cookies set silently ignores --http-only and --same-site and reports success

Summary

cookies set drops any flag it does not recognise and still reports success. The kebab-case spellings required by the repository's own AGENTS.md rule ("CLI flags must always use kebab-case") are among the unrecognised ones, so --http-only and --same-site Strict are discarded. The cookie is written without those attributes, the command prints ✓ Done and exits 0, and only a later cookies --json reveals the difference.

Severity

High. Two of the flags being dropped are the cookie's security attributes, and the drop is indistinguishable from success.

Affected version

Found on agent-browser 0.37.1 (shipped npm binary, Linux, real Chrome). The code path is unchanged in v0.38.0 / cd063d1.

Steps to reproduce

agent-browser cookies set bad v2 --url http://cookie.test:8901/ --http-only --same-site Strict
agent-browser cookies --json          # httpOnly: false, no sameSite

# The camelCase spellings, which the flag rule forbids, do work:
agent-browser cookies set good v2 --url http://cookie.test:8901/ --httpOnly --sameSite Strict
agent-browser cookies --json          # httpOnly: true, sameSite: "Strict"

Actual behaviour

The first command prints ✓ Done and exits 0. cookies --json shows the cookie with httpOnly false and no sameSite field. The second command, using the camelCase spellings, produces httpOnly true and sameSite "Strict", which isolates the difference to flag spelling rather than to anything about the cookie or the page.

Expected behaviour

--http-only and --same-site are accepted as the primary spellings, and any flag the parser genuinely does not recognise is an error with a non-zero exit, never silently discarded.

Root cause

cli/src/commands.rs:1503 and cli/src/commands.rs:1511 match only the literals "--httpOnly" and "--sameSite". The catch-all arm at cli/src/commands.rs:1552 is commented "Unknown flag, skip it (or could error)" and advances the argument index by one without recording anything. The two failures compound: the spelling the project mandates falls into the catch-all, and the catch-all is what makes the miss invisible. Because --same-site is skipped as a single token, its value Strict is then read as another unknown token and skipped as well, so nothing survives to signal that an argument was ignored.

Impact

An AI agent setting up an authenticated session follows the documented kebab-case convention, gets ✓ Done and exit 0, and proceeds believing the session cookie is HttpOnly and SameSite-restricted when it is neither. The cookie remains readable from page JavaScript and is sent on cross-site requests, so a prompt injection or a malicious page reached later in the same session can read or replay it. Verifying the outcome requires a separate cookies --json call that nothing prompts the agent to make.

Start in cli/src/commands.rs around lines 1503, 1511, and 1552, then run the reproduction commands from the issue. Trace how kebab-case cookie flags and unknown arguments are handled. Done means --http-only and --same-site preserve their values, while genuinely unknown flags fail instead of reporting success.