@scrylog/cli 0.2.0 → 0.3.1

package/src/usage/resolvers/browser-cookies.ts

@@ -1,470 +0,0 @@
-import * as child_process from "node:child_process";
-import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { createDecipheriv, pbkdf2Sync } from "node:crypto";
-import { join } from "node:path";
-import { Database } from "bun:sqlite";
-import { IS_MAC, IS_WINDOWS } from "../../shared/platform";
-
-export interface BrowserCookie {
-  name: string;
-  value: string;
-}
-
-// ---------------------------------------------------------------------------
-// Browser catalog types
-// ---------------------------------------------------------------------------
-
-interface ChromiumProfileEntry {
-  /** Unique browser ID, e.g. "chrome", "brave", "claude-desktop" */
-  id: string;
-  /** Relative path under ~/Library/Application Support/ on macOS */
-  macOSPath: string;
-  /** Relative path under ~/.config/ on Linux */
-  linuxPath: string;
-  /** Relative path under %APPDATA%/ on Windows */
-  windowsPath: string;
-  /** macOS Keychain service label, e.g. "Chrome Safe Storage" */
-  keychainService?: string;
-  /** macOS Keychain account label, e.g. "Chrome" */
-  keychainAccount?: string;
-}
-
-interface GeckoProfileEntry {
-  /** Unique browser ID, e.g. "firefox", "zen" */
-  id: string;
-  /**
-   * Profiles parent folder name.
-   * macOS: ~/Library/Application Support/<profilesFolder>/Profiles
-   * Linux: ~/.mozilla/<profilesFolder>/Profiles
-   */
-  profilesFolder: string;
-}
-
-// ---------------------------------------------------------------------------
-// Browser catalogs
-// ---------------------------------------------------------------------------
-
-export const CHROMIUM_PROFILES: ChromiumProfileEntry[] = [
-  {
-    id: "chrome",
-    macOSPath: "Google/Chrome",
-    linuxPath: "google-chrome",
-    windowsPath: "Google/Chrome/User Data",
-    keychainService: "Chrome Safe Storage",
-    keychainAccount: "Chrome",
-  },
-  {
-    id: "edge",
-    macOSPath: "Microsoft Edge",
-    linuxPath: "microsoft-edge",
-    windowsPath: "Microsoft/Edge/User Data",
-    keychainService: "Microsoft Edge Safe Storage",
-    keychainAccount: "Microsoft Edge",
-  },
-  {
-    id: "brave",
-    macOSPath: "BraveSoftware/Brave-Browser",
-    linuxPath: "BraveSoftware/Brave-Browser",
-    windowsPath: "BraveSoftware/Brave-Browser/User Data",
-    keychainService: "Brave Safe Storage",
-    keychainAccount: "Brave",
-  },
-  {
-    id: "arc",
-    macOSPath: "Arc/User Data",
-    linuxPath: "Arc",
-    windowsPath: "Arc/User Data",
-    keychainService: "Arc Safe Storage",
-    keychainAccount: "Arc",
-  },
-  {
-    id: "vivaldi",
-    macOSPath: "Vivaldi",
-    linuxPath: "vivaldi",
-    windowsPath: "Vivaldi/User Data",
-    keychainService: "Vivaldi Safe Storage",
-    keychainAccount: "Vivaldi",
-  },
-  {
-    id: "chromium",
-    macOSPath: "Chromium",
-    linuxPath: "chromium",
-    windowsPath: "Chromium/User Data",
-    keychainService: "Chromium Safe Storage",
-    keychainAccount: "Chromium",
-  },
-  {
-    id: "yandex",
-    macOSPath: "Yandex/YandexBrowser",
-    linuxPath: "yandex-browser",
-    windowsPath: "Yandex/YandexBrowser/User Data",
-    keychainService: "Yandex Safe Storage",
-    keychainAccount: "Yandex",
-  },
-  {
-    // Claude Desktop app (Electron/Chromium) — macOS and Windows only
-    id: "claude-desktop",
-    macOSPath: "Claude",
-    linuxPath: "", // not available on Linux
-    windowsPath: "Anthropic/Claude",
-    keychainService: "Claude Safe Storage",
-    keychainAccount: "Claude",
-  },
-];
-
-export const GECKO_PROFILES: GeckoProfileEntry[] = [
-  { id: "firefox", profilesFolder: "Firefox" },
-  { id: "zen", profilesFolder: "zen" },
-];
-
-const SAFARI_COOKIE_PATH = join(homedir(), "Library", "Cookies", "Cookies.binarycookies");
-
-// ---------------------------------------------------------------------------
-// Platform root resolution
-// ---------------------------------------------------------------------------
-
-function chromiumRootPath(entry: ChromiumProfileEntry): string {
-  const home = homedir();
-  if (IS_MAC) {
-    if (!entry.macOSPath) return "";
-    return join(home, "Library", "Application Support", entry.macOSPath);
-  }
-  if (IS_WINDOWS) {
-    const appData = process.env.APPDATA ?? join(home, "AppData", "Roaming");
-    if (!entry.windowsPath) return "";
-    return join(appData, entry.windowsPath);
-  }
-  // Linux
-  if (!entry.linuxPath) return "";
-  return join(home, ".config", entry.linuxPath);
-}
-
-function geckoProfilesRoot(entry: GeckoProfileEntry): string {
-  const home = homedir();
-  if (IS_MAC) {
-    return join(home, "Library", "Application Support", entry.profilesFolder, "Profiles");
-  }
-  if (IS_WINDOWS) {
-    // Firefox on Windows is not in scope; skip
-    return "";
-  }
-  // Linux
-  return join(home, ".mozilla", entry.profilesFolder, "Profiles");
-}
-
-// ---------------------------------------------------------------------------
-// Chromium helpers
-// ---------------------------------------------------------------------------
-
-/**
- * Derives the Chromium AES-128-CBC key for a given Keychain service label.
- * macOS: reads from Keychain via `security` then applies PBKDF2.
- * Linux/Windows: uses the fixed "peanuts" PBKDF2 key (no Keychain).
- */
-export function getChromiumSafeStorageKey(service: string, _account: string): Buffer | null {
-  try {
-    if (IS_MAC) {
-      const password = child_process.execSync(`security find-generic-password -s "${service}" -w`, {
-        encoding: "utf8",
-        stdio: ["pipe", "pipe", "pipe"],
-      }).trim();
-      if (!password) return null;
-      return pbkdf2Sync(password, "saltysalt", 1003, 16, "sha1");
-    }
-
-    if (IS_WINDOWS) {
-      // DPAPI not implemented; fall back to peanuts key (partial compatibility)
-      return pbkdf2Sync("peanuts", "saltysalt", 1003, 16, "sha1");
-    }
-
-    // Linux
-    return pbkdf2Sync("peanuts", "saltysalt", 1003, 16, "sha1");
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Returns all profile subdirectory paths under rootPath that match the
- * Chromium naming conventions: Default, Profile *, user-*.
- */
-export function discoverChromiumProfiles(rootPath: string): string[] {
-  if (!existsSync(rootPath)) return [];
-  let entries: string[];
-  try {
-    entries = readdirSync(rootPath, { withFileTypes: true })
-      .filter((d) => d.isDirectory())
-      .map((d) => d.name);
-  } catch {
-    return [];
-  }
-  return entries
-    .filter((name) => name === "Default" || /^Profile \d+$/.test(name) || /^user-/.test(name))
-    .map((name) => join(rootPath, name));
-}
-
-/**
- * Returns the two candidate cookie DB paths for a Chromium profile directory.
- * The caller is responsible for checking existence before opening.
- */
-export function chromiumCookieDbPaths(profilePath: string): string[] {
-  return [join(profilePath, "Cookies"), join(profilePath, "Network", "Cookies")];
-}
-
-/**
- * Internal: decrypt AES-128-CBC safeStorage payload, returning raw bytes after
- * PKCS#7 un-padding.  Returns `null` on decryption failure.  Callers that need
- * the Chrome v24+ 32-byte domain-hash strip must apply it themselves.
- */
-function decryptSafeStorageRaw(buf: Buffer, key: Buffer): Buffer | null {
-  if (buf.length < 3) return null;
-  const prefix = buf.slice(0, 3).toString("ascii");
-  if (prefix !== "v10" && prefix !== "v11") {
-    return buf; // plain text (older versions)
-  }
-  const iv = Buffer.alloc(16, 32); // space character (0x20) repeated 16 times
-  try {
-    const decipher = createDecipheriv("aes-128-cbc", key, iv);
-    let decrypted = Buffer.concat([decipher.update(buf.slice(3)), decipher.final()]);
-    // Remove PKCS#7 padding
-    const padLen = decrypted[decrypted.length - 1];
-    if (padLen > 0 && padLen <= 16) {
-      decrypted = decrypted.slice(0, decrypted.length - padLen);
-    }
-    return decrypted;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Decrypt a Chromium/Electron safeStorage blob (AES-128-CBC, v10/v11 prefix)
- * and return the result as a UTF-8 string.
- *
- * Used for Electron `safeStorage`-encrypted config fields (e.g. `oauth:tokenCache`
- * in Claude Desktop's `config.json`).  Does **not** strip the Chrome v24+ 32-byte
- * domain-hash prefix — use `decryptChromiumCookie` for cookie DB values.
- */
-export function decryptSafeStorageBlob(buf: Buffer, key: Buffer): string | null {
-  const raw = decryptSafeStorageRaw(buf, key);
-  return raw !== null ? raw.toString("utf8") : null;
-}
-
-function decryptChromiumCookie(encrypted: Buffer, key: Buffer, dbVersion = 0): string | null {
-  const raw = decryptSafeStorageRaw(encrypted, key);
-  if (raw === null) return null;
-  // Chrome v24+ prepends a SHA256 hash of the domain (32 bytes) to encrypted cookie values
-  if (encrypted.length >= 3) {
-    const prefix = encrypted.slice(0, 3).toString("ascii");
-    if ((prefix === "v10" || prefix === "v11") && dbVersion >= 24 && raw.length >= 32) {
-      return raw.slice(32).toString("utf8");
-    }
-  }
-  return raw.toString("utf8");
-}
-
-export function readChromiumCookies(entry: ChromiumProfileEntry, domain: string): BrowserCookie[] {
-  const cookies: BrowserCookie[] = [];
-  const rootPath = chromiumRootPath(entry);
-  if (!rootPath || !existsSync(rootPath)) return cookies;
-
-  // Resolve decryption key only if we found a root (avoids Keychain prompts for absent browsers)
-  const key = getChromiumSafeStorageKey(
-    entry.keychainService ?? "",
-    entry.keychainAccount ?? ""
-  );
-  if (!key) return cookies;
-
-  const profiles = discoverChromiumProfiles(rootPath);
-  for (const profilePath of profiles) {
-    for (const dbPath of chromiumCookieDbPaths(profilePath)) {
-      if (!existsSync(dbPath)) continue;
-      let db: Database | undefined;
-      try {
-        db = new Database(dbPath, { readonly: true });
-
-        // Chrome v24+ prepends a SHA256 hash (32 bytes) to encrypted cookie values
-        let dbVersion = 0;
-        try {
-          const versionStmt = db.query("SELECT value FROM meta WHERE key = 'version'");
-          const versionRow = versionStmt.get() as { value: number } | null;
-          if (versionRow) dbVersion = Number(versionRow.value);
-        } catch {
-          // meta table may not exist in older DBs
-        }
-
-        const stmt = db.query(
-          "SELECT name, encrypted_value, host_key FROM cookies WHERE host_key LIKE ? AND expires_utc > ?"
-        );
-        const now = (Date.now() + 11644473600000) * 1000; // Chrome epoch offset
-        const rows = stmt.all(`%${domain}%`, now) as Array<{
-          name: string;
-          encrypted_value: Uint8Array;
-          host_key: string;
-        }>;
-        for (const row of rows) {
-          const value = decryptChromiumCookie(Buffer.from(row.encrypted_value), key, dbVersion);
-          if (value !== null) {
-            cookies.push({ name: row.name, value });
-          }
-        }
-      } catch {
-        // Ignore permission errors, locked DB (SQLITE_BUSY), etc.
-      } finally {
-        db?.close();
-      }
-    }
-  }
-
-  return cookies;
-}
-
-// ---------------------------------------------------------------------------
-// Gecko (Firefox/Zen) support
-// ---------------------------------------------------------------------------
-
-export function readGeckoCookies(entry: GeckoProfileEntry, domain: string): BrowserCookie[] {
-  const cookies: BrowserCookie[] = [];
-  const profilesRoot = geckoProfilesRoot(entry);
-  if (!profilesRoot || !existsSync(profilesRoot)) return cookies;
-
-  let profileNames: string[];
-  try {
-    profileNames = readdirSync(profilesRoot, { withFileTypes: true })
-      .filter((d) => d.isDirectory() && d.name.includes(".default"))
-      .map((d) => d.name)
-      // Prefer .default-release over .default
-      .sort((a, b) => {
-        const aScore = a.endsWith(".default-release") ? 1 : 0;
-        const bScore = b.endsWith(".default-release") ? 1 : 0;
-        return bScore - aScore;
-      });
-  } catch {
-    return cookies;
-  }
-
-  for (const profileName of profileNames) {
-    const dbPath = join(profilesRoot, profileName, "cookies.sqlite");
-    if (!existsSync(dbPath)) continue;
-    let db: Database | undefined;
-    try {
-      db = new Database(dbPath, { readonly: true });
-      const stmt = db.query("SELECT name, value FROM moz_cookies WHERE host LIKE ?");
-      const rows = stmt.all(`%${domain}%`) as Array<{ name: string; value: string }>;
-      for (const row of rows) {
-        cookies.push({ name: row.name, value: row.value });
-      }
-      if (cookies.length > 0) break; // first-profile-wins within a browser
-    } catch {
-      // Ignore locked or corrupt DB
-    } finally {
-      db?.close();
-    }
-  }
-
-  return cookies;
-}
-
-// ---------------------------------------------------------------------------
-// Safari (macOS-only, unchanged)
-// ---------------------------------------------------------------------------
-
-function readSafariCookies(domain: string): BrowserCookie[] {
-  const cookies: BrowserCookie[] = [];
-  if (process.platform !== "darwin") return cookies;
-  if (!existsSync(SAFARI_COOKIE_PATH)) return cookies;
-
-  try {
-    const data = readFileSync(SAFARI_COOKIE_PATH);
-    // Simple binarycookies parser
-    // Header: 4 bytes magic "cook", 4 bytes page count, then pages
-    if (data.length < 8 || data.toString("ascii", 0, 4) !== "cook") return cookies;
-
-    const numPages = data.readUInt32BE(4);
-    let offset = 8;
-    const pageSizes: number[] = [];
-    for (let i = 0; i < numPages; i++) {
-      pageSizes.push(data.readUInt32BE(offset));
-      offset += 4;
-    }
-
-    for (const pageSize of pageSizes) {
-      const pageEnd = offset + pageSize;
-      if (pageEnd > data.length) break;
-      // Page header: "page" + 4 bytes count
-      if (data.toString("ascii", offset, offset + 4) !== "page") {
-        offset += pageSize;
-        continue;
-      }
-      const numCookies = data.readUInt32BE(offset + 4);
-      let cookieOffset = offset + 8;
-      for (let i = 0; i < numCookies; i++) {
-        // Each cookie record: size (4) + unknown (4) + flags (4) + hasPort (4)
-        // + port (4) + urlOffset (4) + nameOffset (4) + pathOffset (4) + valueOffset (4)
-        // + tail (8) = 40 bytes header, then strings
-        const size = data.readUInt32BE(cookieOffset);
-        const urlOffset = data.readUInt32BE(cookieOffset + 20);
-        const nameOffset = data.readUInt32BE(cookieOffset + 24);
-        const pathOffset = data.readUInt32BE(cookieOffset + 28);
-        const valueOffset = data.readUInt32BE(cookieOffset + 32);
-
-        const url = data.toString("utf8", cookieOffset + urlOffset, cookieOffset + nameOffset - 1);
-        const name = data.toString("utf8", cookieOffset + nameOffset, cookieOffset + pathOffset - 1);
-        const value = data.toString("utf8", cookieOffset + valueOffset, cookieOffset + size);
-
-        if (url.includes(domain)) {
-          cookies.push({ name, value });
-        }
-
-        cookieOffset += size;
-        if (cookieOffset > pageEnd) break;
-      }
-      offset += pageSize;
-    }
-  } catch {
-    // Ignore errors
-  }
-
-  return cookies;
-}
-
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-
-/**
- * Extract cookies for the given domain from all available browser sources.
- * Sources are tried in order that minimises Keychain prompts:
- *   macOS:   Gecko (Firefox/Zen) → Safari → Chromium catalog
- *   Linux:   Gecko → Chromium catalog
- *   Windows: Gecko (limited) → Chromium catalog
- *
- * Returns the first source that yields ≥1 matching cookie; subsequent sources
- * are skipped (first-source-wins).
- */
-export function extractCookies(domain: string): BrowserCookie[] {
-  // 1. Gecko sources first — no Keychain prompt, cheap read
-  for (const entry of GECKO_PROFILES) {
-    const cookies = readGeckoCookies(entry, domain);
-    if (cookies.length > 0) return cookies;
-  }
-
-  // 2. Safari (macOS only) — no Keychain prompt
-  if (IS_MAC) {
-    const safari = readSafariCookies(domain);
-    if (safari.length > 0) return safari;
-  }
-
-  // 3. Chromium catalog — may trigger Keychain prompts on macOS
-  for (const entry of CHROMIUM_PROFILES) {
-    const cookies = readChromiumCookies(entry, domain);
-    if (cookies.length > 0) return cookies;
-  }
-
-  return [];
-}
-
-export function buildCookieHeader(cookies: BrowserCookie[]): string {
-  return cookies.map((c) => `${c.name}=${c.value}`).join("; ");
-}

package/src/usage/resolvers/claude-auth.ts

@@ -1,108 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import type { TokenResolver } from "../resolver";
-import type { ClaudeOAuthCredentials } from "../types";
-import { IS_MAC } from "../../shared/platform";
-import { ClaudeDesktopAuthResolver } from "./claude-desktop-auth";
-
-export class ClaudeAuthResolver implements TokenResolver<ClaudeOAuthCredentials> {
-  private readonly debug = (message: string, meta?: Record<string, unknown>) => {
-    // Avoid coupling to logger; stderr debug line is acceptable for resolver diagnostics.
-    if (process.env.SCRYLOG_DEBUG_AUTH) {
-      process.stderr.write(`[scrylog:claude-auth] ${message}${meta ? ` ${JSON.stringify(meta)}` : ""}\n`);
-    }
-  };
-
-  async resolve(): Promise<ClaudeOAuthCredentials | null> {
-    // 1. macOS Keychain is the primary store on macOS.
-    if (IS_MAC) {
-      const services = ["claude-api-oauth", "Claude Code-credentials"];
-      for (const service of services) {
-        const creds = this.tryService(service);
-        if (creds) return creds;
-      }
-    } else {
-      this.debug("Keychain not available on this platform", { platform: process.platform });
-    }
-
-    // 2. Claude Desktop app local token cache (macOS / Windows only).
-    //    Reads the Electron safeStorage-encrypted `oauth:tokenCache` from
-    //    ~/Library/Application Support/Claude/config.json (macOS) or
-    //    %APPDATA%/Anthropic/Claude/config.json (Windows).  This covers the
-    //    common case where the user has Claude Desktop but not Claude Code CLI.
-    const desktopCreds = await new ClaudeDesktopAuthResolver().resolve();
-    if (desktopCreds) return desktopCreds;
-
-    // 3. Linux/WSL/Windows: Claude Code stores credentials in ~/.claude/.credentials.json
-    const fileCreds = this.tryCredentialsFile();
-    if (fileCreds) return fileCreds;
-
-    // 4. Universal env-var fallback
-    const envToken = process.env.CLAUDE_CODE_OAUTH_TOKEN;
-    if (envToken) {
-      return { accessToken: envToken };
-    }
-
-    return null;
-  }
-
-  async isAvailable(): Promise<boolean> {
-    return (await this.resolve()) !== null;
-  }
-
-  private tryService(service: string): ClaudeOAuthCredentials | null {
-    try {
-      const output = execSync(
-        `security find-generic-password -s "${service}" -w`,
-        { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }
-      ).trim();
-      if (!output) return null;
-      return this.parseCredentialsJson(output);
-    } catch (error) {
-      this.debug("Keychain lookup failed", { service, error: error instanceof Error ? error.message : String(error) });
-      return null;
-    }
-  }
-
-  private tryCredentialsFile(): ClaudeOAuthCredentials | null {
-    // On macOS, Keychain is authoritative; skip the file unless explicitly requested.
-    if (IS_MAC && !process.env.CLAUDE_CODE_USE_CREDENTIALS_FILE) return null;
-
-    const claudeDir = process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), ".claude");
-    const path = join(claudeDir, ".credentials.json");
-    if (!existsSync(path)) return null;
-
-    try {
-      const raw = readFileSync(path, "utf8");
-      return this.parseCredentialsJson(raw);
-    } catch (error) {
-      this.debug("Failed to read credentials file", { path, error: error instanceof Error ? error.message : String(error) });
-      return null;
-    }
-  }
-
-  private parseCredentialsJson(input: string): ClaudeOAuthCredentials | null {
-    try {
-      const parsed = JSON.parse(input) as Record<string, unknown>;
-      // Handle nested structure: { claudeAiOauth: { accessToken, ... } }
-      const inner = parsed.claudeAiOauth && typeof parsed.claudeAiOauth === "object"
-        ? parsed.claudeAiOauth as Record<string, unknown>
-        : parsed;
-      const accessToken = inner.accessToken ?? inner.access_token;
-      if (!accessToken) return null;
-      return {
-        accessToken: String(accessToken),
-        refreshToken: inner.refreshToken ? String(inner.refreshToken) : undefined,
-        expiresAt: inner.expiresAt ? String(inner.expiresAt) : undefined,
-        scopes: Array.isArray(inner.scopes) ? inner.scopes.map(String) : undefined,
-        rateLimitTier: inner.rateLimitTier ? String(inner.rateLimitTier) : undefined,
-        subscriptionType: inner.subscriptionType ? String(inner.subscriptionType) : undefined,
-      };
-    } catch {
-      // Not JSON — treat the raw string as an access token.
-      return { accessToken: input.trim() };
-    }
-  }
-}

package/src/usage/resolvers/claude-cli.ts

@@ -1,24 +0,0 @@
-import { existsSync } from "node:fs";
-import { homedir } from "node:os";
-import { whichCommand } from "../../shared/platform";
-import type { TokenResolver } from "../resolver";
-
-export class ClaudeCliResolver implements TokenResolver<string> {
-  async resolve(): Promise<string | null> {
-    const paths = [
-      process.env.CLAUDE_BIN_OVERRIDE,
-      `${homedir()}/.claude/local/claude`,
-      "/usr/local/bin/claude",
-    ];
-    for (const p of paths) {
-      if (p && existsSync(p)) return p;
-    }
-    const which = whichCommand("claude");
-    if (which) return which;
-    return null;
-  }
-
-  async isAvailable(): Promise<boolean> {
-    return (await this.resolve()) !== null;
-  }
-}