barebrowse 0.19.1 → 0.19.2

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [0.19.2] - 2026-07-11
+
+### Fixed
+
+- **Firefox `saveState()` now writes `sameSite` capitalized** (`Lax`/`Strict`/`None`,
+  was BiDi's lowercase `lax`/`strict`/`none`). The only loader for a state file is
+  `connect({ storageState })`, which is CDP-only (`Network.setCookies`) and rejects
+  a lowercase enum — so the whole batch threw and every cookie was silently dropped,
+  making a Firefox-saved state useless for auth restore. Found by `/code-review` and
+  confirmed against real Firefox.
+- **Firefox CLI/daemon `eval` accepts statement-form expressions again**
+  (`var x = 2; x * 3`). A Phase-4 wrapper (`await (${expr})`, added to flatten
+  objects) turned every statement list into a `SyntaxError` — a regression versus
+  the CDP `Runtime.evaluate` path. Now evaluates the raw expression (BiDi
+  `script.evaluate` has eval-semantics) and deserializes the `{type,value}` remote
+  value back to the plain value CDP's `returnByValue` yields, so deep objects stay
+  clean *and* statements work.
+- **Firefox daemon console capture no longer dumps nested serialization** for
+  object/array console arguments — it falls back to the type name, matching the CDP
+  capture's `RemoteObject.description` ("Object").
+
 ## [0.19.1] - 2026-07-11
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "barebrowse",
-  "version": "0.19.1",
+  "version": "0.19.2",
   "description": "Authenticated web browsing for autonomous agents via CDP. URL in, pruned ARIA snapshot out.",
   "repository": {
     "type": "git",

package/src/daemon.js

@@ -67,6 +67,31 @@ export function buildDaemonArgs(opts, absDir, initialUrl, cliPath) {
   return args;
 }
 
+/**
+ * Convert a BiDi remote value ({type,value} — see script.evaluate) into the
+ * plain JS value CDP's `Runtime.evaluate({returnByValue:true})` yields, so an
+ * `eval` returns the same shape on both engines. BiDi serializes objects/arrays
+ * as entry lists ([[k,v],…] / [v,…]) rather than plain values; walk them back.
+ * @param {object} r - BiDi remote value
+ * @returns {*}
+ */
+export function deserializeBiDi(r) {
+  if (!r || typeof r !== 'object') return r;
+  switch (r.type) {
+    case 'undefined': return undefined;
+    case 'null': return null;
+    case 'string': case 'number': case 'boolean': case 'bigint': return r.value;
+    case 'array': case 'set': return (r.value || []).map(deserializeBiDi);
+    case 'object': case 'map':
+      return Object.fromEntries(
+        (r.value || []).map(([k, v]) => [typeof k === 'object' ? deserializeBiDi(k) : k, deserializeBiDi(v)]),
+      );
+    // date/regexp/node/function/etc. — no plain-value equivalent; use the raw
+    // value if BiDi provided one, else the type name (matches CDP's coarseness).
+    default: return r.value !== undefined ? r.value : r.type;
+  }
+}
+
 /**
  * Wire Firefox/BiDi console + network capture onto the daemon's log arrays.
  * The BiDi analogue of the CDP `Runtime.consoleAPICalled` / `Network.*`
@@ -99,8 +124,12 @@ export async function attachBiDiCapture(bidi, { consoleLogs, networkLogs, pendin
       // engines — BiDi says 'warn', CDP says 'warning'.
       type: e.method === 'warn' ? 'warning' : (e.method || e.level),
       timestamp: new Date().toISOString(),
+      // Primitive args carry a usable `.value`; objects/arrays/functions carry a
+      // nested {type,value} serialization we must NOT splat into the log (it's
+      // deep junk) — fall back to the type name, mirroring the CDP capture which
+      // logs a RemoteObject's `.description` ("Object") for non-primitives.
       args: Array.isArray(e.args) && e.args.length
-        ? e.args.map((a) => a.value ?? a.type)
+        ? e.args.map((a) => (a.value !== undefined && typeof a.value !== 'object' ? a.value : a.type))
         : [e.text],
     });
   });
@@ -416,13 +445,20 @@ export async function runDaemon(opts, outputDir, initialUrl) {
       // Firefox/BiDi has no page.cdp — evaluate over BiDi in the active context.
       if (!page.cdp) {
         try {
-          // BiDi's raw result.value serializes objects into a {type,value}
-          // entries structure, not a plain object (CDP's returnByValue does).
-          // Stringify + parse in-page so an object/array eval matches the CDP
-          // shape (same trick readable() uses). `undefined` → JSON `null`.
-          const wrapped = `(async () => { const v = await (${expression}); return JSON.stringify(v === undefined ? null : v); })()`;
-          const raw = await page.bidi.evaluate(page.context, wrapped, true);
-          return { ok: true, value: raw == null ? null : JSON.parse(raw) };
+          // Evaluate the RAW expression: script.evaluate has eval-semantics, so
+          // statement lists ("var x = 2; x * 3") work and yield the completion
+          // value — matching the CDP Runtime.evaluate path. (An earlier
+          // `await (${expression})` wrapper flattened objects but broke every
+          // statement-form expression with a SyntaxError.) BiDi returns a
+          // {type,value} remote value; deserializeBiDi walks it back to the plain
+          // JS value CDP's returnByValue produces.
+          const res = await page.bidi.send('script.evaluate', {
+            expression, target: { context: page.context }, awaitPromise: true,
+          });
+          if (res.type === 'exception') {
+            return { ok: false, error: res.exceptionDetails?.text || 'eval error' };
+          }
+          return { ok: true, value: deserializeBiDi(res.result) };
         } catch (err) {
           return { ok: false, error: err.message || 'eval error' };
         }

package/src/firefox-page.js

@@ -575,7 +575,14 @@ export async function createFirefoxPage(bidi, opts = {}) {
           secure: !!c.secure,
           httpOnly: !!c.httpOnly,
         };
-        if (c.sameSite && c.sameSite !== 'default') out.sameSite = c.sameSite;
+        // BiDi reports sameSite lowercase (strict|lax|none); the CDP saveState /
+        // Network.setCookies vocabulary is capitalized (Strict|Lax|None). The only
+        // loader for a state file is connect()'s storageState (CDP-only), which
+        // rejects a lowercase enum and silently drops every cookie — so capitalize
+        // here to keep the format truly symmetric and the round-trip working.
+        if (c.sameSite && c.sameSite !== 'default') {
+          out.sameSite = c.sameSite.charAt(0).toUpperCase() + c.sameSite.slice(1);
+        }
         if (c.expiry && c.expiry > 0) out.expires = c.expiry;
         return out;
       });

package/types/daemon.d.ts

@@ -10,6 +10,15 @@
  * @returns {string[]}
  */
 export function buildDaemonArgs(opts: object, absDir: string, initialUrl: string | undefined, cliPath: string): string[];
+/**
+ * Convert a BiDi remote value ({type,value} — see script.evaluate) into the
+ * plain JS value CDP's `Runtime.evaluate({returnByValue:true})` yields, so an
+ * `eval` returns the same shape on both engines. BiDi serializes objects/arrays
+ * as entry lists ([[k,v],…] / [v,…]) rather than plain values; walk them back.
+ * @param {object} r - BiDi remote value
+ * @returns {*}
+ */
+export function deserializeBiDi(r: object): any;
 /**
  * Wire Firefox/BiDi console + network capture onto the daemon's log arrays.
  * The BiDi analogue of the CDP `Runtime.consoleAPICalled` / `Network.*`