browser state save doesn't persist to disk; cookies get omits HttpOnly (breaks login persistence)

[mvbmir]

Summary

browser state save and browser cookies get don't deliver the "persist login between runs" workflow the docs describe. Hit while automating authenticated Nexus Mods downloads.

Bugs

1. browser state save <path> doesn't write the file

limux-cli browser --surface <id> state save ~/.config/limux/nexus-session.json

Returns the full state JSON on stdout, but never creates <path> on disk. So state load <path> has nothing to restore. The documented use case ("persist a login between runs") doesn't work.

Expected: write cookies + localStorage + sessionStorage to <path>.

2. browser cookies get omits HttpOnly cookies

Only returns JS-visible cookies (got 8 analytics cookies on a logged-in nexusmods.com page). The actual auth cookies (nexusmods_session, nexusmods_session_refresh, cf_clearance — all HttpOnly) are absent, so the result can't represent a real login. Expected: an option to include HttpOnly, or a documented way to export the authenticated session.

Repro

1. limux-cli browser open https://www.nexusmods.com , log in manually
2. limux-cli browser --surface <id> state save ~/foo.json -> prints JSON, ls ~/foo.json = missing
3. limux-cli browser --surface <id> cookies get -> no nexusmods_session

Notes / mitigations found

• The underlying cookie jar at ~/.local/share/limux/cookies.sqlite (moz_cookies table) does persist HttpOnly cookies across restarts, so a login survives reopening a surface. Backing up/restoring the relevant rows works as a manual persistence workaround.
• Injecting a credentialed fetch() from the logged-in page authenticates fine (browser attaches the HttpOnly cookie even though JS can't read it), which is a usable workaround for authenticated requests.
• But the first-class state save/state load + cookies get API is still broken/incomplete.

Env

limux 0.1.19, Linux (CachyOS, kernel 7.0.12), Wayland/KDE, WebKitGTK backend.