ghlike

Star GitHub repos with your browser session — no tokens. / Da estrellas en GitHub con la sesión de tu navegador — sin tokens.

English · Español

This is the Python CLI of the ghlike project: a pair of twin CLIs — the Node one and this Python one. Zero dependencies: the CDP client talks to the browser over a private pipe (--remote-debugging-pipe, no TCP port) using only the standard library, so the whole package audits in one sitting.

English

What it does

ghlike owner/repo stars a GitHub repository using the login session already active in your browser. No gh auth login, no personal access tokens, no OAuth: if you're logged into GitHub in Brave, Chrome, Chromium, Edge, Vivaldi or Opera (native or snap installs), it just works.

How: it finds the browser profile with your github.com session → copies the encrypted cookie store to a throwaway profile → opens your own browser headless with a private CDP pipe (no TCP port) → clicks the real Star button (GitHub handles its own CSRF) → verifies → kills the browser and deletes the profile. Cookies are never decrypted and never leave your machine.

Install

Available on PyPI: pypi.org/project/ghlike

pipx install ghlike        # or: pip install --user ghlike

Requires Python ≥ 3.9 on Linux (POSIX — the CDP pipe uses fds 3/4) and a Chromium-family browser with a github.com session. Firefox is not supported (no CDP).

CLI

ghlike owner/repo            # star (idempotent — tells you if already starred)
ghlike https://github.com/o/r  # full URLs work
ghlike owner/repo -c         # check current state only
ghlike owner/repo -u         # unstar
ghlike owner/repo --toggle   # flip
ghlike --list                # github.com sessions found in your browsers
ghlike --browser brave o/r   # force one browser (strict)
ghlike o/r --json            # machine-readable output
ghlike daemon                # local server (127.0.0.1:8469) for the website's like button

Exit codes: 0 ok (incl. nothing-to-do) · 1 generic error · 2 no github.com session · 3 repo not found.

JSON example:

$ ghlike cli/cli --check --json
{"repo":"cli/cli","user":"you","browser":"Brave","profile":"Default",
 "before":false,"action":"check","after":false,"changed":false}

Daemon

ghlike daemon [--port N] [--allow-origin URL]... serves the same actions over HTTP on 127.0.0.1:8469, so the like button on ghlike.686f6c61.dev works without a browser extension — the page talks to your local daemon, which clicks with your own browser session.

Errors (JSON): 400 bad-repo · 403 bad-origin / bad-host · 404 not-found · 409 no-session · 429 queue-full · 500 ghlike-error.

Security: it only answers to https://ghlike.686f6c61.dev and localhost — any other Origin gets a 403 before anything runs (the allowlist gates execution, not just CORS, and is extensible with --allow-origin). The Host header must be 127.0.0.1:<port> or localhost:<port> (anti DNS-rebinding), CORS never returns *, one browser action runs at a time (max 4 queued → 429), and bodies are capped at 4 KB.

Library

from ghlike import star, unstar, check, toggle

star("vercel/next.js")                 # -> {"repo": ..., "changed": True, ...}
state = check("vercel/next.js")        # -> {"repo": ..., "after": True/False, ...}
unstar("vercel/next.js", browser="brave")
toggle("vercel/next.js")

Exceptions: NoSessionError, RepoNotFoundError, GhlikeError.

Limitations

• Chromium-family browsers only; Firefox is not supported (no CDP).
• Each operation takes ~8–12 s (headless browser + page load). That's the price of the no-token approach.
• Depends on GitHub's Star button; if the markup changes, one selector line fixes it (STATE_JS in src/ghlike/core.py).

Development

PYTHONPATH=src python3 -m ghlike.cli --list
python -m pip wheel . --no-deps --no-build-isolation -w dist

Publishing is automated: push a git tag / create a GitHub Release vX.Y.Z and .github/workflows/publish-pypi.yml publishes to PyPI via Trusted Publishing (no secrets). Versions live in pyproject.toml and src/ghlike/__init__.py.

License: MIT.

Español

Qué hace

ghlike owner/repo da una estrella a un repositorio de GitHub usando la sesión ya iniciada en tu navegador. Sin gh auth login, sin personal access tokens, sin OAuth: si estás logueado en GitHub en Brave, Chrome, Chromium, Edge, Vivaldi u Opera (nativo o snap), funciona directamente.

Cómo: busca el perfil del navegador con tu sesión de github.com → copia la tienda de cookies cifrada a un perfil desechable → abre tu propio navegador en modo invisible con un pipe CDP privado (sin puerto TCP) → pulsa el botón de Star real (GitHub gestiona su propio CSRF) → verifica → cierra el navegador y borra el perfil. Las cookies nunca se descifran ni salen de tu máquina.

Instalación

Disponible en PyPI: pypi.org/project/ghlike

pipx install ghlike        # o: pip install --user ghlike

Requiere Python ≥ 3.9 en Linux (POSIX — el pipe CDP usa los fds 3/4) y un navegador de la familia Chromium con sesión de github.com. Firefox no está soportado (sin CDP).

CLI

ghlike owner/repo            # dar star (idempotente)
ghlike https://github.com/o/r  # URLs completas valen
ghlike owner/repo -c         # solo consultar estado
ghlike owner/repo -u         # quitar star
ghlike owner/repo --toggle   # invertir
ghlike --list                # sesiones de GitHub detectadas
ghlike --browser brave o/r   # forzar un navegador (estricto)
ghlike o/r --json            # salida para scripts
ghlike daemon                # servidor local (127.0.0.1:8469) para el botón de la web

Códigos de salida: 0 ok (también "nada que hacer") · 1 error genérico · 2 sin sesión de github.com · 3 repo no encontrado.

Daemon

ghlike daemon [--port N] [--allow-origin URL]... sirve las mismas acciones por HTTP en 127.0.0.1:8469, para que el botón de like de ghlike.686f6c61.dev funcione sin extensión: la página habla con tu daemon local, que pulsa el botón con tu propia sesión del navegador.

Errores (JSON): 400 bad-repo · 403 bad-origin / bad-host · 404 not-found · 409 no-session · 429 queue-full · 500 ghlike-error.

Seguridad: solo responde a https://ghlike.686f6c61.dev y localhost — cualquier otro Origin recibe 403 antes de ejecutar nada (la allowlist gobierna la ejecución, no solo CORS, y se amplía con --allow-origin). La cabecera Host debe ser 127.0.0.1:<puerto> o localhost:<puerto> (anti DNS-rebinding), CORS nunca devuelve *, solo corre una acción de navegador a la vez (máx. 4 en cola → 429) y los bodies están limitados a 4 KB.

Librería

from ghlike import star, unstar, check, toggle

star("vercel/next.js")                 # -> {"repo": ..., "changed": True, ...}
state = check("vercel/next.js")        # -> {"repo": ..., "after": True/False, ...}
unstar("vercel/next.js", browser="brave")

Excepciones: NoSessionError, RepoNotFoundError, GhlikeError.

Limitaciones

• Solo navegadores Chromium; Firefox no (sin CDP).
• Cada operación tarda ~8–12 s (navegador invisible + carga). Es el precio del enfoque sin tokens.
• Depende del botón de Star de GitHub; si cambia el markup, se arregla con una línea (STATE_JS en src/ghlike/core.py).

Desarrollo

PYTHONPATH=src python3 -m ghlike.cli --list
python -m pip wheel . --no-deps --no-build-isolation -w dist

La publicación es automática: crea un Release vX.Y.Z en GitHub y .github/workflows/publish-pypi.yml publica en PyPI con Trusted Publishing (sin secrets). Las versiones viven en pyproject.toml y src/ghlike/__init__.py.

Licencia: MIT.