barebrowse 0.14.0 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,162 @@
 # Changelog
 
+## [0.17.0] - 2026-07-10
+
+### Added
+
+- **Firefox/BiDi observability parity (parity plan Phase 2).** The Firefox
+  engine now backs the same console/network capture and network-idle wait the
+  Chromium/CDP engine has, over WebDriver BiDi events instead of CDP:
+  - **`page.waitForNetworkIdle()`** works on Firefox (was a CDP-only stub that
+    threw). Wired to `network.beforeRequestSent` / `responseCompleted` /
+    `fetchError`, reusing the same orphan-resilient idle core as the CDP path
+    (`waitForNetworkIdleBiDi` in `network-idle.js`).
+  - **Daemon console + network log capture** on Firefox: the `console-logs`,
+    `network-log`, and `wait-idle` CLI commands now return real data for a
+    `--engine firefox` session (previously empty / unsupported). Backed by
+    `log.entryAdded` + `network.*` events (`attachBiDiCapture` in `daemon.js`),
+    mirroring the CDP `Runtime.consoleAPICalled` / `Network.*` capture. BiDi's
+    `warn` console level is normalized to CDP's `warning` so `--level` filters
+    match cross-engine.
+
+  Event shapes were measured against real Firefox before wiring (per the Phase 1
+  lesson). Unit-tested against those shapes in `test/unit/network-idle.test.js`
+  and `test/unit/daemon.test.js`; live-verified in `test/integration/firefox.test.js`.
+  Still Firefox gaps (Phase 3+): ad/tracker block, dialog capture, `saveState`,
+  `waitForNavigation`, hybrid mode.
+
+## [0.16.1] - 2026-07-10
+
+### Fixed
+
+- **Firefox consent auto-dismiss no longer risks clicking an unrelated button.**
+  A code review of v0.16.0 found (and reproduced) a false-positive: when a
+  consent *dialog* was detected but contained no in-dialog accept button, the
+  Firefox walker fell back to a page-wide "accept" scan that could auto-click an
+  unrelated `Accept all …` control elsewhere on the page (e.g. a ToS/signup
+  button) during `goto()`. The page-wide scan now runs **only** for banner-style
+  consent (no dialog container at all). Trade-off: an accept button rendered
+  *outside* its own dialog (some SourcePoint deployments) is no longer
+  auto-dismissed on Firefox — we accept that miss rather than risk a wrong
+  click. Regression-tested in `test/unit/consent-firefox.test.js`.
+
+### Documentation
+
+- **Firefox stealth + consent known limitations** captured in the PRD
+  (`docs/01-product/prd.md`), slated for the Phase 5 cross-engine fidelity
+  harness: the consent double AX-build per navigate (bounded latency, parity
+  with CDP), the single-click-without-re-verify behavior (`consent: false` to
+  opt out), and the latent `navigator.webdriver` own-property fallback. All
+  three were validated in the same review; none is a correctness defect on
+  current engines.
+
+## [0.16.0] - 2026-07-10
+
+### Added
+
+- **Firefox anti-detection + consent auto-dismiss (BiDi parity Phase 1).** The
+  two most agent-breaking Firefox gaps are closed: headless bot-detection and
+  cookie-consent dialogs that were never dismissed. Both now work on
+  `connect({ engine: 'firefox' })` (and therefore the CLI/daemon/MCP Firefox
+  paths), behind the same flags as the CDP engine.
+  - **Stealth** (`src/stealth-firefox.js`, headless only, via BiDi
+    `script.addPreloadScript`). Deliberately *not* a port of Chromium's
+    `STEALTH_SCRIPT`: a POC measured stock Firefox-under-BiDi and found it
+    already exposes a realistic surface (no `window.chrome`, a real plugin set,
+    the real GPU, a UA with no "Headless" marker) — injecting Chromium's
+    Chrome-shims would have *created* a spoof tell worse than the one removed.
+    Firefox's only real tell is `navigator.webdriver` (`true`), so it gets a
+    minimal script: `navigator.webdriver` hiding + canvas-fingerprint noise.
+    `WEBDRIVER_PATCH` and `CANVAS_NOISE_PATCH` are now exported from
+    `stealth.js` and shared by both engines (single-sourcing the canvas
+    double-XOR fix).
+- **Hardened `navigator.webdriver` hiding on both engines.** The shared
+  `WEBDRIVER_PATCH` now *deletes* the getter off `Navigator.prototype` instead
+  of shadowing it with an own property. A naive override hid the value but left
+  `navigator.hasOwnProperty('webdriver') === true` — a tell that advanced
+  anti-bot checks (e.g. sannysoft's "WebDriver New") detect. After the change
+  `navigator.webdriver` is `undefined` and both `hasOwnProperty` and
+  `'webdriver' in navigator` read `false`, matching a stock browser
+  (POC-verified on Chromium and Firefox). This improves the Chromium engine
+  too, not just Firefox.
+  - **Consent** (`src/consent-firefox.js`). A walker over the reconstructed
+    nested AX tree that clicks the "accept" button via the existing BiDi
+    `pointerClick`. The multilingual accept/dialog patterns were extracted to
+    `src/consent-patterns.js`, now imported by both the CDP (`consent.js`) and
+    BiDi walkers, so language coverage stays single-sourced. Runs after
+    `goto()` behind the same `consent !== false` flag as CDP.
+  - **Tests:** `test/unit/consent-firefox.test.js` (pure walker: dialog
+    scoping, pattern priority, non-English, banner fallback, false-positive
+    guard) plus Firefox integration tests (webdriver hidden at page-parse time,
+    no `window.chrome` spoof, consent auto-dismiss + a `consent: false` control
+    that proves the test can fail).
+
+### Known gaps (Firefox engine)
+
+- `hybrid` mode, ad/tracker blocking, and console/network log capture remain
+  Chromium-only (BiDi parity Phases 2–4). `saveState`, `waitForNavigation`,
+  and `waitForNetworkIdle` still throw a clear "not supported on the
+  Firefox/BiDi engine" error; download/dialog logs read empty.
+- `reload()` still cannot honour `ignoreCache` (Firefox BiDi does not support
+  it yet).
+- Consent auto-dismiss clicks once without re-verifying dismissal (the CDP
+  path's synthetic→real retry is unnecessary here — BiDi `pointerClick` is
+  already a real pointer event). Accessible-name computation remains a
+  high-value subset of the full W3C accname spec.
+
+## [0.15.0] - 2026-07-10
+
+### Added
+
+- **Firefox support via WebDriver BiDi (`connect({ engine: 'firefox' })`).** CDP
+  is deprecated in Firefox, so Firefox is driven over the W3C-standard BiDi
+  protocol — a second transport (`src/bidi.js`) over the *same* `ws` dependency,
+  with no geckodriver and no new package. Selectable from the CLI
+  (`barebrowse open <url> --engine firefox`) and MCP (`BAREBROWSE_ENGINE=firefox`).
+  - New modules: `bidi.js` (BiDi JSON-RPC transport), `firefox.js` (launch/find/
+    reap), `ax-snapshot.js` (reconstructs a CDP-vocabulary ARIA tree in-page —
+    BiDi has no `getFullAXTree` — with implicit roles, accessible-name
+    computation, `aria-hidden`/visibility filtering, and shadow-DOM/`<slot>`
+    traversal), `firefox-page.js` (the BiDi-backed page object).
+  - `prune.js`, `aria.js`, and `readable.js` are reused unchanged across engines
+    (readable.js refactored to share `EXTRACT_EXPRESSION` + `finalizeReadable`).
+  - Covers `goto`, `snapshot`, `click`, `type`, `press`, `scroll`, `hover`,
+    `select`, `drag`, `upload`, `goBack`/`goForward`, `reload`, `screenshot`,
+    `pdf`, `tabs`/`switchTab`, `waitFor`, `readable`, `injectCookies`, `close`.
+    The navigation guard and upload sandbox are enforced on the Firefox path for
+    parity with CDP.
+  - Fidelity validated against real CDP snapshots; iframes (incl. nested +
+    multi-tab), shadow DOM, CSP, and SPA timing covered in
+    `test/integration/firefox.test.js` (18 tests).
+  - `goto`/`reload`/history navigation honour a timeout (a page that never
+    finishes loading rejects instead of hanging). Proxy honours the URL scheme
+    (`http`/`https` → HTTP+SSL, `socks`/`socks5`/`socks4` → SOCKS). Cookie
+    injection is host-scoped like CDP (shared `scopedCookiesForUrl`, not the
+    whole jar). Snapshot fidelity: a collapsed `<select>` surfaces as its value
+    (not every `<option>`), and bare text directly under `<body>` is kept.
+
+- **Incognito mode — a clean, unauthenticated session (`incognito: true`).**
+  Skips ALL auth injection: no cookie extraction/injection and no
+  `storageState` loading, so the agent browses logged-out even though the
+  default throwaway profile is unchanged. The gate lives at the page-object
+  level, so it holds even when a caller (MCP `goto`, the daemon) injects
+  unconditionally. Available on `browse()`, `connect()`, both engines, MCP
+  (`browse` tool arg + `BAREBROWSE_INCOGNITO=1`), and CLI (`--incognito`).
+  Cookie injection is scoped to the target host on **both** engines via a
+  shared `scopedCookiesForUrl` (the Firefox path no longer loads the whole
+  cookie jar).
+
+### Known gaps (Firefox engine)
+
+- Consent auto-dismiss, stealth patches, and `hybrid` mode remain Chromium-only.
+- `reload()` cannot honour `ignoreCache` (Firefox BiDi does not support it yet).
+- The CLI daemon's console/network log capture is CDP-only, so those logs are
+  empty for a Firefox session. `saveState`, `waitForNavigation`, and
+  `waitForNetworkIdle` are CDP-only too — on Firefox they throw a clear
+  "not supported on the Firefox/BiDi engine" error, and download/dialog logs
+  read empty. Accessible-name computation is a high-value subset of the full
+  W3C accname spec.
+
 ## [0.14.0] - 2026-06-15
 
 ### Documentation

package/README.md

@@ -132,8 +132,40 @@ const snap = await page.snapshot();
 await page.close(); // closes only the tab barebrowse opened — your browser keeps running
 ```
 
+### Firefox (WebDriver BiDi)
+
+CDP is deprecated in Firefox, so barebrowse drives it over the W3C WebDriver
+BiDi protocol instead — a second transport over the same `ws` dependency, no
+extra download. Same `page.*` API (the ARIA snapshot is reconstructed in-page
+since BiDi has no `getFullAXTree`):
+
+```js
+const page = await connect({ engine: 'firefox' }); // headless by default
+```
+
+From the CLI: `barebrowse open <url> --engine firefox`. From MCP: set
+`BAREBROWSE_ENGINE=firefox`. Firefox cookies (plaintext) reuse into the same
+engine. Consent auto-dismiss and headless stealth work on Firefox too (as of
+v0.16.0). Chromium (CDP) remains the default; `hybrid` mode, ad/tracker
+blocking, and the daemon's console/network capture are still Chromium-only.
+
 No clone profile, no fresh cookies — the agent sees what you see.
 
+### Incognito (clean session)
+
+Pass `incognito: true` for a clean, **unauthenticated** session — barebrowse
+skips *all* auth injection (cookies + storage state), so the agent browses
+logged out. It is not Chrome's `--incognito` flag: the session already runs in
+a throwaway profile, so this gates the *other* auth source — your real browser
+cookies. Works on both engines:
+
+```js
+const page = await connect({ incognito: true });
+```
+
+From the CLI: `barebrowse open <url> --incognito`. From MCP: set
+`BAREBROWSE_INCOGNITO=1`.
+
 ## What it handles automatically
 
 Cookie consent walls (29 languages, with real mouse click fallback for stubborn CMPs), login walls (cookie extraction from your browsers), bot detection (ARIA node count heuristic + stealth patches + automatic headed fallback — snapshot shows `[BOT CHALLENGE DETECTED]` warning when blocked), permission prompts, SPA navigation, JS dialogs, off-screen elements, pre-filled inputs, ARIA noise, and profile locking. The agent doesn't think about any of it.
@@ -223,7 +255,7 @@ URL -> find/launch browser (chromium.js)
 ## Requirements
 
 - Node.js >= 22 (built-in WebSocket, built-in SQLite)
-- Any Chromium-based browser installed (Chrome, Chromium, Brave, Edge, Vivaldi)
+- Any Chromium-based browser installed (Chrome, Chromium, Brave, Edge, Vivaldi) — or Firefox (>= 121) for the `engine: 'firefox'` BiDi path
 - Linux tested (Fedora/KDE). macOS/Windows cookie paths exist but untested.
 
 ## The bare ecosystem

package/barebrowse.context.md

@@ -46,6 +46,7 @@ const snapshot = await browse('https://example.com');
 const snapshot = await browse('https://example.com', {
   mode: 'headless',      // 'headless' | 'headed' | 'hybrid'
   cookies: true,         // inject user's browser cookies
+  incognito: false,      // clean, unauthenticated session: skip ALL auth injection
   browser: 'firefox',    // cookie source: 'firefox' | 'chromium' (auto-detected)
   prune: true,           // apply ARIA pruning (47-95% token reduction)
   pruneMode: 'act',      // 'act' (interactive elements) | 'read' (all content)
@@ -94,10 +95,12 @@ const snapshot = await browse('https://example.com', {
 | `close()` | -- | void | Close page, disconnect CDP, kill browser (if headless) |
 
 **connect() options** (in addition to mode/port/consent):
+- `engine: 'chromium'|'firefox'` — Browser engine. Default `chromium` (CDP). `firefox` drives Firefox over WebDriver BiDi (CDP is deprecated there) — a separate transport with the same `page.*` API; the ARIA snapshot is reconstructed in-page since BiDi has no `getFullAXTree`. Consent auto-dismiss and stealth (headless anti-detection) work on Firefox as of v0.16.0; the CLI daemon's console/network capture and `waitForNetworkIdle` work as of v0.17.0. Still Chromium-only: `hybrid` mode and ad/tracker blocking. `reload()` ignores `ignoreCache` on Firefox (BiDi limitation).
 - `port: 9222` — Attach to a Chromium already running with `--remote-debugging-port=N` instead of spawning one. The browser keeps running on `close()`. Stealth + permission denial + download capture are skipped to avoid mutating the user's running browser.
 - `proxy: 'http://...'` — HTTP/SOCKS proxy for browser
 - `viewport: '1280x720'` — Set viewport dimensions
 - `storageState: 'file.json'` — Load cookies/localStorage from saved state
+- `incognito: true|false` — Default `false`. When `true`, run a clean, unauthenticated session: skips `storageState` loading AND makes `injectCookies()` a no-op, so no auth ever enters the session even though callers (MCP `goto`, daemon) inject unconditionally. The temp profile is already throwaway; this gates the *other* auth source — the user's real browser cookies. Not Chrome's `--incognito` flag. Surfaced everywhere: library, MCP (`browse` tool param + `BAREBROWSE_INCOGNITO=1` env for the session), CLI (`--incognito`), bareagent (via `connect` opts).
 - `downloadPath: '/abs/dir'` — Where downloads land. Default: per-session `mkdtemp` under `/tmp/barebrowse-dl-*` that gets removed on `close()`. Caller-supplied paths are not cleaned up — caller owns the lifecycle.
 - `blockAds: true|false` — CDP-level URL blocking of 128 common ad/tracker patterns (Google ads/analytics, FB/Amazon/MS/Adobe ad+analytics, Segment/Amplitude/Mixpanel/Heap/PostHog, Hotjar/FullStory/LogRocket, Criteo/Taboola/Outbrain, the consumer-pixel cluster, AppNexus/Rubicon/PubMatic supply, marketing automation; v0.10.1 added AppsFlyer/Branch/Adjust, Cloudflare Web Analytics, Matomo Cloud). Default `true` for launched browsers, `false` in attach mode (would affect any tab in the user's running browser). Explicit `true` in attach mode is honored and follows the session across `switchTab()` (regression-tested). Shrinks ARIA snapshots and speeds page loads. On legacy Chromium lacking `Network.setBlockedURLs` a one-time `console.warn` surfaces the fallback.
 - `blockUrls: ['*://foo.com/*', ...]` — Extra glob patterns (CDP `Network.setBlockedURLs` format) to block in addition to the default. Merged with the default unless `blockAds: false`.
@@ -186,8 +189,8 @@ barebrowse can inject cookies from the user's real browser sessions, bypassing l
 
 | Obstacle | How | Mode |
 |---|---|---|
-| Cookie consent | ARIA scan + jsClick accept button, 29 languages | Both |
-| Consent behind iframes | JS `.click()` via DOM.resolveNode bypasses overlays, real mouse click fallback for CMPs that ignore synthetic clicks | Both |
+| Cookie consent | ARIA scan for the accept button, 29 languages. CDP: `jsClick` (overlay-bypassing) then a real-mouse-click fallback for CMPs that ignore synthetic clicks. Firefox/BiDi: a single real pointer click. A page-wide accept scan runs only for banner-style consent (no dialog) — when a dialog is detected but has no in-dialog accept button, no page-wide scan runs, to avoid clicking an unrelated `Accept all …` control | Both engines |
+| Consent behind iframes | Scanned/clicked in the owning frame (CDP `DOM.resolveNode`; Firefox resolves the ref in its browsing context) | Both engines |
 | Permission prompts | Launch flags + CDP Browser.setPermission auto-deny | Both |
 | Media autoplay blocked | `--autoplay-policy=no-user-gesture-required` | Both |
 | Login walls | Cookie extraction from Firefox/Chromium + CDP injection | Both |

package/cli.js

@@ -108,9 +108,11 @@ async function cmdOpen() {
 
   const url = args[1] && !args[1].startsWith('--') ? args[1] : undefined;
   const opts = {
+    engine: parseFlag('--engine'),
     mode: parseFlag('--mode') || 'headless',
     port: parseFlag('--port'),
     cookies: !hasFlag('--no-cookies'),
+    incognito: hasFlag('--incognito') || undefined,
     browser: parseFlag('--browser'),
     timeout: parseFlag('--timeout'),
     pruneMode: parseFlag('--prune-mode') || 'act',
@@ -201,7 +203,7 @@ async function oneShot() {
   const url = args[1];
   const mode = args[2] || 'headless';
   try {
-    const snapshot = await browse(url, { mode });
+    const snapshot = await browse(url, { mode, incognito: hasFlag('--incognito') || undefined });
     process.stdout.write(snapshot + '\n');
     process.exit(0);
   } catch (err) {
@@ -213,9 +215,11 @@ async function oneShot() {
 async function runDaemonInternal() {
   const { runDaemon } = await import('./src/daemon.js');
   const opts = {
+    engine: parseFlag('--engine'),
     mode: parseFlag('--mode') || 'headless',
     port: parseFlag('--port'),
     cookies: !hasFlag('--no-cookies'),
+    incognito: hasFlag('--incognito') || undefined,
     browser: parseFlag('--browser'),
     timeout: parseFlag('--timeout'),
     pruneMode: parseFlag('--prune-mode') || 'act',
@@ -480,9 +484,13 @@ Session:
   barebrowse status                 Check session status
 
   Open flags:
-    --mode=headless|headed|hybrid   Browser mode (default: headless)
+    --engine=chromium|firefox       Browser engine (default: chromium/CDP;
+                                    firefox drives over WebDriver BiDi)
+    --mode=headless|headed|hybrid   Browser mode (default: headless;
+                                    hybrid is chromium-only)
     --port=N                        CDP port for headed mode
     --no-cookies                    Skip cookie injection
+    --incognito                     Clean, unauthenticated session (skip all auth injection)
     --browser=firefox|chromium      Cookie source browser
     --timeout=N                     Navigation timeout in ms
     --prune-mode=act|read           Default pruning mode

package/mcp-server.js

@@ -121,7 +121,18 @@ let _pageConnecting = null;
 async function getPage() {
   if (_page) return _page;
   if (_pageConnecting) return _pageConnecting;
-  _pageConnecting = connect({ mode: 'hybrid' });
+  // Engine selection is a launch-time setting (the browser persists across
+  // tool calls), so it's an env var, not a per-request flag. Firefox is driven
+  // over WebDriver BiDi and has no hybrid fallback — default it to headless
+  // (override with BAREBROWSE_MODE=headed).
+  // Incognito is a launch-time setting like engine/mode: the session persists
+  // across tool calls, so it's an env var (BAREBROWSE_INCOGNITO=1), not a
+  // per-request flag. Skips all auth injection for a clean, logged-out session.
+  const incognito = process.env.BAREBROWSE_INCOGNITO === '1';
+  const connectOpts = process.env.BAREBROWSE_ENGINE === 'firefox'
+    ? { engine: 'firefox', mode: process.env.BAREBROWSE_MODE || 'headless', incognito }
+    : { mode: 'hybrid', incognito };
+  _pageConnecting = connect(connectOpts);
   try {
     _page = await _pageConnecting;
     return _page;
@@ -156,6 +167,7 @@ export const TOOLS = [
         url: { type: 'string', description: 'URL to browse' },
         mode: { type: 'string', enum: ['headless', 'headed', 'hybrid'], description: 'Browser mode (default: headless)' },
         pruneMode: { type: 'string', enum: ['act', 'read'], description: 'Pruning mode. "act" (default) keeps interactive elements and short labels — best for clicking/filling. "read" keeps paragraphs, headings, and long text — best for articles, docs, and content extraction. If the page is content-heavy and act-mode returns mostly empty, retry with "read".' },
+        incognito: { type: 'boolean', description: 'Clean, unauthenticated session: skip cookie injection so the page loads logged-out (default: false).' },
         maxChars: { type: 'number', description: 'Max chars to return inline. Larger snapshots are saved to .barebrowse/ and a file path is returned instead. Default: 30000.' },
       },
       required: ['url'],
@@ -391,7 +403,7 @@ async function handleToolCall(name, args) {
     case 'browse': {
       let timer;
       const text = await Promise.race([
-        browse(args.url, { mode: args.mode, pruneMode: args.pruneMode }),
+        browse(args.url, { mode: args.mode, pruneMode: args.pruneMode, incognito: args.incognito }),
         new Promise((_, rej) => { timer = setTimeout(() => rej(new Error('browse timed out after 60s')), 60000); }),
       ]);
       clearTimeout(timer);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "barebrowse",
-  "version": "0.14.0",
+  "version": "0.17.0",
   "description": "Authenticated web browsing for autonomous agents via CDP. URL in, pruned ARIA snapshot out.",
   "repository": {
     "type": "git",

package/src/auth.js

@@ -288,25 +288,39 @@ export function cookieDomainMatch(host, cookieDomain) {
 }
 
 /**
- * Extract cookies for a URL and inject them into a CDP session.
- * Convenience function combining extractCookies + injectCookies.
- * @param {object} session - CDP session handle
- * @param {string} url - URL to extract cookies for
- * @param {object} [opts] - Options passed to extractCookies
+ * Select the user's cookies that are in-scope for `url`. Shared by BOTH engines
+ * (CDP `authenticate` and Firefox/BiDi `injectCookies`) so they can't drift on
+ * scoping — a divergence here re-opens loading the entire cookie jar into an
+ * agent session. Returns the filtered cookie array; never injects.
+ *
+ * Coarse SQL pre-filter strips to a registrable-ish domain so the LIKE query
+ * returns a superset (incl. parent-domain cookies). slice(-2) is a cheap
+ * heuristic — it over-selects for multi-part eTLDs (co.uk) and as a substring
+ * match, so the precise RFC-6265 domain-match is what actually decides which
+ * cookies pass. Without it, browsing apple.com would match apple.com.evil.org
+ * and every *.co.uk site (verified).
+ * @param {string} url - URL whose host the cookies must match
+ * @param {object} [opts] - passed to extractCookies (e.g. { browser })
+ * @returns {Array<object>} cookies whose domain matches the URL host
  */
-export async function authenticate(session, url, opts = {}) {
+export function scopedCookiesForUrl(url, opts = {}) {
   const fullHost = new URL(url).hostname.toLowerCase();
-  // Coarse SQL pre-filter: strip to a registrable-ish domain so the LIKE query
-  // returns a superset (incl. parent-domain cookies). slice(-2) is a cheap
-  // heuristic — it over-selects for multi-part eTLDs (co.uk) and as a substring
-  // match, so the precise RFC-6265 domain-match below is what actually decides
-  // which cookies get injected. Without it, browsing apple.com would inject
-  // cookies for apple.com.evil.org and every *.co.uk site (verified).
   const noWww = fullHost.replace(/^www\./, '');
   const parts = noWww.split('.');
   const coarseDomain = parts.length > 2 ? parts.slice(-2).join('.') : noWww;
   const candidates = extractCookies({ ...opts, domain: coarseDomain });
-  const cookies = candidates.filter((c) => cookieDomainMatch(fullHost, c.domain));
+  return candidates.filter((c) => cookieDomainMatch(fullHost, c.domain));
+}
+
+/**
+ * Extract cookies for a URL and inject them into a CDP session.
+ * Convenience function combining scopedCookiesForUrl + injectCookies.
+ * @param {object} session - CDP session handle
+ * @param {string} url - URL to extract cookies for
+ * @param {object} [opts] - Options passed to extractCookies
+ */
+export async function authenticate(session, url, opts = {}) {
+  const cookies = scopedCookiesForUrl(url, opts);
   if (cookies.length > 0) {
     await injectCookies(session, cookies);
   }