release: v0.19.2 — Firefox saveState/eval/console fixes#10
Merged
Conversation
… (BiDi)
Three fixes from a /code-review medium pass over the FF parity arc
(v0.16.0–v0.19.1), each validated against real Firefox before fixing:
- saveState wrote BiDi's lowercase sameSite (lax/strict/none), but the only
loader for a state file is connect()'s CDP-only storageState → Network.setCookies,
whose enum is capitalized (Lax/Strict/None). The lowercase value was rejected
and the swallowing try/catch dropped EVERY cookie — the cross-engine auth
restore was silently dead. Capitalize on save.
- daemon Firefox `eval` wrapped the expression in `await (${expr})`, which is a
SyntaxError for any statement list ("var x=2; x*3") — a regression vs the raw
script.evaluate it replaced (and vs the CDP Runtime.evaluate path). Evaluate
the raw expression (eval-semantics: statements work) and walk BiDi's
{type,value} remote value back to a plain value via new deserializeBiDi().
- daemon Firefox console capture splatted objects' nested {type,value}
serialization into the log; fall back to the type name, matching the CDP
capture's RemoteObject.description ("Object").
Declined (validated, but fixing would regress): premature network-idle on
redirect (empty-pending window is microscopic; a 3xx-skip breaks manual/
background 3xx) and download savedPath URL-mismatch (unreproduced, speculative).
Tests: +3 deserializeBiDi cases, +object-arg console assertion, saveState now
asserts capitalized sameSite. tsc 0; unit 144/144; CLI 20/20; FF integration 33/33.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MZpPPhwXmSfN1n7uX7RAxT
…ole args fixes Three validated fixes from a /code-review pass over the FF parity arc (saveState cross-engine cookie casing, statement-form eval regression, console object-arg formatting). See CHANGELOG [0.19.2]. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MZpPPhwXmSfN1n7uX7RAxT
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three validated fixes from a
/code-review mediumpass over the Firefox parity arc (v0.16.0–v0.19.1). Each was confirmed against real Firefox before fixing; two candidate findings were validated-but-declined (would regress).saveStatesameSite casing — Firefox wrote BiDi's lowercaselax/strict/none, but the only loader (connect({ storageState })) is CDP-only and rejects a lowercase enum → the wholeNetwork.setCookiesbatch threw and every cookie was silently dropped, making a Firefox-saved state useless for auth restore. Now capitalized toLax/Strict/None.evalstatement regression — a Phase-4await (${expr})wrapper turned every statement list (var x=2; x*3) into aSyntaxError. Now evaluates the raw expression (BiDiscript.evaluatehas eval-semantics) + a newdeserializeBiDi()walks the{type,value}remote value back to CDP's plain-value shape — statements work and deep objects stay clean.{type,value}serialization into the daemon log; falls back to the type name (CDP-parity).Declined (validated, but fixing would regress): premature network-idle on redirect (empty-pending window is microscopic; a 3xx-skip breaks manual/background 3xx) and download
savedPathURL-mismatch (unreproduced).Verification
tsc --noEmit→ 0/shipReady ·/securityclean ·/diff-reviewReady-to-merge🤖 Generated with Claude Code