Add Windows cookie extraction support for Gemini browser mode

[prathamdby]

Problem

Gemini browser mode fails on Windows with:

ERROR: Gemini browser mode requires Chrome cookies for google.com (missing __Secure-1PSID/__Secure-1PSIDTS).

Root Cause

• Gemini executor uses chrome-cookies-secure which doesn't work on Windows (requires macOS Keychain/Linux keyring)
• Windows cookie extraction exists (src/browser/windowsCookies.ts) but is hardcoded to chatgpt.com only (line 130)
• Windows cookie sync is disabled in loadChromeCookies() (line 31-35)

Solution

1. Make loadWindowsCookies() domain-agnostic, add domainFilter parameter to readChromeCookiesDb() to support google.com (currently hardcoded to chatgpt.com)
2. Add Windows-specific loader in Gemini executor, create loadGeminiCookiesFromWindows() that uses loadWindowsCookies() with 'google.com' filter
3. Integrate into Gemini executor, try Windows extraction first on Windows before falling back to chrome-cookies-secure
4. Export resolveCookieFilePath() from chromeCookies.ts for cookie path resolution

Files to Modify

• src/browser/windowsCookies.ts, add domain filter parameter
• src/gemini-web/executor.ts, add Windows cookie loader
• src/browser/chromeCookies.ts, export resolveCookieFilePath

Dependencies

All required dependencies already exist (DPAPI via @primno/dpapi, sqlite3, PowerShell)

Note

App-bound cookies (v20) may still fail DPAPI decryption, which is why Windows cookie sync was originally disabled. This should work for most cases.

[steipete]

Working on that via moving to https://github.com/steipete/sweet-cookie

[prathamdby]

Working on that via moving to https://github.com/steipete/sweet-cookie

I'd also like to point out it looks for google.com when these cookies exist for gemini.google.com 👀

$ npx -y @steipete/oracle --engine browser --model gemini-3-pro --prompt "a cute robot holding a banana" --generate-image out.jpg --aspect 1:1
🧿 oracle 0.8.0 — Calm prompt, converged truths.
Using Gemini web client for browser automation
Launching browser mode (gemini-3-pro) with ~13 tokens.
This run can take up to an hour (usually ~10 minutes).
ERROR: Gemini browser mode requires Chrome cookies for google.com (missing __Secure-1PSID/__Secure-1PSIDTS).
User error (browser-automation): Gemini browser mode requires Chrome cookies for google.com (missing __Secure-1PSID/__Secure-1PSIDTS).

[steipete]

Unlikely I'll spend more time on this anytime soon, but PRs are welcome!

[prathamdby]

I did some debugging on Windows to understand why Gemini browser mode fails, and wanted to share what I found for anyone else looking into this.

When running Oracle with --engine browser --model gemini-3-pro, sweet-cookie returns 0 cookies even when logged into Google/Gemini in Chrome. At first I thought it might be a domain mismatch issue (google.com vs gemini.google.com), but that's not it.

The cookies are actually there in Chrome's SQLite database. I verified this by querying the DB directly and found __Secure-1PSID, __Secure-1PSIDTS, and other Google auth cookies for .google.com. The problem is their values.

All of these cookies use the v20 prefix, which means they're encrypted with Chrome's app-bound encryption (introduced in Chrome 127). The value field is empty and the actual data lives in encrypted_value, which can't be decrypted outside of Chrome. This is by design.

For anyone trying to use Gemini browser mode on Windows: The workaround is to export cookies from inside Chrome using an extension (like Cookie-Editor or the sweet-cookie extension), then pass them via --browser-inline-cookies-file.

One small improvement that might help, sweet-cookie currently drops v20 cookies silently. A warning message when v20 cookies are encountered would make debugging easier for others.

[steipete]

Small improvement landed in ea47dcc: Gemini missing-cookie failures now include underlying Chrome/sweet-cookie warnings and point at / , so Windows app-bound-cookie failures are at least debuggable instead of looking like a generic auth miss. Keeping this open because it does not add native Windows extraction for app-bound () cookies yet.

[steipete]

Correction to the mangled shell-rendered comment above:

Commit ea47dcc6 improved Gemini browser-mode diagnostics. Missing-cookie failures now include the underlying Chrome/sweet-cookie warnings and explicitly suggest --browser-manual-login or --browser-inline-cookies-file, so Windows app-bound-cookie failures are at least debuggable instead of looking like a generic auth miss.

Keeping this open because it still does not add native Windows extraction for app-bound (v20) cookies.

[steipete]

Closing this triage pass as not currently fixable in Oracle itself: current Chrome Windows auth cookies use app-bound v20 encryption, so external DPAPI/sqlite extraction cannot reliably recover them. The practical paths are still --browser-manual-login or --browser-inline-cookies-file, and the diagnostic improvement for this case already landed earlier.