{"record":{"id":"3fed4e9d766de598","repo":"garrytan/gstack","slug":"domain-domain-does-not-match-current-page-d","errorCode":null,"errorMessage":"--domain \"${domain}\" does not match current page domain \"${pageHostname}\". Navigate to the target site first.","messagePattern":"--domain \"(.+?)\" does not match current page domain \"(.+?)\"\\. Navigate to the target site first\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"browse/src/write-commands.ts","lineNumber":704,"sourceCode":"    case 'cookie-import-browser': {\n      // Two modes:\n      // 1. Direct CLI import: cookie-import-browser <browser> --domain <domain> [--profile <profile>]\n      //    Requires --domain (or --all to explicitly import everything).\n      // 2. Open picker UI: cookie-import-browser [browser] (interactive domain selection)\n      const browserArg = args[0];\n      const domainIdx = args.indexOf('--domain');\n      const profileIdx = args.indexOf('--profile');\n      const hasAll = args.includes('--all');\n      const profile = (profileIdx !== -1 && profileIdx + 1 < args.length) ? args[profileIdx + 1] : 'Default';\n\n      if (domainIdx !== -1 && domainIdx + 1 < args.length) {\n        // Direct import mode — scoped to specific domain\n        const domain = args[domainIdx + 1];\n        // Validate --domain against current page hostname to prevent cross-site cookie injection\n        const pageHostname = new URL(page.url()).hostname;\n        const normalizedDomain = domain.startsWith('.') ? domain.slice(1) : domain;\n        if (normalizedDomain !== pageHostname && !pageHostname.endsWith('.' + normalizedDomain)) {\n          throw new Error(`--domain \"${domain}\" does not match current page domain \"${pageHostname}\". Navigate to the target site first.`);\n        }\n        const browser = browserArg || 'comet';\n        let result = await importCookies(browser, [domain], profile);\n        // If all cookies failed and v20 is detected, try CDP extraction\n        if (result.cookies.length === 0 && result.failed > 0 && hasV20Cookies(browser, profile)) {\n          result = await importCookiesViaCdp(browser, [domain], profile);\n        }\n        if (result.cookies.length > 0) {\n          await page.context().addCookies(result.cookies);\n          bm.trackCookieImportDomains([domain]);\n        }\n        const msg = [`Imported ${result.count} cookies for ${domain} from ${browser}`];\n        if (result.failed > 0) msg.push(`(${result.failed} failed to decrypt)`);\n        return msg.join(' ');\n      }\n\n      if (hasAll) {\n        // Explicit all-cookies import — requires --all flag as a deliberate opt-in.","sourceCodeStart":686,"sourceCodeEnd":722,"githubUrl":"https://github.com/garrytan/gstack/blob/94993f74012782fd94416dd44b8314f6363a13a4/browse/src/write-commands.ts#L686-L722","documentation":"Thrown by `browse cookie-import-browser` in direct (`--domain`) mode when the supplied `--domain` value does not match the current page hostname. The check strips a leading dot from the domain, then requires an exact match or a parent-domain match (`pageHostname.endsWith('.' + normalizedDomain)`). This is the browser-source counterpart of the JSON-import domain guard and exists for the same reason: preventing cross-site cookie injection by ensuring cookies are only imported for the site the user is currently viewing.","triggerScenarios":"Browser is on `example.com` but `--domain other.com` is passed; browser is on `app.example.com` and `--domain example.com` is passed (PASSES the parent check); user passes `--domain .example.com` (dot stripped, matches `example.com` page).","commonSituations":"User wants to pull cookies for a target site but forgot to navigate there first; an agent infers the domain from a URL string but the page never actually navigated (still on `about:blank` or a redirect); the domain was extracted from the browser's cookie DB for many sites and the user picked the wrong one.","solutions":["Navigate to the target site first: `browse navigate https://target.com`, then run `browse cookie-import-browser <browser> --domain target.com`.","Use the exact hostname or a parent domain; `--domain example.com` works when the page is on `app.example.com`.","If you genuinely want cookies for multiple sites, use `--all` (deliberate opt-in) instead of `--domain`.","Use the interactive picker mode (no `--domain`/`--all`) to select domains in a UI after navigation."],"exampleFix":"// before (page on about:blank)\nawait runBrowseCommand(['cookie-import-browser', 'comet', '--domain', 'target.com']);\n\n// after\nawait runBrowseCommand(['navigate', 'https://target.com']);\nawait runBrowseCommand(['cookie-import-browser', 'comet', '--domain', 'target.com']);","handlingStrategy":"validation","validationCode":"function validateDomainArg(domain: string, pageHostname: string): void {\n  const d = domain.startsWith('.') ? domain.slice(1) : domain;\n  if (d !== pageHostname && !pageHostname.endsWith('.' + d)) {\n    throw new Error(`--domain ${domain} does not match page ${pageHostname}`);\n  }\n}","typeGuard":"function domainArgMatchesPage(domain: string, pageHostname: string): boolean {\n  const d = domain.startsWith('.') ? domain.slice(1) : domain;\n  return d === pageHostname || pageHostname.endsWith('.' + d);\n}","tryCatchPattern":null,"preventionTips":["Navigate to the target site before invoking --domain.","Pass the exact hostname or a parent domain.","Use --all or the picker if you need cookies for multiple sites."],"tags":["cookies","import","security","domain-mismatch","cross-site","browser-import","browse-command"],"backgroundTag":null,"analyzedSha":"94993f74012782fd94416dd44b8314f6363a13a4","analyzedAt":"2026-08-12T04:06:23.140Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}