Properly handle redirects

[unacoder]

Right now any mode (cfw,appscript,vps script ...) other than full node does not respect redirects. This breaks google sso, or any type of sso login (github etc). See this url for example https://github.community/t/cd-command-doesnt-work/169987, this should redirect to a discussions page on a repo but instead it shows that discussion page inline.

[therealaleph]

Reviewed via Anthropic Claude.

@unacoder — accurate observation. SSO redirect chains break in apps_script / cfw / exit-node modes because of how the response envelope is constructed:

1. Browser sends GET https://github.com/login
2. Apps Script's UrlFetchApp.fetch() defaults to followRedirects: true — silently follows all 3xx hops and returns only the final response body.
3. mhrv-rs returns that final body to the browser under the original URL (https://github.com/login) — but the browser has no idea a redirect chain happened, so it doesn't set cookies that were Set-Cookied on the intermediate URLs (https://github.com/sessions/..., https://github.com/oauth/...).
4. SSO state cookies set on intermediate hops are lost. The login attempt fails, often as an infinite loop.

Why Full mode works: tunnel-node uses real fetch with redirect: "manual" (similar to exit_node's recent c437598 fix), so each 3xx is passed back to the browser as a real HTTP redirect. The browser follows it itself, setting cookies correctly per-hop.

Fix options:

1. Code.gs change: pass followRedirects: false to UrlFetchApp.fetch(). Each 3xx then comes back to mhrv-rs which forwards it as a real redirect to the browser. Caveat: Apps Script's UrlFetchApp doesn't allow Set-Cookie headers in the response back (forbidden header list), which means even if 3xx is passed through, the cookie chain still breaks. This is a hard limit of Apps Script's response model.

2. Route SSO-using hosts via exit-node: exit_node.ts already uses redirect: "manual" since c437598. The full set-cookie chain works there.

   "exit_node": {
     "enabled": true,
     "relay_url": "https://your-exit-node-url",
     "psk": "<secret>",
     "mode": "selective",
     "hosts": ["github.com", "accounts.google.com", "login.microsoftonline.com"]
   }

3. Pure structural fix (medium-term): add followRedirects: false to Code.gs's fetch options AND explicitly forward Set-Cookie as one big Set-Cookie-Encoded header (base64-encoded) that mhrv-rs's relay decode step splits back into multiple Set-Cookie response headers. This is doable but invasive — requires Code.gs + Rust client coordination.

Workaround today: exit-node for SSO hosts (option 2). Architectural fix: option 3, queued for v1.10.x.

Keeping open as the tracking issue for SSO-cookie-chain support.

---

_{[reply via Anthropic Claude | reviewed by @therealaleph]}