@humain/terminal 0.0.3-beta.0 → 0.0.3-beta.2

package/dist/humain/web-access/vendor/auth-fetch.js

@@ -0,0 +1,134 @@
+import { existsSync, readFileSync } from "node:fs";
+import { getWebSearchConfigPath } from "./utils.js";
+const WEB_SEARCH_CONFIG_PATH = getWebSearchConfigPath();
+const AUTH_PROFILE_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+export function resolveAuthFetchProfile(request) {
+    const profiles = loadAuthFetchProfiles();
+    if (profiles.length === 0) {
+        throw new Error(`auth requires at least one authFetch profile in ${WEB_SEARCH_CONFIG_PATH}`);
+    }
+    if (request === true) {
+        if (profiles.length !== 1) {
+            throw new Error("auth: true requires exactly one authFetch profile; use a profile name instead");
+        }
+        return profiles[0];
+    }
+    const name = request.trim();
+    const profile = profiles.find(candidate => candidate.name === name);
+    if (!profile)
+        throw new Error(`Unknown authFetch profile: ${name}`);
+    return profile;
+}
+export function assertAuthFetchUrl(profile, rawUrl) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Authenticated fetch requires an HTTPS URL: ${message}`);
+    }
+    if (url.protocol !== "https:")
+        throw new Error("Authenticated fetch requires an HTTPS URL");
+    const hostname = normalizeHostname(url.hostname);
+    if (!profile.hosts.some(host => hostMatches(hostname, host))) {
+        throw new Error(`URL host ${hostname} is not allowed by authFetch profile ${profile.name}`);
+    }
+    return url;
+}
+export function authFetchRedirectGuard(profile, from, to) {
+    if (profile.redirects === "same-origin" && to.origin !== from.origin) {
+        throw new Error(`Authenticated fetch refused cross-origin redirect: ${from.origin} -> ${to.origin}`);
+    }
+}
+function loadAuthFetchProfiles() {
+    if (!existsSync(WEB_SEARCH_CONFIG_PATH))
+        return [];
+    const raw = readFileSync(WEB_SEARCH_CONFIG_PATH, "utf-8");
+    let parsed;
+    try {
+        const value = JSON.parse(raw);
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new Error("expected a JSON object");
+        parsed = value;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Failed to parse ${WEB_SEARCH_CONFIG_PATH}: ${message}`);
+    }
+    if (parsed.authFetch === undefined || parsed.authFetch === null)
+        return [];
+    if (typeof parsed.authFetch !== "object" || Array.isArray(parsed.authFetch)) {
+        throw new Error(`authFetch in ${WEB_SEARCH_CONFIG_PATH} must be an object`);
+    }
+    return Object.entries(parsed.authFetch).map(([name, value]) => parseProfile(name, value));
+}
+function parseProfile(name, value) {
+    if (!AUTH_PROFILE_NAME_PATTERN.test(name)) {
+        throw new Error(`authFetch profile name ${JSON.stringify(name)} must start with a letter and contain only letters, numbers, underscores, or hyphens`);
+    }
+    if (Array.isArray(value)) {
+        return { name, hosts: parseHosts(value, `authFetch.${name}`), redirects: "same-origin", cache: "session" };
+    }
+    if (!value || typeof value !== "object") {
+        throw new Error(`authFetch.${name} in ${WEB_SEARCH_CONFIG_PATH} must be an array of hosts or an object`);
+    }
+    const config = value;
+    if (!Array.isArray(config.hosts)) {
+        throw new Error(`authFetch.${name}.hosts in ${WEB_SEARCH_CONFIG_PATH} must be a non-empty array of hostnames`);
+    }
+    const redirects = config.redirects ?? "same-origin";
+    if (redirects !== "same-origin") {
+        throw new Error(`authFetch.${name}.redirects in ${WEB_SEARCH_CONFIG_PATH} must be "same-origin"`);
+    }
+    const cache = config.cache ?? "session";
+    if (cache !== "session" && cache !== "off") {
+        throw new Error(`authFetch.${name}.cache in ${WEB_SEARCH_CONFIG_PATH} must be "session" or "off"`);
+    }
+    const chromeProfile = parseChromeProfile(config.chromeProfile, `authFetch.${name}.chromeProfile`);
+    return {
+        name,
+        hosts: parseHosts(config.hosts, `authFetch.${name}.hosts`),
+        ...(chromeProfile ? { chromeProfile } : {}),
+        redirects,
+        cache,
+    };
+}
+function parseHosts(value, label) {
+    if (value.length === 0)
+        throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must be a non-empty array of hostnames`);
+    const hosts = value.map((entry) => {
+        if (typeof entry !== "string")
+            throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must contain only hostnames`);
+        return parseHost(entry, label);
+    });
+    return [...new Set(hosts)];
+}
+function parseHost(value, label) {
+    const host = normalizeHostname(value.trim());
+    if (!host || host.startsWith(".") || host.endsWith(".") || /\s|[\\/?:#@*]/.test(host)) {
+        throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} contains an invalid hostname: ${JSON.stringify(value)}`);
+    }
+    if (host.length > 253 || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(host)) {
+        throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} contains an invalid hostname: ${JSON.stringify(value)}`);
+    }
+    return host;
+}
+function parseChromeProfile(value, label) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== "string")
+        throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must be a string`);
+    const normalized = value.trim();
+    if (!normalized || normalized === "." || normalized === ".." || normalized.includes("/") || normalized.includes("\\")) {
+        throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must be a profile directory name, not a path`);
+    }
+    return normalized;
+}
+function normalizeHostname(hostname) {
+    return hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+}
+function hostMatches(hostname, allowedHost) {
+    return hostname === allowedHost || hostname.endsWith(`.${allowedHost}`);
+}
+//# sourceMappingURL=auth-fetch.js.map

package/dist/humain/web-access/vendor/auth-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-fetch.js","sourceRoot":"","sources":["../../../../src/humain/web-access/vendor/auth-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,sBAAsB,GAAG,sBAAsB,EAAE,CAAC;AACxD,MAAM,yBAAyB,GAAG,+BAA+B,CAAC;AAiBlE,MAAM,UAAU,uBAAuB,CAAC,OAAyB,EAAoB;IACpF,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,mDAAmD,sBAAsB,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QAClG,CAAC;QACD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACpE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;IACpE,OAAO,OAAO,CAAC;AAAA,CACf;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAyB,EAAE,MAAc,EAAO;IAClF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,8CAA8C,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,YAAY,QAAQ,wCAAwC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,GAAG,CAAC;AAAA,CACX;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAyB,EAAE,IAAS,EAAE,EAAO,EAAQ;IAC3F,IAAI,OAAO,CAAC,SAAS,KAAK,aAAa,IAAI,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,CAAC,MAAM,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACtG,CAAC;AAAA,CACD;AAED,SAAS,qBAAqB,GAAuB;IACpD,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC;QAAE,OAAO,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACJ,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC3G,MAAM,GAAG,KAA4B,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,sBAAsB,KAAK,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC3E,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,gBAAgB,sBAAsB,oBAAoB,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAoC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAAA,CACrH;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAc,EAAoB;IACrE,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;IACvJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,aAAa,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC5G,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,OAAO,sBAAsB,yCAAyC,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,aAAa,sBAAsB,yCAAyC,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,aAAa,CAAC;IACpD,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,iBAAiB,sBAAsB,wBAAwB,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC;IACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,aAAa,sBAAsB,6BAA6B,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,aAAa,EAAE,aAAa,IAAI,gBAAgB,CAAC,CAAC;IAClG,OAAO;QACN,IAAI;QACJ,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,IAAI,QAAQ,CAAC;QAC1D,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,SAAS;QACT,KAAK;KACL,CAAC;AAAA,CACF;AAED,SAAS,UAAU,CAAC,KAAgB,EAAE,KAAa,EAAY;IAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,sBAAsB,yCAAyC,CAAC,CAAC;IACxH,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,sBAAsB,8BAA8B,CAAC,CAAC;QACpH,OAAO,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAAA,CAC/B,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAAA,CAC3B;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,KAAa,EAAU;IACxD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,sBAAsB,kCAAkC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,oFAAoF,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3H,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,sBAAsB,kCAAkC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,KAAa,EAAsB;IAC9E,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,sBAAsB,mBAAmB,CAAC,CAAC;IACzG,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvH,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,sBAAsB,+CAA+C,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,UAAU,CAAC;AAAA,CAClB;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAU;IACpD,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAAA,CACzE;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,WAAmB,EAAW;IACpE,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC;AAAA,CACxE","sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { getWebSearchConfigPath } from \"./utils.ts\";\n\nconst WEB_SEARCH_CONFIG_PATH = getWebSearchConfigPath();\nconst AUTH_PROFILE_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;\n\nexport type AuthFetchRequest = true | string;\nexport type AuthFetchCache = \"session\" | \"off\";\n\nexport interface AuthFetchProfile {\n\tname: string;\n\thosts: string[];\n\tchromeProfile?: string;\n\tredirects: \"same-origin\";\n\tcache: AuthFetchCache;\n}\n\ninterface AuthFetchConfigRoot {\n\tauthFetch?: unknown;\n}\n\nexport function resolveAuthFetchProfile(request: AuthFetchRequest): AuthFetchProfile {\n\tconst profiles = loadAuthFetchProfiles();\n\tif (profiles.length === 0) {\n\t\tthrow new Error(`auth requires at least one authFetch profile in ${WEB_SEARCH_CONFIG_PATH}`);\n\t}\n\tif (request === true) {\n\t\tif (profiles.length !== 1) {\n\t\t\tthrow new Error(\"auth: true requires exactly one authFetch profile; use a profile name instead\");\n\t\t}\n\t\treturn profiles[0];\n\t}\n\tconst name = request.trim();\n\tconst profile = profiles.find(candidate => candidate.name === name);\n\tif (!profile) throw new Error(`Unknown authFetch profile: ${name}`);\n\treturn profile;\n}\n\nexport function assertAuthFetchUrl(profile: AuthFetchProfile, rawUrl: string): URL {\n\tlet url: URL;\n\ttry {\n\t\turl = new URL(rawUrl);\n\t} catch (err) {\n\t\tconst message = err instanceof Error ? err.message : String(err);\n\t\tthrow new Error(`Authenticated fetch requires an HTTPS URL: ${message}`);\n\t}\n\tif (url.protocol !== \"https:\") throw new Error(\"Authenticated fetch requires an HTTPS URL\");\n\tconst hostname = normalizeHostname(url.hostname);\n\tif (!profile.hosts.some(host => hostMatches(hostname, host))) {\n\t\tthrow new Error(`URL host ${hostname} is not allowed by authFetch profile ${profile.name}`);\n\t}\n\treturn url;\n}\n\nexport function authFetchRedirectGuard(profile: AuthFetchProfile, from: URL, to: URL): void {\n\tif (profile.redirects === \"same-origin\" && to.origin !== from.origin) {\n\t\tthrow new Error(`Authenticated fetch refused cross-origin redirect: ${from.origin} -> ${to.origin}`);\n\t}\n}\n\nfunction loadAuthFetchProfiles(): AuthFetchProfile[] {\n\tif (!existsSync(WEB_SEARCH_CONFIG_PATH)) return [];\n\tconst raw = readFileSync(WEB_SEARCH_CONFIG_PATH, \"utf-8\");\n\tlet parsed: AuthFetchConfigRoot;\n\ttry {\n\t\tconst value: unknown = JSON.parse(raw);\n\t\tif (!value || typeof value !== \"object\" || Array.isArray(value)) throw new Error(\"expected a JSON object\");\n\t\tparsed = value as AuthFetchConfigRoot;\n\t} catch (err) {\n\t\tconst message = err instanceof Error ? err.message : String(err);\n\t\tthrow new Error(`Failed to parse ${WEB_SEARCH_CONFIG_PATH}: ${message}`);\n\t}\n\tif (parsed.authFetch === undefined || parsed.authFetch === null) return [];\n\tif (typeof parsed.authFetch !== \"object\" || Array.isArray(parsed.authFetch)) {\n\t\tthrow new Error(`authFetch in ${WEB_SEARCH_CONFIG_PATH} must be an object`);\n\t}\n\treturn Object.entries(parsed.authFetch as Record<string, unknown>).map(([name, value]) => parseProfile(name, value));\n}\n\nfunction parseProfile(name: string, value: unknown): AuthFetchProfile {\n\tif (!AUTH_PROFILE_NAME_PATTERN.test(name)) {\n\t\tthrow new Error(`authFetch profile name ${JSON.stringify(name)} must start with a letter and contain only letters, numbers, underscores, or hyphens`);\n\t}\n\tif (Array.isArray(value)) {\n\t\treturn { name, hosts: parseHosts(value, `authFetch.${name}`), redirects: \"same-origin\", cache: \"session\" };\n\t}\n\tif (!value || typeof value !== \"object\") {\n\t\tthrow new Error(`authFetch.${name} in ${WEB_SEARCH_CONFIG_PATH} must be an array of hosts or an object`);\n\t}\n\tconst config = value as Record<string, unknown>;\n\tif (!Array.isArray(config.hosts)) {\n\t\tthrow new Error(`authFetch.${name}.hosts in ${WEB_SEARCH_CONFIG_PATH} must be a non-empty array of hostnames`);\n\t}\n\tconst redirects = config.redirects ?? \"same-origin\";\n\tif (redirects !== \"same-origin\") {\n\t\tthrow new Error(`authFetch.${name}.redirects in ${WEB_SEARCH_CONFIG_PATH} must be \"same-origin\"`);\n\t}\n\tconst cache = config.cache ?? \"session\";\n\tif (cache !== \"session\" && cache !== \"off\") {\n\t\tthrow new Error(`authFetch.${name}.cache in ${WEB_SEARCH_CONFIG_PATH} must be \"session\" or \"off\"`);\n\t}\n\tconst chromeProfile = parseChromeProfile(config.chromeProfile, `authFetch.${name}.chromeProfile`);\n\treturn {\n\t\tname,\n\t\thosts: parseHosts(config.hosts, `authFetch.${name}.hosts`),\n\t\t...(chromeProfile ? { chromeProfile } : {}),\n\t\tredirects,\n\t\tcache,\n\t};\n}\n\nfunction parseHosts(value: unknown[], label: string): string[] {\n\tif (value.length === 0) throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must be a non-empty array of hostnames`);\n\tconst hosts = value.map((entry) => {\n\t\tif (typeof entry !== \"string\") throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must contain only hostnames`);\n\t\treturn parseHost(entry, label);\n\t});\n\treturn [...new Set(hosts)];\n}\n\nfunction parseHost(value: string, label: string): string {\n\tconst host = normalizeHostname(value.trim());\n\tif (!host || host.startsWith(\".\") || host.endsWith(\".\") || /\\s|[\\\\/?:#@*]/.test(host)) {\n\t\tthrow new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} contains an invalid hostname: ${JSON.stringify(value)}`);\n\t}\n\tif (host.length > 253 || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(host)) {\n\t\tthrow new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} contains an invalid hostname: ${JSON.stringify(value)}`);\n\t}\n\treturn host;\n}\n\nfunction parseChromeProfile(value: unknown, label: string): string | undefined {\n\tif (value === undefined || value === null) return undefined;\n\tif (typeof value !== \"string\") throw new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must be a string`);\n\tconst normalized = value.trim();\n\tif (!normalized || normalized === \".\" || normalized === \"..\" || normalized.includes(\"/\") || normalized.includes(\"\\\\\")) {\n\t\tthrow new Error(`${label} in ${WEB_SEARCH_CONFIG_PATH} must be a profile directory name, not a path`);\n\t}\n\treturn normalized;\n}\n\nfunction normalizeHostname(hostname: string): string {\n\treturn hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\").replace(/\\.$/, \"\");\n}\n\nfunction hostMatches(hostname: string, allowedHost: string): boolean {\n\treturn hostname === allowedHost || hostname.endsWith(`.${allowedHost}`);\n}\n"]}

package/dist/humain/web-access/vendor/chrome-cookies.d.ts

@@ -1,5 +1,6 @@
 export type CookieMap = Record<string, string>;
 export declare function getLastGoogleCookieDiagnostic(): string | null;
+export declare function getLastBrowserCookieDiagnostic(): string | null;
 export declare function getGoogleCookies(options?: {
     profile?: string;
     requiredCookies?: string[];
@@ -7,4 +8,16 @@ export declare function getGoogleCookies(options?: {
     cookies: CookieMap;
     warnings: string[];
 } | null>;
+export declare function getBrowserCookiesForHosts(options: {
+    hosts: string[];
+    profile?: string;
+    requiredCookies?: string[];
+    cookieNames?: Iterable<string>;
+    requiredLabel?: string;
+    requestUrl?: URL;
+}): Promise<{
+    cookies: CookieMap;
+    warnings: string[];
+    cookieHeader?: string;
+} | null>;
 //# sourceMappingURL=chrome-cookies.d.ts.map

package/dist/humain/web-access/vendor/chrome-cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chrome-cookies.d.ts","sourceRoot":"","sources":["../../../../src/humain/web-access/vendor/chrome-cookies.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAyC/C,wBAAgB,6BAA6B,IAAI,MAAM,GAAG,IAAI,CAE7D;AAED,wBAAsB,gBAAgB,CACrC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACxD,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAAC,CA4G5D","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { pbkdf2Sync, createDecipheriv } from \"node:crypto\";\nimport { copyFileSync, existsSync, mkdtempSync, readdirSync, realpathSync, rmSync } from \"node:fs\";\nimport { tmpdir, homedir, platform } from \"node:os\";\nimport { isAbsolute, join, sep } from \"node:path\";\nimport { isBrowserCookieAccessAllowed } from \"./gemini-web-config.ts\";\n\nexport type CookieMap = Record<string, string>;\n\ninterface BrowserConfig {\n\tname: string;\n\tbaseDir: string;\n\tkeychainService?: string;\n\tkeychainAccount?: string;\n\tsecretToolApp?: string;\n}\n\ntype SqliteRow = Record<string, unknown>;\ntype SqliteFailure = \"unavailable\" | \"query\";\n\nconst GOOGLE_ORIGINS = [\n\t\"https://gemini.google.com\",\n\t\"https://accounts.google.com\",\n\t\"https://www.google.com\",\n];\n\nconst ALL_COOKIE_NAMES = new Set([\n\t\"__Secure-1PSID\", \"__Secure-1PSIDTS\", \"__Secure-1PSIDCC\", \"__Secure-1PAPISID\", \"NID\", \"AEC\", \"SOCS\",\n\t\"__Secure-BUCKET\", \"__Secure-ENID\", \"SID\", \"HSID\", \"SSID\", \"APISID\", \"SAPISID\", \"__Secure-3PSID\",\n\t\"__Secure-3PSIDTS\", \"__Secure-3PAPISID\", \"SIDCC\",\n]);\n\nconst MACOS_BROWSER_CONFIGS: BrowserConfig[] = [\n\t{ name: \"Helium\", baseDir: \"Library/Application Support/net.imput.helium\", keychainService: \"Helium Storage Key\", keychainAccount: \"Helium\" },\n\t{ name: \"Chrome\", baseDir: \"Library/Application Support/Google/Chrome\", keychainService: \"Chrome Safe Storage\", keychainAccount: \"Chrome\" },\n\t{ name: \"Arc\", baseDir: \"Library/Application Support/Arc/User Data\", keychainService: \"Arc Safe Storage\", keychainAccount: \"Arc\" },\n];\n\nconst LINUX_BROWSER_CONFIGS: BrowserConfig[] = [\n\t{ name: \"Chromium\", baseDir: \".config/chromium\", secretToolApp: \"chromium\" },\n\t{ name: \"Chrome\", baseDir: \".config/google-chrome\", secretToolApp: \"chrome\" },\n];\n\nconst browserPasswordCache = new Map<string, Promise<string | null>>();\nlet lastCookieDiagnostic: string | null = null;\nlet sqliteModule: typeof import(\"node:sqlite\") | null = null;\nlet sqliteImportAttempted = false;\n\nexport function getLastGoogleCookieDiagnostic(): string | null {\n\treturn lastCookieDiagnostic;\n}\n\nexport async function getGoogleCookies(\n\toptions?: { profile?: string; requiredCookies?: string[] },\n): Promise<{ cookies: CookieMap; warnings: string[] } | null> {\n\tlastCookieDiagnostic = null;\n\tif (!isBrowserCookieAccessAllowed()) {\n\t\tlastCookieDiagnostic = \"Browser cookie access is disabled; enable allowBrowserCookies to use Gemini Web cookies.\";\n\t\treturn null;\n\t}\n\n\tconst currentPlatform = platform();\n\tconst configs = currentPlatform === \"darwin\" ? MACOS_BROWSER_CONFIGS : currentPlatform === \"linux\" ? LINUX_BROWSER_CONFIGS : [];\n\tif (configs.length === 0) {\n\t\tlastCookieDiagnostic = \"Chromium cookie extraction is unsupported on this platform.\";\n\t\treturn null;\n\t}\n\n\tconst warningSet = new Set<string>();\n\tconst rawProfile = typeof options?.profile === \"string\" ? options.profile.trim() : \"\";\n\tconst requestedProfile = normalizeProfileName(options?.profile);\n\tif (rawProfile && !requestedProfile) {\n\t\tlastCookieDiagnostic = \"Configured Chromium profile must be a profile directory name, not a path.\";\n\t\treturn null;\n\t}\n\tconst requiredCookies = normalizeCookieNames(options?.requiredCookies);\n\tconst hosts = GOOGLE_ORIGINS.map((origin) => new URL(origin).hostname);\n\tconst home = homedir();\n\tlet sawCookieDatabase = false;\n\tlet sawRequiredCookies = false;\n\tlet sawBackendFailure: SqliteFailure | undefined;\n\tlet sawUnsafeProfilePath = false;\n\n\tfor (const config of configs) {\n\t\tconst profiles = requestedProfile ? [requestedProfile] : listBrowserProfiles(home, config);\n\t\tfor (const profile of profiles) {\n\t\t\tconst profilePath = resolveProfilePath(home, config, profile);\n\t\t\tif (profilePath === \"outside-root\") {\n\t\t\t\tsawUnsafeProfilePath = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!profilePath) continue;\n\t\t\tconst cookiesPath = join(profilePath, \"Cookies\");\n\t\t\tsawCookieDatabase = true;\n\n\t\t\tconst tempDir = mkdtempSync(join(tmpdir(), \"pi-chrome-cookies-\"));\n\t\t\ttry {\n\t\t\t\tconst tempDb = join(tempDir, \"Cookies\");\n\t\t\t\tcopyFileSync(cookiesPath, tempDb);\n\t\t\t\tcopySidecar(cookiesPath, tempDb, \"-wal\");\n\t\t\t\tcopySidecar(cookiesPath, tempDb, \"-shm\");\n\n\t\t\t\tif (requiredCookies?.length) {\n\t\t\t\t\tconst preflight = await hasCookieNames(tempDb, hosts, requiredCookies);\n\t\t\t\t\tif (preflight.failure) sawBackendFailure = preflight.failure;\n\t\t\t\t\tif (!preflight.present) continue;\n\t\t\t\t\tsawRequiredCookies = true;\n\t\t\t\t}\n\n\t\t\t\tconst password = await readBrowserPassword(config, currentPlatform);\n\t\t\t\tif (!password) {\n\t\t\t\t\twarningSet.add(`Could not read ${config.name} cookie encryption password`);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\tconst key = pbkdf2Sync(password, \"saltysalt\", currentPlatform === \"darwin\" ? 1003 : 1, 16, \"sha1\");\n\t\t\t\tconst metaVersion = await readMetaVersion(tempDb);\n\t\t\t\tif (metaVersion.failure) sawBackendFailure = metaVersion.failure;\n\t\t\t\tif (metaVersion.value === null) continue;\n\t\t\t\tconst rowsResult = await queryCookieRows(tempDb, hosts, ALL_COOKIE_NAMES);\n\t\t\t\tif (rowsResult.status === \"failure\") {\n\t\t\t\t\tsawBackendFailure = rowsResult.failure;\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\tconst cookies: CookieMap = {};\n\t\t\t\tfor (const row of rowsResult.rows) {\n\t\t\t\t\tconst name = typeof row.name === \"string\" ? row.name : \"\";\n\t\t\t\t\tif (!ALL_COOKIE_NAMES.has(name) || cookies[name]) continue;\n\t\t\t\t\tlet value = typeof row.value === \"string\" && row.value.length > 0 ? row.value : null;\n\t\t\t\t\tif (!value && typeof row.encrypted_value_hex === \"string\" && /^[0-9a-f]*$/i.test(row.encrypted_value_hex)) {\n\t\t\t\t\t\tvalue = decryptCookieValue(Buffer.from(row.encrypted_value_hex, \"hex\"), key, metaVersion.value >= 24);\n\t\t\t\t\t}\n\t\t\t\t\tif (value) cookies[name] = value;\n\t\t\t\t}\n\n\t\t\t\tif (requiredCookies?.length && !requiredCookies.every((name) => Boolean(cookies[name]))) continue;\n\t\t\t\treturn { cookies, warnings: [...warningSet] };\n\t\t\t} finally {\n\t\t\t\trmSync(tempDir, { recursive: true, force: true });\n\t\t\t}\n\t\t}\n\t}\n\n\tif (sawBackendFailure === \"unavailable\") {\n\t\tlastCookieDiagnostic = \"SQLite backend unavailable: install sqlite3 or use a runtime with SQLite support.\";\n\t} else if (sawBackendFailure === \"query\") {\n\t\tlastCookieDiagnostic = \"SQLite query failed while reading the copied Chromium cookie database.\";\n\t} else if (sawUnsafeProfilePath) {\n\t\tlastCookieDiagnostic = \"Configured Chromium profile must resolve inside the browser profile root.\";\n\t} else if (!sawCookieDatabase) {\n\t\tlastCookieDiagnostic = requestedProfile\n\t\t\t? `Chromium profile '${requestedProfile}' does not contain a cookie database.`\n\t\t\t: \"No detected Chromium profile contains a cookie database.\";\n\t} else if (requiredCookies?.length && !sawRequiredCookies) {\n\t\tlastCookieDiagnostic = \"No detected Chromium profile contains the required Gemini cookies.\";\n\t} else if (warningSet.size > 0) {\n\t\tlastCookieDiagnostic = [...warningSet][0];\n\t} else {\n\t\tlastCookieDiagnostic = \"Required Gemini cookies were not available or could not be decrypted.\";\n\t}\n\treturn null;\n}\n\nfunction normalizeProfileName(value: string | undefined): string | undefined {\n\tif (typeof value !== \"string\") return undefined;\n\tconst normalized = value.trim();\n\tif (!normalized) return undefined;\n\tif (isAbsolute(normalized) || normalized === \".\" || normalized === \"..\" || normalized.includes(\"/\") || normalized.includes(\"\\\\\")) {\n\t\treturn undefined;\n\t}\n\treturn normalized;\n}\n\nfunction resolveProfilePath(home: string, config: BrowserConfig, profile: string): string | \"outside-root\" | null {\n\tconst basePath = join(home, config.baseDir);\n\tconst profilePath = join(basePath, profile);\n\tconst cookiesPath = join(profilePath, \"Cookies\");\n\tif (!existsSync(cookiesPath)) return null;\n\ttry {\n\t\tconst baseRealPath = realpathSync(basePath);\n\t\tconst profileRealPath = realpathSync(profilePath);\n\t\tif (profileRealPath !== baseRealPath && !profileRealPath.startsWith(`${baseRealPath}${sep}`)) return \"outside-root\";\n\t\treturn profileRealPath;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction normalizeCookieNames(names: string[] | undefined): string[] | undefined {\n\tif (!names?.length) return undefined;\n\tconst normalized = names.filter((name): name is string => typeof name === \"string\").map((name) => name.trim()).filter(Boolean);\n\treturn normalized.length > 0 ? [...new Set(normalized)] : undefined;\n}\n\nfunction listBrowserProfiles(home: string, config: BrowserConfig): string[] {\n\tconst basePath = join(home, config.baseDir);\n\tif (!existsSync(basePath)) return [\"Default\"];\n\tconst profiles = new Set<string>();\n\ttry {\n\t\tfor (const entry of readdirSync(basePath, { withFileTypes: true })) {\n\t\t\tif (entry.isDirectory() && existsSync(join(basePath, entry.name, \"Cookies\"))) profiles.add(entry.name);\n\t\t}\n\t} catch {\n\t}\n\tif (profiles.size === 0) return [\"Default\"];\n\treturn [...profiles].sort(compareProfileNames);\n}\n\nfunction compareProfileNames(a: string, b: string): number {\n\tconst key = (name: string): [number, number] => {\n\t\tif (name === \"Default\") return [0, 0];\n\t\tconst profile = /^Profile\\s+(\\d+)$/i.exec(name);\n\t\tif (profile) return [1, Number(profile[1])];\n\t\tconst person = /^Person\\s+(\\d+)$/i.exec(name);\n\t\tif (person) return [2, Number(person[1])];\n\t\treturn [3, Number.MAX_SAFE_INTEGER];\n\t};\n\tconst [ap, ai] = key(a);\n\tconst [bp, bi] = key(b);\n\treturn ap - bp || ai - bi || a.localeCompare(b, undefined, { sensitivity: \"base\", numeric: true });\n}\n\nfunction decryptCookieValue(encrypted: Uint8Array, key: Buffer, stripHash: boolean): string | null {\n\tconst buf = Buffer.from(encrypted);\n\tif (buf.length < 3 || !/^v\\d\\d$/.test(buf.subarray(0, 3).toString(\"utf8\"))) return null;\n\tconst ciphertext = buf.subarray(3);\n\tif (!ciphertext.length) return \"\";\n\ttry {\n\t\tconst decipher = createDecipheriv(\"aes-128-cbc\", key, Buffer.alloc(16, 0x20));\n\t\tdecipher.setAutoPadding(false);\n\t\tconst unpadded = removePkcs7Padding(Buffer.concat([decipher.update(ciphertext), decipher.final()]));\n\t\tconst bytes = stripHash && unpadded.length >= 32 ? unpadded.subarray(32) : unpadded;\n\t\tconst decoded = new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n\t\tlet i = 0;\n\t\twhile (i < decoded.length && decoded.charCodeAt(i) < 0x20) i++;\n\t\treturn decoded.slice(i);\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction removePkcs7Padding(buf: Buffer): Buffer {\n\tif (!buf.length) return buf;\n\tconst padding = buf[buf.length - 1];\n\treturn !padding || padding > 16 ? buf : buf.subarray(0, buf.length - padding);\n}\n\nfunction readBrowserPassword(config: BrowserConfig, currentPlatform: ReturnType<typeof platform>): Promise<string | null> {\n\tconst cacheKey = `${currentPlatform}:${config.name}`;\n\tconst cached = browserPasswordCache.get(cacheKey);\n\tif (cached) return cached;\n\tconst passwordResult = currentPlatform === \"darwin\"\n\t\t? config.keychainAccount && config.keychainService\n\t\t\t? readKeychainPassword(config.keychainAccount, config.keychainService).then(password => ({ password, cacheable: Boolean(password) }))\n\t\t\t: Promise.resolve({ password: null, cacheable: false })\n\t\t: currentPlatform === \"linux\"\n\t\t\t? readLinuxPassword(config.secretToolApp)\n\t\t\t: Promise.resolve({ password: null, cacheable: false });\n\tconst passwordPromise = passwordResult.then(({ password, cacheable }) => {\n\t\tif (!cacheable) browserPasswordCache.delete(cacheKey);\n\t\treturn password;\n\t}, (error) => {\n\t\tbrowserPasswordCache.delete(cacheKey);\n\t\tthrow error;\n\t});\n\tbrowserPasswordCache.set(cacheKey, passwordPromise);\n\treturn passwordPromise;\n}\n\nfunction readKeychainPassword(account: string, service: string): Promise<string | null> {\n\treturn new Promise((resolve) => {\n\t\texecFile(\"security\", [\"find-generic-password\", \"-w\", \"-a\", account, \"-s\", service], { timeout: 5000 }, (err, stdout) => {\n\t\t\tif (err) { resolve(null); return; }\n\t\t\tresolve(stdout.trim() || null);\n\t\t});\n\t});\n}\n\nfunction readLinuxPassword(secretToolApp: string | undefined): Promise<{ password: string; cacheable: boolean }> {\n\tif (!secretToolApp) return Promise.resolve({ password: \"peanuts\", cacheable: true });\n\treturn new Promise((resolve) => {\n\t\texecFile(\"secret-tool\", [\"lookup\", \"application\", secretToolApp], { timeout: 5000 }, (err, stdout) => {\n\t\t\tif (err) { resolve({ password: \"peanuts\", cacheable: false }); return; }\n\t\t\tconst password = stdout.trim();\n\t\t\tresolve(password ? { password, cacheable: true } : { password: \"peanuts\", cacheable: false });\n\t\t});\n\t});\n}\n\nasync function importSqlite(): Promise<typeof import(\"node:sqlite\") | null> {\n\tif (process.env.PI_WEB_ACCESS_DISABLE_NODE_SQLITE === \"1\") return null;\n\tif (sqliteImportAttempted) return sqliteModule;\n\tsqliteImportAttempted = true;\n\tconst orig = process.emitWarning.bind(process);\n\tprocess.emitWarning = ((warning: string | Error, ...args: unknown[]) => {\n\t\tconst msg = typeof warning === \"string\" ? warning : warning?.message ?? \"\";\n\t\tif (msg.includes(\"SQLite is an experimental feature\")) return;\n\t\treturn (orig as Function)(warning, ...args);\n\t}) as typeof process.emitWarning;\n\ttry {\n\t\tsqliteModule = await import(\"node:sqlite\");\n\t} catch {\n\t\tsqliteModule = null;\n\t} finally {\n\t\tprocess.emitWarning = orig;\n\t}\n\treturn sqliteModule;\n}\n\ntype QueryResult =\n\t| { status: \"success\"; rows: SqliteRow[] }\n\t| { status: \"failure\"; failure: SqliteFailure };\n\nasync function runSqliteQuery(dbPath: string, sql: string): Promise<QueryResult> {\n\tconst sqlite = await importSqlite();\n\tlet queryFailed = false;\n\tif (sqlite) {\n\t\ttry {\n\t\t\tconst db = new sqlite.DatabaseSync(dbPath, { readOnly: true });\n\t\t\ttry {\n\t\t\t\treturn { status: \"success\", rows: db.prepare(sql).all() as SqliteRow[] };\n\t\t\t} finally {\n\t\t\t\tdb.close();\n\t\t\t}\n\t\t} catch {\n\t\t\tqueryFailed = true;\n\t\t}\n\t}\n\n\tconst cli = await runSqliteCli(dbPath, sql);\n\tif (cli.status === \"success\") return cli;\n\tif (cli.failure === \"query\") queryFailed = true;\n\tconst python = await runPythonSqlite(dbPath, sql);\n\tif (python.status === \"success\") return python;\n\tif (python.failure === \"query\") queryFailed = true;\n\treturn { status: \"failure\", failure: queryFailed ? \"query\" : \"unavailable\" };\n}\n\nfunction runSqliteCli(dbPath: string, sql: string): Promise<QueryResult> {\n\treturn new Promise((resolve) => {\n\t\texecFile(\"sqlite3\", [\"-readonly\", \"-json\", dbPath, sql], { timeout: 5000, maxBuffer: 1024 * 1024 }, (err, stdout) => {\n\t\t\tif (err) { resolve({ status: \"failure\", failure: err.code === \"ENOENT\" ? \"unavailable\" : \"query\" }); return; }\n\t\t\ttry {\n\t\t\t\tconst parsed = JSON.parse(stdout || \"[]\");\n\t\t\t\tresolve(Array.isArray(parsed) ? { status: \"success\", rows: parsed as SqliteRow[] } : { status: \"failure\", failure: \"query\" });\n\t\t\t} catch {\n\t\t\t\tresolve({ status: \"failure\", failure: \"query\" });\n\t\t\t}\n\t\t});\n\t});\n}\n\nfunction runPythonSqlite(dbPath: string, sql: string): Promise<QueryResult> {\n\tconst script = \"import json,sqlite3,sys\\ntry:\\n c=sqlite3.connect('file:'+sys.argv[1]+'?mode=ro',uri=True)\\n c.row_factory=sqlite3.Row\\n print(json.dumps([dict(r) for r in c.execute(sys.argv[2]).fetchall()]))\\nexcept Exception:\\n sys.exit(1)\";\n\treturn new Promise((resolve) => {\n\t\texecFile(\"python3\", [\"-c\", script, dbPath, sql], { timeout: 5000, maxBuffer: 1024 * 1024 }, (err, stdout) => {\n\t\t\tif (err) { resolve({ status: \"failure\", failure: err.code === \"ENOENT\" ? \"unavailable\" : \"query\" }); return; }\n\t\t\ttry {\n\t\t\t\tconst parsed = JSON.parse(stdout || \"[]\");\n\t\t\t\tresolve(Array.isArray(parsed) ? { status: \"success\", rows: parsed as SqliteRow[] } : { status: \"failure\", failure: \"query\" });\n\t\t\t} catch {\n\t\t\t\tresolve({ status: \"failure\", failure: \"query\" });\n\t\t\t}\n\t\t});\n\t});\n}\n\nasync function readMetaVersion(dbPath: string): Promise<{ value: number | null; failure?: SqliteFailure }> {\n\tconst result = await runSqliteQuery(dbPath, \"SELECT value FROM meta WHERE key = 'version'\");\n\tif (result.status === \"failure\") {\n\t\treturn result.failure === \"unavailable\"\n\t\t\t? { value: null, failure: result.failure }\n\t\t\t: { value: 0 };\n\t}\n\tconst value = result.rows[0]?.value;\n\tif (typeof value === \"number\") return { value: Math.floor(value) };\n\tif (typeof value === \"string\") return { value: parseInt(value, 10) || 0 };\n\treturn { value: 0 };\n}\n\nasync function hasCookieNames(dbPath: string, hosts: string[], names: string[]): Promise<{ present: boolean; failure?: SqliteFailure }> {\n\tconst result = await runSqliteQuery(dbPath, `SELECT DISTINCT name FROM cookies WHERE ${buildCookieWhere(hosts, names)}`);\n\tif (result.status === \"failure\") return { present: false, failure: result.failure };\n\tconst present = new Set(result.rows.map((row) => typeof row.name === \"string\" ? row.name : \"\"));\n\treturn { present: names.every((name) => present.has(name)) };\n}\n\nasync function queryCookieRows(dbPath: string, hosts: string[], names: Iterable<string>): Promise<QueryResult> {\n\treturn runSqliteQuery(dbPath, `SELECT name, value, host_key, hex(encrypted_value) AS encrypted_value_hex FROM cookies WHERE ${buildCookieWhere(hosts, names)} ORDER BY expires_utc DESC`);\n}\n\nfunction buildCookieWhere(hosts: string[], cookieNames?: Iterable<string>): string {\n\tconst hostClauses: string[] = [];\n\tfor (const host of hosts) {\n\t\tfor (const candidate of expandHosts(host)) {\n\t\t\tconst escaped = escapeSqlString(candidate);\n\t\t\thostClauses.push(`host_key = '${escaped}'`, `host_key = '.${escaped}'`, `host_key LIKE '%.${escaped}'`);\n\t\t}\n\t}\n\tlet where = `(${hostClauses.join(\" OR \")})`;\n\tconst names = cookieNames ? [...cookieNames].filter(Boolean) : [];\n\tif (names.length) where += ` AND name IN (${names.map((name) => `'${escapeSqlString(name)}'`).join(\", \")})`;\n\treturn where;\n}\n\nfunction escapeSqlString(value: string): string {\n\treturn value.replaceAll(\"'\", \"''\");\n}\n\nfunction expandHosts(host: string): string[] {\n\tconst parts = host.split(\".\").filter(Boolean);\n\tif (parts.length <= 1) return [host];\n\tconst candidates = new Set([host]);\n\tfor (let i = 1; i <= parts.length - 2; i++) candidates.add(parts.slice(i).join(\".\"));\n\treturn [...candidates];\n}\n\nfunction copySidecar(srcDb: string, targetDb: string, suffix: string): void {\n\tconst sidecar = `${srcDb}${suffix}`;\n\tif (!existsSync(sidecar)) return;\n\ttry {\n\t\tcopyFileSync(sidecar, `${targetDb}${suffix}`);\n\t} catch {\n\t}\n}\n"]}
+{"version":3,"file":"chrome-cookies.d.ts","sourceRoot":"","sources":["../../../../src/humain/web-access/vendor/chrome-cookies.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAgD/C,wBAAgB,6BAA6B,IAAI,MAAM,GAAG,IAAI,CAE7D;AAED,wBAAgB,8BAA8B,IAAI,MAAM,GAAG,IAAI,CAE9D;AAED,wBAAsB,gBAAgB,CACrC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACxD,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAAC,CAQ5D;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,GAAG,CAAA;CAAE,GAClJ,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAiInF","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { pbkdf2Sync, createDecipheriv } from \"node:crypto\";\nimport { copyFileSync, existsSync, mkdtempSync, readdirSync, realpathSync, rmSync } from \"node:fs\";\nimport { tmpdir, homedir } from \"node:os\";\nimport { isAbsolute, join, sep } from \"node:path\";\nimport { isBrowserCookieAccessAllowed } from \"./gemini-web-config.ts\";\n\nexport type CookieMap = Record<string, string>;\n\ninterface BrowserConfig {\n\tname: string;\n\tbaseDir: string;\n\tkeychainService?: string;\n\tkeychainAccount?: string;\n\tsecretToolApp?: string;\n}\n\ntype SqliteRow = Record<string, unknown>;\ntype SqliteFailure = \"unavailable\" | \"query\";\n\ninterface BrowserCookieEntry {\n\tname: string;\n\tvalue: string;\n\tpath: string;\n}\n\nconst GOOGLE_ORIGINS = [\n\t\"https://gemini.google.com\",\n\t\"https://accounts.google.com\",\n\t\"https://www.google.com\",\n];\n\nconst ALL_COOKIE_NAMES = new Set([\n\t\"__Secure-1PSID\", \"__Secure-1PSIDTS\", \"__Secure-1PSIDCC\", \"__Secure-1PAPISID\", \"NID\", \"AEC\", \"SOCS\",\n\t\"__Secure-BUCKET\", \"__Secure-ENID\", \"SID\", \"HSID\", \"SSID\", \"APISID\", \"SAPISID\", \"__Secure-3PSID\",\n\t\"__Secure-3PSIDTS\", \"__Secure-3PAPISID\", \"SIDCC\",\n]);\n\nconst MACOS_BROWSER_CONFIGS: BrowserConfig[] = [\n\t{ name: \"Helium\", baseDir: \"Library/Application Support/net.imput.helium\", keychainService: \"Helium Storage Key\", keychainAccount: \"Helium\" },\n\t{ name: \"Chrome\", baseDir: \"Library/Application Support/Google/Chrome\", keychainService: \"Chrome Safe Storage\", keychainAccount: \"Chrome\" },\n\t{ name: \"Brave\", baseDir: \"Library/Application Support/BraveSoftware/Brave-Browser\", keychainService: \"Brave Safe Storage\", keychainAccount: \"Brave\" },\n\t{ name: \"Arc\", baseDir: \"Library/Application Support/Arc/User Data\", keychainService: \"Arc Safe Storage\", keychainAccount: \"Arc\" },\n];\n\nconst LINUX_BROWSER_CONFIGS: BrowserConfig[] = [\n\t{ name: \"Chromium\", baseDir: \".config/chromium\", secretToolApp: \"chromium\" },\n\t{ name: \"Chrome\", baseDir: \".config/google-chrome\", secretToolApp: \"chrome\" },\n];\n\nconst browserPasswordCache = new Map<string, Promise<string | null>>();\nlet lastCookieDiagnostic: string | null = null;\nlet sqliteModule: typeof import(\"node:sqlite\") | null = null;\nlet sqliteImportAttempted = false;\n\nexport function getLastGoogleCookieDiagnostic(): string | null {\n\treturn lastCookieDiagnostic;\n}\n\nexport function getLastBrowserCookieDiagnostic(): string | null {\n\treturn lastCookieDiagnostic;\n}\n\nexport async function getGoogleCookies(\n\toptions?: { profile?: string; requiredCookies?: string[] },\n): Promise<{ cookies: CookieMap; warnings: string[] } | null> {\n\treturn getBrowserCookiesForHosts({\n\t\thosts: GOOGLE_ORIGINS.map((origin) => new URL(origin).hostname),\n\t\tprofile: options?.profile,\n\t\trequiredCookies: options?.requiredCookies,\n\t\tcookieNames: ALL_COOKIE_NAMES,\n\t\trequiredLabel: \"Gemini\",\n\t});\n}\n\nexport async function getBrowserCookiesForHosts(\n\toptions: { hosts: string[]; profile?: string; requiredCookies?: string[]; cookieNames?: Iterable<string>; requiredLabel?: string; requestUrl?: URL },\n): Promise<{ cookies: CookieMap; warnings: string[]; cookieHeader?: string } | null> {\n\tlastCookieDiagnostic = null;\n\tif (!isBrowserCookieAccessAllowed()) {\n\t\tlastCookieDiagnostic = \"Browser cookie access is disabled; enable allowBrowserCookies to use browser cookies.\";\n\t\treturn null;\n\t}\n\n\tconst currentPlatform = process.platform;\n\tconst configs = currentPlatform === \"darwin\" ? MACOS_BROWSER_CONFIGS : currentPlatform === \"linux\" ? LINUX_BROWSER_CONFIGS : [];\n\tif (configs.length === 0) {\n\t\tlastCookieDiagnostic = \"Chromium cookie extraction is unsupported on this platform.\";\n\t\treturn null;\n\t}\n\n\tconst warningSet = new Set<string>();\n\tconst rawProfile = typeof options.profile === \"string\" ? options.profile.trim() : \"\";\n\tconst requestedProfile = normalizeProfileName(options.profile);\n\tif (rawProfile && !requestedProfile) {\n\t\tlastCookieDiagnostic = \"Configured Chromium profile must be a profile directory name, not a path.\";\n\t\treturn null;\n\t}\n\tconst requiredCookies = normalizeCookieNames(options.requiredCookies);\n\tconst cookieNames = normalizeCookieNames(options.cookieNames ? [...options.cookieNames] : undefined);\n\tconst hosts = normalizeHosts(options.hosts);\n\tif (hosts.length === 0) {\n\t\tlastCookieDiagnostic = \"No valid cookie hosts were requested.\";\n\t\treturn null;\n\t}\n\tconst home = homedir();\n\tlet sawCookieDatabase = false;\n\tlet sawRequiredCookies = false;\n\tlet sawAnyHostCookie = false;\n\tlet sawBackendFailure: SqliteFailure | undefined;\n\tlet sawUnsafeProfilePath = false;\n\n\tfor (const config of configs) {\n\t\tconst profiles = requestedProfile ? [requestedProfile] : listBrowserProfiles(home, config);\n\t\tfor (const profile of profiles) {\n\t\t\tconst profilePath = resolveProfilePath(home, config, profile);\n\t\t\tif (profilePath === \"outside-root\") {\n\t\t\t\tsawUnsafeProfilePath = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!profilePath) continue;\n\t\t\tconst cookiesPath = join(profilePath, \"Cookies\");\n\t\t\tsawCookieDatabase = true;\n\n\t\t\tconst tempDir = mkdtempSync(join(tmpdir(), \"pi-chrome-cookies-\"));\n\t\t\ttry {\n\t\t\t\tconst tempDb = join(tempDir, \"Cookies\");\n\t\t\t\tcopyFileSync(cookiesPath, tempDb);\n\t\t\t\tcopySidecar(cookiesPath, tempDb, \"-wal\");\n\t\t\t\tcopySidecar(cookiesPath, tempDb, \"-shm\");\n\n\t\t\t\tif (requiredCookies?.length) {\n\t\t\t\t\tconst preflight = await hasCookieNames(tempDb, hosts, requiredCookies);\n\t\t\t\t\tif (preflight.failure) sawBackendFailure = preflight.failure;\n\t\t\t\t\tif (!preflight.present) continue;\n\t\t\t\t\tsawRequiredCookies = true;\n\t\t\t\t}\n\n\t\t\t\tconst password = await readBrowserPassword(config, currentPlatform);\n\t\t\t\tif (!password) {\n\t\t\t\t\twarningSet.add(`Could not read ${config.name} cookie encryption password`);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\tconst key = pbkdf2Sync(password, \"saltysalt\", currentPlatform === \"darwin\" ? 1003 : 1, 16, \"sha1\");\n\t\t\t\tconst metaVersion = await readMetaVersion(tempDb);\n\t\t\t\tif (metaVersion.failure) sawBackendFailure = metaVersion.failure;\n\t\t\t\tif (metaVersion.value === null) continue;\n\t\t\t\tconst rowsResult = await queryCookieRows(tempDb, hosts, cookieNames ?? null, Boolean(options.requestUrl));\n\t\t\t\tif (rowsResult.status === \"failure\") {\n\t\t\t\t\tsawBackendFailure = rowsResult.failure;\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\tconst entries: BrowserCookieEntry[] = [];\n\t\t\t\tconst cookies: CookieMap = {};\n\t\t\t\tfor (const row of rowsResult.rows) {\n\t\t\t\t\tconst name = typeof row.name === \"string\" ? row.name : \"\";\n\t\t\t\t\tif (!name) continue;\n\t\t\t\t\tlet value = typeof row.value === \"string\" && row.value.length > 0 ? row.value : null;\n\t\t\t\t\tif (!value && typeof row.encrypted_value_hex === \"string\" && /^[0-9a-f]*$/i.test(row.encrypted_value_hex)) {\n\t\t\t\t\t\tvalue = decryptCookieValue(Buffer.from(row.encrypted_value_hex, \"hex\"), key, metaVersion.value >= 24);\n\t\t\t\t\t}\n\t\t\t\t\tif (!value) continue;\n\t\t\t\t\tconst path = typeof row.path === \"string\" && row.path.startsWith(\"/\") ? row.path : \"/\";\n\t\t\t\t\tif (options.requestUrl && !pathMatches(options.requestUrl.pathname || \"/\", path)) continue;\n\t\t\t\t\tentries.push({ name, value, path });\n\t\t\t\t\tif (!cookies[name]) cookies[name] = value;\n\t\t\t\t}\n\n\t\t\t\tif (entries.length > 0) sawAnyHostCookie = true;\n\t\t\t\tif (requiredCookies?.length && !requiredCookies.every((name) => Boolean(cookies[name]))) continue;\n\t\t\t\tif (entries.length === 0) continue;\n\t\t\t\treturn {\n\t\t\t\t\tcookies,\n\t\t\t\t\twarnings: [...warningSet],\n\t\t\t\t\t...(options.requestUrl ? { cookieHeader: buildCookieHeader(entries) } : {}),\n\t\t\t\t};\n\t\t\t} finally {\n\t\t\t\trmSync(tempDir, { recursive: true, force: true });\n\t\t\t}\n\t\t}\n\t}\n\n\tif (sawBackendFailure === \"unavailable\") {\n\t\tlastCookieDiagnostic = \"SQLite backend unavailable: install sqlite3 or use a runtime with SQLite support.\";\n\t} else if (sawBackendFailure === \"query\") {\n\t\tlastCookieDiagnostic = \"SQLite query failed while reading the copied Chromium cookie database.\";\n\t} else if (sawUnsafeProfilePath) {\n\t\tlastCookieDiagnostic = \"Configured Chromium profile must resolve inside the browser profile root.\";\n\t} else if (!sawCookieDatabase) {\n\t\tlastCookieDiagnostic = requestedProfile\n\t\t\t? `Chromium profile '${requestedProfile}' does not contain a cookie database.`\n\t\t\t: \"No detected Chromium profile contains a cookie database.\";\n\t} else if (requiredCookies?.length && !sawRequiredCookies) {\n\t\tlastCookieDiagnostic = `No detected Chromium profile contains the required ${options.requiredLabel ?? \"browser\"} cookies.`;\n\t} else if (!sawAnyHostCookie) {\n\t\tlastCookieDiagnostic = options.requestUrl\n\t\t\t? \"No detected Chromium profile contains cookies for the requested URL.\"\n\t\t\t: \"No detected Chromium profile contains cookies for the requested host.\";\n\t} else if (warningSet.size > 0) {\n\t\tlastCookieDiagnostic = [...warningSet][0];\n\t} else {\n\t\tlastCookieDiagnostic = \"Required Gemini cookies were not available or could not be decrypted.\";\n\t}\n\treturn null;\n}\n\nfunction normalizeProfileName(value: string | undefined): string | undefined {\n\tif (typeof value !== \"string\") return undefined;\n\tconst normalized = value.trim();\n\tif (!normalized) return undefined;\n\tif (isAbsolute(normalized) || normalized === \".\" || normalized === \"..\" || normalized.includes(\"/\") || normalized.includes(\"\\\\\")) {\n\t\treturn undefined;\n\t}\n\treturn normalized;\n}\n\nfunction resolveProfilePath(home: string, config: BrowserConfig, profile: string): string | \"outside-root\" | null {\n\tconst basePath = join(home, config.baseDir);\n\tconst profilePath = join(basePath, profile);\n\tconst cookiesPath = join(profilePath, \"Cookies\");\n\tif (!existsSync(cookiesPath)) return null;\n\ttry {\n\t\tconst baseRealPath = realpathSync(basePath);\n\t\tconst profileRealPath = realpathSync(profilePath);\n\t\tif (profileRealPath !== baseRealPath && !profileRealPath.startsWith(`${baseRealPath}${sep}`)) return \"outside-root\";\n\t\treturn profileRealPath;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction normalizeCookieNames(names: string[] | undefined): string[] | undefined {\n\tif (!names?.length) return undefined;\n\tconst normalized = names.filter((name): name is string => typeof name === \"string\").map((name) => name.trim()).filter(Boolean);\n\treturn normalized.length > 0 ? [...new Set(normalized)] : undefined;\n}\n\nfunction normalizeHosts(hosts: string[]): string[] {\n\treturn [...new Set(hosts.map(host => host.trim().toLowerCase().replace(/^\\[|\\]$/g, \"\").replace(/\\.$/, \"\")).filter(Boolean))];\n}\n\nfunction listBrowserProfiles(home: string, config: BrowserConfig): string[] {\n\tconst basePath = join(home, config.baseDir);\n\tif (!existsSync(basePath)) return [\"Default\"];\n\tconst profiles = new Set<string>();\n\ttry {\n\t\tfor (const entry of readdirSync(basePath, { withFileTypes: true })) {\n\t\t\tif (entry.isDirectory() && existsSync(join(basePath, entry.name, \"Cookies\"))) profiles.add(entry.name);\n\t\t}\n\t} catch {\n\t}\n\tif (profiles.size === 0) return [\"Default\"];\n\treturn [...profiles].sort(compareProfileNames);\n}\n\nfunction compareProfileNames(a: string, b: string): number {\n\tconst key = (name: string): [number, number] => {\n\t\tif (name === \"Default\") return [0, 0];\n\t\tconst profile = /^Profile\\s+(\\d+)$/i.exec(name);\n\t\tif (profile) return [1, Number(profile[1])];\n\t\tconst person = /^Person\\s+(\\d+)$/i.exec(name);\n\t\tif (person) return [2, Number(person[1])];\n\t\treturn [3, Number.MAX_SAFE_INTEGER];\n\t};\n\tconst [ap, ai] = key(a);\n\tconst [bp, bi] = key(b);\n\treturn ap - bp || ai - bi || a.localeCompare(b, undefined, { sensitivity: \"base\", numeric: true });\n}\n\nfunction decryptCookieValue(encrypted: Uint8Array, key: Buffer, stripHash: boolean): string | null {\n\tconst buf = Buffer.from(encrypted);\n\tif (buf.length < 3 || !/^v\\d\\d$/.test(buf.subarray(0, 3).toString(\"utf8\"))) return null;\n\tconst ciphertext = buf.subarray(3);\n\tif (!ciphertext.length) return \"\";\n\ttry {\n\t\tconst decipher = createDecipheriv(\"aes-128-cbc\", key, Buffer.alloc(16, 0x20));\n\t\tdecipher.setAutoPadding(false);\n\t\tconst unpadded = removePkcs7Padding(Buffer.concat([decipher.update(ciphertext), decipher.final()]));\n\t\tconst bytes = stripHash && unpadded.length >= 32 ? unpadded.subarray(32) : unpadded;\n\t\tconst decoded = new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n\t\tlet i = 0;\n\t\twhile (i < decoded.length && decoded.charCodeAt(i) < 0x20) i++;\n\t\treturn decoded.slice(i);\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction removePkcs7Padding(buf: Buffer): Buffer {\n\tif (!buf.length) return buf;\n\tconst padding = buf[buf.length - 1];\n\treturn !padding || padding > 16 ? buf : buf.subarray(0, buf.length - padding);\n}\n\nfunction readBrowserPassword(config: BrowserConfig, currentPlatform: typeof process.platform): Promise<string | null> {\n\tconst cacheKey = `${currentPlatform}:${config.name}`;\n\tconst cached = browserPasswordCache.get(cacheKey);\n\tif (cached) return cached;\n\tconst passwordResult = currentPlatform === \"darwin\"\n\t\t? config.keychainAccount && config.keychainService\n\t\t\t? readKeychainPassword(config.keychainAccount, config.keychainService).then(password => ({ password, cacheable: Boolean(password) }))\n\t\t\t: Promise.resolve({ password: null, cacheable: false })\n\t\t: currentPlatform === \"linux\"\n\t\t\t? readLinuxPassword(config.secretToolApp)\n\t\t\t: Promise.resolve({ password: null, cacheable: false });\n\tconst passwordPromise = passwordResult.then(({ password, cacheable }) => {\n\t\tif (!cacheable) browserPasswordCache.delete(cacheKey);\n\t\treturn password;\n\t}, (error) => {\n\t\tbrowserPasswordCache.delete(cacheKey);\n\t\tthrow error;\n\t});\n\tbrowserPasswordCache.set(cacheKey, passwordPromise);\n\treturn passwordPromise;\n}\n\nfunction readKeychainPassword(account: string, service: string): Promise<string | null> {\n\treturn new Promise((resolve) => {\n\t\texecFile(\"security\", [\"find-generic-password\", \"-w\", \"-a\", account, \"-s\", service], { timeout: 5000 }, (err, stdout) => {\n\t\t\tif (err) { resolve(null); return; }\n\t\t\tresolve(stdout.trim() || null);\n\t\t});\n\t});\n}\n\nfunction readLinuxPassword(secretToolApp: string | undefined): Promise<{ password: string; cacheable: boolean }> {\n\tif (!secretToolApp) return Promise.resolve({ password: \"peanuts\", cacheable: true });\n\treturn new Promise((resolve) => {\n\t\texecFile(\"secret-tool\", [\"lookup\", \"application\", secretToolApp], { timeout: 5000 }, (err, stdout) => {\n\t\t\tif (err) { resolve({ password: \"peanuts\", cacheable: false }); return; }\n\t\t\tconst password = stdout.trim();\n\t\t\tresolve(password ? { password, cacheable: true } : { password: \"peanuts\", cacheable: false });\n\t\t});\n\t});\n}\n\nasync function importSqlite(): Promise<typeof import(\"node:sqlite\") | null> {\n\tif (process.env.PI_WEB_ACCESS_DISABLE_NODE_SQLITE === \"1\") return null;\n\tif (sqliteImportAttempted) return sqliteModule;\n\tsqliteImportAttempted = true;\n\tconst orig = process.emitWarning.bind(process);\n\tprocess.emitWarning = ((warning: string | Error, ...args: unknown[]) => {\n\t\tconst msg = typeof warning === \"string\" ? warning : warning?.message ?? \"\";\n\t\tif (msg.includes(\"SQLite is an experimental feature\")) return;\n\t\treturn (orig as Function)(warning, ...args);\n\t}) as typeof process.emitWarning;\n\ttry {\n\t\tsqliteModule = await import(\"node:sqlite\");\n\t} catch {\n\t\tsqliteModule = null;\n\t} finally {\n\t\tprocess.emitWarning = orig;\n\t}\n\treturn sqliteModule;\n}\n\ntype QueryResult =\n\t| { status: \"success\"; rows: SqliteRow[] }\n\t| { status: \"failure\"; failure: SqliteFailure };\n\nasync function runSqliteQuery(dbPath: string, sql: string): Promise<QueryResult> {\n\tconst sqlite = await importSqlite();\n\tlet queryFailed = false;\n\tif (sqlite) {\n\t\ttry {\n\t\t\tconst db = new sqlite.DatabaseSync(dbPath, { readOnly: true });\n\t\t\ttry {\n\t\t\t\treturn { status: \"success\", rows: db.prepare(sql).all() as SqliteRow[] };\n\t\t\t} finally {\n\t\t\t\tdb.close();\n\t\t\t}\n\t\t} catch {\n\t\t\tqueryFailed = true;\n\t\t}\n\t}\n\n\tconst cli = await runSqliteCli(dbPath, sql);\n\tif (cli.status === \"success\") return cli;\n\tif (cli.failure === \"query\") queryFailed = true;\n\tconst python = await runPythonSqlite(dbPath, sql);\n\tif (python.status === \"success\") return python;\n\tif (python.failure === \"query\") queryFailed = true;\n\treturn { status: \"failure\", failure: queryFailed ? \"query\" : \"unavailable\" };\n}\n\nfunction runSqliteCli(dbPath: string, sql: string): Promise<QueryResult> {\n\treturn new Promise((resolve) => {\n\t\texecFile(\"sqlite3\", [\"-readonly\", \"-json\", dbPath, sql], { timeout: 5000, maxBuffer: 1024 * 1024 }, (err, stdout) => {\n\t\t\tif (err) { resolve({ status: \"failure\", failure: err.code === \"ENOENT\" ? \"unavailable\" : \"query\" }); return; }\n\t\t\ttry {\n\t\t\t\tconst parsed = JSON.parse(stdout || \"[]\");\n\t\t\t\tresolve(Array.isArray(parsed) ? { status: \"success\", rows: parsed as SqliteRow[] } : { status: \"failure\", failure: \"query\" });\n\t\t\t} catch {\n\t\t\t\tresolve({ status: \"failure\", failure: \"query\" });\n\t\t\t}\n\t\t});\n\t});\n}\n\nfunction runPythonSqlite(dbPath: string, sql: string): Promise<QueryResult> {\n\tconst script = \"import json,sqlite3,sys\\ntry:\\n c=sqlite3.connect('file:'+sys.argv[1]+'?mode=ro',uri=True)\\n c.row_factory=sqlite3.Row\\n print(json.dumps([dict(r) for r in c.execute(sys.argv[2]).fetchall()]))\\nexcept Exception:\\n sys.exit(1)\";\n\treturn new Promise((resolve) => {\n\t\texecFile(\"python3\", [\"-c\", script, dbPath, sql], { timeout: 5000, maxBuffer: 1024 * 1024 }, (err, stdout) => {\n\t\t\tif (err) { resolve({ status: \"failure\", failure: err.code === \"ENOENT\" ? \"unavailable\" : \"query\" }); return; }\n\t\t\ttry {\n\t\t\t\tconst parsed = JSON.parse(stdout || \"[]\");\n\t\t\t\tresolve(Array.isArray(parsed) ? { status: \"success\", rows: parsed as SqliteRow[] } : { status: \"failure\", failure: \"query\" });\n\t\t\t} catch {\n\t\t\t\tresolve({ status: \"failure\", failure: \"query\" });\n\t\t\t}\n\t\t});\n\t});\n}\n\nasync function readMetaVersion(dbPath: string): Promise<{ value: number | null; failure?: SqliteFailure }> {\n\tconst result = await runSqliteQuery(dbPath, \"SELECT value FROM meta WHERE key = 'version'\");\n\tif (result.status === \"failure\") {\n\t\treturn result.failure === \"unavailable\"\n\t\t\t? { value: null, failure: result.failure }\n\t\t\t: { value: 0 };\n\t}\n\tconst value = result.rows[0]?.value;\n\tif (typeof value === \"number\") return { value: Math.floor(value) };\n\tif (typeof value === \"string\") return { value: parseInt(value, 10) || 0 };\n\treturn { value: 0 };\n}\n\nasync function hasCookieNames(dbPath: string, hosts: string[], names: string[]): Promise<{ present: boolean; failure?: SqliteFailure }> {\n\tconst result = await runSqliteQuery(dbPath, `SELECT DISTINCT name FROM cookies WHERE ${buildCookieWhere(hosts, names)}`);\n\tif (result.status === \"failure\") return { present: false, failure: result.failure };\n\tconst present = new Set(result.rows.map((row) => typeof row.name === \"string\" ? row.name : \"\"));\n\treturn { present: names.every((name) => present.has(name)) };\n}\n\nasync function queryCookieRows(dbPath: string, hosts: string[], names: Iterable<string> | null, filterExpired: boolean): Promise<QueryResult> {\n\tconst columns = await readCookieColumns(dbPath);\n\tif (columns.status === \"failure\") return columns;\n\tconst pathExpr = columns.columns.has(\"path\") ? \"path\" : \"'/' AS path\";\n\tconst expiresExpr = columns.columns.has(\"expires_utc\") ? \"expires_utc\" : \"0 AS expires_utc\";\n\tconst expiryFilter = filterExpired && columns.columns.has(\"expires_utc\") ? ` AND (expires_utc = 0 OR expires_utc > ${chromeExpiryNowMicros()})` : \"\";\n\tconst partitionFilter = filterExpired ? unpartitionedCookieFilter(columns.columns) : \"\";\n\treturn runSqliteQuery(dbPath, `SELECT name, value, host_key, ${pathExpr}, ${expiresExpr}, hex(encrypted_value) AS encrypted_value_hex FROM cookies WHERE ${buildCookieWhere(hosts, names ?? undefined)}${expiryFilter}${partitionFilter} ORDER BY length(path) DESC, expires_utc ASC`);\n}\n\nasync function readCookieColumns(dbPath: string): Promise<{ status: \"success\"; columns: Set<string> } | { status: \"failure\"; failure: SqliteFailure }> {\n\tconst result = await runSqliteQuery(dbPath, \"PRAGMA table_info(cookies)\");\n\tif (result.status === \"failure\") return result;\n\treturn { status: \"success\", columns: new Set(result.rows.map(row => typeof row.name === \"string\" ? row.name : \"\")) };\n}\n\nfunction chromeExpiryNowMicros(): number {\n\treturn (Date.now() + 11644473600000) * 1000;\n}\n\nfunction unpartitionedCookieFilter(columns: Set<string>): string {\n\tconst clauses: string[] = [];\n\tif (columns.has(\"top_frame_site_key\")) clauses.push(\"(top_frame_site_key IS NULL OR top_frame_site_key = '')\");\n\tif (columns.has(\"partition_key\")) clauses.push(\"(partition_key IS NULL OR partition_key = '')\");\n\tif (columns.has(\"is_partitioned\")) clauses.push(\"(is_partitioned IS NULL OR is_partitioned = 0)\");\n\treturn clauses.length > 0 ? ` AND ${clauses.join(\" AND \")}` : \"\";\n}\n\nfunction buildCookieHeader(entries: BrowserCookieEntry[]): string {\n\treturn entries\n\t\t.sort((a, b) => b.path.length - a.path.length)\n\t\t.map(({ name, value }) => `${name}=${value}`)\n\t\t.join(\"; \");\n}\n\nfunction pathMatches(requestPath: string, cookiePath: string): boolean {\n\tif (requestPath === cookiePath) return true;\n\tif (!requestPath.startsWith(cookiePath)) return false;\n\tif (cookiePath.endsWith(\"/\")) return true;\n\treturn requestPath[cookiePath.length] === \"/\";\n}\n\nfunction buildCookieWhere(hosts: string[], cookieNames?: Iterable<string>): string {\n\tconst hostClauses: string[] = [];\n\tfor (const host of hosts) {\n\t\tconst escapedHost = escapeSqlString(host);\n\t\thostClauses.push(`host_key = '${escapedHost}'`);\n\t\tfor (const candidate of domainCookieHosts(host)) {\n\t\t\thostClauses.push(`host_key = '.${escapeSqlString(candidate)}'`);\n\t\t}\n\t}\n\tlet where = `(${[...new Set(hostClauses)].join(\" OR \")})`;\n\tconst names = cookieNames ? [...cookieNames].filter(Boolean) : [];\n\tif (names.length) where += ` AND name IN (${names.map((name) => `'${escapeSqlString(name)}'`).join(\", \")})`;\n\treturn where;\n}\n\nfunction escapeSqlString(value: string): string {\n\treturn value.replaceAll(\"'\", \"''\");\n}\n\nfunction domainCookieHosts(host: string): string[] {\n\tconst parts = host.split(\".\").filter(Boolean);\n\tif (parts.length <= 1) return [];\n\tconst candidates = new Set<string>();\n\tfor (let i = 0; i <= parts.length - 2; i++) candidates.add(parts.slice(i).join(\".\"));\n\treturn [...candidates];\n}\n\nfunction copySidecar(srcDb: string, targetDb: string, suffix: string): void {\n\tconst sidecar = `${srcDb}${suffix}`;\n\tif (!existsSync(sidecar)) return;\n\ttry {\n\t\tcopyFileSync(sidecar, `${targetDb}${suffix}`);\n\t} catch {\n\t}\n}\n"]}

package/dist/humain/web-access/vendor/chrome-cookies.js

@@ -1,7 +1,7 @@
 import { execFile } from "node:child_process";
 import { pbkdf2Sync, createDecipheriv } from "node:crypto";
 import { copyFileSync, existsSync, mkdtempSync, readdirSync, realpathSync, rmSync } from "node:fs";
-import { tmpdir, homedir, platform } from "node:os";
+import { tmpdir, homedir } from "node:os";
 import { isAbsolute, join, sep } from "node:path";
 import { isBrowserCookieAccessAllowed } from "./gemini-web-config.js";
 const GOOGLE_ORIGINS = [
@@ -17,6 +17,7 @@ const ALL_COOKIE_NAMES = new Set([
 const MACOS_BROWSER_CONFIGS = [
     { name: "Helium", baseDir: "Library/Application Support/net.imput.helium", keychainService: "Helium Storage Key", keychainAccount: "Helium" },
     { name: "Chrome", baseDir: "Library/Application Support/Google/Chrome", keychainService: "Chrome Safe Storage", keychainAccount: "Chrome" },
+    { name: "Brave", baseDir: "Library/Application Support/BraveSoftware/Brave-Browser", keychainService: "Brave Safe Storage", keychainAccount: "Brave" },
     { name: "Arc", baseDir: "Library/Application Support/Arc/User Data", keychainService: "Arc Safe Storage", keychainAccount: "Arc" },
 ];
 const LINUX_BROWSER_CONFIGS = [
@@ -30,30 +31,48 @@ let sqliteImportAttempted = false;
 export function getLastGoogleCookieDiagnostic() {
     return lastCookieDiagnostic;
 }
+export function getLastBrowserCookieDiagnostic() {
+    return lastCookieDiagnostic;
+}
 export async function getGoogleCookies(options) {
+    return getBrowserCookiesForHosts({
+        hosts: GOOGLE_ORIGINS.map((origin) => new URL(origin).hostname),
+        profile: options?.profile,
+        requiredCookies: options?.requiredCookies,
+        cookieNames: ALL_COOKIE_NAMES,
+        requiredLabel: "Gemini",
+    });
+}
+export async function getBrowserCookiesForHosts(options) {
     lastCookieDiagnostic = null;
     if (!isBrowserCookieAccessAllowed()) {
-        lastCookieDiagnostic = "Browser cookie access is disabled; enable allowBrowserCookies to use Gemini Web cookies.";
+        lastCookieDiagnostic = "Browser cookie access is disabled; enable allowBrowserCookies to use browser cookies.";
         return null;
     }
-    const currentPlatform = platform();
+    const currentPlatform = process.platform;
     const configs = currentPlatform === "darwin" ? MACOS_BROWSER_CONFIGS : currentPlatform === "linux" ? LINUX_BROWSER_CONFIGS : [];
     if (configs.length === 0) {
         lastCookieDiagnostic = "Chromium cookie extraction is unsupported on this platform.";
         return null;
     }
     const warningSet = new Set();
-    const rawProfile = typeof options?.profile === "string" ? options.profile.trim() : "";
-    const requestedProfile = normalizeProfileName(options?.profile);
+    const rawProfile = typeof options.profile === "string" ? options.profile.trim() : "";
+    const requestedProfile = normalizeProfileName(options.profile);
     if (rawProfile && !requestedProfile) {
         lastCookieDiagnostic = "Configured Chromium profile must be a profile directory name, not a path.";
         return null;
     }
-    const requiredCookies = normalizeCookieNames(options?.requiredCookies);
-    const hosts = GOOGLE_ORIGINS.map((origin) => new URL(origin).hostname);
+    const requiredCookies = normalizeCookieNames(options.requiredCookies);
+    const cookieNames = normalizeCookieNames(options.cookieNames ? [...options.cookieNames] : undefined);
+    const hosts = normalizeHosts(options.hosts);
+    if (hosts.length === 0) {
+        lastCookieDiagnostic = "No valid cookie hosts were requested.";
+        return null;
+    }
     const home = homedir();
     let sawCookieDatabase = false;
     let sawRequiredCookies = false;
+    let sawAnyHostCookie = false;
     let sawBackendFailure;
     let sawUnsafeProfilePath = false;
     for (const config of configs) {
@@ -93,26 +112,41 @@ export async function getGoogleCookies(options) {
                     sawBackendFailure = metaVersion.failure;
                 if (metaVersion.value === null)
                     continue;
-                const rowsResult = await queryCookieRows(tempDb, hosts, ALL_COOKIE_NAMES);
+                const rowsResult = await queryCookieRows(tempDb, hosts, cookieNames ?? null, Boolean(options.requestUrl));
                 if (rowsResult.status === "failure") {
                     sawBackendFailure = rowsResult.failure;
                     continue;
                 }
+                const entries = [];
                 const cookies = {};
                 for (const row of rowsResult.rows) {
                     const name = typeof row.name === "string" ? row.name : "";
-                    if (!ALL_COOKIE_NAMES.has(name) || cookies[name])
+                    if (!name)
                         continue;
                     let value = typeof row.value === "string" && row.value.length > 0 ? row.value : null;
                     if (!value && typeof row.encrypted_value_hex === "string" && /^[0-9a-f]*$/i.test(row.encrypted_value_hex)) {
                         value = decryptCookieValue(Buffer.from(row.encrypted_value_hex, "hex"), key, metaVersion.value >= 24);
                     }
-                    if (value)
+                    if (!value)
+                        continue;
+                    const path = typeof row.path === "string" && row.path.startsWith("/") ? row.path : "/";
+                    if (options.requestUrl && !pathMatches(options.requestUrl.pathname || "/", path))
+                        continue;
+                    entries.push({ name, value, path });
+                    if (!cookies[name])
                         cookies[name] = value;
                 }
+                if (entries.length > 0)
+                    sawAnyHostCookie = true;
                 if (requiredCookies?.length && !requiredCookies.every((name) => Boolean(cookies[name])))
                     continue;
-                return { cookies, warnings: [...warningSet] };
+                if (entries.length === 0)
+                    continue;
+                return {
+                    cookies,
+                    warnings: [...warningSet],
+                    ...(options.requestUrl ? { cookieHeader: buildCookieHeader(entries) } : {}),
+                };
             }
             finally {
                 rmSync(tempDir, { recursive: true, force: true });
@@ -134,7 +168,12 @@ export async function getGoogleCookies(options) {
             : "No detected Chromium profile contains a cookie database.";
     }
     else if (requiredCookies?.length && !sawRequiredCookies) {
-        lastCookieDiagnostic = "No detected Chromium profile contains the required Gemini cookies.";
+        lastCookieDiagnostic = `No detected Chromium profile contains the required ${options.requiredLabel ?? "browser"} cookies.`;
+    }
+    else if (!sawAnyHostCookie) {
+        lastCookieDiagnostic = options.requestUrl
+            ? "No detected Chromium profile contains cookies for the requested URL."
+            : "No detected Chromium profile contains cookies for the requested host.";
     }
     else if (warningSet.size > 0) {
         lastCookieDiagnostic = [...warningSet][0];
@@ -178,6 +217,9 @@ function normalizeCookieNames(names) {
     const normalized = names.filter((name) => typeof name === "string").map((name) => name.trim()).filter(Boolean);
     return normalized.length > 0 ? [...new Set(normalized)] : undefined;
 }
+function normalizeHosts(hosts) {
+    return [...new Set(hosts.map(host => host.trim().toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "")).filter(Boolean))];
+}
 function listBrowserProfiles(home, config) {
     const basePath = join(home, config.baseDir);
     if (!existsSync(basePath))
@@ -396,18 +438,60 @@ async function hasCookieNames(dbPath, hosts, names) {
     const present = new Set(result.rows.map((row) => typeof row.name === "string" ? row.name : ""));
     return { present: names.every((name) => present.has(name)) };
 }
-async function queryCookieRows(dbPath, hosts, names) {
-    return runSqliteQuery(dbPath, `SELECT name, value, host_key, hex(encrypted_value) AS encrypted_value_hex FROM cookies WHERE ${buildCookieWhere(hosts, names)} ORDER BY expires_utc DESC`);
+async function queryCookieRows(dbPath, hosts, names, filterExpired) {
+    const columns = await readCookieColumns(dbPath);
+    if (columns.status === "failure")
+        return columns;
+    const pathExpr = columns.columns.has("path") ? "path" : "'/' AS path";
+    const expiresExpr = columns.columns.has("expires_utc") ? "expires_utc" : "0 AS expires_utc";
+    const expiryFilter = filterExpired && columns.columns.has("expires_utc") ? ` AND (expires_utc = 0 OR expires_utc > ${chromeExpiryNowMicros()})` : "";
+    const partitionFilter = filterExpired ? unpartitionedCookieFilter(columns.columns) : "";
+    return runSqliteQuery(dbPath, `SELECT name, value, host_key, ${pathExpr}, ${expiresExpr}, hex(encrypted_value) AS encrypted_value_hex FROM cookies WHERE ${buildCookieWhere(hosts, names ?? undefined)}${expiryFilter}${partitionFilter} ORDER BY length(path) DESC, expires_utc ASC`);
+}
+async function readCookieColumns(dbPath) {
+    const result = await runSqliteQuery(dbPath, "PRAGMA table_info(cookies)");
+    if (result.status === "failure")
+        return result;
+    return { status: "success", columns: new Set(result.rows.map(row => typeof row.name === "string" ? row.name : "")) };
+}
+function chromeExpiryNowMicros() {
+    return (Date.now() + 11644473600000) * 1000;
+}
+function unpartitionedCookieFilter(columns) {
+    const clauses = [];
+    if (columns.has("top_frame_site_key"))
+        clauses.push("(top_frame_site_key IS NULL OR top_frame_site_key = '')");
+    if (columns.has("partition_key"))
+        clauses.push("(partition_key IS NULL OR partition_key = '')");
+    if (columns.has("is_partitioned"))
+        clauses.push("(is_partitioned IS NULL OR is_partitioned = 0)");
+    return clauses.length > 0 ? ` AND ${clauses.join(" AND ")}` : "";
+}
+function buildCookieHeader(entries) {
+    return entries
+        .sort((a, b) => b.path.length - a.path.length)
+        .map(({ name, value }) => `${name}=${value}`)
+        .join("; ");
+}
+function pathMatches(requestPath, cookiePath) {
+    if (requestPath === cookiePath)
+        return true;
+    if (!requestPath.startsWith(cookiePath))
+        return false;
+    if (cookiePath.endsWith("/"))
+        return true;
+    return requestPath[cookiePath.length] === "/";
 }
 function buildCookieWhere(hosts, cookieNames) {
     const hostClauses = [];
     for (const host of hosts) {
-        for (const candidate of expandHosts(host)) {
-            const escaped = escapeSqlString(candidate);
-            hostClauses.push(`host_key = '${escaped}'`, `host_key = '.${escaped}'`, `host_key LIKE '%.${escaped}'`);
+        const escapedHost = escapeSqlString(host);
+        hostClauses.push(`host_key = '${escapedHost}'`);
+        for (const candidate of domainCookieHosts(host)) {
+            hostClauses.push(`host_key = '.${escapeSqlString(candidate)}'`);
         }
     }
-    let where = `(${hostClauses.join(" OR ")})`;
+    let where = `(${[...new Set(hostClauses)].join(" OR ")})`;
     const names = cookieNames ? [...cookieNames].filter(Boolean) : [];
     if (names.length)
         where += ` AND name IN (${names.map((name) => `'${escapeSqlString(name)}'`).join(", ")})`;
@@ -416,12 +500,12 @@ function buildCookieWhere(hosts, cookieNames) {
 function escapeSqlString(value) {
     return value.replaceAll("'", "''");
 }
-function expandHosts(host) {
+function domainCookieHosts(host) {
     const parts = host.split(".").filter(Boolean);
     if (parts.length <= 1)
-        return [host];
-    const candidates = new Set([host]);
-    for (let i = 1; i <= parts.length - 2; i++)
+        return [];
+    const candidates = new Set();
+    for (let i = 0; i <= parts.length - 2; i++)
         candidates.add(parts.slice(i).join("."));
     return [...candidates];
 }