SessionCourier

Cookie & session manager for developers, QA engineers, and test automation — a Manifest V3 browser extension.

Early stage: this repository currently contains the project scaffold. First public release is planned for September 2026.

Why another cookie manager?

• Built for dev/QA workflows. Inspect, search, edit, and bulk-manage cookies; export as JSON, Netscape (cookies.txt for curl/wget/yt-dlp), a raw Cookie: header string, a runnable curl command — and Playwright/Puppeteer storageState.json.
• Test verbs, not just storage. Expire now backdates a cookie's expiry in one click, so the site takes its expired-session path immediately — no idling 20 minutes, no bespoke short-lived-token endpoint. It is undoable: the cookie is snapshotted first (in memory, never on disk) and restored exactly as it was, protection included.
• Tokens, decoded locally. Find every JWT in a site's cookies and the tab's localStorage — including ones buried inside JSON auth blobs — badged with the token's own expiry, and decoded in your browser. Nothing is ever sent anywhere.
• Trust by construction. GPL-3.0 client, minimal permissions (cookies, storage, activeTab; broad host access only as an optional runtime grant), no ads, no third-party tracking, reproducible builds (below).

Development

Requires Node 22+ (see .nvmrc).

npm ci
npm run dev        # run in Chrome with hot reload
npm run check      # type checking (svelte-check)
npm test           # unit tests (Vitest)
npm run build      # production build → .output/chrome-mv3
npm run zip        # store-submission zip → .output/

Acceptance tests

The Playwright storageState export is verified end-to-end: the exact storageState.json the extension produces is loaded into a real Chromium context and checked for live, correctly-flagged cookies. A second spec (e2e/perf.spec.ts, SUPA-148) validates performance at scale: it seeds a profile with 1,350 cookies and asserts the popup's list render, search, export, and bulk delete stay within generous smoke budgets, so hangs or quadratic regressions fail CI. These tests need a browser binary, so they run separately from npm test via make:

make e2e            # first run: download Chromium, then run the tests
make test-e2e       # subsequent runs (browser already installed)

CI runs the same targets (see .github/workflows/ci.yml).

Reproducible builds

Every store submission must be reproducible from this repository:

./scripts/verify-build.sh path/to/store-download.zip

The script performs a clean build with the pinned toolchain (.nvmrc + package-lock.json) and diffs the produced files against the given zip's contents. CI runs the same build on every push and publishes per-file content hashes as an artifact.

npm run zip is byte-reproducible: two builds of the same commit produce identical archives with the same sha1sum. WXT hands the built files to JSZip, which stamps each entry with the wall-clock build time, so a post-build step (scripts/normalize-zip.mjs) pins every embedded ZIP timestamp to the DOS epoch (1980-01-01). This only rewrites the container's clock — the extension's file contents are already deterministic and are left untouched.

verify-build.sh still compares contents rather than whole-file hashes because the Chrome Web Store re-packages the download as a CRX (adding _metadata/, re-zipping); the store artifact will never be byte-identical to our zip, but its contents match a clean build.

License

GPL-3.0-only