[andreakiro]

profiles sync now transfers localStorage as well as cookies, including storage-only logins. --cdp-url also captures sessionStorage from open Chromium tabs while preserving saved storage for closed tabs.

Scoped sync preserves other sites, including for cookie-only snapshots. Incomplete or oversized snapshots fail before profile creation, and uploads refuse redirects. Requires POST /profiles/{id}/state; older servers return an explicit unsupported-server error. IndexedDB, partitioned storage and device-bound credentials remain unsupported.

Updated against current main without changing sync behavior. New integration cases exercise authenticated storage-only and mixed imports with synthetic browser data and temporary profiles. Both passed against staging. The existing payment sandbox test now requests a vault-backed session, matching the fixture correction already verified in #157.

Validation: current-head CI passes, including the full staging integration suite, both storage-import cases, payment sandbox lifecycle, build/lint, credential stores, installation and skill installation. Greptile approved the current head at 5/5. Local Go 1.25.5 race tests, generated-code stability, endpoint/skill guards and all six release builds also pass. Both changed integration tests compile and pass changed-code lint. Integration-tag lint additionally reports five existing errcheck issues in unchanged functions tests.

[andreakiro]

@greptile review

[greptile-apps]

Confidence Score: 5/5

[Critical impact] The PR appears safe to merge; no new actionable issues were found.

Summary

profiles sync now copies cookies and localStorage, with live sessionStorage capture through --cdp-url.

• Browser profile sync now includes localStorage logins.
• Open Chromium tabs can supply live cookies and web storage.
• Profile sync imports selected browser state through the state API.
• The payment integration test starts its session with a vault.

The merge bases differ, so this review used the full PR diff rather than the previous-review diff. No new actionable issues were found.

The earlier concerns are addressed by origin-scoped live imports, early Firefox directory filtering, final request-size checks, storage-value-based endpoint selection, Unicode checks and concurrent-copy tests. The three threads resolved by andreakiro were resolved without explanatory replies.

This review inspected code and tests; it did not run the test suite.

_{Reviews (5) · Last reviewed commit: "Use a vault-backed session in the paymen..." · Reviewed by Greptile}

[andreakiro]

@greptile review

[andreakiro]

@greptile review

Added live Unicode rejection, concurrent WAL and compaction coverage, source-change detection, and redirect/error redaction tests for the legacy cookie upload. Unscoped disk cookie-only snapshots, including empty storage tables, keep the existing cookie endpoint. Scoped cookie-only and live snapshots intentionally use the state endpoint to preserve unrelated saved state. The final request-size check runs before profile creation. The full race-enabled suite and lint pass.

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

[andreakiro]

@greptile review

[andreakiro]

@greptile review