mirror of https://github.com/garrytan/gstack.git
5d7e494258
Spawns Chrome with --remote-debugging-pipe instead of --remote-debugging-port, closing the v20 ABE cookie exfiltration window where any same-user local process could connect to Chrome's debug port (in the 1-3s it's listening) and call Network.getAllCookies to read decrypted v20 cookies. Pipe transport is inherited by Chrome only; no TCP socket binds, no /json/list HTTP endpoint exists. Target discovery via Target.getTargets + Target.attachToTarget(flatten: true). Browser.getVersion replaces the old /json/version fetch for diagnostics. Uses node:child_process.spawn for the Chrome subprocess because Bun.spawn exposes fds >= 3 as raw numeric fds, not streams, and Node stream-to-Web bridges hang in Bun on those sockets. The non-CDP path (direct SQLite + DPAPI on v10/v11 cookies) is unchanged; this change only affects the Windows v20 ABE fallback. Closes #1136. |
||
|---|---|---|
| .. | ||
| bin | ||
| scripts | ||
| src | ||
| test | ||
| PLAN-snapshot-dropdown-interactive.md | ||
| SKILL.md | ||
| SKILL.md.tmpl | ||