fix: use browser.cookies API in Firefox extension for session

- Extension now reads session cookie using browser.cookies.get()
- Passes session as query parameter to work around SameSite=Lax
- Firefox cookie partitioning prevents credentials:include from working
- Works for both development and production cookie names

docs/git-history.json

···
 [
   {
-    "hash": "bb14ec5fb6426bbf4a7bc8bf1661bfbad29f16bd",
-    "short_hash": "bb14ec5",
+    "hash": "15b67054a684ebb2a21761a1774ba15f9b1c29e2",
+    "short_hash": "15b6705",
     "author": "Ariel M. Lighty",
-    "date": "2025-12-28T20:32:16-05:00",
-    "message": "fix: add Firefox extension CORS support\n\n- Added moz-extension:// origin detection to CORS handler\n- Added cookies permission to Firefox manifest for credentialed requests\n- Functions now properly reflect Firefox extension origins with credentials",
+    "date": "2025-12-28T20:38:38-05:00",
+    "message": "fix: add health check function for extension server detection\n\n- Created /health function endpoint with CORS support\n- Updated checkServerHealth to use function endpoint instead of root URL\n- Fixes Firefox extension server detection with proper CORS headers",
     "files_changed": 5
   },
   {
···
     "files_changed": 5
   },
   {
-    "hash": "d07180cd3a19328b82b35118e525b59d4e2e060b",
-    "short_hash": "d07180c",
+    "hash": "bd3aabb75abb1875aef125610fcdccb14967a8e3",
+    "short_hash": "bd3aabb",
     "author": "Ariel M. Lighty",
-    "date": "2025-12-27T18:38:39-05:00",
-    "message": "feat: add Tailwind CSS to extension\n\nReplaced 299 lines of vanilla CSS with Tailwind for design consistency with web app. Production build minified to 13KB.",
-    "files_changed": 9
+    "date": "2025-12-27T22:10:11-05:00",
+    "message": "fix: extension dark mode and build mode messaging\n\n- Changed darkMode from 'class' to 'media' for automatic system preference detection\n- Made server offline message conditional on build mode (dev vs prod)\n- Hide dev server instructions in production builds",
+    "files_changed": 5
   },
   {
     "hash": "d07180cd3a19328b82b35118e525b59d4e2e060b",
···
     "files_changed": 3
   },
   {
-    "hash": "32cdee3aeac7ef986df47e0fff786b5f7471e55b",
-    "short_hash": "32cdee3",
+    "hash": "ba29fd68872913ba0a587aa7f29f97b3d373a732",
+    "short_hash": "ba29fd6",
     "author": "Ariel M. Lighty",
     "date": "2025-12-25T13:22:32-05:00",
     "message": "configure Netlify dev for monorepo with --filter flag\n\nFixed Netlify CLI monorepo detection issue by using --filter flag:\n- Updated root package.json scripts to use 'npx netlify-cli dev --filter @atlast/web'\n- Updated netlify.toml [dev] section to use npm with --prefix for framework command\n- Added monorepo development instructions to CLAUDE.md\n- Documented Windows Git Bash compatibility issue with netlify command\n\nSolution: Use 'npx netlify-cli dev --filter @atlast/web' to bypass monorepo\nproject selection prompt and specify which workspace package to run.\n\nDev server now runs successfully at http://localhost:8888 with all backend\nfunctions loaded.",
-    "files_changed": 4
+    "files_changed": 5
   },
   {
-    "hash": "ba29fd68872913ba0a587aa7f29f97b3d373a732",
-    "short_hash": "ba29fd6",
+    "hash": "32cdee3aeac7ef986df47e0fff786b5f7471e55b",
+    "short_hash": "32cdee3",
     "author": "Ariel M. Lighty",
     "date": "2025-12-25T13:22:32-05:00",
     "message": "configure Netlify dev for monorepo with --filter flag\n\nFixed Netlify CLI monorepo detection issue by using --filter flag:\n- Updated root package.json scripts to use 'npx netlify-cli dev --filter @atlast/web'\n- Updated netlify.toml [dev] section to use npm with --prefix for framework command\n- Added monorepo development instructions to CLAUDE.md\n- Documented Windows Git Bash compatibility issue with netlify command\n\nSolution: Use 'npx netlify-cli dev --filter @atlast/web' to bypass monorepo\nproject selection prompt and specify which workspace package to run.\n\nDev server now runs successfully at http://localhost:8888 with all backend\nfunctions loaded.",
-    "files_changed": 5
+    "files_changed": 4
   },
   {
     "hash": "c3e7afad396d130791d801a85cbfc9643bcd6309",

docs/graph-data.json

···
       "node_type": "observation",
       "title": "Health endpoint gets CORS headers correctly (moz-extension detected). Session endpoint error middleware doesn't pass event to errorResponse, returns wildcard CORS. Need to fix error middleware to pass event.",
       "description": null,
-      "status": "pending",
+      "status": "completed",
       "created_at": "2025-12-28T20:55:32.024834200-05:00",
-      "updated_at": "2025-12-28T20:55:32.024834200-05:00",
+      "updated_at": "2025-12-28T21:38:14.729731500-05:00",
       "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
     },
     {
···
       "node_type": "action",
       "title": "Fixed error middleware to pass event to errorResponse for proper CORS headers on errors",
       "description": null,
-      "status": "pending",
+      "status": "completed",
       "created_at": "2025-12-28T20:56:38.876266200-05:00",
-      "updated_at": "2025-12-28T20:56:38.876266200-05:00",
+      "updated_at": "2025-12-28T21:38:14.888627800-05:00",
       "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
     },
     {
···
       "node_type": "outcome",
       "title": "Fixed Firefox extension CORS completely. Error middleware now passes event to errorResponse so Firefox extension origin is properly reflected in error responses with credentials. Debug logging removed.",
       "description": null,
+      "status": "completed",
+      "created_at": "2025-12-28T21:37:22.780953600-05:00",
+      "updated_at": "2025-12-28T21:38:15.071425500-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
+    },
+    {
+      "id": 394,
+      "change_id": "3b0dea7a-c3cd-45a8-ba1a-f1040aa4e1d9",
+      "node_type": "observation",
+      "title": "CORS fully working - Firefox extension origin properly reflected with credentials. But cookies not sent from extension despite credentials:include. Cookie set in web context not accessible from extension context due to Firefox cookie partitioning.",
+      "description": null,
       "status": "pending",
-      "created_at": "2025-12-28T21:37:22.780953600-05:00",
-      "updated_at": "2025-12-28T21:37:22.780953600-05:00",
+      "created_at": "2025-12-28T21:46:45.822343200-05:00",
+      "updated_at": "2025-12-28T21:46:45.822343200-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
+    },
+    {
+      "id": 395,
+      "change_id": "8a93413f-a09c-4cc1-8693-4fe90dc055c4",
+      "node_type": "action",
+      "title": "Updated extension checkSession to read cookie via browser.cookies API and pass as query parameter. Workaround for Firefox SameSite=Lax cookie partitioning.",
+      "description": null,
+      "status": "pending",
+      "created_at": "2025-12-28T21:52:22.059862700-05:00",
+      "updated_at": "2025-12-28T21:52:22.059862700-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
+    },
+    {
+      "id": 396,
+      "change_id": "864dd973-5f15-4e31-a7da-c548dbbe1f0e",
+      "node_type": "outcome",
+      "title": "Extension now uses browser.cookies.get() API to read session cookie and pass as query parameter. Workaround for Firefox SameSite=Lax cookie partitioning in extensions. Extension rebuilt successfully.",
+      "description": null,
+      "status": "pending",
+      "created_at": "2025-12-28T22:51:31.578965200-05:00",
+      "updated_at": "2025-12-28T22:51:31.578965200-05:00",
       "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
     }
   ],
···
       "weight": 1.0,
       "rationale": "Complete fix with cleanup",
       "created_at": "2025-12-28T21:37:27.704906300-05:00"
+    },
+    {
+      "id": 390,
+      "from_node_id": 393,
+      "to_node_id": 394,
+      "from_change_id": "aafd9977-8800-4152-9f7f-b817db6df573",
+      "to_change_id": "3b0dea7a-c3cd-45a8-ba1a-f1040aa4e1d9",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "New issue - cookie partitioning",
+      "created_at": "2025-12-28T21:46:48.417911400-05:00"
+    },
+    {
+      "id": 391,
+      "from_node_id": 394,
+      "to_node_id": 395,
+      "from_change_id": "3b0dea7a-c3cd-45a8-ba1a-f1040aa4e1d9",
+      "to_change_id": "8a93413f-a09c-4cc1-8693-4fe90dc055c4",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "Workaround using browser.cookies API",
+      "created_at": "2025-12-28T21:52:52.704792400-05:00"
+    },
+    {
+      "id": 392,
+      "from_node_id": 395,
+      "to_node_id": 396,
+      "from_change_id": "8a93413f-a09c-4cc1-8693-4fe90dc055c4",
+      "to_change_id": "864dd973-5f15-4e31-a7da-c548dbbe1f0e",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "Complete workaround",
+      "created_at": "2025-12-28T22:51:33.159870400-05:00"
     }
   ]
 }

packages/extension/src/lib/api-client.ts

···
   avatar?: string;
 } | null> {
   try {
-    const response = await fetch(`${ATLAST_API_URL}/.netlify/functions/session`, {
+    // Try to get session cookie using browser.cookies API
+    // This works around Firefox's cookie partitioning for extensions
+    let sessionId: string | null = null;
+
+    try {
+      const cookieName = __BUILD_MODE__ === 'production' ? 'atlast_session' : 'atlast_session_dev';
+      const cookie = await browser.cookies.get({
+        url: ATLAST_API_URL,
+        name: cookieName
+      });
+
+      if (cookie) {
+        sessionId = cookie.value;
+        console.log('[API Client] Found session cookie:', cookieName);
+      }
+    } catch (cookieError) {
+      console.log('[API Client] Could not read cookie:', cookieError);
+    }
+
+    // Build URL with session parameter if we have one
+    const url = sessionId
+      ? `${ATLAST_API_URL}/.netlify/functions/session?session=${sessionId}`
+      : `${ATLAST_API_URL}/.netlify/functions/session`;
+
+    const response = await fetch(url, {
       method: 'GET',
-      credentials: 'include', // Include cookies
+      credentials: 'include', // Include cookies as fallback
       headers: {
         'Accept': 'application/json'
       }