harnery 0.45.2 → 0.46.1

package/src/lib/browser/runts.ts

@@ -39,7 +39,7 @@ export interface RuntsResult {
   outcome: "pass" | "fail" | "unknown";
   /** Text blocks scanned (post length/inline-children filters). */
   scannedBlocks: number;
-  /** True when the block sweep hit the internal cap (very large page). */
+  /** True when the sweep reached its findings limit or the internal block cap. */
   truncated: boolean;
   runts: RuntHit[];
 }
@@ -47,13 +47,20 @@ export interface RuntsResult {
 /**
  * Build the JS function passed to `page.evaluate`. `scope` narrows the sweep
  * to one container (null = whole body); `minChars` filters out tiny labels
- * that can't meaningfully wrap (default 40).
+ * that can't meaningfully wrap (default 40). `maxFindings` bounds the retained
+ * failure list (default 50; integer 1..5000), not the separate 5000-block cap.
  */
 export function buildRuntsCheck(): (args: {
   scope: string | null;
   minChars: number;
+  maxFindings?: number;
 }) => RuntsResult {
-  return ({ scope, minChars }) => {
+  return ({ scope, minChars, maxFindings = 50 }) => {
+    // page.evaluate has no module closure: validate this boundary too, even
+    // when a caller evaluates the built function without the Browser client.
+    if (!Number.isInteger(maxFindings) || maxFindings < 1 || maxFindings > 5000) {
+      throw new Error("maxFindings must be an integer from 1 to 5000.");
+    }
     const INLINE = new Set([
       "B",
       "I",
@@ -74,7 +81,7 @@ export function buildRuntsCheck(): (args: {
     ]);
     const ATOMIC = /@|https?:|\.(com|org|net|io|co)\b|\d-\d{3}/;
     const BLOCK_CAP = 5000;
-    const RUNT_CAP = 50;
+    const RUNT_CAP = maxFindings;
 
     const root = scope ? document.querySelector(scope) : document.body;
     if (!root) {
@@ -128,34 +135,78 @@ export function buildRuntsCheck(): (args: {
       }
       scanned++;
 
-      // Map every word to its visual line by rounding the Range rect top.
-      const lines = new Map<number, { words: string[]; last: DOMRect; node: Node }>();
-      const tw = document.createTreeWalker(el, NodeFilter.SHOW_TEXT);
+      // Inline markup does not create word boundaries. Keep offsets into the
+      // original text nodes so one Range can measure a word split by emphasis
+      // or followed by punctuation in a separate node. BR still separates words.
+      const segments: Array<{ node: Text; start: number; end: number }> = [];
+      let content = "";
+      const tw = document.createTreeWalker(el, NodeFilter.SHOW_TEXT | NodeFilter.SHOW_ELEMENT);
       for (let n = tw.nextNode(); n; n = tw.nextNode()) {
+        if (n instanceof Element && n.tagName === "BR") content += "\n";
+        if (n.nodeType !== Node.TEXT_NODE) continue;
         const value = n.nodeValue ?? "";
-        for (const m of value.matchAll(/\S+/g)) {
-          const r = document.createRange();
-          r.setStart(n, m.index);
-          r.setEnd(n, m.index + m[0].length);
-          const rect = r.getBoundingClientRect();
-          if (!rect.width) continue;
-          const top = Math.round(rect.top);
-          const entry = lines.get(top);
-          if (entry) {
-            entry.words.push(m[0]);
-            entry.last = rect;
-            entry.node = n;
-          } else {
-            lines.set(top, { words: [m[0]], last: rect, node: n });
+        segments.push({
+          node: n as Text,
+          start: content.length,
+          end: content.length + value.length,
+        });
+        content += value;
+      }
+      type Word = { value: string; rect: DOMRect; node: Node };
+      const lines: Array<{ top: number; bottom: number; words: Map<number, Word> }> = [];
+      let segmentIndex = 0;
+      for (const m of content.matchAll(/\S+/g)) {
+        const lexical = /[\p{L}\p{N}]/u.exec(m[0]);
+        if (!lexical) continue; // punctuation alone is not an orphan word
+        const end = m.index + m[0].length;
+        while (segments[segmentIndex] && segments[segmentIndex]!.end <= m.index) segmentIndex++;
+        const first = segments[segmentIndex];
+        if (!first) continue;
+        let endIndex = segmentIndex;
+        while (segments[endIndex] && segments[endIndex]!.end < end) endIndex++;
+        const final = segments[endIndex];
+        if (!final) continue;
+        let wordIndex = segmentIndex;
+        while (segments[wordIndex]!.end <= m.index + lexical.index) wordIndex++;
+        const wordNode = segments[wordIndex]!.node;
+        const range = document.createRange();
+        range.setStart(first.node, m.index - first.start);
+        range.setEnd(final.node, end - final.start);
+        for (const rect of range.getClientRects()) {
+          if (!rect.width || !rect.height) continue;
+          // Different inline fonts have different glyph tops on the same line.
+          // Require substantial vertical overlap rather than exact rounded tops.
+          let line = lines.find(
+            (candidate) =>
+              Math.min(candidate.bottom, rect.bottom) - Math.max(candidate.top, rect.top) >
+              Math.min(candidate.bottom - candidate.top, rect.height) / 2,
+          );
+          if (!line) {
+            line = { top: rect.top, bottom: rect.bottom, words: new Map() };
+            lines.push(line);
           }
+          line.top = Math.min(line.top, rect.top);
+          line.bottom = Math.max(line.bottom, rect.bottom);
+          const previous = line.words.get(m.index)?.rect;
+          const box = previous
+            ? new DOMRect(
+                Math.min(previous.left, rect.left),
+                Math.min(previous.top, rect.top),
+                Math.max(previous.right, rect.right) - Math.min(previous.left, rect.left),
+                Math.max(previous.bottom, rect.bottom) - Math.min(previous.top, rect.top),
+              )
+            : rect;
+          line.words.set(m.index, { value: m[0], rect: box, node: wordNode });
         }
       }
-      const tops = [...lines.keys()].sort((a, b) => a - b);
-      if (tops.length < 2) continue; // single line, no runt risk
-      const lastTop = tops[tops.length - 1];
-      const last = lastTop === undefined ? undefined : lines.get(lastTop);
-      if (last?.words.length !== 1) continue;
-      const word = last.words[0] ?? "";
+      lines.sort((a, b) => a.top - b.top);
+      if (lines.length < 2) continue; // single line, no runt risk
+      const lastLine = lines[lines.length - 1];
+      if (lastLine?.words.size !== 1) continue;
+      const [wordOffset, last] = [...lastLine.words.entries()][0]!;
+      // A word split across visual lines is not a separate final orphan word.
+      if (lines.slice(0, -1).some((line) => line.words.has(wordOffset))) continue;
+      const word = last.value;
       if (ATOMIC.test(word)) continue;
       // A chip is not prose. A lone token whose glyphs live inside a padded,
       // boxed inline element (a <code> chip, pill, or badge) is a UI control:
@@ -165,11 +216,7 @@ export function buildRuntsCheck(): (args: {
       // inline ancestry (tag-based, since flex/grid parents blockify computed
       // display) and skip the finding when a chip hosts it.
       const chipHosted = (() => {
-        for (
-          let e = last.node.parentElement;
-          e && e !== el && INLINE.has(e.tagName);
-          e = e.parentElement
-        ) {
+        for (let e = last.node.parentElement; e && INLINE.has(e.tagName); e = e.parentElement) {
           const cs = getComputedStyle(e);
           const padX =
             (Number.parseFloat(cs.paddingLeft) || 0) + (Number.parseFloat(cs.paddingRight) || 0);
@@ -177,6 +224,7 @@ export function buildRuntsCheck(): (args: {
             (cs.backgroundColor !== "rgba(0, 0, 0, 0)" && cs.backgroundColor !== "transparent") ||
             (Number.parseFloat(cs.borderTopWidth) || 0) > 0;
           if (padX > 0 && boxed) return true;
+          if (e === el) break;
         }
         return false;
       })();
@@ -187,12 +235,12 @@ export function buildRuntsCheck(): (args: {
         word,
         snippet: text.replace(/\s+/g, " ").trim().slice(0, 80),
         rect: {
-          x: Math.round(last.last.x + sx),
-          y: Math.round(last.last.y + sy),
-          width: Math.round(last.last.width),
-          height: Math.round(last.last.height),
+          x: Math.round(last.rect.x + sx),
+          y: Math.round(last.rect.y + sy),
+          width: Math.round(last.rect.width),
+          height: Math.round(last.rect.height),
         },
-        lines: tops.length,
+        lines: lines.length,
       });
       if (runts.length >= RUNT_CAP) {
         truncated = true;

package/src/lib/browser/windows-chrome.ts

@@ -479,6 +479,56 @@ export function stopWindowsChromeProfile(
   return parseStopOutput(result.stdout, profileWindows);
 }
 
+/**
+ * PowerShell that lists the Chrome processes running on the profile matched
+ * by `$Pattern` and prints their ids as a JSON array. It never closes them.
+ */
+export function runningScript(): string {
+  return [
+    "param([string]$Pattern)",
+    "$ErrorActionPreference = 'Stop'",
+    PROFILE_PROCESS_FUNCTION,
+    "$ids = @(Get-ProfileChrome | ForEach-Object { [int]$_.ProcessId })",
+    "[Console]::Out.Write((ConvertTo-Json -Compress -InputObject $ids))",
+  ].join("\r\n");
+}
+
+/** Parse the running script's stdout into process ids. */
+export function parseRunningOutput(stdout: string): number[] {
+  const trimmed = stdout.trim();
+  if (!trimmed) return [];
+  const parsed = JSON.parse(trimmed) as number | number[] | null;
+  if (parsed === null) return [];
+  return (Array.isArray(parsed) ? parsed : [parsed]).map(Number);
+}
+
+/**
+ * Ids of the Chrome processes running on `profileWindows`, for callers that
+ * must leave an open profile alone. Throws when the check cannot run.
+ */
+export function windowsChromeProfileProcesses(profileWindows: string): number[] {
+  const result = runPowerShellScript(
+    "profile-running",
+    runningScript(),
+    ["-Pattern", profileCommandLinePattern(profileWindows)],
+    30_000,
+  );
+  if (result.status !== 0) {
+    throw new Error(
+      `Checking for Chrome on ${profileWindows} failed: ${(result.stderr || result.stdout || result.error?.message || "no output").trim().slice(0, 400)}`,
+    );
+  }
+  return parseRunningOutput(result.stdout);
+}
+
+/** Linux form of a drive-letter Windows path (`C:\x` becomes `/mnt/c/x`). */
+export function windowsPathToWsl(windowsPath: string): string {
+  const match = /^([A-Za-z]):\\(.*)$/.exec(windowsPath);
+  if (!match) throw new Error(`Not a drive-letter path: ${windowsPath}`);
+  const rest = (match[2] ?? "").replace(/\\+/g, "/").replace(/\/+$/, "");
+  return `/mnt/${(match[1] as string).toLowerCase()}${rest ? `/${rest}` : ""}`;
+}
+
 /** Windows form of a `/mnt/<drive>/...` path. */
 export function wslPathToWindows(linuxPath: string): string {
   const match = /^\/mnt\/([a-z])\/(.*)$/.exec(linuxPath);

package/src/lib/browser/windows-login-sync.ts

@@ -0,0 +1,275 @@
+import { createHash } from "node:crypto";
+import {
+  closeSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { basename, dirname, join } from "node:path";
+import type { Cookie } from "../cookies/client.ts";
+import { CookieJar, mergeCookies } from "../cookies/index.ts";
+import type { WindowsChromeHarvest } from "./windows-chrome.ts";
+
+/**
+ * Keep the shared cookie store current with the WSL sign-in profile.
+ *
+ * Under WSL, `browse --login` signs in through the Windows host's Chrome on a
+ * dedicated profile and copies that site's cookies into the cookie store when
+ * the window closes. People also keep that profile open as an ordinary
+ * browser and sign in to other sites there later. Nothing copies those
+ * sign-ins when the window is closed outside a waiting `--login` run, so a
+ * later headless run would show the site signed out.
+ *
+ * Before a headless run, this module compares the profile's cookie database
+ * modification time with the time recorded at the last copy for the run's
+ * domain. When the profile changed and no Chrome is running on it, the
+ * domain's cookies are read (the same headless read `--login` uses) and
+ * merged into the store. A profile that is open is never touched. A small
+ * owner-only state file next to the store records, per domain, the database
+ * time and a fingerprint of the cookies last read. When a read returns the
+ * same cookies as last time, nothing is merged, so cookies a headless run
+ * refreshed in the store are not replaced with the profile's older copies.
+ */
+
+export interface DomainSyncRecord {
+  /** When the profile's cookies for the domain were last read. */
+  syncedAt: string;
+  /** Cookie database modification time right after that read. */
+  cookieDbMtimeMs: number;
+  /** SHA-256 over the cookies read, so an unchanged read merges nothing. */
+  fingerprint: string;
+  /** Number of cookies read. */
+  cookies: number;
+}
+
+export interface LoginSyncState {
+  version: 1;
+  domains: Record<string, DomainSyncRecord>;
+}
+
+/** The sync-state file for a cookie store: `<store>.login-sync.json`, beside it. */
+export function loginSyncStatePath(storePath: string): string {
+  const name = basename(storePath).replace(/\.json$/i, "");
+  return join(dirname(storePath), `${name}.login-sync.json`);
+}
+
+export function readLoginSyncState(statePath: string): LoginSyncState {
+  try {
+    const parsed = JSON.parse(readFileSync(statePath, "utf8")) as Partial<LoginSyncState>;
+    if (parsed && parsed.version === 1 && parsed.domains && typeof parsed.domains === "object") {
+      return { version: 1, domains: parsed.domains };
+    }
+  } catch {
+    // Missing or unreadable state means nothing has been copied yet.
+  }
+  return { version: 1, domains: {} };
+}
+
+/** Write the state file owner-only, replacing it atomically. */
+export function writeLoginSyncState(statePath: string, state: LoginSyncState): void {
+  mkdirSync(dirname(statePath), { recursive: true, mode: 0o700 });
+  const tmp = `${statePath}.${process.pid}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+  renameSync(tmp, statePath);
+}
+
+/** Order-independent fingerprint of a cookie set. Values are hashed, never stored. */
+export function cookieFingerprint(cookies: Cookie[]): string {
+  const rows = cookies
+    .map((c) => JSON.stringify([c.name, c.domain, c.path, c.value, c.expires]))
+    .sort();
+  return createHash("sha256").update(rows.join("\n")).digest("hex");
+}
+
+export type LoginSyncDecision =
+  /** No cookie database: the profile has never been used. */
+  | "no-profile"
+  /** The database has not changed since the last read for this domain. */
+  | "current"
+  /** The database is newer, but Chrome is open on the profile. */
+  | "open"
+  /** The database is newer (or the read is forced) and the profile is closed. */
+  | "sync";
+
+/**
+ * Decide what to do before reading. `running` is consulted only when the
+ * database is newer, since checking for Chrome costs a PowerShell call.
+ */
+export function decideLoginSync(input: {
+  cookieDbMtimeMs: number | undefined;
+  record: DomainSyncRecord | undefined;
+  running: () => boolean;
+  force?: boolean;
+}): LoginSyncDecision {
+  if (input.cookieDbMtimeMs === undefined) return "no-profile";
+  if (!input.force && input.record && input.cookieDbMtimeMs <= input.record.cookieDbMtimeMs)
+    return "current";
+  return input.running() ? "open" : "sync";
+}
+
+export interface LoginSyncDeps {
+  /** Newest modification time of the profile's cookie database, or `undefined`. */
+  cookieDbMtimeMs: () => number | undefined;
+  /** Ids of Chrome processes running on the profile. */
+  profileProcesses: () => number[];
+  /** Read the profile's cookies for `domain`; the profile must be closed. */
+  harvest: (domain: string) => WindowsChromeHarvest;
+  now?: () => Date;
+}
+
+export interface LoginSyncResult {
+  status: "no-profile" | "current" | "open" | "busy" | "synced" | "unchanged";
+  domain: string;
+  /** Cookies read from the profile (0 when nothing was read). */
+  cookies: number;
+  /** Cookies merged into the store (0 unless `synced`). */
+  merged: number;
+  sessionCookies: number;
+  /** Cookie names merged, sorted. Never values. */
+  names: string[];
+  /** Chrome process ids on the profile when `open`. */
+  processes: number[];
+}
+
+/**
+ * Copy the profile's cookies for `domain` into the store when the profile
+ * changed since the last copy and is closed. `force` skips the time check
+ * and merges whatever is read. Throws only on read failures; the caller
+ * decides whether that is a warning.
+ */
+export function syncLoginCookies(input: {
+  domain: string;
+  storePath: string;
+  deps: LoginSyncDeps;
+  force?: boolean;
+}): LoginSyncResult {
+  const { domain, storePath, deps } = input;
+  const base: LoginSyncResult = {
+    status: "current",
+    domain,
+    cookies: 0,
+    merged: 0,
+    sessionCookies: 0,
+    names: [],
+    processes: [],
+  };
+  const statePath = loginSyncStatePath(storePath);
+  const state = readLoginSyncState(statePath);
+  const record = state.domains[domain];
+  let processes: number[] = [];
+  const decision = decideLoginSync({
+    cookieDbMtimeMs: deps.cookieDbMtimeMs(),
+    record,
+    force: input.force,
+    running: () => {
+      processes = deps.profileProcesses();
+      return processes.length > 0;
+    },
+  });
+  if (decision === "no-profile") return { ...base, status: "no-profile" };
+  if (decision === "current") return base;
+  if (decision === "open") return { ...base, status: "open", processes };
+
+  const release = acquireSyncLock(statePath);
+  if (!release) return { ...base, status: "busy" };
+  try {
+    const { cookies } = deps.harvest(domain);
+    const fingerprint = cookieFingerprint(cookies);
+    const changed = input.force || !record || record.fingerprint !== fingerprint;
+    let merged: Cookie[] = [];
+    if (changed && cookies.length > 0) {
+      const jar = new CookieJar({ path: storePath, source: "harn-browse" });
+      jar.save(mergeCookies(jar.load(), cookies));
+      merged = cookies;
+    }
+    const after = readLoginSyncState(statePath);
+    after.domains[domain] = {
+      syncedAt: (deps.now?.() ?? new Date()).toISOString(),
+      cookieDbMtimeMs: deps.cookieDbMtimeMs() ?? 0,
+      fingerprint,
+      cookies: cookies.length,
+    };
+    writeLoginSyncState(statePath, after);
+    return {
+      ...base,
+      status: merged.length > 0 ? "synced" : "unchanged",
+      cookies: cookies.length,
+      merged: merged.length,
+      sessionCookies: merged.filter((c) => c.expires <= 0).length,
+      names: [...new Set(merged.map((c) => c.name))].sort(),
+    };
+  } finally {
+    release();
+  }
+}
+
+/**
+ * Record a read that happened elsewhere (the `--login` flow), so the next
+ * headless run does not read the same cookies again.
+ */
+export function recordLoginSync(input: {
+  domain: string;
+  storePath: string;
+  cookies: Cookie[];
+  cookieDbMtimeMs: number | undefined;
+  now?: Date;
+}): void {
+  const statePath = loginSyncStatePath(input.storePath);
+  const state = readLoginSyncState(statePath);
+  state.domains[input.domain] = {
+    syncedAt: (input.now ?? new Date()).toISOString(),
+    cookieDbMtimeMs: input.cookieDbMtimeMs ?? 0,
+    fingerprint: cookieFingerprint(input.cookies),
+    cookies: input.cookies.length,
+  };
+  writeLoginSyncState(statePath, state);
+}
+
+/** Newest mtime among a profile's cookie database locations, or `undefined`. */
+export function profileCookieDbMtimeMs(
+  profileLinux: string,
+  stat: (path: string) => number | undefined = fileMtimeMs,
+): number | undefined {
+  const times = [
+    join(profileLinux, "Default", "Network", "Cookies"),
+    join(profileLinux, "Default", "Cookies"),
+  ]
+    .map((path) => stat(path))
+    .filter((t): t is number => t !== undefined);
+  return times.length > 0 ? Math.max(...times) : undefined;
+}
+
+function fileMtimeMs(path: string): number | undefined {
+  try {
+    return statSync(path).mtimeMs;
+  } catch {
+    return undefined;
+  }
+}
+
+const LOCK_STALE_MS = 3 * 60_000;
+
+/**
+ * One read at a time: a second headless Chrome on the profile would refuse
+ * to start. A lock older than three minutes is treated as abandoned.
+ */
+function acquireSyncLock(statePath: string): (() => void) | null {
+  const lockPath = `${statePath}.lock`;
+  mkdirSync(dirname(lockPath), { recursive: true, mode: 0o700 });
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      closeSync(openSync(lockPath, "wx", 0o600));
+      return () => rmSync(lockPath, { force: true });
+    } catch {
+      const age = existsSync(lockPath) ? Date.now() - (fileMtimeMs(lockPath) ?? 0) : 0;
+      if (age < LOCK_STALE_MS) return null;
+      rmSync(lockPath, { force: true });
+    }
+  }
+  return null;
+}

package/src/lib/cookies/client.ts

@@ -284,9 +284,9 @@ export class CookieJar {
   }
 
   /**
-   * Read + filter helper. Drops expired cookies. Optional domain filter
-   * uses the same `domainMatches` logic Playwright/CDP do (leading dot
-   * means subdomain match).
+   * Read + filter helper. Drops expired cookies. The optional domain filter
+   * uses `domainMatches` (equal host or any subdomain); it is a query, not a
+   * delivery rule. `header(url)` uses the stricter `cookieSendsToHost`.
    */
   list(filter: { domain?: string } = {}): Cookie[] {
     const store = this.load();
@@ -451,14 +451,62 @@ export function mergeCookies(store: CookieStore, incoming: Cookie[]): CookieStor
   return { ...store, cookies: Array.from(map.values()) };
 }
 
-/** RFC 6265 domain match. Leading dot in cookie domain means subdomain match. */
+/**
+ * Filter-style domain match used by `list({ domain })` and `clear({ domain })`:
+ * a cookie domain "matches" a hostname when they are equal or the hostname is
+ * a subdomain of it, whether or not the cookie is host-only. Never use this to
+ * decide whether a cookie may be SENT to a host; use `cookieSendsToHost`.
+ */
 export function domainMatches(cookieDomain: string, hostname: string): boolean {
-  const cd = cookieDomain.startsWith(".") ? cookieDomain.slice(1) : cookieDomain;
-  if (hostname === cd) return true;
-  if (hostname.endsWith(`.${cd}`)) return true;
+  const cd = (cookieDomain.startsWith(".") ? cookieDomain.slice(1) : cookieDomain).toLowerCase();
+  const host = hostname.toLowerCase();
+  if (host === cd) return true;
+  if (host.endsWith(`.${cd}`)) return true;
   return false;
 }
 
+/**
+ * RFC 6265 delivery rule. A cookie domain with a leading dot is a domain
+ * cookie and goes to the domain and every subdomain. A cookie domain without
+ * one is host-only (how CDP, Playwright and `Set-Cookie` without `Domain`
+ * record it) and goes to that exact host and nowhere else.
+ */
+export function cookieSendsToHost(cookieDomain: string, hostname: string): boolean {
+  const host = hostname.toLowerCase();
+  if (cookieDomain.startsWith(".")) return domainMatches(cookieDomain, host);
+  return cookieDomain.toLowerCase() === host;
+}
+
+/**
+ * Cookie-prefix rules (RFC 6265bis). `__Secure-` needs Secure; `__Host-` also
+ * needs Path=/ and no Domain attribute, which a jar records as a host-only
+ * domain (no leading dot). Browsers refuse a violating cookie, so the jar
+ * never stores one and the browser injector never hands one to Chromium.
+ */
+export function violatesCookiePrefix(
+  cookie: Pick<Cookie, "name" | "domain" | "path" | "secure">,
+): boolean {
+  if (cookie.name.startsWith("__Secure-") && !cookie.secure) return true;
+  if (
+    cookie.name.startsWith("__Host-") &&
+    (!cookie.secure || cookie.domain.startsWith(".") || cookie.path !== "/")
+  ) {
+    return true;
+  }
+  return false;
+}
+
+/** True for hosts a browser treats as a secure context without TLS. */
+export function isLoopbackHost(hostname: string): boolean {
+  const host = hostname.toLowerCase();
+  return (
+    host === "localhost" ||
+    host.endsWith(".localhost") ||
+    host === "[::1]" ||
+    /^127(?:\.\d{1,3}){3}$/.test(host)
+  );
+}
+
 /** RFC 6265 path match. */
 export function pathMatches(cookiePath: string, urlPath: string): boolean {
   if (urlPath === cookiePath) return true;
@@ -473,13 +521,17 @@ export function isExpired(cookie: Cookie): boolean {
   return cookie.expires < Date.now() / 1000;
 }
 
-/** Cookies that should be sent with a request to `url`. */
+/**
+ * Cookies that should be sent with a request to `url`: exact-host delivery for
+ * host-only cookies, domain delivery for dotted ones, then path and Secure.
+ * Secure cookies go over HTTPS and to loopback hosts, as in browsers.
+ */
 export function matchingCookies(store: CookieStore, url: string): Cookie[] {
   const parsed = new URL(url);
-  const isSecure = parsed.protocol === "https:";
+  const isSecure = parsed.protocol === "https:" || isLoopbackHost(parsed.hostname);
   return store.cookies.filter((c) => {
     if (isExpired(c)) return false;
-    if (!domainMatches(c.domain, parsed.hostname)) return false;
+    if (!cookieSendsToHost(c.domain, parsed.hostname)) return false;
     if (!pathMatches(c.path, parsed.pathname)) return false;
     if (c.secure && !isSecure) return false;
     return true;

package/src/lib/cookies/index.ts

@@ -4,12 +4,15 @@ export {
   type CookieJarOptions,
   type CookieStore,
   CookieStoreParseError,
+  cookieSendsToHost,
   domainMatches,
   type InfoResult,
   isExpired,
+  isLoopbackHost,
   matchingCookies,
   mergeCookies,
   type OriginEntry,
   pathMatches,
+  violatesCookiePrefix,
 } from "./client.js";
 export { applyExtraCookies, type ExtraCookies } from "./extra.js";