From 26e9d8be8b287e803b04f47ddedaa6e4369a2e53 Mon Sep 17 00:00:00 2001
From: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Date: Mon, 20 Apr 2026 21:13:21 -0700
Subject: [PATCH] fix(browse): log decrypt failures behind GSTACK_DEBUG in
 cookie-import

cookie-import-browser silently drops cookies that fail to decrypt,
leaving users unable to tell which cookies failed or why. The Keychain
entry behind Arc's Safe Storage can rotate, invalidating older
encrypted_value blobs while newer ones still decrypt, producing the
partial-import symptom reported.

Keep the existing failed counter, but surface per-row detail when
GSTACK_DEBUG=1 or DEBUG=1 is set. Log host_key and cookie name plus the
error code and message to stderr. Never log cookie values.

Closes #1057
---
 browse/src/cookie-import-browser.ts | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/browse/src/cookie-import-browser.ts b/browse/src/cookie-import-browser.ts
index 271d3659b..88c9c19c0 100644
--- a/browse/src/cookie-import-browser.ts
+++ b/browse/src/cookie-import-browser.ts
@@ -279,8 +279,14 @@ export async function importCookies(
         const cookie = toPlaywrightCookie(row, value);
         cookies.push(cookie);
         domainCounts[row.host_key] = (domainCounts[row.host_key] || 0) + 1;
-      } catch {
+      } catch (err: any) {
         failed++;
+        if (process.env.GSTACK_DEBUG === '1' || process.env.DEBUG === '1') {
+          const code = err?.code ? ` [${err.code}]` : '';
+          console.error(
+            `[cookie-import] decrypt failed for ${row.host_key}/${row.name}${code}: ${err?.message ?? String(err)}`
+          );
+        }
       }
     }