feat(browser): add cookies action for retrieving browser cookies including HttpOnly by euisuk-chung · Pull Request #7635 · openclaw/openclaw

euisuk-chung · 2026-02-03T02:19:35Z

Summary

Add a new cookies action to the browser tool that allows retrieving browser cookies including
HttpOnly cookies via Playwright CDP.

New action: browser action="cookies" to retrieve cookies from browser context
Domain filtering: Optional domain parameter to filter cookies by domain
Proxy support: Works with both local browser control and Node Host proxy routing
HttpOnly access: Can retrieve HttpOnly cookies via CDP (not accessible via JavaScript)

Use Case

Enable MCP server authentication token refresh by extracting session cookies from authenticated
browser sessions. For example, NotebookLM MCP authentication requires Google session cookies (HSID,
SSID, SID) which are HttpOnly and cannot be accessed via document.cookie.

Usage

browser action="cookies" profile="chrome" domain="google.com"

Returns:

{
"ok": true,
"targetId": "ABC123",
"cookies": [
  {
    "name": "SID",
    "value": "...",
    "domain": ".google.com",
    "path": "/",
    "httpOnly": true,
    "secure": true,
    "sameSite": "Lax"
  }
]
}

Test plan

- Unit tests added for cookies action
- Tests for domain filtering
- Tests for Node Host proxy routing
- All existing browser-tool tests pass

…elay The Chrome extension relay server needs to be running before the extension can connect. Previously, the browser control service was initialized lazily (on first browser.proxy command), causing a chicken-and-egg problem where the extension couldn't connect because the relay wasn't started yet. This change starts the browser control service eagerly when Node Host starts (if browser proxy is enabled), ensuring the relay server on port 18792 is available for Chrome extension connections. Security: No change to security model - relay remains loopback-only (127.0.0.1) with existing connection validation.

Add a new `cookies` action to the browser tool that allows retrieving browser cookies including HttpOnly cookies via Playwright CDP. Features: - Retrieve all cookies from the browser context - Filter cookies by domain using the `domain` parameter - Support both local browser control and Node Host proxy routing - Include HttpOnly cookies (accessible via CDP, not JavaScript) Use case: Enable MCP server authentication token refresh by extracting session cookies from authenticated browser sessions. Co-Authored-By: Claude Opus 4.5 <[email protected]>

greptile-apps

_{2 files reviewed, 3 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-03T02:23:06Z

+          if (proxyRequest) {
+            const result = (await proxyRequest({
+              method: "GET",
+              path: "/cookies",
+              profile,
+              query: {
+                targetId,
+              },
+            })) as { ok: boolean; targetId: string; cookies: unknown[] };


[P0] domain filter is ignored when calling the node proxy.

In the node-proxy path you only include targetId in query, so domain never reaches the node-host /cookies route. This means browser action="cookies" target="node" domain=... will return unfiltered cookies unless the server happens to filter some other way. (You currently filter client-side after the proxy call, but that assumes the proxy always returns all cookies, which is both inefficient and may not match intended semantics.)

Also appears in src/agents/tools/browser-tool.test.ts:367 (test name implies proxy-side filter but current implementation is client-side).

Prompt To Fix With AI

This is a comment left during a code review. Path: src/agents/tools/browser-tool.ts Line: 723:731 Comment: [P0] `domain` filter is ignored when calling the node proxy. In the node-proxy path you only include `targetId` in `query`, so `domain` never reaches the node-host `/cookies` route. This means `browser action="cookies" target="node" domain=...` will return *unfiltered* cookies unless the server happens to filter some other way. (You currently filter client-side after the proxy call, but that assumes the proxy always returns *all* cookies, which is both inefficient and may not match intended semantics.) Also appears in `src/agents/tools/browser-tool.test.ts:367` (test name implies proxy-side filter but current implementation is client-side). How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-02-03T02:23:07Z

+  const result = await fetchBrowserJson<BrowserCookiesResult>(
+    withBaseUrl(baseUrl, `/cookies?${q.toString()}`),
+    { timeoutMs: 10000 },
+  );


[P1] /cookies URL always includes a trailing ?, which can break routing.

withBaseUrl(baseUrl, /cookies?${q.toString()}) produces /cookies? when q is empty. Some routers/middlewares treat /cookies and /cookies? differently, which can lead to 404s or cache misses. Safer to omit the ? when there are no query params.

Prompt To Fix With AI

This is a comment left during a code review. Path: src/browser/client.ts Line: 369:372 Comment: [P1] `/cookies` URL always includes a trailing `?`, which can break routing. `withBaseUrl(baseUrl, `/cookies?${q.toString()}`)` produces `/cookies?` when `q` is empty. Some routers/middlewares treat `/cookies` and `/cookies?` differently, which can lead to 404s or cache misses. Safer to omit the `?` when there are no query params. How can I resolve this? If you propose a fix, please make it concise.

greptile-apps · 2026-02-03T02:23:08Z

+  if (opts?.domain) {
+    const domainFilter = opts.domain.toLowerCase();
+    result.cookies = result.cookies.filter((c) =>
+      c.domain.toLowerCase().includes(domainFilter),
+    );
+  }


[P2] Client-side domain filtering duplicates server/proxy behavior and can hide bugs.

browserCookies() fetches from /cookies then filters result.cookies client-side. If the server later adds domain filtering (or already does for some backends), the client filtering can mask issues and makes it harder to reason about what the API returns. Consider pushing domain down into the request query (so all backends filter consistently) and keeping client-side filtering only as a fallback (or removing it).

Prompt To Fix With AI

This is a comment left during a code review. Path: src/browser/client.ts Line: 374:379 Comment: [P2] Client-side domain filtering duplicates server/proxy behavior and can hide bugs. `browserCookies()` fetches from `/cookies` then filters `result.cookies` client-side. If the server later adds domain filtering (or already does for some backends), the client filtering can mask issues and makes it harder to reason about what the API returns. Consider pushing `domain` down into the request query (so all backends filter consistently) and keeping client-side filtering only as a fallback (or removing it). How can I resolve this? If you propose a fix, please make it concise.

- Fix URL query string formatting (P1): avoid trailing '?' when no params - Add comment clarifying client-side domain filtering (P0/P2) - Fix lint errors in test file (no-unsafe-optional-chaining) Co-Authored-By: Claude Opus 4.5 <[email protected]>

…mory YouTube Ultimate v2.0.0: - Added yt-dlp integration for video/audio downloads - formats command to list available qualities - 4K/1440p support, FLAC/WAV/OPUS audio - Cookie support for age-restricted content - Robust error handling WhatsApp Full History Sync: - New config option: syncFullHistory (opt-in) - Handles messaging-history.set events from Baileys - Enables reading all past messages (one-time sync at pairing) LanceDB Hybrid Memory: - Cherry-picked openclaw#7695 + openclaw#7636 for better recall - Hybrid search combining vector + keyword Also includes: - openclaw#7747 Zero-latency hot-reload - openclaw#7635 Browser cookies action - openclaw#7600 Secrets injection proxy Trust-first fork: Removing restrictions, enabling full AI access.

euisuk-chung and others added 2 commits February 2, 2026 22:36

openclaw-barnacle Bot added the agents Agent runtime and tooling label Feb 3, 2026

greptile-apps Bot reviewed Feb 3, 2026

View reviewed changes

thewilloftheshadow force-pushed the main branch from bfc1ccb to f92900f Compare February 15, 2026 18:46

euisuk-chung closed this by deleting the head repository Feb 21, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat(browser): add cookies action for retrieving browser cookies including HttpOnly#7635

feat(browser): add cookies action for retrieving browser cookies including HttpOnly#7635
euisuk-chung wants to merge 3 commits into
openclaw:mainfrom
euisuk-chung:feat/browser-cookies-action

euisuk-chung commented Feb 3, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot left a comment

Uh oh!

greptile-apps Bot Feb 3, 2026

Uh oh!

greptile-apps Bot Feb 3, 2026

Uh oh!

greptile-apps Bot Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

euisuk-chung commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Use Case

Usage

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

euisuk-chung commented Feb 3, 2026 •

edited

Loading