chore: clean up the server cookie automation converters and various automation code

[AtofStryker]

• Closes N/A — cleanup driven by the cookie automation consolidation (explained below)

Additional details

Stacked on #34245 (refactor/automation_client_p2), which stacks on #34244 — this PR targets the p2 branch.

Unlike the earlier PRs in this stack, this one does contain behavior changes. The goal is no regressions — each change below is either provably unreachable code, or a deliberate contract cleanup with the reasoning spelled out. New direct unit tests pin all of it.

Behavior changes, each with its no-regression rationale:

1. Removed obsolete Firefox-CDP handling from cdp_automation.ts. Firefox runs exclusively through WebDriver BiDi (and upstream Firefox removed CDP entirely), so two accommodations are unreachable: the URL hash strip in onNetworkRequestWillBeSent (Firefox CDP bug — Chromium strips fragments per spec before the network layer) and the ffToStandardResourceTypeMap (img/csp/webmanifest are Firefox-CDP type names; I enumerated the possible inputs — Chromium CDP's PascalCase ResourceType enum and playwright's lowercase resource types — and neither can produce them). The validResourceTypes allowlist itself is untouched since its membership defines live cy.intercept resourceType behavior, and new tests pin the full mapping for every CDP and playwright value.

2. clear:cookies (CDP) no longer emits undefined placeholder entries for cookies that don't exist at clear time. The placeholders were a Bluebird.mapSeries artifact that survived to the driver unfiltered — but they're only producible via a race, because the driver fetches existing cookies immediately before clearing them. The response now reports only cookies actually cleared.

3. Minimum supported Firefox is now 140. Firefox support is rolling — versions 135–139 are no longer maintained by Mozilla, and ESR 140 is the oldest line Mozilla ships. Their BiDi implementations also predate the default sameSite value Cypress relies on, which is what motivated this: with the floor at 140, the Firefox-version sameSite guard and all its majorFirefoxVersion parameter threading come out of convertSameSiteExtensionToBiDi, convertCyCookieToBiDiCookie, and BidiAutomation. No changelog entry: Cypress documents rolling support for the last 3 major versions of each browser, so moving the enforcement floor is housekeeping rather than a policy change.

4. The CDP cookie converters are now pure functions. convertCdpCookieToCyCookie previously mutated the incoming CDP cookie in place behind seven @ts-ignores and returned it — it now builds a fresh CyCookie (which also stops passing through CDP-only fields like size/session; the automation layer already stripped those via _.pick before they reached the driver). convertCyCookieToCdpCookie loses a delete cookie.hostOnly input side effect that never influenced the outgoing SetCookieRequest. CyCookie.hostOnly becomes optional to reflect that every producer sets it conditionally — the required field inherited from chrome.cookies.Cookie was what forced the @ts-ignores. The existing middleware deep-equality specs pass unchanged, confirming identical output shapes.

Behavior-neutral commits alongside:

• The per-protocol converters are renamed for the dialects they translate: convertCdpCookieToCyCookie / convertCyCookieToCdpCookie (formerly normalizeGetCookieProps / normalizeSetCookieProps in the cdp converter), convertPlaywrightCookieToCyCookie / convertCyCookieToPlaywrightCookie (formerly the same normalize* names in the webkit converter), and convertSameSiteExtensionToPlaywright (formerly ...ToCypress, which misdescribed its output vocabulary). normalize* now exclusively means the within-dialect cleanup in cookie/automation.ts.
• The sameSite vocabulary is consolidated into cookie/util.ts (ExtensionSameSiteStatus + sameSiteExtensionToProtocolMap), replacing three hand-written copies.
• New direct unit specs under test/unit/automation/cookie/converters/ (48 tests) mirror the lib layout so they move with the code when it's eventually extracted from the server package. They cover previously-untested surfaces: the __Host- domain→url swap, isHostOnlyCookie edge cases (dot-prefix/localhost/IP), the playwright converters (no prior cookie-shape coverage at all), and purity pins on every converter.

Steps to test

yarn workspace @packages/server test-unit -- cdp_spec      # new: CDP converter suite
yarn workspace @packages/server test-unit -- bidi_spec     # new: BiDi converter suite
yarn workspace @packages/server test-unit -- webkit_spec   # new: playwright converter suite
yarn workspace @packages/server test-unit -- util_spec     # cookieMatches + isHostOnlyCookie
yarn workspace @packages/server test-unit -- automation    # middleware behavior (unchanged assertions)
yarn workspace @packages/launcher test                     # validator floor + detection fixtures

Firefox e2e/system jobs run against Firefox 141+ in CI, so the floor bump doesn't change what CI exercises.

How has the user experience changed?

Users launching Firefox 135–139 now see the unsupported-browser warning ("Cypress does not support running Firefox version NNN due to an incomplete WebDriver BiDi implementation. To use Firefox with Cypress, install version 140 or newer.") where those versions previously launched. No other user-visible change.

PR Tasks

• [na] Is there an associated issue with maintainer approval for PR submission? — internal cleanup within the cookie automation consolidation stack
• Have tests been added/updated?
• Has a PR for user-facing changes been opened in cypress-documentation? — the documented minimum Firefox version needs updating to 140; will link the docs PR here
• [na] Have API changes been updated in the type definitions?

---

Note

Medium Risk
Touches cookie get/set/clear across CDP and BiDi and changes supported Firefox versions (135–139 blocked); behavior is heavily unit-tested but cookie automation is user-facing.

Overview
Refactors server cookie automation so CDP, BiDi, and WebKit/Playwright converters are pure, renamed (convert*), and sameSite mapping lives in cookie/util.ts (ExtensionSameSiteStatus, sameSiteExtensionToProtocolMap) instead of three copies.

Firefox 140+ is now required in the launcher validator (was 135); BiDi drops majorFirefoxVersion sameSite workarounds because older Firefox BiDi lacked the default sameSite value.

CDP path: converters build fresh CyCookie objects (no in-place mutation / CDP-only fields leaking); clear:cookies omits undefined entries for cookies already gone; Firefox-CDP-only URL hash stripping and ffToStandardResourceTypeMap are removed from cdp_automation (Firefox uses BiDi only).

Adds unit specs under test/unit/automation/cookie/converters/ and updates launcher/driver tests for the new Firefox floor and e2e sameSite comment.

^{Reviewed by Cursor Bugbot for commit 3b14a28. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cypress]

cypress    Run #72361

Run Properties:   Passed #72361  •  3b14a28063: test(server): add direct unit coverage for the cookie converters

Project	cypress
Branch Review	refactor/automation_client_p3
Run status	Passed #72361
Run duration	15m 57s
Commit	3b14a28063: test(server): add direct unit coverage for the cookie converters
Committer	Bill Glesias
View all properties for this run ↗︎

---

Test results
Failures	0
Flaky	7
Pending	1113
Skipped	0
Passing	24944
View all changes introduced in this branch ↗︎

---

Warning

No Report: Something went wrong and we could not generate a report for the Application Quality products.