fix(t3-chat-web): parse cookies + convexSessionId from stored credential (#3007)

[diegosouzapw]

Closes #3007

t3.chat was non-functional for everyone: the executor read credentials.cookies/convexSessionId, but the pipeline only stores the pasted string under apiKey. Now parses both from apiKey (fallback accessToken).

Regression test: tests/unit/t3-chat-web-credentials.test.ts; existing test aligned to the real credential contract. Thanks @minhtran162.

[gemini-code-assist]

Code Review

This pull request addresses issue #3007 by refactoring how t3.chat web credentials are parsed and validated. Instead of expecting pre-structured fields, the executor now parses a single pasted string (provided via apiKey or accessToken) into a structured credentials object, and unit tests have been updated and added to verify this behavior. The review feedback suggests three improvements to make the parsing logic more robust: trimming the extracted convexSessionId to handle whitespace, preventing a leading semicolon in the synthesized Cookie header when the base header is empty, and refining the regular expression to match only the exact convex-session-id cookie name.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

In the structured/multi-part parsing block, the extracted convexSessionId is not trimmed. If there is a leading space after the = (e.g., convexSessionId= abc), the parsed ID will retain that leading space. Adding .trim() ensures consistency with the fallback block (which trims the parsed ID) and prevents issues with leading/trailing whitespace.

Suggested change

	convexSessionId = part.split("=").slice(1).join("=");
	convexSessionId = part.split("=").slice(1).join("=").trim();

[gemini-code-assist]

If cookieHeader is empty, synthesizing finalCookie by prepending ${cookieHeader}; results in a malformed Cookie header with a leading semicolon (e.g., ; convex-session-id=abc). Checking if cookieHeader is non-empty before prepending avoids this issue.

Suggested change

	const finalCookie =
	convexSessionId && !cookieHeader.includes("convex-session-id")
	? `${cookieHeader}; convex-session-id=${convexSessionId}`
	: cookieHeader;
	const finalCookie =
	convexSessionId && !cookieHeader.includes("convex-session-id")
	? cookieHeader
	? cookieHeader + "; convex-session-id=" + convexSessionId
	: "convex-session-id=" + convexSessionId
	: cookieHeader;

[gemini-code-assist]

The regular expression /convex-session-id=([^;]+)/ can match other cookie names that merely end with convex-session-id (e.g., some-other-convex-session-id=abc). To ensure robust matching of only the exact cookie name, use a non-capturing group to match either the start of the string or a semicolon with optional whitespace.

Suggested change

	const m = finalCookie.match(/convex-session-id=([^;]+)/);
	const m = finalCookie.match(/(?:^|;\s*)convex-session-id=([^;]+)/);

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3f03f31af4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Strip Cookie prefixes before forwarding credentials

When users follow the existing t3-web dashboard guidance/placeholder (convex-session-id=...; Cookie: ...), this parser splits the pasted string and then accepts the Cookie: __Secure-...=... segment because it contains =, forwarding that literal text as part of the Cookie header. In that scenario the auth cookie name is no longer the browser cookie name (or may be ignored by the upstream parser), so t3.chat can return 401 even though the user pasted the documented credentials; strip optional Cookie:/header labels before pushing cookie parts.

Useful? React with 👍 / 👎.

[kilo-code-bot]

WARNING: Splitting on comma can break cookie values containing commas

The regex /[,;\n]/ splits on commas, semicolons, and newlines. Cookie values can legally contain commas (e.g., session=abc,def,ghi). This would incorrectly split a single cookie into multiple parts. The standard cookie separator is ; (semicolon + space), not comma. Consider using /[;\n]/ instead, or a more robust cookie parser.

[kilo-code-bot]

SUGGESTION: Substring check for "convex-session-id" could have false positives

Using cookieHeader.includes("convex-session-id") matches any occurrence of that substring in the cookie header. If another cookie name or value happens to contain "convex-session-id" as a substring (e.g., my-convex-session-id=value), it would incorrectly skip appending the real convex-session-id. Consider using a regex with word boundaries like /(?:^|;\s*)convex-session-id=/ for more precise detection.

[kilo-code-bot]

Code Review Summary

Status: 2 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
open-sse/executors/t3-chat-web.ts	71	Splitting on comma can break cookie values containing commas

SUGGESTION

File	Line	Issue
open-sse/executors/t3-chat-web.ts	88	Substring check for "convex-session-id" could have false positives

Files Reviewed (3 files)

• open-sse/executors/t3-chat-web.ts - 2 issues
• tests/unit/t3-chat-web-credentials.test.ts - No issues (new test file, good coverage)
• tests/unit/t3-chat-web.test.ts - No issues (updated tests align with new credential format)

---

_{Reviewed by nemotron-3-ultra-550b-a55b-20260604:free · 403,853 tokens}