fix: Linux Chrome cookie extraction (libsecret default keyring) - #40
Draft
MabezDev wants to merge 1 commit into
Draft
fix: Linux Chrome cookie extraction (libsecret default keyring)#40MabezDev wants to merge 1 commit into
MabezDev wants to merge 1 commit into
Conversation
Point kooky at a temporary replace of browserutils/kooky#116 so Linux Chrome can read Chrome Safe Storage from the default libsecret keyring (not only the login collection). That unblocks extract-token/check-token and uploads without GH_SESSION_TOKEN when the user is logged into GitHub in Chrome. Also add clear error hints when keyring lookup fails, and a short README note that interactive Linux use should prefer the native keyring path over injecting session cookies into agent environments. Drop the replace and bump to a released kooky version once browserutils/kooky#116 lands.
MabezDev
marked this pull request as draft
July 28, 2026 12:52
drogers0
added
the
upstream
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Linux Chrome cookie extraction was broken on non-KDE desktops (e.g. Hyprland + gnome-keyring): kooky only searched the Secret Service login collection, while Chrome Safe Storage lives in the default keyring. That produced
kwallet: password not foundeven whensecret-toolcould read the secret, sogh imagerequiredGH_SESSION_TOKEN.Changes
replaceofgithub.com/browserutils/kooky→ MabezDev/kooky@3e00ef3 from browserutils/kooky#116. Drop the replace and bump to a released kooky version once that PR merges.keyring password retrieval failed/secret not found in keyring).user_session/GH_SESSION_TOKENto unattended agents.Verified on this machine (2026-07-28)
~/.config/google-chrome/Default/Cookies(meta v24,v11ciphertext)secret-tool lookup xdg:schema chrome_libsecret_os_crypt_password_v2worksGH_SESSION_TOKEN):gh image check-token→Token is valid (source: browser cookies)/ usernamegh image --repo <writable-repo> test.png→Test plan
go test ./...check-tokenand image upload without env tokenreplace, bump require, re-verify