garrytan/gstack · warning · Error

--domain "${domain}" does not match current page domain "${p

Error message

--domain "${domain}" does not match current page domain "${pageHostname}". Navigate to the target site first.

What it means

Thrown by `browse cookie-import-browser` in direct (`--domain`) mode when the supplied `--domain` value does not match the current page hostname. The check strips a leading dot from the domain, then requires an exact match or a parent-domain match (`pageHostname.endsWith('.' + normalizedDomain)`). This is the browser-source counterpart of the JSON-import domain guard and exists for the same reason: preventing cross-site cookie injection by ensuring cookies are only imported for the site the user is currently viewing.

Source

Thrown at browse/src/write-commands.ts:704

    case 'cookie-import-browser': {
      // Two modes:
      // 1. Direct CLI import: cookie-import-browser <browser> --domain <domain> [--profile <profile>]
      //    Requires --domain (or --all to explicitly import everything).
      // 2. Open picker UI: cookie-import-browser [browser] (interactive domain selection)
      const browserArg = args[0];
      const domainIdx = args.indexOf('--domain');
      const profileIdx = args.indexOf('--profile');
      const hasAll = args.includes('--all');
      const profile = (profileIdx !== -1 && profileIdx + 1 < args.length) ? args[profileIdx + 1] : 'Default';

      if (domainIdx !== -1 && domainIdx + 1 < args.length) {
        // Direct import mode — scoped to specific domain
        const domain = args[domainIdx + 1];
        // Validate --domain against current page hostname to prevent cross-site cookie injection
        const pageHostname = new URL(page.url()).hostname;
        const normalizedDomain = domain.startsWith('.') ? domain.slice(1) : domain;
        if (normalizedDomain !== pageHostname && !pageHostname.endsWith('.' + normalizedDomain)) {
          throw new Error(`--domain "${domain}" does not match current page domain "${pageHostname}". Navigate to the target site first.`);
        }
        const browser = browserArg || 'comet';
        let result = await importCookies(browser, [domain], profile);
        // If all cookies failed and v20 is detected, try CDP extraction
        if (result.cookies.length === 0 && result.failed > 0 && hasV20Cookies(browser, profile)) {
          result = await importCookiesViaCdp(browser, [domain], profile);
        }
        if (result.cookies.length > 0) {
          await page.context().addCookies(result.cookies);
          bm.trackCookieImportDomains([domain]);
        }
        const msg = [`Imported ${result.count} cookies for ${domain} from ${browser}`];
        if (result.failed > 0) msg.push(`(${result.failed} failed to decrypt)`);
        return msg.join(' ');
      }

      if (hasAll) {
        // Explicit all-cookies import — requires --all flag as a deliberate opt-in.

View on GitHub (pinned to 94993f7401)

Solutions

Navigate to the target site first: `browse navigate https://target.com`, then run `browse cookie-import-browser <browser> --domain target.com`.
Use the exact hostname or a parent domain; `--domain example.com` works when the page is on `app.example.com`.
If you genuinely want cookies for multiple sites, use `--all` (deliberate opt-in) instead of `--domain`.
Use the interactive picker mode (no `--domain`/`--all`) to select domains in a UI after navigation.

Example fix

// before (page on about:blank)
await runBrowseCommand(['cookie-import-browser', 'comet', '--domain', 'target.com']);

// after
await runBrowseCommand(['navigate', 'https://target.com']);
await runBrowseCommand(['cookie-import-browser', 'comet', '--domain', 'target.com']);

Defensive patterns

Strategy: validation

Validate before calling

function validateDomainArg(domain: string, pageHostname: string): void {
  const d = domain.startsWith('.') ? domain.slice(1) : domain;
  if (d !== pageHostname && !pageHostname.endsWith('.' + d)) {
    throw new Error(`--domain ${domain} does not match page ${pageHostname}`);
  }
}

Type guard

function domainArgMatchesPage(domain: string, pageHostname: string): boolean {
  const d = domain.startsWith('.') ? domain.slice(1) : domain;
  return d === pageHostname || pageHostname.endsWith('.' + d);
}

Prevention

Navigate to the target site before invoking --domain.
Pass the exact hostname or a parent domain.
Use --all or the picker if you need cookies for multiple sites.

When it happens

Trigger: Browser is on `example.com` but `--domain other.com` is passed; browser is on `app.example.com` and `--domain example.com` is passed (PASSES the parent check); user passes `--domain .example.com` (dot stripped, matches `example.com` page).

Common situations: User wants to pull cookies for a target site but forgot to navigate there first; an agent infers the domain from a URL string but the page never actually navigated (still on `about:blank` or a redirect); the domain was extracted from the browser's cookie DB for many sites and the user picked the wrong one.

Related errors

AI-assisted analysis of garrytan/gstack@94993f7401 (2026-08-12). Data as JSON: /api/errors/3fed4e9d766de598. Report an issue: GitHub.