Skip to content

Gate live browser cookie test behind opt-in - #902

Merged
Finesssee merged 2 commits into
mainfrom
fix/gate-cookie-extraction-test
Oct 16, 2026
Merged

Finesssee merged 2 commits into
mainfrom
fix/gate-cookie-extraction-test

Conversation

@Finesssee

@Finesssee Finesssee commented Oct 16, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

browser::cookies::tests::test_cookie_extraction ran in every cargo test. It read and decrypted real claude.ai cookies from the machine's installed browsers and printed the first 20 characters of each value.

  • The test is now #[ignore] (same pattern as providers/claude/accounts.rs) and also returns early unless CODEXBAR_LIVE_COOKIE_TEST=1 is set, so --ignored runs skip it too unless you opt in.
  • It prints the cookie count and names only. Values are never printed.

No CI script runs --ignored / --include-ignored or sets the variable, so the test no longer runs in CI or in normal local runs.

Not changed, listed for later: browser/detection.rs test_browser_detection reads real browser profile directories (paths and profile counts, no cookies).

Commands run

  • cargo test --manifest-path rust/Cargo.toml browser: 129 passed, 1 ignored (test_cookie_extraction)
  • cargo fmt --all: clean
  • cargo clippy on both manifests with -D warnings: clean

UI proof

Not applicable: test-only change.

Summary by CodeRabbit

  • Tests
    • The live cookie extraction test is skipped by default and can be enabled with an environment setting.
    • Test output reports cookie names without exposing cookie values.

@coderabbitai

coderabbitai Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 36 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Repository: nesszer/Win-CodexBar/.coderabbit.yaml
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 042646c2-245d-4a07-be8b-a328430d657f
📥 Commits

Reviewing files that changed from the base of the PR and between 5764cf1 and 5dfcf7f.

📒 Files selected for processing: 1
  • rust/src/browser/cookies.rs

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository: nesszer/Win-CodexBar/.coderabbit.yaml
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: e2395496-176d-4bae-8bc1-923515d1c43f
📥 Commits

Reviewing files that changed from the base of the PR and between 1170520 and 5764cf1.

📒 Files selected for processing: 1
  • rust/src/browser/cookies.rs

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 1 remain after this review.

📝 Walkthrough

The live claude.ai cookie test is ignored by default. It runs when CODEXBAR_LIVE_COOKIE_TEST=1 and reports cookie names without printing values or value prefixes.

Changes: Live cookie test

Layer / File(s) Summary
Opt-in test and output
rust/src/browser/cookies.rs
The live cookie test requires CODEXBAR_LIVE_COOKIE_TEST=1. Its output includes cookie names only.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 5764c

Live cookie access is excluded from normal test and CI runs, while maintainers can opt in explicitly. The test no longer prints cookie values, and no merge-blocking risk is evident.

Pre-merge checks: Passed 8
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title is a short imperative summary that accurately describes gating the live browser cookie test behind opt-in execution.
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Provider Data Stays Siloed Passed PASS. The pull request changes only the live cookie test in rust/src/browser/cookies.rs. It adds an opt-in environment check, marks the test ignored, and changes output from cookie name/value prefix…
Secrets Handled Safely Passed The pull request removes the live test's cookie-value output. The changed test now logs only a count, cookie names, a fixed opt-in message, or CookieError text; it no longer prints any cookie value …
No Unapproved Dependencies Passed The pull request changes only rust/src/browser/cookies.rs. It does not change any Cargo.toml, package.json, npm or yarn lockfile, or pnpm packageManager version. No dependency addition require…
Ui Changes Include Windows Proof Passed The pull request changes only the live test in rust/src/browser/cookies.rs. It does not modify desktop UI files, tray rendering, the float bar, settings, or window chrome. The PR description correct…
Full details: Provider Data Stays Siloed

Explanation

PASS. The pull request changes only the live cookie test in rust/src/browser/cookies.rs. It adds an opt-in environment check, marks the test ignored, and changes output from cookie name/value prefixes to cookie names only. It does not add provider or account identity handling, cross-provider UI/payload/storage behavior, or cross-provider branching.

Full details: Secrets Handled Safely

Explanation

The pull request removes the live test's cookie-value output. The changed test now logs only a count, cookie names, a fixed opt-in message, or CookieError text; it no longer prints any cookie value or prefix. The test is also ignored by default and requires CODEXBAR_LIVE_COOKIE_TEST=1. The diff introduces no credential-file or keyring deletion or overwrite.

Full details: No Unapproved Dependencies

Explanation

The pull request changes only rust/src/browser/cookies.rs. It does not change any Cargo.toml, package.json, npm or yarn lockfile, or pnpm packageManager version. No dependency addition requires approval.

Full details: Ui Changes Include Windows Proof

Explanation

The pull request changes only the live test in rust/src/browser/cookies.rs. It does not modify desktop UI files, tray rendering, the float bar, settings, or window chrome. The PR description correctly states that UI proof is not applicable.

✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@Finesssee
Finesssee merged commit 2a68cbd into main Oct 16, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant