching, Google login is required again → per the contract, result: not verified / session did not persist (and no "retry login or claim persisted" is warranted).
Additional data point supporting the "in-memory cookie store" hypothesis in the issue body:
Network\Cookies LastWriteTime equals the app's start time and never advances, even minutes after a successful login flow completes in a tab.
Cookies-journal stays 0 bytes (no pending WAL/journal activity at shutdown checkpoint either).
The profile directory itself is fully writable (other stores update), so it is not a permissions/locking problem.
Happy to capture stage-2 (flush/close receipt) timing on the next quit if it helps.
Thanks for the report! OpenCode 2.0 is now out and development is focused on V2, so we're closing issues filed against OpenCode 1. Please upgrade (opencode upgrade --major, details: https://anoma.ly/notes/opencode-2-0), and if this is still relevant on 2.0, reopen this issue or open a new one with your 2.0 version.
Activity
Hronom commentedon Sep 21, 2026
One test detail that may make this easier to land: treat cookie persistence as a three-stage contract rather than a single profile-path check.
The regression matrix should include clean quit, crash or kill, two profiles, a locked Cookies DB, profile migration, and concurrent app instances. If a cookie is present in memory but the flush receipt is missing, the safe result is not verified, not a retry of login or a claim that the session persisted.
I maintain Hronaut, a local visible Browser/MCP workspace, and this is the boundary we use for workspace, tab, and storage continuity. AI-assisted; no cookie values or private site details are involved.
Tomflame-4ever commentedon Sep 22, 2026
Stage-1 probe results (per the 3-stage contract): cookie store is not writable to disk
Reproducing on opencode v2.0.12 (latest), Windows NT 10.0.28020 (x64). The embedded browser's Chromium profile is at
%APPDATA%\ai.opencode.desktop.Observed while logged into Google in-session (browser tab active, cookies working in memory):
Network\CookiesNetwork\Cookies-journalNetwork\Cookies-walNetwork Persistent StateTransportSecuritydrafts.sqlite-wal,SharedStorage-wal,DIPS-walSo stage 1 fails: the browser is using the intended persistent profile, but the cookie store is never flushed to disk — no
Cookies-walis ever created despite successful logins, while other SQLite stores in the same profile write fine.Stage 3 already confirmed by report: after quitting and relaunching, Google login is required again → per the contract, result: not verified / session did not persist (and no "retry login or claim persisted" is warranted).
Additional data point supporting the "in-memory cookie store" hypothesis in the issue body:
Network\CookiesLastWriteTime equals the app's start time and never advances, even minutes after a successful login flow completes in a tab.Cookies-journalstays 0 bytes (no pending WAL/journal activity at shutdown checkpoint either).Happy to capture stage-2 (flush/close receipt) timing on the next quit if it helps.
thdxr commentedon Oct 11, 2026
Thanks for the report! OpenCode 2.0 is now out and development is focused on V2, so we're closing issues filed against OpenCode 1. Please upgrade (
opencode upgrade --major, details: https://anoma.ly/notes/opencode-2-0), and if this is still relevant on 2.0, reopen this issue or open a new one with your 2.0 version.— from 𝕺𝖕𝖊𝖓𝕮𝖔𝖉𝖊
Tomflame-4ever commentedon Oct 11, 2026
What? But this issue was regarding the browser harness built on the OpenCode V2 desktop app...