[PR #763] [MERGED] fix(browser): fingerprint cookies at the selected page URL #2224

New issue

Closed

opened 2026-10-16 21:15:54 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:15:54 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/763
Author: @rudycelekli
Created: 10/6/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/rea-current-page-cookie-fingerprints-20261006

📝 Commits (1)

573ee9f fix(browser): fingerprint cookies at the selected page URL

📊 Changes

7 files changed (+58 additions, -7 deletions)

View changed files

📝 docs/browser-observation.md (+1 -1)
📝 scripts/fixtures/browser-verifier-site.mjs (+4 -0)
📝 scripts/lib/browser-verifier-assertions.mjs (+8 -0)
📝 src/browser/CdpCaptureStorage.ts (+4 -2)
📝 src/browser/CdpCaptureStorageFingerprints.ts (+8 -3)
📝 src/browser/CdpPageCapture.ts (+1 -1)
📝 tests/boundary/browser/cdpBrowserProvider.sensitive_data.test.ts (+32 -0)

📄 Description

Summary

Include path-specific cookies in explicitly requested storage fingerprints for the selected page. This is a self-contained correctness fix; no separate issue is linked.

Problem and expected behavior

On a page at /app, a cookie with Path=/app is available to the page. Capture previously requested Network.getCookies with the origin URL, whose path is /, so it omitted that cookie while reporting complete fingerprints. Changing the omitted cookie could leave the observed storage fingerprints identical.

Change and scope

Pass the authorized attached main-frame URL to the cookie query. Derive the same origin for DOM storage, IndexedDB, cache names and quota. Document that cookie coverage means the current page URL, including its path, rather than every cookie path on the origin.

Contract and boundary impact

Semantic owner and earliest changed stage: browser storage capture, at the CDP cookie URL selection.
CLI and MCP/tool-catalog contract: unchanged schemas and tool names; requested storage fingerprints now include current-page cookies.
Provider, bridge, target-format, or platform compatibility: CDP browser capture; real Chrome tested on macOS arm64.
Evidence, artifact, provenance, or reconstruction contract: cookie identity/value hashes remain value-redacted; current-page scope is explicit in limitations.
Process execution, authorization, cleanup, or containment impact: the URL is the already-authorized main frame; other storage retains origin scope. No browser-wide cookie enumeration or new process ownership.
Generated metadata (docs/product-catalog.json), package, or installation impact: none.

Evidence and regression coverage

Tests added or updated: boundary test checks full attached cookie URL and unchanged DOM-storage origin; real browser verifier installs root and /app cookies and requires both fingerprints.
Base reproduction or other evidence: executed public CdpBrowserProvider.inspectPage against owned loopback HTTP and actual Chrome. Base 91daaa6 captures only the root cookie (1 vs expected 2), despite fingerprints_complete: true. The fix captures both; changing the actual /app cookie from alpha to beta changes its fingerprint.
User-visible CLI/MCP output: storage content_fingerprints gains the missing cookie hash; raw cookie values remain absent.
Remaining proof gaps: no other browser or OS matrix tested locally. Cookies at unrelated paths are outside the documented current-page scope. The native verifier's process-lineage metadata was unavailable because a descendant run token did not match; its browser checks completed successfully.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Native public capture fixture — fails on base (root only), passes after fix (root plus /app, changed scoped-cookie hash).
npm run test:focused -- tests/boundary/browser/cdpBrowserProvider.sensitive_data.test.ts — 6 passed.
npm run check — 5 tasks successful; 124 existing lint warnings, zero errors.
npm run check:fast — 2 tasks successful.
npm run docs:check — 2 tasks successful.
npm run verify:browser — verified with Chrome 154.0.8037.94 and locked Playwright-core 1.58.2, including actual CLI/stdio MCP scenarios, source maps, screenshots, popup events and owned/external cleanup controls.
git diff --check — passed. Node 24.18.0 and reused exact dependency versions; no dependency source changes.

Full deterministic coverage remains with hosted CI; its results are tracked separately.

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real Hopper/Ghidra, browser, or OS coverage: actual macOS Chrome only; unrelated binary providers not exercised.
Package or release metadata impact: none.
Security, privacy, process, or containment review: origin authorization remains unchanged; fingerprints remain hashes of explicitly requested cookie data, never raw values. Owned loopback/profile fixtures only, with cleanup; no personal browser profile or browser download.

AI assistance: implemented and source reviewed with Codex on behalf of @rudycelekli before publication.

Review checklist

The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/763 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/6/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/rea-current-page-cookie-fingerprints-20261006` --- ### 📝 Commits (1) - [`573ee9f`](https://github.com/morluto/rea/commit/573ee9fd96ff3219e8f6879cededb461b36c99a5) fix(browser): fingerprint cookies at the selected page URL ### 📊 Changes **7 files changed** (+58 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `docs/browser-observation.md` (+1 -1) 📝 `scripts/fixtures/browser-verifier-site.mjs` (+4 -0) 📝 `scripts/lib/browser-verifier-assertions.mjs` (+8 -0) 📝 `src/browser/CdpCaptureStorage.ts` (+4 -2) 📝 `src/browser/CdpCaptureStorageFingerprints.ts` (+8 -3) 📝 `src/browser/CdpPageCapture.ts` (+1 -1) 📝 `tests/boundary/browser/cdpBrowserProvider.sensitive_data.test.ts` (+32 -0) </details> ### 📄 Description ## Summary Include path-specific cookies in explicitly requested storage fingerprints for the selected page. This is a self-contained correctness fix; no separate issue is linked. ## Problem and expected behavior On a page at `/app`, a cookie with `Path=/app` is available to the page. Capture previously requested `Network.getCookies` with the origin URL, whose path is `/`, so it omitted that cookie while reporting complete fingerprints. Changing the omitted cookie could leave the observed storage fingerprints identical. ## Change and scope Pass the authorized attached main-frame URL to the cookie query. Derive the same origin for DOM storage, IndexedDB, cache names and quota. Document that cookie coverage means the current page URL, including its path, rather than every cookie path on the origin. ## Contract and boundary impact - Semantic owner and earliest changed stage: browser storage capture, at the CDP cookie URL selection. - CLI and MCP/tool-catalog contract: unchanged schemas and tool names; requested storage fingerprints now include current-page cookies. - Provider, bridge, target-format, or platform compatibility: CDP browser capture; real Chrome tested on macOS arm64. - Evidence, artifact, provenance, or reconstruction contract: cookie identity/value hashes remain value-redacted; current-page scope is explicit in limitations. - Process execution, authorization, cleanup, or containment impact: the URL is the already-authorized main frame; other storage retains origin scope. No browser-wide cookie enumeration or new process ownership. - Generated metadata (`docs/product-catalog.json`), package, or installation impact: none. ## Evidence and regression coverage - Tests added or updated: boundary test checks full attached cookie URL and unchanged DOM-storage origin; real browser verifier installs root and `/app` cookies and requires both fingerprints. - Base reproduction or other evidence: executed public `CdpBrowserProvider.inspectPage` against owned loopback HTTP and actual Chrome. Base `91daaa6` captures only the root cookie (1 vs expected 2), despite `fingerprints_complete: true`. The fix captures both; changing the actual `/app` cookie from alpha to beta changes its fingerprint. - User-visible CLI/MCP output: storage `content_fingerprints` gains the missing cookie hash; raw cookie values remain absent. - Remaining proof gaps: no other browser or OS matrix tested locally. Cookies at unrelated paths are outside the documented current-page scope. The native verifier's process-lineage metadata was unavailable because a descendant run token did not match; its browser checks completed successfully. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - Native public capture fixture — fails on base (root only), passes after fix (root plus `/app`, changed scoped-cookie hash). - `npm run test:focused -- tests/boundary/browser/cdpBrowserProvider.sensitive_data.test.ts` — 6 passed. - `npm run check` — 5 tasks successful; 124 existing lint warnings, zero errors. - `npm run check:fast` — 2 tasks successful. - `npm run docs:check` — 2 tasks successful. - `npm run verify:browser` — verified with Chrome 154.0.8037.94 and locked Playwright-core 1.58.2, including actual CLI/stdio MCP scenarios, source maps, screenshots, popup events and owned/external cleanup controls. - `git diff --check` — passed. Node 24.18.0 and reused exact dependency versions; no dependency source changes. Full deterministic coverage remains with hosted CI; its results are tracked separately. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: actual macOS Chrome only; unrelated binary providers not exercised. - Package or release metadata impact: none. - Security, privacy, process, or containment review: origin authorization remains unchanged; fingerprints remain hashes of explicitly requested cookie data, never raw values. Owned loopback/profile fixtures only, with cleanup; no personal browser profile or browser download. AI assistance: implemented and source reviewed with Codex on behalf of @rudycelekli before publication. ## Review checklist - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:15:54 +00:00