From 0f0eb959396f9bb643ab239ab625fbf7895f06f7 Mon Sep 17 00:00:00 2001 From: Lukce Date: Thu, 29 Oct 2026 17:44:46 -0400 Subject: [PATCH] Send same-origin cookies, so the reader works behind a login Both fetches (the llms.txt probe and the reader) used credentials: "omit". On a deployment behind a login, such as a Vercel preview with Deployment Protection, the cookieless request was redirected to the login page: the probe failed, or the reader's fetch failed and Machine fell back to navigating to the raw file, with no reader and no pill. same-origin sends the visitor's cookies only to the site's own origin, so a cross-origin data-llms URL still gets none. Adds a test that no fetch drops same-origin cookies. Co-Authored-By: Claude Opus 5.5 --- src/human-machine-swapper.js | 9 +++++++-- test/component.test.mjs | 8 ++++++++ 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/src/human-machine-swapper.js b/src/human-machine-swapper.js index 66bd285..99b02c7 100644 --- a/src/human-machine-swapper.js +++ b/src/human-machine-swapper.js @@ -71,7 +71,10 @@ for (const path of PROBE_PATHS) { try { - const response = await fetch(path, { method: "HEAD", credentials: "omit" }); + // same-origin, not omit: behind a login (a Vercel preview, an intranet) a cookieless + // request is bounced to the login page, the probe fails, and the pill never appears. + // Cookies still never go to another origin. + const response = await fetch(path, { method: "HEAD", credentials: "same-origin" }); if (response.ok) { try { window.sessionStorage.setItem(cacheKey, path); @@ -472,7 +475,9 @@ if (!this._text) { try { - const response = await fetch(href, { credentials: "omit" }); + // same-origin: see the probe above. With "omit", a protected deployment bounced this + // to its login page, the fetch failed, and the reader fell back to the raw file. + const response = await fetch(href, { credentials: "same-origin" }); if (!response.ok) throw new Error(String(response.status)); this._text = await response.text(); } catch (error) { diff --git a/test/component.test.mjs b/test/component.test.mjs index 3191e18..a6785b3 100644 --- a/test/component.test.mjs +++ b/test/component.test.mjs @@ -112,3 +112,11 @@ test("package.json points at the manifest and ships it", () => { assert.equal(PKG.customElements, "custom-elements.json"); assert.ok(PKG.files.includes("custom-elements.json")); }); + +test("it sends cookies to its own origin, so the reader works behind a login", () => { + // With credentials: "omit", a password-protected deployment (e.g. a Vercel preview) sent the + // fetch to its login page, the reader failed, and Machine fell back to the raw file. + assert.ok(!/credentials:\s*"omit"/.test(SOURCE), "no fetch may drop same-origin cookies"); + assert.equal((SOURCE.match(/credentials:\s*"same-origin"/g) || []).length, 2); +}); +