@zixt/host 0.0.156 → 0.0.158

package/dist/index.js

@@ -28,7 +28,7 @@ import { homedir as homedir6 } from "node:os";
 // package.json
 var package_default = {
   name: "@zixt/host",
-  version: "0.0.156",
+  version: "0.0.158",
   type: "module",
   exports: {
     ".": "./src/client.ts",
@@ -14881,6 +14881,23 @@ var BrowserFramePayload = external_exports.object({
   width: external_exports.number().int().min(1).max(3840),
   height: external_exports.number().int().min(1).max(2160)
 }).strict();
+var BrowserCookie = external_exports.object({
+  name: external_exports.string().min(1).max(256),
+  value: external_exports.string().max(8192),
+  domain: external_exports.string().min(1).max(253),
+  path: external_exports.string().min(1).max(2048),
+  expires: external_exports.number().finite().min(-1).max(253402300799),
+  httpOnly: external_exports.boolean(),
+  secure: external_exports.boolean(),
+  sameSite: external_exports.enum(["Strict", "Lax", "None"]),
+  /** Chromium partition key for CHIPS cookies, when present. */
+  partitionKey: external_exports.string().min(1).max(2048).optional()
+}).strict();
+var BROWSER_MAX_SYNCED_COOKIES = 512;
+var BrowserCookieState = external_exports.object({
+  revision: external_exports.number().int().min(0),
+  cookies: external_exports.array(BrowserCookie).max(BROWSER_MAX_SYNCED_COOKIES)
+}).strict();
 var inputCoordinate = external_exports.number().min(0).max(16384);
 var BrowserMouseButton = external_exports.enum(["left", "middle", "right"]);
 var BrowserInputEvent = external_exports.discriminatedUnion("kind", [
@@ -14940,7 +14957,7 @@ var BrowserSessionProjection = external_exports.object({
   canStart: external_exports.boolean(),
   /** Member-safe reason when canStart is false. */
   reason: external_exports.string().max(300).optional(),
-  /** Present only when active work must use a different Machine-local profile. */
+  /** Present only when active work uses a different local profile Machine. */
   profileContext: BrowserProfileContext.optional()
 }).strict();
 var StartBrowserSessionRequest = external_exports.object({ url: external_exports.string().min(1).max(2e3).optional() }).strict();
@@ -18338,7 +18355,7 @@ var ListTasksResponse = external_exports.object({
 }).strict();
 
 // ../../packages/contracts/src/protocol.ts
-var PROTOCOL_VERSION = 13;
+var PROTOCOL_VERSION = 14;
 var BROWSER_PROFILE_INVENTORY_PAGE_SIZE = 200;
 var HELLO_UNWOUND_ASSIGNMENT_LIMIT = 1e3;
 var TASK_CANCEL_ACK_EVENT = "zixt.task.cancel.acknowledged";
@@ -19512,6 +19529,44 @@ var BrowserSessionEndedFrame = external_exports.object({
   agentId: AgentId,
   reason: BrowserSessionEndReason
 });
+var BrowserCookieSyncFrame = external_exports.object({
+  type: external_exports.literal("browser.cookies.sync"),
+  requestId: external_exports.string().min(1).max(200),
+  projectId: ProjectId,
+  taskId: TaskId,
+  agentId: AgentId,
+  browserSessionId: external_exports.string().min(1).max(200),
+  /** Omitted only by a Machine that has not received the canonical jar yet. */
+  baseRevision: external_exports.number().int().min(0).optional(),
+  cookies: external_exports.array(BrowserCookie).max(BROWSER_MAX_SYNCED_COOKIES)
+}).strict();
+var BrowserCookieSyncResultFrame = external_exports.discriminatedUnion("ok", [
+  external_exports.object({
+    type: external_exports.literal("browser.cookies.result"),
+    requestId: external_exports.string().min(1).max(200),
+    projectId: ProjectId,
+    taskId: TaskId,
+    agentId: AgentId,
+    browserSessionId: external_exports.string().min(1).max(200),
+    ok: external_exports.literal(true),
+    /** False asks the Host to reconcile its local changes over this newer jar. */
+    accepted: external_exports.boolean(),
+    state: BrowserCookieState,
+    error: external_exports.never().optional()
+  }).strict(),
+  external_exports.object({
+    type: external_exports.literal("browser.cookies.result"),
+    requestId: external_exports.string().min(1).max(200),
+    projectId: ProjectId,
+    taskId: TaskId,
+    agentId: AgentId,
+    browserSessionId: external_exports.string().min(1).max(200),
+    ok: external_exports.literal(false),
+    accepted: external_exports.never().optional(),
+    state: external_exports.never().optional(),
+    error: external_exports.string().min(1).max(300)
+  }).strict()
+]);
 var BrowserCredentialRequestFrame = external_exports.object({
   type: external_exports.literal("browser.credential.request"),
   projectId: ProjectId,
@@ -19939,6 +19994,7 @@ var HostToCloudFrame = external_exports.discriminatedUnion("type", [
   BrowserStateFrame,
   BrowserScreencastFrame,
   BrowserSessionEndedFrame,
+  BrowserCookieSyncFrame,
   BrowserCredentialRequestFrame,
   BrowserProfilePurged,
   PingFrame,
@@ -19946,6 +20002,7 @@ var HostToCloudFrame = external_exports.discriminatedUnion("type", [
 ]);
 var CloudToHostFrame = external_exports.discriminatedUnion("type", [
   HelloAckFrame,
+  BrowserCookieSyncResultFrame,
   DeliverFrame,
   ConnectionProbeFrame,
   ApiOperationCallFrame,
@@ -19970,6 +20027,11 @@ var CLOSE_CODES = {
   revoked: 4004
 };
 var UNSUPPORTED_PROTOCOL_CLOSE_REASON = "unsupported protocol version";
+function parseUnsupportedProtocolCloseReason(detail) {
+  if (detail === UNSUPPORTED_PROTOCOL_CLOSE_REASON) return { cloudProtocolVersion: null };
+  const match = /^unsupported protocol version; cloud protocol (\d{1,6})$/.exec(detail);
+  return match ? { cloudProtocolVersion: Number(match[1]) } : null;
+}
 var CLOSE_REASON_MAX_BYTES = 123;
 
 // ../../packages/contracts/src/webhook-automations.ts
@@ -25813,6 +25875,8 @@ var HostClient = class _HostClient {
   operationGrantWaiters = /* @__PURE__ */ new Map();
   /** Project/Task-qualified, socket-generation-bound web_login exchanges. */
   browserCredentialWaiters = /* @__PURE__ */ new Map();
+  /** Project-scoped, socket-generation-bound Browser cookie exchanges. */
+  browserCookieSyncWaiters = /* @__PURE__ */ new Map();
   /** True only after the connected cloud's helloAck advertised the feature. */
   browserFeatureActive = false;
   workingContextFeatureActive = false;
@@ -25978,6 +26042,13 @@ var HostClient = class _HostClient {
       waiter.deny("No sign-in was attempted: this machine lost its connection to Zixt.");
     }
   }
+  rejectBrowserCookieSyncWaiters() {
+    for (const [requestId, waiter] of this.browserCookieSyncWaiters) {
+      clearTimeout(waiter.timer);
+      this.browserCookieSyncWaiters.delete(requestId);
+      waiter.deny("Browser cookie synchronization lost its Zixt connection.");
+    }
+  }
   async unwindAllRuns(reason, stopReason) {
     const runs = [...this.activeRuns.values()];
     const unwindingAssignments = [...this.activeAssignments.values()];
@@ -26017,6 +26088,7 @@ var HostClient = class _HostClient {
     }
     this.rejectOperationGrantWaiters();
     this.rejectBrowserCredentialWaiters();
+    this.rejectBrowserCookieSyncWaiters();
     for (const deadline of this.authorityExpiryTimers.values()) clearTimeout(deadline.timer);
     this.cancels.clear();
     this.secretGrants.clear();
@@ -26315,7 +26387,7 @@ var HostClient = class _HostClient {
       await this.unwindAllRuns("host connection was replaced by a newer client", "client_shutdown");
       return;
     }
-    const versionMismatch = code === CLOSE_CODES.protocolError && detail === UNSUPPORTED_PROTOCOL_CLOSE_REASON;
+    const versionMismatch = code === CLOSE_CODES.protocolError && detail !== void 0 && parseUnsupportedProtocolCloseReason(detail) !== null;
     if (versionMismatch) {
       this.opts.onStatus?.("incompatible", detail);
       this.stopped = true;
@@ -26369,10 +26441,46 @@ var HostClient = class _HostClient {
    * frame at a non-advertising cloud would each close the socket outright.
    */
   sendBrowserFrame(frame) {
-    if (!this.browserFeatureActive) return;
+    if (!this.browserFeatureActive) return false;
     const projectId = frame.type === "browser.state" ? frame.state.projectId : frame.type === "browser.frame" ? frame.frame.projectId : frame.projectId;
-    if (this.purgingProjects.has(projectId)) return;
-    this.send(frame);
+    if (this.purgingProjects.has(projectId)) return false;
+    return this.send(frame);
+  }
+  requestBrowserCookieSync(input) {
+    const socket = this.ws;
+    if (!socket || !this.browserFeatureActive || !this.protocolReady) {
+      return Promise.reject(
+        new Error("Browser cookie synchronization has no live Zixt connection.")
+      );
+    }
+    const requestId = crypto.randomUUID();
+    return new Promise((resolve24, reject3) => {
+      const timer = setTimeout(() => {
+        if (this.browserCookieSyncWaiters.delete(requestId)) {
+          reject3(new Error("Zixt did not answer Browser cookie synchronization in time."));
+        }
+      }, 3e4);
+      timer.unref?.();
+      this.browserCookieSyncWaiters.set(requestId, {
+        projectId: input.projectId,
+        taskId: input.taskId,
+        agentId: input.agentId,
+        browserSessionId: input.browserSessionId,
+        socket,
+        timer,
+        accept: resolve24,
+        deny: (reason) => reject3(new Error(reason))
+      });
+      if (!this.sendBrowserFrame({
+        type: "browser.cookies.sync",
+        requestId,
+        ...input
+      })) {
+        clearTimeout(timer);
+        this.browserCookieSyncWaiters.delete(requestId);
+        reject3(new Error("Browser cookie synchronization has no live Zixt connection."));
+      }
+    });
   }
   replaceablePendingUp(message) {
     return message.type === "host.report" || message.type === "task.working_context" || message.type === "task.runner_runtime" || message.type === "task.title" || message.type === "task.event" && message.event.ephemeral === true;
@@ -26594,7 +26702,8 @@ var HostClient = class _HostClient {
               taskId,
               agentId,
               reason
-            })
+            }),
+            syncCookies: (input) => this.requestBrowserCookieSync(input)
           });
         } else {
           this.opts.browser?.attach(null);
@@ -26708,6 +26817,17 @@ var HostClient = class _HostClient {
         waiter.accept(grant);
         return;
       }
+      case "browser.cookies.result": {
+        const waiter = this.browserCookieSyncWaiters.get(frame.requestId);
+        if (!waiter || waiter.socket !== sourceSocket || waiter.projectId !== frame.projectId || waiter.taskId !== frame.taskId || waiter.agentId !== frame.agentId || waiter.browserSessionId !== frame.browserSessionId) {
+          return;
+        }
+        clearTimeout(waiter.timer);
+        this.browserCookieSyncWaiters.delete(frame.requestId);
+        if (frame.ok) waiter.accept({ accepted: frame.accepted, state: frame.state });
+        else waiter.deny(frame.error);
+        return;
+      }
       case "browser.open": {
         if (!this.acceptsVolatileProjectWork(frame.projectId, frame.projectWorkFenceRevision)) {
           return;
@@ -30384,6 +30504,29 @@ function installedReleaseVersion(entry, root = versionsRoot()) {
   if (!version2 || !VERSION_DIR.test(version2)) return null;
   return resolve8(entry) === resolve8(installedReleaseEntry(version2, root)) ? version2 : null;
 }
+function compareReleaseVersions(left, right) {
+  const parse4 = (version2) => version2.split(/[-+]/, 1)[0].split(".").map((part) => Number(part));
+  const leftParts = parse4(left);
+  const rightParts = parse4(right);
+  for (let index = 0; index < 3; index += 1) {
+    const difference = (leftParts[index] ?? 0) - (rightParts[index] ?? 0);
+    if (difference !== 0) return difference;
+  }
+  return 0;
+}
+async function newestInstalledReleaseBelow(version2, excluded, root = versionsRoot()) {
+  let names;
+  try {
+    names = await readdir6(root);
+  } catch {
+    return null;
+  }
+  const candidates = names.filter((name) => VERSION_DIR.test(name)).filter((name) => !excluded.has(name) && compareReleaseVersions(name, version2) < 0).sort(compareReleaseVersions).reverse();
+  for (const candidate of candidates) {
+    if (await validInstalledRelease(candidate, root)) return candidate;
+  }
+  return null;
+}
 function currentReleaseEntry(root = versionsRoot(), platform = process.platform) {
   return join12(root, platform === "win32" ? "current-launcher.cjs" : CURRENT_RELEASE_ENTRY);
 }
@@ -31488,6 +31631,7 @@ async function superviseHost(options = {}) {
   });
   const attempted = /* @__PURE__ */ new Set();
   let unsatisfiableUpdates = 0;
+  const cloudRefusedVersions = /* @__PURE__ */ new Set();
   const waitOrShutdown = async (ms) => {
     if (shuttingDown2) return false;
     if (!customDelay) {
@@ -31568,6 +31712,14 @@ async function superviseHost(options = {}) {
       rollbackCandidate = null;
     }
   };
+  const parkRefusedCandidate = async (version2) => {
+    if (!releaseStore || releaseState?.candidateVersion !== version2) return;
+    await releaseStore.clear();
+    if (releaseState?.candidateVersion === version2) {
+      releaseState = null;
+      rollbackCandidate = null;
+    }
+  };
   const markReleaseValidated = async (version2) => {
     if (releaseState?.phase !== "probation" || releaseState.candidateVersion !== version2 || !releaseStore) {
       return;
@@ -31876,21 +32028,66 @@ async function superviseHost(options = {}) {
       const target = await published();
       let updateLanded = false;
       let rejectedUpdate = null;
+      if (runtimeMs >= FAST_UPDATE_EXIT_MS) cloudRefusedVersions.clear();
       if (target === null) {
         log2(
           "Zixt Host: a newer release was reported but the registry is unreachable; staying on the current version"
         );
       } else if (target === command.version) {
+        cloudRefusedVersions.add(target);
+        await parkRefusedCandidate(target);
         if (unsatisfiableUpdates === 0) {
           log2(
             `Zixt Host: ${target} is the newest published Zixt Host, so no update can satisfy this cloud; the cloud this Machine is paired to speaks a newer Host protocol than any published release`
           );
+        }
+        const compatible = await newestInstalledReleaseBelow(target, cloudRefusedVersions);
+        if (compatible) {
+          log2(
+            `Zixt Host: running installed ${compatible} while the cloud catches up with ${target}; this Machine returns to ${target} by itself once the cloud speaks its protocol`
+          );
+          command = {
+            entry: installedReleaseEntry(compatible),
+            version: compatible,
+            // The parked newest release is not for this worker to re-request:
+            // its own update checks skip it while the cloud stays behind.
+            rejectedVersion: target
+          };
+          updateLanded = true;
+        } else if (unsatisfiableUpdates === 0) {
           log2(
-            "Zixt Host: pair this Machine with a cloud running a published release, or start the Host from the same source checkout that cloud runs; this Machine connects by itself once a matching release is published"
+            "Zixt Host: no older installed release remains to serve this cloud; pair this Machine with a cloud running a published release, or start the Host from the same source checkout that cloud runs; this Machine connects by itself once a matching release is published"
+          );
+        }
+      } else if (cloudRefusedVersions.has(target)) {
+        if (command.version && runtimeMs < FAST_UPDATE_EXIT_MS) {
+          cloudRefusedVersions.add(command.version);
+          await parkRefusedCandidate(command.version);
+        }
+        const compatible = command.version ? await newestInstalledReleaseBelow(command.version, cloudRefusedVersions) : null;
+        if (compatible) {
+          log2(
+            `Zixt Host: ${target} is still refused by the paired cloud; running installed ${compatible} until the cloud updates`
+          );
+          command = {
+            entry: installedReleaseEntry(compatible),
+            version: compatible,
+            rejectedVersion: target
+          };
+          updateLanded = true;
+        } else {
+          log2(
+            `Zixt Host: the paired cloud refuses every installed release; waiting for the cloud or a newer published release`
           );
         }
       } else if (attempted.has(target)) {
-        log2(`Zixt Host: already running ${target}; ignoring a repeated update request`);
+        if (command.version !== target && await validInstalledRelease(target)) {
+          log2(`Zixt Host: returning to installed ${target} now that the cloud accepts it`);
+          command = { entry: installedReleaseEntry(target), version: target };
+          updateLanded = true;
+        } else {
+          log2(`Zixt Host: already running ${target}; ignoring a repeated update request`);
+        }
       } else {
         let entry;
         const attempt = { failure: null };
@@ -32486,6 +32683,7 @@ function createDemoBrowserAdapterFactory() {
       const tabs = [newDemoTab()];
       let activeIndex = 0;
       let sink = null;
+      let cookies = [];
       const listeners = [];
       const frame = () => ({
         jpegBase64: DEMO_FRAME_JPEG_BASE64,
@@ -32629,6 +32827,12 @@ function createDemoBrowserAdapterFactory() {
           }
           emit();
         },
+        async cookies() {
+          return cookies.map((cookie) => ({ ...cookie }));
+        },
+        async replaceCookies(next) {
+          cookies = next.map((cookie) => ({ ...cookie }));
+        },
         async close() {
           sink = null;
         }
@@ -44384,6 +44588,10 @@ var BrowserManager = class {
   deniedAuthorizations = /* @__PURE__ */ new Map();
   /** Serializes profile lifecycle and session open/close per teammate. */
   locks = /* @__PURE__ */ new Map();
+  /** Last cloud-canonical jar observed for each exact Project teammate. */
+  cookieStates = /* @__PURE__ */ new Map();
+  cookieSyncTails = /* @__PURE__ */ new Map();
+  cookieSyncTimers = /* @__PURE__ */ new Map();
   events = null;
   profileRoot;
   profileStateRoot;
@@ -44400,8 +44608,15 @@ var BrowserManager = class {
   attach(events) {
     this.events = events;
     if (!events) return;
+    const scheduledProfiles = /* @__PURE__ */ new Set();
     for (const session of this.sessions.values()) {
-      if (!session.closed) events.state(this.stateOf(session));
+      if (session.closed) continue;
+      events.state(this.stateOf(session));
+      const profileKey = this.profileKey(session.projectId, session.agentId);
+      if (!scheduledProfiles.has(profileKey)) {
+        scheduledProfiles.add(profileKey);
+        this.scheduleCookieSync(session, 0);
+      }
     }
   }
   capability() {
@@ -44486,6 +44701,39 @@ var BrowserManager = class {
   profileKey(projectId, agentId) {
     return `${projectId}:${agentId}`;
   }
+  cookieKey(cookie) {
+    return `${cookie.name}\0${cookie.domain}\0${cookie.path}\0${cookie.partitionKey ?? ""}`;
+  }
+  normalizedCookies(cookies) {
+    return [
+      ...new Map(cookies.map((cookie) => [this.cookieKey(cookie), { ...cookie }])).values()
+    ].sort((left, right) => this.cookieKey(left).localeCompare(this.cookieKey(right)));
+  }
+  cookiesEqual(left, right) {
+    return JSON.stringify(this.normalizedCookies(left)) === JSON.stringify(this.normalizedCookies(right));
+  }
+  /**
+   * Rebase only the changes this Machine made since its last canonical jar
+   * over the newer jar returned by another Machine. Unchanged cookies retain
+   * the remote value; local additions, changes, and deletions win per cookie.
+   */
+  mergeCookieChanges(base, local, remote) {
+    const baseByKey = new Map(base.map((cookie) => [this.cookieKey(cookie), cookie]));
+    const localByKey = new Map(local.map((cookie) => [this.cookieKey(cookie), cookie]));
+    const merged = new Map(remote.map((cookie) => [this.cookieKey(cookie), { ...cookie }]));
+    for (const [key, baseCookie] of baseByKey) {
+      const localCookie = localByKey.get(key);
+      if (!localCookie) {
+        merged.delete(key);
+      } else if (!this.cookiesEqual([baseCookie], [localCookie])) {
+        merged.set(key, { ...localCookie });
+      }
+    }
+    for (const [key, localCookie] of localByKey) {
+      if (!baseByKey.has(key)) merged.set(key, { ...localCookie });
+    }
+    return this.normalizedCookies([...merged.values()]);
+  }
   exactChild(root, child) {
     const canonicalRoot = resolve16(root);
     const target = resolve16(canonicalRoot, child);
@@ -44606,6 +44854,87 @@ var BrowserManager = class {
       throw error52;
     }
   }
+  synchronizeCookies(session) {
+    const profileKey = this.profileKey(session.projectId, session.agentId);
+    const tail = this.cookieSyncTails.get(profileKey) ?? Promise.resolve();
+    const next = tail.then(async () => {
+      if (session.closed) return;
+      const synchronize = this.events?.syncCookies;
+      if (!synchronize) return;
+      let baseline = this.cookieStates.get(profileKey);
+      let observedLocal = this.normalizedCookies(await session.adapter.cookies());
+      let desired = observedLocal;
+      for (let attempt = 0; attempt < 8; attempt++) {
+        if (desired.length > BROWSER_MAX_SYNCED_COOKIES) {
+          throw new Error(
+            `the browser profile has more than ${BROWSER_MAX_SYNCED_COOKIES} cookies and cannot be synchronized safely`
+          );
+        }
+        const result = await synchronize({
+          projectId: session.projectId,
+          taskId: session.taskId,
+          agentId: session.agentId,
+          browserSessionId: session.browserSessionId,
+          ...baseline ? { baseRevision: baseline.revision } : {},
+          cookies: desired
+        });
+        if (result.accepted) {
+          const canonical = {
+            revision: result.state.revision,
+            cookies: this.normalizedCookies(result.state.cookies)
+          };
+          this.cookieStates.set(profileKey, canonical);
+          const current2 = this.normalizedCookies(await session.adapter.cookies());
+          if (!this.cookiesEqual(current2, observedLocal)) {
+            baseline = canonical;
+            desired = this.mergeCookieChanges(observedLocal, current2, canonical.cookies);
+            observedLocal = current2;
+            continue;
+          }
+          if (!this.cookiesEqual(current2, canonical.cookies)) {
+            await session.adapter.replaceCookies(canonical.cookies);
+          }
+          return;
+        }
+        const remote = {
+          revision: result.state.revision,
+          cookies: this.normalizedCookies(result.state.cookies)
+        };
+        if (!baseline) {
+          this.cookieStates.set(profileKey, remote);
+          await session.adapter.replaceCookies(remote.cookies);
+          return;
+        }
+        const current = this.normalizedCookies(await session.adapter.cookies());
+        const currentDesired = this.cookiesEqual(current, observedLocal) ? desired : this.mergeCookieChanges(observedLocal, current, desired);
+        desired = this.mergeCookieChanges(baseline.cookies, currentDesired, remote.cookies);
+        baseline = remote;
+        observedLocal = current;
+      }
+      throw new Error("browser cookies changed too many times while synchronizing");
+    });
+    const tracked = next.catch(() => {
+    }).finally(() => {
+      if (this.cookieSyncTails.get(profileKey) === tracked)
+        this.cookieSyncTails.delete(profileKey);
+    });
+    this.cookieSyncTails.set(profileKey, tracked);
+    return next;
+  }
+  scheduleCookieSync(session, delayMs = 250) {
+    if (session.closed || !this.events?.syncCookies) return;
+    const profileKey = this.profileKey(session.projectId, session.agentId);
+    const existing = this.cookieSyncTimers.get(profileKey);
+    if (existing) clearTimeout(existing);
+    const timer = setTimeout(() => {
+      if (this.cookieSyncTimers.get(profileKey) !== timer) return;
+      this.cookieSyncTimers.delete(profileKey);
+      void this.synchronizeCookies(session).catch(() => {
+      });
+    }, delayMs);
+    timer.unref?.();
+    this.cookieSyncTimers.set(profileKey, timer);
+  }
   /**
    * Ensure a live session for this Task. An existing session is adopted
    * as-is (the cloud-minted id loses to the live one — the cloud reconciles
@@ -44683,8 +45012,20 @@ var BrowserManager = class {
         closeFailed: false
       };
       this.sessions.set(taskKey, session);
+      try {
+        await this.synchronizeCookies(session);
+      } catch (error52) {
+        session.closed = true;
+        this.sessions.delete(taskKey);
+        await adapter.close().catch(() => {
+        });
+        throw error52;
+      }
       adapter.onStateChanged(() => {
-        if (!session.closed) this.events?.state(this.stateOf(session));
+        if (!session.closed) {
+          this.events?.state(this.stateOf(session));
+          this.scheduleCookieSync(session);
+        }
       });
       this.armIdleTimer(session);
       this.events?.state(this.stateOf(session));
@@ -44714,6 +45055,14 @@ var BrowserManager = class {
       return;
     }
     if (!session || session.closed && !session.closeFailed) return;
+    const profileKey = this.profileKey(session.projectId, session.agentId);
+    const pendingCookieTimer = this.cookieSyncTimers.get(profileKey);
+    if (pendingCookieTimer) {
+      clearTimeout(pendingCookieTimer);
+      this.cookieSyncTimers.delete(profileKey);
+    }
+    await this.synchronizeCookies(session).catch(() => {
+    });
     session.closed = true;
     session.closeFailed = false;
     if (session.frameTimer) clearTimeout(session.frameTimer);
@@ -44763,6 +45112,12 @@ var BrowserManager = class {
         force: true,
         maxRetries: 3
       });
+      const profileKey = this.profileKey(projectId, agentId);
+      const timer = this.cookieSyncTimers.get(profileKey);
+      if (timer) clearTimeout(timer);
+      this.cookieSyncTimers.delete(profileKey);
+      this.cookieSyncTails.delete(profileKey);
+      this.cookieStates.delete(profileKey);
       await this.syncDirectory(this.projectProfileRoot(projectId));
     });
   }
@@ -44797,6 +45152,17 @@ var BrowserManager = class {
     this.deniedAuthorizations.forEach((_revision, key) => {
       if (key.startsWith(`${projectId}:`)) this.deniedAuthorizations.delete(key);
     });
+    this.cookieSyncTimers.forEach((timer, key) => {
+      if (!key.startsWith(`${projectId}:`)) return;
+      clearTimeout(timer);
+      this.cookieSyncTimers.delete(key);
+    });
+    this.cookieSyncTails.forEach((_tail, key) => {
+      if (key.startsWith(`${projectId}:`)) this.cookieSyncTails.delete(key);
+    });
+    this.cookieStates.forEach((_state, key) => {
+      if (key.startsWith(`${projectId}:`)) this.cookieStates.delete(key);
+    });
     await this.syncDirectory(this.profileRoot);
     await this.syncDirectory(this.profileStateRoot);
   }
@@ -44865,6 +45231,11 @@ var BrowserManager = class {
     const next = session.inputQueue.then(work, work);
     session.inputQueue = next.catch(() => {
     });
+    void next.then(
+      () => this.scheduleCookieSync(session),
+      () => {
+      }
+    );
     return next;
   }
   /** Tool surface: every call ensures the session and counts as activity. */
@@ -45666,6 +46037,37 @@ function createPlaywrightBrowserAdapterFactory(dependencies = {}) {
             }
           }
         },
+        async cookies() {
+          return (await context.cookies()).map((cookie) => ({
+            name: cookie.name,
+            value: cookie.value,
+            domain: cookie.domain,
+            path: cookie.path,
+            expires: cookie.expires,
+            httpOnly: cookie.httpOnly,
+            secure: cookie.secure,
+            sameSite: cookie.sameSite,
+            ...cookie.partitionKey ? { partitionKey: cookie.partitionKey } : {}
+          }));
+        },
+        async replaceCookies(cookies) {
+          await context.clearCookies();
+          if (cookies.length > 0) {
+            await context.addCookies(
+              cookies.map((cookie) => ({
+                name: cookie.name,
+                value: cookie.value,
+                domain: cookie.domain,
+                path: cookie.path,
+                expires: cookie.expires,
+                httpOnly: cookie.httpOnly,
+                secure: cookie.secure,
+                sameSite: cookie.sameSite,
+                ...cookie.partitionKey !== void 0 ? { partitionKey: cookie.partitionKey } : {}
+              }))
+            );
+          }
+        },
         async close() {
           closed = true;
           for (const tab of [...tabs]) {
@@ -48384,14 +48786,21 @@ var client = new HostClient({
         });
         queueMicrotask(() => shutdown(DO_NOT_RESTART_EXIT_CODE));
         break;
-      case "incompatible":
-        log.error("Zixt Cloud refused this Host as too old to connect", {
-          ...connectionContext,
-          protocol: PROTOCOL_VERSION,
-          next: packagedBuild ? "Zixt checks the published release now; nothing to do on this Machine" : "Update this checkout through Git and restart the Host"
-        });
+      case "incompatible": {
+        const refusal = detail ? parseUnsupportedProtocolCloseReason(detail) : null;
+        const cloudBehind = refusal?.cloudProtocolVersion != null && refusal.cloudProtocolVersion < PROTOCOL_VERSION;
+        log.error(
+          cloudBehind ? "Zixt Cloud is behind this Host and refused the connection" : "Zixt Cloud refused this Host as too old to connect",
+          {
+            ...connectionContext,
+            protocol: PROTOCOL_VERSION,
+            ...refusal?.cloudProtocolVersion != null ? { cloudProtocol: refusal.cloudProtocolVersion } : {},
+            next: packagedBuild ? cloudBehind ? "Zixt runs the newest installed release this cloud accepts until the cloud updates" : "Zixt checks the published release now; nothing to do on this Machine" : cloudBehind ? "Deploy the paired cloud, or run this checkout at the revision that cloud runs" : "Update this checkout through Git and restart the Host"
+          }
+        );
         queueMicrotask(() => shutdown(packagedBuild ? UPDATE_EXIT_CODE : DO_NOT_RESTART_EXIT_CODE));
         break;
+      }
       case "rejected":
         log.error("Zixt Cloud refused this Machine", {
           ...connectionContext,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zixt/host",
-  "version": "0.0.156",
+  "version": "0.0.158",
   "type": "module",
   "exports": {
     ".": "./src/client.ts",