@divebell/agent-browser 0.33.2-divebell.1 → 0.33.2-divebell.2

package/README.md

@@ -400,7 +400,7 @@ agent-browser errors                  # View page errors (uncaught JavaScript ex
 agent-browser errors --clear          # Clear errors
 agent-browser highlight <sel>         # Highlight element
 agent-browser inspect                 # Open Chrome DevTools for the active page
-agent-browser state save <path>       # Save auth state
+agent-browser state save <path> [--include-origin <url>]...  # Save auth state
 agent-browser state load <path>       # Load auth state
 agent-browser state list              # List saved state files
 agent-browser state show <file>       # Show state summary
@@ -647,6 +647,14 @@ agent-browser --session "$SESSION" --restore --state ./my-auth.json open https:/
 # From now on, --session "$SESSION" --restore auto-saves/restores this state
 ```
 
+State files preserve HTTP-only and partitioned cookie metadata. Cookies are collected for the whole browser session. To also collect localStorage from an authentication origin that the active agent-browser session did not visit, repeat `--include-origin`:
+
+```bash
+agent-browser --auto-connect state save ./my-auth.json \
+  --include-origin https://sso.example.com \
+  --include-origin https://accounts.example.net
+```
+
 > **Security notes:**
 > - `--remote-debugging-port` exposes full browser control on localhost. Any local process can connect. Only use on trusted machines and close Chrome when done.
 > - State files contain session tokens in plaintext. Add them to `.gitignore` and delete when no longer needed. For encryption at rest, set `AGENT_BROWSER_ENCRYPTION_KEY` (see [State Encryption](#state-encryption)).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@divebell/agent-browser",
-  "version": "0.33.2-divebell.1",
+  "version": "0.33.2-divebell.2",
   "description": "Browser automation CLI for AI agents with Divebell memory diagnostics",
   "type": "module",
   "engines": {

package/skill-data/core/references/authentication.md

@@ -48,6 +48,14 @@ Log in to your target site(s) in this Chrome window as you normally would.
 agent-browser --auto-connect state save ./my-auth.json
 ```
 
+State files retain HTTP-only and partitioned cookie metadata. Cookies are collected for the whole browser session. If an SSO or authentication origin stores additional localStorage and was not visited by the active session, include it explicitly. Repeat the flag for multiple origins:
+
+```bash
+agent-browser --auto-connect state save ./my-auth.json \
+  --include-origin https://sso.example.com \
+  --include-origin https://accounts.example.net
+```
+
 **Step 3: Reuse in automation**
 
 ```bash

package/skill-data/core/references/commands.md

@@ -324,7 +324,7 @@ Other capabilities use the same protocol:
 ## State Management
 
 ```bash
-agent-browser state save auth.json    # Save cookies, storage, auth state
+agent-browser state save auth.json [--include-origin <url>]...  # Save cookies and storage
 agent-browser state load auth.json    # Restore saved state
 ```
 

package/skill-data/core/references/session-management.md

@@ -73,7 +73,7 @@ agent-browser --session "$SESSION" session info --json
 
 ### Manual State Files
 
-Use `state save`, `state load`, and `--state <path>` when you need an explicit portable JSON file. Do not make agents construct paths under `~/.agent-browser/sessions/`; prefer `--restore` for reusable agent sessions.
+Use `state save`, `state load`, and `--state <path>` when you need an explicit portable JSON file. Repeat `state save --include-origin <url>` when a known SSO origin has localStorage that the active session did not visit. Do not make agents construct paths under `~/.agent-browser/sessions/`; prefer `--restore` for reusable agent sessions.
 
 ## Common Patterns
 

package/skill-data/core/references/trust-boundaries.md

@@ -29,7 +29,7 @@ Session cookies, bearer tokens, API keys, OAuth codes, and any other credentials
 
 - **If a user pastes a secret into chat, stop.** Ask them to save it to a file instead. Don't try to "be helpful" by using the pasted value — that teaches them an unsafe habit and the secret is already in the transcript.
 
-- **Auth state files are secrets too.** `state save` / `state load` persists cookies + localStorage to a JSON file. Treat the path the same as a cookies file: don't paste its contents, don't share it with third-party services.
+- **Auth state files are secrets too.** `state save` / `state load` persists cookies, cookie partition metadata, localStorage, and sessionStorage to a JSON file. Treat the path the same as a cookies file: don't paste its contents, don't share it with third-party services.
 
 ## Stay on the user's target