feat(browser): inject_cookies() + user_data_dir builder with auto tempdir (#11, #12)

Author: greysquirr3l

CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.10] - 2026-03-03
+
+### Added
+
+- `stygian-browser`: `PageHandle::inject_cookies()` — seed session cookies on a page without a full `SessionSnapshot` round-trip and without a direct `chromiumoxide` dependency in calling code (closes [#11](https://github.com/greysquirr3l/stygian/issues/11))
+- `stygian-browser`: `BrowserConfig::builder().user_data_dir(path)` builder method — set a custom Chrome profile directory; when omitted each browser instance now auto-generates a unique temporary directory (`$TMPDIR/stygian-<id>`) so concurrent pools no longer race on `SingletonLock` (closes [#12](https://github.com/greysquirr3l/stygian/issues/12))
+
 ## [0.1.9] - 2026-03-02
 
 ### Fixed

Cargo.lock

@@ -6,7 +6,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.1.9"
+version = "0.1.10"
 edition = "2024"
 rust-version = "1.93.1"
 authors = ["Nick Campbell <s0ma@protonmail.com>"]

Cargo.toml

@@ -93,9 +93,13 @@ impl BrowserInstance {
             builder = builder.chrome_executable(path);
         }
 
-        if let Some(dir) = &config.user_data_dir {
-            builder = builder.user_data_dir(dir);
-        }
+        // Use the caller-supplied profile dir, or generate a unique temp dir
+        // per instance so concurrent pools never race on SingletonLock.
+        let data_dir = config
+            .user_data_dir
+            .clone()
+            .unwrap_or_else(|| std::env::temp_dir().join(format!("stygian-{id}")));
+        builder = builder.user_data_dir(&data_dir);
 
         for arg in &args {
             // chromiumoxide's ArgsBuilder prepends "--" when formatting args, so

crates/stygian-browser/src/browser.rs

@@ -424,6 +424,27 @@ impl BrowserConfigBuilder {
         self
     }
 
+    /// Set a custom user profile directory.
+    ///
+    /// When not set, each browser instance automatically uses a unique
+    /// temporary directory derived from its instance ID, preventing
+    /// `SingletonLock` races between concurrent pools or instances.
+    ///
+    /// # Example
+    ///
+    /// ```
+    /// use stygian_browser::BrowserConfig;
+    /// let cfg = BrowserConfig::builder()
+    ///     .user_data_dir("/tmp/my-profile")
+    ///     .build();
+    /// assert!(cfg.user_data_dir.is_some());
+    /// ```
+    #[must_use]
+    pub fn user_data_dir(mut self, path: impl Into<std::path::PathBuf>) -> Self {
+        self.config.user_data_dir = Some(path.into());
+        self
+    }
+
     /// Set headless mode.
     #[must_use]
     pub const fn headless(mut self, headless: bool) -> Self {

crates/stygian-browser/src/config.rs

@@ -685,6 +685,84 @@ impl PageHandle {
         .map(|r| r.cookies.clone())
     }
 
+    /// Inject cookies into the current page.
+    ///
+    /// Seeds session tokens or other state without needing a full
+    /// [`SessionSnapshot`][crate::session::SessionSnapshot] and without
+    /// requiring a direct `chromiumoxide` dependency in calling code.
+    ///
+    /// Individual cookie failures are logged as warnings and do not abort the
+    /// remaining cookies.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`BrowserError::Timeout`] if a single `Network.setCookie` CDP
+    /// call exceeds `cdp_timeout`.
+    ///
+    /// # Example
+    ///
+    /// ```no_run
+    /// use stygian_browser::{BrowserPool, BrowserConfig};
+    /// use stygian_browser::session::SessionCookie;
+    /// use std::time::Duration;
+    ///
+    /// # async fn run() -> stygian_browser::error::Result<()> {
+    /// let pool = BrowserPool::new(BrowserConfig::default()).await?;
+    /// let handle = pool.acquire().await?;
+    /// let page = handle.browser().expect("valid browser").new_page().await?;
+    /// let cookies = vec![SessionCookie {
+    ///     name: "session".to_string(),
+    ///     value: "abc123".to_string(),
+    ///     domain: ".example.com".to_string(),
+    ///     path: "/".to_string(),
+    ///     expires: -1.0,
+    ///     http_only: true,
+    ///     secure: true,
+    ///     same_site: "Lax".to_string(),
+    /// }];
+    /// page.inject_cookies(&cookies).await?;
+    /// # Ok(())
+    /// # }
+    /// ```
+    pub async fn inject_cookies(&self, cookies: &[crate::session::SessionCookie]) -> Result<()> {
+        use chromiumoxide::cdp::browser_protocol::network::SetCookieParams;
+
+        for cookie in cookies {
+            let params = match SetCookieParams::builder()
+                .name(cookie.name.clone())
+                .value(cookie.value.clone())
+                .domain(cookie.domain.clone())
+                .path(cookie.path.clone())
+                .http_only(cookie.http_only)
+                .secure(cookie.secure)
+                .build()
+            {
+                Ok(p) => p,
+                Err(e) => {
+                    warn!(cookie = %cookie.name, error = %e, "Failed to build cookie params");
+                    continue;
+                }
+            };
+
+            match timeout(self.cdp_timeout, self.page.execute(params)).await {
+                Err(_) => {
+                    warn!(
+                        cookie = %cookie.name,
+                        timeout_ms = self.cdp_timeout.as_millis(),
+                        "Timed out injecting cookie"
+                    );
+                }
+                Ok(Err(e)) => {
+                    warn!(cookie = %cookie.name, error = %e, "Failed to inject cookie");
+                }
+                Ok(Ok(_)) => {}
+            }
+        }
+
+        debug!(count = cookies.len(), "Cookies injected");
+        Ok(())
+    }
+
     /// Capture a screenshot of the current page as PNG bytes.
     ///
     /// The screenshot is full-page by default (viewport clipped to the rendered