fix(cookies): require domain and path together when url is absent

cli/src/commands.rs

@@ -828,6 +828,17 @@ pub fn parse_command(args: &[String], flags: &Flags) -> Result<Value, ParseError
                         }
                     }
 
+                    // Playwright requires either `url` or a complete `domain`+`path` pair.
+                    let has_url = cookie.get("url").is_some();
+                    let has_domain = cookie.get("domain").is_some();
+                    let has_path = cookie.get("path").is_some();
+                    if !has_url && (has_domain != has_path) {
+                        return Err(ParseError::MissingArguments {
+                            context: "cookies set".to_string(),
+                            usage: "When not using --url, you must provide both --domain <domain> and --path <path>",
+                        });
+                    }
+
                     Ok(json!({ "id": id, "action": "cookies_set", "cookies": [cookie] }))
                 }
                 "clear" => Ok(json!({ "id": id, "action": "cookies_clear" })),
@@ -2097,28 +2108,34 @@ mod tests {
     }
 
     #[test]
-    fn test_cookies_set_with_domain() {
-        let cmd = parse_command(
+    fn test_cookies_set_with_domain_requires_path() {
+        let result = parse_command(
             &args("cookies set mycookie myvalue --domain example.com"),
             &default_flags(),
+        );
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_cookies_set_with_path_requires_domain() {
+        let result = parse_command(
+            &args("cookies set mycookie myvalue --path /api"),
+            &default_flags(),
+        );
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_cookies_set_with_domain_and_path() {
+        let cmd = parse_command(
+            &args("cookies set mycookie myvalue --domain example.com --path /api"),
+            &default_flags(),
         )
         .unwrap();
         assert_eq!(cmd["action"], "cookies_set");
         assert_eq!(cmd["cookies"][0]["name"], "mycookie");
         assert_eq!(cmd["cookies"][0]["value"], "myvalue");
         assert_eq!(cmd["cookies"][0]["domain"], "example.com");
-    }
-
-    #[test]
-    fn test_cookies_set_with_path() {
-        let cmd = parse_command(
-            &args("cookies set mycookie myvalue --path /api"),
-            &default_flags(),
-        )
-        .unwrap();
-        assert_eq!(cmd["action"], "cookies_set");
-        assert_eq!(cmd["cookies"][0]["name"], "mycookie");
-        assert_eq!(cmd["cookies"][0]["value"], "myvalue");
         assert_eq!(cmd["cookies"][0]["path"], "/api");
     }
 

cli/src/output.rs

@@ -1486,8 +1486,8 @@ Operations:
 
 Cookie Set Options:
   --url <url>                        URL for the cookie (allows setting before page load)
-  --domain <domain>                  Cookie domain (e.g., ".example.com")
-  --path <path>                      Cookie path (e.g., "/api")
+  --domain <domain>                  Cookie domain (use with --path, e.g., ".example.com")
+  --path <path>                      Cookie path (use with --domain, e.g., "/api")
   --httpOnly                         Set HttpOnly flag (prevents JavaScript access)
   --secure                           Set Secure flag (HTTPS only)
   --sameSite <Strict|Lax|None>       SameSite policy
@@ -1495,6 +1495,7 @@ Cookie Set Options:
 
 Note: If --url, --domain, and --path are all omitted, the cookie will be set
 for the current page URL.
+When --url is omitted, --domain and --path must be provided together.
 
 Global Options:
   --json               Output as JSON