Agent Cookie - Session State Sync for the Agent's Second Mac

Continuously replicates your laptop's session state - Chrome cookies, per-CLI bearer tokens, API keys, auth blobs - to the Mac your agent actually runs on, encrypted over Tailscale, with zero per-site auth ceremony. So a headless agent runtime "wakes up authenticated." By Matt Van Horn; the auth companion to Printing Press - Agent-Native CLIs from a Single Prompt.

The problem it solves

Your agent runs on a Mac that isn't your daily driver (a Mac mini, a remote box). It needs to act as you on every site you're logged into and against every API you've already authenticated - but it has none of your cookies, tokens, or keys, and re-authing each one by hand is the bottleneck. Agent Cookie is the one-way, continuous, unattended replication from the machine you live in (source) to the machine your agents act from (sink). Source: github.com/mvanhorn/agentcookie README, 2026-06-01

How it works

• Continuous source→sink sync. fsnotify watches Chrome's Cookies file, debounced, allowlist + blocklist filtered both ends; AES-256-GCM over the Tailscale tailnet's WireGuard channel; pairing-derived per-peer keys with persistent replay defense. Source: agentcookie.dev, 2026-06-01
• Two surfaces, one encrypted push. (1) Cookies for browser-driving agents and adapter-equipped CLIs - delivered as Chrome's SQLite re-encrypted for the sink keychain, a plaintext sidecar at ~/.agentcookie/cookies-plain.db, or per-CLI adapter session files. (2) Secrets bus - bearer tokens, API keys, and KEY=VALUE auth blobs land at ~/.agentcookie/secrets/<cli>/secrets.env (mode 0600, optional sealed twin). Source: agentcookie.dev, 2026-06-01
• Hard parts handled. macOS Keychain protections, Chrome's App-Bound Encryption, and per-CLI auth conventions are all dealt with. A single macOS login-password entry at install opens the sink's Chrome Safe Storage to any cookie reader (yt-dlp, gallery-dl, browser-driving agents, the Printing Press CLIs) via a partition list - no per-tool AllowAlways prompts. Source: agentcookie README, 2026-06-01

Relationship to Printing Press

The secrets bus is "read by every PP CLI" - any Printing Press - Agent-Native CLIs from a Single Prompt-generated -pp-cli (or anything with a bearer token / API key) reads ~/.agentcookie/secrets/<cli>/secrets.env. Five commerce CLIs (instacart, airbnb, ebay, pagliacci, table-reservation-goat) additionally get bespoke cookie adapters. The v2 adoption standard: drop an agentcookie.toml in a repo and agentcookie discover auto-detects it (three integration tiers - explicit, pp-cli-derived, legacy v1 - coexist). PrintingPress prints the CLI; Agent Cookie keeps it authenticated on the box where the agent runs. Source: agentcookie.dev "what's working today," 2026-06-01

Security profile (read before installing)

This is security-sensitive infrastructure: it decrypts Chrome's cookie store and replicates live credentials across machines. Mitigations: tailnet-only listeners (both ends bind tailnet-private addresses), rate-limited pairing with a 64-bit code, pairing-derived per-peer keys with rotation, allowlist + blocklist on both sides, Apple Developer ID-signed + timestamped release binaries, and an 11-category doctor (binary signature, Tailscale, keystore, sealing posture, adapter coverage, CDP injector health, secrets bus coverage). macOS only on both ends. 449+ unit tests across 26 packages. Treat the sink Mac as holding production credentials; scope the allowlist tightly. Source: agentcookie.dev, README, 2026-06-01

Current source snapshot on 2026-07-04: main HEAD d67904960bd2cf8cea16547eef238929cf6df9b1, latest tag v0.17.1, MIT license, 575 stars, 47 forks, and no public agentcookie npm package. Source: GitHub API; git ls-remote; npm registry, 2026-07-04

Install

# Beta installer runs end-to-end over SSH on a headless Mac mini (no GUI clicks)
# Source side reads Chrome via the macOS Keychain-backed decrypt path;
# sink relies on macOS LaunchAgent + Keychain conventions.
# See: https://github.com/mvanhorn/agentcookie  (install-beta.sh)
agentcookie doctor   # 11-category health check after install

Why this matters for Kevin

Closes the loop on Persistent Sandbox Thesis and headless agent runtimes: a Dedalus/agent box, a personal automation Mac, or an always-on agent can act as Kevin across his logged-in sites and authenticated APIs without a per-site login ritual. It is the auth layer in the Tailnet Agent Mesh - Reaching Your Agents from Anywhere (Tailscale network + Agent Cookie auth + pp-clis) - the "reach your agent from your phone" pattern - and the practical substrate beneath browser-driving agents like Browser Testing Skills. Source: User directive, 2026-06-01

---

Timeline

• 2026-06-01 | Captured and enforced alongside Printing Press - Agent-Native CLIs from a Single Prompt. Created tool page; documented in Agent-Native CLIs and agent-native-cli.mdc (headless/second-Mac auth row). Flagged security profile; binary install deferred pending Kevin's go-ahead. Source: User, 2026-06-01
• 2026-07-04 | Reviewed EXM's Hermes-stack endorsement and refreshed source state. Agent Cookie remains the auth/session layer paired with Printing Press - Agent-Native CLIs from a Single Prompt and Security and Review Skills, not a generic install recommendation for every machine. Source: X/@EXM7777, 2026-06-01; Source: GitHub mvanhorn/agentcookie, 2026-07-04