rechrome 1.43.0 → 1.43.2

package/README.md

@@ -126,7 +126,8 @@ browser into an auth tool:
 rech read-cookie d acme.slack.com --allow-domain acme.slack.com | slack auth cookie
 ```
 
-- Reads via Playwright's `context.cookies()`, so `HttpOnly` cookies are included.
+- Reads via Playwright's `context.cookies()`, so `HttpOnly` cookies are included. It works over the
+  extension bridge too: the relay answers the browser-level cookie query through an attached tab.
 - `--allow-domain` is required, and the cookie's own domain must match it.
 - Same pipe-only, never-logged, masked-afterwards rules as `read-secret`.
 - On a shared (scoped) listener it is off until the host runs

package/fill-secret.js

@@ -505,13 +505,15 @@ function buildReadCookieCode(name, domain, allowDomains) {
   const dom = ${JSON.stringify(domain.toLowerCase())}.replace(/^\\./, "");
   if (!allowed.some(p => new RegExp(p, "i").test(dom)))
     throw new Error("read-cookie refused: domain " + JSON.stringify(dom) + " is not allowed by --allow-domain");
-  const url = "https://" + dom + "/";
-  const cookies = await page.context().cookies([url]);
-  const match = cookies.filter(c => c.name === ${JSON.stringify(name)} && dom === String(c.domain).replace(/^\\./, "").toLowerCase());
+  // All cookies, any path (a URL filter would drop /app-scoped ones). Domain-match per RFC6265:
+  // the cookie's own domain is dom, or a parent of dom (a ".slack.com" cookie serves a subdomain).
+  const cookies = await page.context().cookies();
+  const domainMatches = cd => { cd = String(cd).replace(/^\\./, "").toLowerCase(); return dom === cd || dom.endsWith("." + cd); };
+  const match = cookies.filter(c => c.name === ${JSON.stringify(name)} && domainMatches(c.domain));
   if (!match.length) throw new Error("read-cookie: no cookie " + JSON.stringify(${JSON.stringify(name)}) + " for " + dom + " (is this profile signed in?)");
-  let value;
-  try { value = String(match[0].value); } catch { throw new Error("read-cookie: could not read the cookie"); }
-  return JSON.stringify({ domain: dom, value });
+  const values = [...new Set(match.map(c => { try { return String(c.value); } catch { return null; } }))];
+  if (values.length !== 1 || values[0] == null) throw new Error("read-cookie: " + match.length + " cookies named " + JSON.stringify(${JSON.stringify(name)}) + " for " + dom + " disagree; narrow the domain");
+  return JSON.stringify({ domain: dom, value: values[0] });
 }`;
 }
 async function readCookieOnSession(opts) {

package/fill-secret.ts

@@ -512,13 +512,15 @@ export function buildReadCookieCode(name: string, domain: string, allowDomains:
   const dom = ${JSON.stringify(domain.toLowerCase())}.replace(/^\\./, "");
   if (!allowed.some(p => new RegExp(p, "i").test(dom)))
     throw new Error("read-cookie refused: domain " + JSON.stringify(dom) + " is not allowed by --allow-domain");
-  const url = "https://" + dom + "/";
-  const cookies = await page.context().cookies([url]);
-  const match = cookies.filter(c => c.name === ${JSON.stringify(name)} && dom === String(c.domain).replace(/^\\./, "").toLowerCase());
+  // All cookies, any path (a URL filter would drop /app-scoped ones). Domain-match per RFC6265:
+  // the cookie's own domain is dom, or a parent of dom (a ".slack.com" cookie serves a subdomain).
+  const cookies = await page.context().cookies();
+  const domainMatches = cd => { cd = String(cd).replace(/^\\./, "").toLowerCase(); return dom === cd || dom.endsWith("." + cd); };
+  const match = cookies.filter(c => c.name === ${JSON.stringify(name)} && domainMatches(c.domain));
   if (!match.length) throw new Error("read-cookie: no cookie " + JSON.stringify(${JSON.stringify(name)}) + " for " + dom + " (is this profile signed in?)");
-  let value;
-  try { value = String(match[0].value); } catch { throw new Error("read-cookie: could not read the cookie"); }
-  return JSON.stringify({ domain: dom, value });
+  const values = [...new Set(match.map(c => { try { return String(c.value); } catch { return null; } }))];
+  if (values.length !== 1 || values[0] == null) throw new Error("read-cookie: " + match.length + " cookies named " + JSON.stringify(${JSON.stringify(name)}) + " for " + dom + " disagree; narrow the domain");
+  return JSON.stringify({ domain: dom, value: values[0] });
 }`;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rechrome",
-  "version": "1.43.0",
+  "version": "1.43.2",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/rechrome.git"

package/vendor/playwright-cli/node_modules/playwright-core/lib/coreBundle.js

@@ -65837,6 +65837,10 @@ var init_browserModel = __esm({
         await this._sendToExtension("chrome.tabs.remove", [tabSession.tabId]);
         return { success: true };
       }
+      // Any attached tab's relay sessionId, for browser-level commands the tab debugger can serve.
+      anyAttachedSessionId() {
+        return this._findTabSession(() => true)?.sessionId;
+      }
       getTargetInfo(sessionId) {
         if (!sessionId)
           return void 0;
@@ -65974,6 +65978,14 @@ var init_cdpRelayV2 = __esm({
             return { result: await this._model.closeTarget(params2?.targetId) };
           case "Target.getTargetInfo":
             return { result: this._model.getTargetInfo(sessionId) };
+          case "Storage.getCookies": {
+            if (sessionId)
+              return void 0;
+            const tabSessionId = this._model.anyAttachedSessionId();
+            if (!tabSessionId)
+              throw new Error("Storage.getCookies: no tab is attached yet; open a page first");
+            return { result: await this._model.sendCommand(tabSessionId, "Storage.getCookies", params2) };
+          }
         }
         return void 0;
       }