garrytan/gstack · warning · Error
Usage: browse cookie-import <json-file>
Error message
Usage: browse cookie-import <json-file>
What it means
Thrown by `browse cookie-import` when no file path argument is supplied (`args[0]` is undefined/falsy). The command imports a JSON array of cookies from a local file; without a path it has nothing to read. This is the simplest guard, checked before the path-security, existence, and JSON parsing layers.
Source
Thrown at browse/src/write-commands.ts:644
case 'dialog-accept': {
const text = args.length > 0 ? args.join(' ') : null;
bm.setDialogAutoAccept(true);
bm.setDialogPromptText(text);
return text
? `Dialogs will be accepted with text: "${text}"`
: 'Dialogs will be accepted';
}
case 'dialog-dismiss': {
bm.setDialogAutoAccept(false);
bm.setDialogPromptText(null);
return 'Dialogs will be dismissed';
}
case 'cookie-import': {
const filePath = args[0];
if (!filePath) throw new Error('Usage: browse cookie-import <json-file>');
// Path validation — resolve to absolute and check against safe dirs.
// Fixes #707: relative paths previously bypassed the safe directory check.
// Mirrors validateOutputPath() — resolves symlinks (e.g., macOS /tmp → /private/tmp).
const resolved = path.resolve(filePath);
let resolvedReal = resolved;
try { resolvedReal = fs.realpathSync(resolved); } catch {
// File may not exist yet — resolve parent dir instead
try { resolvedReal = path.join(fs.realpathSync(path.dirname(resolved)), path.basename(resolved)); } catch {}
}
if (!SAFE_DIRECTORIES.some(dir => isPathWithin(resolvedReal, dir))) {
throw new Error(`Path must be within: ${SAFE_DIRECTORIES.join(', ')}`);
}
if (!fs.existsSync(filePath)) throw new Error(`File not found: ${filePath}`);
const raw = fs.readFileSync(filePath, 'utf-8');
let cookies: any[];
try { cookies = JSON.parse(raw); } catch (err: any) { throw new Error(`Invalid JSON in ${filePath}: ${err?.message || err}`); }
if (!Array.isArray(cookies)) throw new Error('Cookie file must contain a JSON array');
View on GitHub (pinned to 94993f7401)
Solutions
- Provide a JSON file path: `browse cookie-import /tmp/errlookup-0o5UJv/cookies.json`.
- The file must be inside TEMP_DIR or the project cwd (see the safe-directory check that runs next).
- If you have cookies as an in-memory array, write them to a temp JSON file first, then import.
- Use `browse cookie-import-browser <browser> --domain <domain>` if you want to pull cookies directly from an installed browser instead of a file.
Example fix
// before await runBrowseCommand(['cookie-import']); // after await runBrowseCommand(['cookie-import', '/tmp/errlookup-0o5UJv/cookies.json']);
Defensive patterns
Strategy: validation
Validate before calling
function validateCookieImportArgs(args: string[]): string {
const filePath = args[0];
if (!filePath) throw new Error('cookie-import requires a json file path');
return filePath;
} Type guard
function hasFilePathArg(args: unknown): args is [string, ...unknown[]] {
return Array.isArray(args) && typeof args[0] === 'string' && args[0].length > 0;
} Prevention
- Provide a JSON file path as the first argument.
- Ensure the path is inside TEMP_DIR or the project cwd.
- Use cookie-import-browser for direct browser-DB extraction instead of a file.
When it happens
Trigger: Calling `browse cookie-import` with no args; passing only flags like `--help` that the command does not recognize as a path; forwarding an undefined variable as the path.
Common situations: Agent intended to export cookies first (`cookie-export`) and import second but ran the import command alone; user expects an interactive file picker; a wrapper script dropped the path arg during argument forwarding.
Related errors
- Usage: browse cookie <name>=<value>
- Usage: browse viewport [<WxH>] [--scale <n>] (e.g. 375x812,
- Usage: browse header <name>:<value>
- Usage: browse useragent <string>
- Usage: browse upload <selector> <file1> [file2...]
AI-assisted analysis of garrytan/gstack@94993f7401 (2026-08-12).
Data as JSON: /api/errors/69b98b774d7a9675.
Report an issue: GitHub.