rdt login fails for users with valid Reddit sessions: hardcoded `reddit_session` cookie + only scans default browser profile

[BrokeBoiiBot]

Summary

rdt login reports ❌ No Reddit cookies found. for users who are clearly logged in to reddit.com in their browser. Three independent bugs combine to produce this. Likely the same root cause as the closed-without-resolution report in #8.

Tested on macOS 15 (Darwin 25.3.0), rdt-cli 0.4.1, Python 3.14, Microsoft Edge.

Root causes

1. REQUIRED_COOKIES is years out of date

rdt_cli/constants.py:72:

REQUIRED_COOKIES = {"reddit_session"}

Reddit's web session cookie has been token_v2 (a JWT) for a long time — reddit_session is only present on some accounts/profiles. Both _extract_subprocess and _extract_direct in auth.py gate their result on any(k in cookies for k in REQUIRED_COOKIES), so they silently discard a perfectly valid cookie set that contains token_v2 but not reddit_session.

2. Read capability also keys off the legacy cookie

rdt_cli/session.py:56:

if self.cookies.get("reddit_session"):
    capabilities.add("read")

Same issue — is_authenticated requires the read capability, so even after fixing (1), status reports the session as un-authenticated until this is also widened to token_v2.

3. Only the browser's default profile is scanned

browser_cookie3.chrome() / .edge() / .brave() with no cookie_file= use the Default profile only. Most users have multiple profiles — work/personal/etc. — and the logged-in Reddit session is frequently in a non-default one. In my case:

• Microsoft Edge/Default/Cookies → anonymous token_v2 (sub: \"loid\")
• Microsoft Edge/Profile 3/Cookies → real session (sub: \"user\", lid: t2_…, plus reddit_session)

browser_cookie3.edge() returns the Default profile's anonymous token, and rdt either rejects it (after fix 1 it would store an anonymous token and then whoami returns Reddit's logged-out blob with loid/feature flags only).

Reproduction

1. Sign in to reddit.com on a non-default browser profile.
2. rdt login → "No Reddit cookies found."
3. Even after patching (1), rdt whoami returns loid/features only — the cookies are anonymous.

You can verify which profile holds the real session by decoding the token_v2 JWT payload — sub: \"user\" = logged-in, sub: \"loid\" = anonymous.

Suggested fix

1. REQUIRED_COOKIES = {\"token_v2\", \"reddit_session\"} in constants.py.
2. if self.cookies.get(\"reddit_session\") or self.cookies.get(\"token_v2\"): in session.py.
3. In auth.py, enumerate all profile Cookies files under each browser's app-support dir (e.g. ~/Library/Application Support/Microsoft Edge/*/Cookies on macOS, equivalents on Linux/Windows), call the matching browser_cookie3 loader with cookie_file= for each, and rank candidates: prefer token_v2 whose JWT payload has sub == \"user\", then any candidate with reddit_session, then any with token_v2.

I have a working local patch implementing all three; happy to send a PR if useful.

Why this matters

Without (3), even fixing (1) and (2) leaves multi-profile users with a silently-anonymous credential that passes rdt status but fails on every authenticated endpoint with a confusing "logged-out" payload — worse UX than the original "no cookies found" error.