使用pi agent 用大佬您的scansci中的问题

[yu-hai-long-bbyxy]

Issue 1：Cookie 文件名不一致

Title

  [Bug] WebVPN login saves cookies to a different filename than session validation reads

Body

  ## Description

  In `scansci-pdf 1.9.0`, the WebVPN login flow and the WebVPN session validation logic use different cookie filenames.

  The login flow saves cookies to:

  ```python
  # scansci_pdf/browser_login.py
  cookie_file = cache_dir / "instsci_cookies.json"

However, the download and session validation code reads:

  # scansci_pdf/sources/instsci.py
  return Path(...) / "instsci-cookies.json"

The first filename uses an underscore:

  instsci_cookies.json

The second uses a hyphen:

  instsci-cookies.json

As a result, login may appear successful, but vpnsci_status and subsequent downloads cannot find the saved cookies.

Environment

• OS: Windows
• Python: 3.11.15
• scansci-pdf: 1.9.0
• mcp: 1.27.2
• cloakbrowser: 0.5.5
• Institution tested: Fudan University WebVPN

Steps to reproduce

1. Configure WebVPN:

  vpnsci_school = 复旦大学
  vpnsci_base_url = https://webvpn.fudan.edu.cn
  vpnsci_enabled = true

2. Run:

  scansci_pdf_vpnsci_login

3. Complete institutional login.

4. Check the cache directory.

The login flow writes:

  ~/.scansci-pdf/cache/instsci_cookies.json

5. Run:

  scansci_pdf_vpnsci_status

The status code looks for:

  ~/.scansci-pdf/cache/instsci-cookies.json

and therefore reports no usable cookies.

Expected behavior

All WebVPN login, status, validation, and download paths should use the same canonical cookie path.

Suggested fix

Instead of duplicating the filename in browser_login.py, reuse the existing helper:

  from .sources.instsci import _get_webvpn_base, instsci_cookie_path

  cookie_file = instsci_cookie_path(config)

This would prevent the login and validation paths from drifting apart again.

Additional information

Changing the login filename to instsci-cookies.json locally fixed the cookie discovery issue.

  ---

  # Issue 2：登录检测假成功

  ## Title

  ```text
  [Bug] WebVPN login can report success while only pre-login cookies were captured

Body

  ## Description

  The generic login detection in `open_login_browser()` can incorrectly treat pre-login cookies as an authenticated WebVPN session.

  The current heuristic is approximately:

  ```python
  url_lower = current_url.lower()

  if (
      "login" not in url_lower
      and "cas" not in url_lower
      and "sso" not in url_lower
  ):
      cookies = context.cookies()

      if len(cookies) > 3:
          # Report login success and save cookies

This is unreliable when the initial navigation or redirect is still pending.

For example, Fudan WebVPN behaves as follows:

  https://webvpn.fudan.edu.cn/
      -> HTTP 302
  https://webvpn.fudan.edu.cn:443/login

If page.goto() times out during the redirect, page.url may temporarily remain at the root URL. The root URL does not contain login, cas, or sso, while the
login page has already created several pre-authentication cookies.

The code therefore reports:

  Login successful! Saved 5 cookies.

However, those cookies still redirect back to:

  https://webvpn.fudan.edu.cn:443/login

and _validate_session() returns False.

Environment

• OS: Windows
• Python: 3.11.15
• scansci-pdf: 1.9.0
• mcp: 1.27.2
• cloakbrowser: 0.5.5
• Institution tested: Fudan University WebVPN

Steps to reproduce

1. Configure Fudan University WebVPN.
2. Run scansci_pdf_vpnsci_login.
3. Allow the initial page.goto() to time out during the root-to-login redirect.
4. Observe that several pre-login cookies are present.
5. The login flow may report success.
6. Run scansci_pdf_vpnsci_status.

Observed result:

  {
    "has_cookies": true,
    "session_valid": false
  }

A request using the captured cookies still ends at:

  https://webvpn.fudan.edu.cn:443/login

Expected behavior

The login tool should only report success after the cookies have been verified as an authenticated WebVPN session.

Suggested fix

For WebVPN, validate the current browser cookies against the WebVPN endpoint before saving them.

For example:

1. Copy the current browser cookies into a temporary requests.Session.
2. Request the WebVPN base URL with redirects enabled.
3. Only report success if the final URL is not a login/CAS/SSO endpoint.

Conceptually:

  response = session.get(
      webvpn_base,
      timeout=10,
      allow_redirects=True,
  )

  final_url = response.url.lower()

  authenticated = (
      response.status_code == 200
      and "/login" not in final_url
      and "/cas" not in final_url
      and "/sso" not in final_url
  )

It would also be safer to make a caller-provided detect_login callback authoritative:

  if detect_login:
      if detect_login(context, page):
          save_cookies()
          return True

      continue  # Do not fall through to the generic heuristic

Currently, if a custom detector returns False, the generic URL/cookie-count heuristic can still produce a false positive.

Local verification

After changing the detector to validate the cookies against the WebVPN endpoint, the same login flow produced:

  cookie_count: 6
  session_valid: true

and:

  {
    "success": true,
    "message": "Session is valid."
  }