@nurix/etna 0.16.0 → 0.17.0

package/data/harnesses/discover/rules/tradecraft.md

@@ -478,6 +478,19 @@ Inferences from `localStorage` / `sessionStorage` / cookie / IndexedDB **key nam
 | **Opaque session cookie** (HttpOnly, same-origin, auto-attached) | No `Authorization` header anywhere on the SPA; the cookie auto-attaches because all API is same-origin. **The negative finding is the tell.** | No |
 | **Firebase ID token in IndexedDB** | `firebaseLocalStorageDb` → `stsTokenManager.accessToken`; Firebase Modular SDK v9+ store; short-lived (3600 s) + auto-refreshed. Confirm the Bearer model with one Firestore REST `GET documents/users/{uid}`. | Partially (IDB is JS-reachable, but token is short-lived + refreshed) |
 
+> **Same-origin replay — mine an opaque-session-cookie API without ever reading the cookie.** When the
+> taxonomy lands on **opaque session cookie** above (no `Authorization`, no JS-readable token, no CSRF
+> meta — a server-session app: Symfony/PHP, Rails, Django, classic ASP.NET), the *absence* in JS storage
+> **is** the positive fingerprint, not a dead end. Mine it with **in-page `fetch(path, {credentials:'same-origin'})`
+> replay from the app origin**: the browser auto-attaches the httpOnly cookie, so once the in-page tap has
+> revealed an endpoint you replay it for verbatim read bodies (and, Pass-2-gated, write bodies) **without
+> ever reading, returning, or writing the cookie value** — the secret never reaches the harness, which is
+> what keeps this inside the §7 ethics line. You do **not** need raw CDP `Network` for this case (it would
+> only add the literal `Cookie`/request headers, which you'd redact anyway); the in-page fetch/XHR tap +
+> same-origin replay is the complete tool. Reach for raw CDP only to reconstruct exact request headers for
+> an *out-of-browser* reproducer, or for non-`fetch` transports (WS frames). (Origin tag: Akeneo — httpOnly
+> `BAPID` Symfony session, 54-path internal API mined entirely by same-origin replay.)
+
 **Key claims to look for in the JWT payload** (decode *structure* only — redact `sub`/`email`/`session_id`/`provider_id`, never log the signature):
 
 | Claim | What it tells you |

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nurix/etna",
-    "version": "0.16.0",
+    "version": "0.17.0",
     "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
     "type": "module",
     "bin": {