@steipete/oracle 0.14.1 → 0.15.0

package/dist/src/browser/chromeLifecycle.js

@@ -15,20 +15,31 @@ export async function launchChrome(config, userDataDir, logger) {
     const debugPort = config.debugPort ?? parseDebugPortEnv();
     const chromeFlags = buildChromeFlags(config.headless ?? false, debugBindAddress);
     const usePatchedLauncher = Boolean(connectHost && connectHost !== "127.0.0.1");
+    // copy-profile reuses a copied signed-in profile whose cookies are
+    // Keychain-encrypted, so it must launch with the real Keychain (not mocked):
+    // strip the keychain-mocking flags from both chrome-launcher's defaults and
+    // Oracle's set, and ignore the defaults so they aren't re-added.
+    const usingCopiedProfile = Boolean(config.copyProfileSource);
+    if (usingCopiedProfile && config.chromeProfile) {
+        chromeFlags.push(`--profile-directory=${config.chromeProfile}`);
+    }
+    const launchOptions = resolveChromeLaunchOptions(chromeFlags, usingCopiedProfile);
     const launcher = usePatchedLauncher
         ? await launchWithCustomHost({
-            chromeFlags,
+            chromeFlags: launchOptions.chromeFlags,
             chromePath: config.chromePath ?? undefined,
             userDataDir,
             host: connectHost ?? "127.0.0.1",
             requestedPort: debugPort ?? undefined,
+            ignoreDefaultFlags: launchOptions.ignoreDefaultFlags,
         })
         : await launch({
             chromePath: config.chromePath ?? undefined,
-            chromeFlags,
+            chromeFlags: launchOptions.chromeFlags,
             userDataDir,
             handleSIGINT: false,
             port: debugPort ?? undefined,
+            ignoreDefaultFlags: launchOptions.ignoreDefaultFlags,
         });
     const pidLabel = typeof launcher.pid === "number" ? ` (pid ${launcher.pid})` : "";
     const hostLabel = connectHost ? ` on ${connectHost}` : "";
@@ -44,10 +55,14 @@ export function registerTerminationHooks(chrome, userDataDir, keepBrowser, logge
         }
         handling = true;
         const inFlight = opts?.isInFlight?.() ?? false;
-        const leaveRunning = keepBrowser || inFlight;
+        const forceCleanup = opts?.forceProfileCleanup ?? false;
+        const leaveRunning = (keepBrowser || inFlight) && !forceCleanup;
         if (leaveRunning) {
             logger(`Received ${signal}; leaving Chrome running${inFlight ? " (assistant response pending)" : ""}`);
         }
+        else if (forceCleanup && (keepBrowser || inFlight)) {
+            logger(`Received ${signal}; terminating Chrome and removing the copied profile (copy-profile is not retained)`);
+        }
         else {
             logger(`Received ${signal}; terminating Chrome process`);
         }
@@ -343,6 +358,9 @@ function createSessionBoundChromeClient(browser, sessionId) {
         // Raw `send` here is the browser-level send (not session-bound), so callers
         // that issue Target.* via `send` must pass this page session id explicitly to
         // stay scoped to this tab (e.g. Deep Research OOPIF auto-attach).
+        // chrome-remote-interface defines `send` on the client prototype, so object
+        // spread does not preserve it. Bind it explicitly for raw session commands.
+        send: typeof browser.send === "function" ? browser.send.bind(browser) : undefined,
         oraclePageSessionId: sessionId,
         Network: bindDomain("Network"),
         Page: bindDomain("Page"),
@@ -472,6 +490,18 @@ function buildChromeFlags(headless, debugBindAddress) {
     }
     return flags;
 }
+function resolveChromeLaunchOptions(chromeFlags, usingCopiedProfile) {
+    if (!usingCopiedProfile) {
+        return { chromeFlags, ignoreDefaultFlags: false };
+    }
+    return {
+        chromeFlags: [...Launcher.defaultFlags(), ...chromeFlags].filter((flag) => flag !== "--use-mock-keychain" && flag !== "--password-store=basic"),
+        ignoreDefaultFlags: true,
+    };
+}
+export function resolveChromeLaunchOptionsForTest(chromeFlags, usingCopiedProfile) {
+    return resolveChromeLaunchOptions(chromeFlags, usingCopiedProfile);
+}
 function parseDebugPortEnv() {
     const raw = process.env.ORACLE_BROWSER_PORT ?? process.env.ORACLE_BROWSER_DEBUG_PORT;
     if (!raw)
@@ -514,13 +544,14 @@ function isWsl() {
     const release = os.release();
     return release.toLowerCase().includes("microsoft");
 }
-async function launchWithCustomHost({ chromeFlags, chromePath, userDataDir, host, requestedPort, }) {
+async function launchWithCustomHost({ chromeFlags, chromePath, userDataDir, host, requestedPort, ignoreDefaultFlags, }) {
     const launcher = new Launcher({
         chromePath: chromePath ?? undefined,
         chromeFlags,
         userDataDir,
         handleSIGINT: false,
         port: requestedPort ?? undefined,
+        ignoreDefaultFlags,
     });
     if (host) {
         const patched = launcher;

package/dist/src/browser/deepResearchResult.js

@@ -0,0 +1,23 @@
+export function isDeepResearchIncompleteText(text) {
+    const normalized = text.toLowerCase().replace(/\s+/g, " ").trim();
+    const lines = text
+        .split(/\n+/)
+        .map((line) => line.trim())
+        .filter(Boolean);
+    const tailIsPlanningPanel = text.length <= 1_500 &&
+        lines.length >= 4 &&
+        lines.length <= 20 &&
+        /^update$/i.test(lines[1] ?? "") &&
+        /^stop research$/i.test(lines.at(-1) ?? "") &&
+        /^determining steps for creating a report(?:\.\.\.)?$/i.test(lines.at(-2) ?? "");
+    return (normalized === "called tool" ||
+        normalized === "used tool" ||
+        normalized === "użyto narzędzia" ||
+        normalized === "narzędzie wywołane" ||
+        normalized === "planning" ||
+        normalized === "researching" ||
+        normalized === "searching the web" ||
+        (text.trimStart().startsWith("<system-reminder>") &&
+            /<system-reminder>[\s\S]*#\s*plan mode\b/i.test(text)) ||
+        tailIsPlanningPanel);
+}

package/dist/src/browser/index.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import os from "node:os";
 import net from "node:net";
 import { resolveBrowserConfig } from "./config.js";
+import { copyChromeProfile } from "./profileCopy.js";
 import { launchChrome, registerTerminationHooks, hideChromeWindow, connectToRemoteChrome, connectWithNewTab, closeTab, closeRemoteChromeTarget, closeBlankChromeTabs, } from "./chromeLifecycle.js";
 import { syncCookies } from "./cookies.js";
 import { navigateToChatGPT, navigateToPromptReadyWithFallback, ensureNotBlocked, ensureLoggedIn, ensurePromptReady, waitForResumedConversationHydration, installJavaScriptDialogAutoDismissal, ensureModelSelection, clearPromptComposer, waitForAssistantResponse, captureAssistantMarkdown, clearComposerAttachments, uploadAttachmentFile, waitForAttachmentCompletion, waitForUserTurnAttachments, readAssistantSnapshot, } from "./pageActions.js";
@@ -66,6 +67,11 @@ function classifyPreservedBrowserError(error, headless) {
 function shouldPreserveBrowserOnError(error, headless) {
     return classifyPreservedBrowserError(error, headless) !== null;
 }
+function shouldKeepLocalBrowserOpen(options) {
+    if (options.usingCopiedProfile)
+        return false;
+    return options.effectiveKeepBrowser || options.preserveBrowserOnError;
+}
 export function shouldPreserveBrowserOnErrorForTest(error, headless) {
     return shouldPreserveBrowserOnError(error, headless);
 }
@@ -429,6 +435,15 @@ async function maybeArchiveCompletedConversation({ Runtime, logger, config, conv
 export function maybeArchiveCompletedConversationForTest(args) {
     return maybeArchiveCompletedConversation(args);
 }
+async function captureDeepResearchTargetBaseline(client, logger) {
+    try {
+        return { targetKeys: await captureDeepResearchTargetKeys(client), captured: true };
+    }
+    catch {
+        logger("[browser] Deep Research target baseline unavailable; retaining conversation-turn owner scoping.");
+        return { targetKeys: [], captured: false };
+    }
+}
 async function runSubmissionWithRecovery({ prompt, attachments, fallbackSubmission, submit, reloadPromptComposer, prepareFallbackSubmission, logger, }) {
     let currentPrompt = prompt;
     let currentAttachments = attachments;
@@ -520,6 +535,10 @@ export async function runBrowserMode(options) {
     const attachments = options.attachments ?? [];
     const fallbackSubmission = options.fallbackSubmission;
     let config = resolveBrowserConfig(options.config);
+    const usingCopiedProfile = Boolean(config.copyProfileSource);
+    if (usingCopiedProfile && (config.attachRunning || config.remoteChrome)) {
+        throw new BrowserAutomationError("--copy-profile requires a locally launched Chrome instance and cannot be combined with attach-running or remote Chrome.", { stage: "profile-config" });
+    }
     const isResumingConversation = Boolean(config.resumeConversationUrl);
     const followUpPrompts = normalizeBrowserFollowUpPrompts(options.followUpPrompts);
     if (config.researchMode === "deep" && followUpPrompts.length > 0) {
@@ -613,6 +632,12 @@ export async function runBrowserMode(options) {
         return runRemoteBrowserMode(promptText, attachments, config, logger, options);
     }
     const manualLogin = Boolean(config.manualLogin);
+    if (manualLogin && usingCopiedProfile) {
+        throw new BrowserAutomationError("--copy-profile cannot be combined with --browser-manual-login: choose either a throwaway copied profile or the persistent manual-login profile.", { stage: "profile-config" });
+    }
+    // Manual-login and copy-profile both start from an already-signed-in profile,
+    // so neither clears nor syncs cookies.
+    const profileIsPreSigned = manualLogin || usingCopiedProfile;
     const manualProfileDir = config.manualLoginProfileDir
         ? path.resolve(config.manualLoginProfileDir)
         : defaultManualLoginProfileDir();
@@ -629,6 +654,11 @@ export async function runBrowserMode(options) {
             keepBrowser: effectiveKeepBrowser,
         });
     }
+    else if (config.copyProfileSource) {
+        const copiedProfileDirectory = await copyChromeProfile(config.copyProfileSource, userDataDir, config.chromeProfile);
+        config = { ...config, chromeProfile: copiedProfileDirectory };
+        logger(`Seeded temporary Chrome profile ${copiedProfileDirectory} from ${config.copyProfileSource} (copy-profile mode; signed-in session reused without manual login)`);
+    }
     else {
         logger(`Created temporary Chrome profile at ${userDataDir}`);
     }
@@ -658,6 +688,9 @@ export async function runBrowserMode(options) {
             tabLease = null;
             await handle.release().catch(() => undefined);
         }
+        if (usingCopiedProfile) {
+            await rm(userDataDir, { recursive: true, force: true }).catch(() => undefined);
+        }
         throw error;
     }
     const { chrome, reusedChrome } = acquiredChrome;
@@ -674,6 +707,8 @@ export async function runBrowserMode(options) {
             isInFlight: () => runStatus !== "complete",
             emitRuntimeHint,
             preserveUserDataDir: manualLogin,
+            // copy-profile is a throwaway copy of a signed-in profile; never leave it on disk.
+            forceProfileCleanup: usingCopiedProfile,
         });
     }
     catch {
@@ -753,11 +788,11 @@ export async function runBrowserMode(options) {
         }
         await Promise.all(domainEnablers);
         removeDialogHandler = installJavaScriptDialogAutoDismissal(Page, logger);
-        if (!manualLogin) {
+        if (!profileIsPreSigned) {
             await Network.clearBrowserCookies();
         }
         const manualLoginCookieSync = manualLogin && Boolean(config.manualLoginCookieSync);
-        const cookieSyncEnabled = config.cookieSync && (!manualLogin || manualLoginCookieSync);
+        const cookieSyncEnabled = config.cookieSync && (!profileIsPreSigned || manualLoginCookieSync);
         if (cookieSyncEnabled) {
             if (manualLoginCookieSync) {
                 logger("Manual login mode: seeding persistent profile with cookies from your Chrome profile.");
@@ -1060,8 +1095,8 @@ export async function runBrowserMode(options) {
                 attachmentNames: attachmentExpectations,
                 onPromptSubmitted: markPromptSubmitted,
             };
-            const deepResearchTargetKeys = deepResearch && client
-                ? await captureDeepResearchTargetKeys(client).catch(() => [])
+            const deepResearchTargetBaseline = deepResearch && client
+                ? await captureDeepResearchTargetBaseline(client, logger)
                 : undefined;
             await runProviderSubmissionFlow(chatgptDomProvider, {
                 prompt,
@@ -1095,7 +1130,12 @@ export async function runBrowserMode(options) {
             }
             // Reattach needs a /c/ URL; ChatGPT can update it late, so poll in the background.
             scheduleConversationHint("post-submit", config.timeoutMs ?? 120_000);
-            return { baselineTurns, baselineAssistantText, deepResearchTargetKeys };
+            return {
+                baselineTurns,
+                baselineAssistantText,
+                deepResearchTargetKeys: deepResearchTargetBaseline?.targetKeys,
+                deepResearchTargetBaselineCaptured: deepResearchTargetBaseline?.captured,
+            };
         };
         const reloadPromptComposer = async () => {
             logger("[browser] Composer became unresponsive; reloading page and retrying once.");
@@ -1105,6 +1145,7 @@ export async function runBrowserMode(options) {
         let baselineTurns = null;
         let baselineAssistantText = null;
         let deepResearchTargetKeys = [];
+        let deepResearchTargetBaselineCaptured = false;
         await acquireProfileLockIfNeeded();
         try {
             const submission = await runSubmissionWithRecovery({
@@ -1122,6 +1163,7 @@ export async function runBrowserMode(options) {
             baselineTurns = submission.baselineTurns;
             baselineAssistantText = submission.baselineAssistantText;
             deepResearchTargetKeys = submission.deepResearchTargetKeys ?? [];
+            deepResearchTargetBaselineCaptured = submission.deepResearchTargetBaselineCaptured ?? false;
         }
         finally {
             await releaseProfileLockIfHeld();
@@ -1129,7 +1171,10 @@ export async function runBrowserMode(options) {
         const imageArtifactMinTurnIndex = baselineTurns;
         if (deepResearch) {
             await raceWithDisconnect(waitForResearchPlanAutoConfirm(Runtime, logger));
-            const researchResult = await raceWithDisconnect(waitForDeepResearchCompletion(Runtime, logger, config.timeoutMs, baselineTurns, Page, client, { ignoredTargetKeys: deepResearchTargetKeys }));
+            const researchResult = await raceWithDisconnect(waitForDeepResearchCompletion(Runtime, logger, config.timeoutMs, baselineTurns, Page, client, {
+                ignoredTargetKeys: deepResearchTargetKeys,
+                targetBaselineCaptured: deepResearchTargetBaselineCaptured,
+            }));
             await updateConversationHint("post-deep-research", 15_000).catch(() => false);
             runStatus = "complete";
             const durationMs = Date.now() - startedAt;
@@ -1614,6 +1659,10 @@ export async function runBrowserMode(options) {
         connectionClosedUnexpectedly = connectionClosedUnexpectedly || socketClosed;
         const preservedErrorKind = classifyPreservedBrowserError(normalizedError, config.headless);
         if (preservedErrorKind === "cloudflare-challenge") {
+            if (usingCopiedProfile) {
+                logger("Cloudflare challenge detected; closing Chrome and removing the copied profile because copy-profile runs cannot be retained.");
+                throw new BrowserAutomationError("Cloudflare challenge detected. Copy-profile runs cannot be retained; complete the check in the source Chrome profile, then rerun.", { stage: "cloudflare-challenge", reattachable: false }, normalizedError);
+            }
             preserveBrowserOnError = true;
             const runtime = {
                 chromePid: chrome.pid,
@@ -1637,6 +1686,13 @@ export async function runBrowserMode(options) {
             }, normalizedError);
         }
         if (preservedErrorKind === "reattachable-capture") {
+            if (usingCopiedProfile) {
+                logger("Assistant capture incomplete; closing Chrome and removing the copied profile because copy-profile runs cannot be reattached.");
+                const details = normalizedError instanceof BrowserAutomationError
+                    ? { ...normalizedError.details, runtime: undefined, reattachable: false }
+                    : { stage: "assistant-recheck", reattachable: false };
+                throw new BrowserAutomationError(normalizedError.message, details, normalizedError);
+            }
             preserveBrowserOnError = true;
             await emitRuntimeHint();
             logger("Assistant capture incomplete; leaving browser open for reattach.");
@@ -1689,7 +1745,11 @@ export async function runBrowserMode(options) {
             chrome?.port) {
             await closeTab(chrome.port, isolatedTargetId, logger, chromeHost).catch(() => undefined);
         }
-        let keepBrowserOpen = effectiveKeepBrowser || preserveBrowserOnError;
+        let keepBrowserOpen = shouldKeepLocalBrowserOpen({
+            effectiveKeepBrowser,
+            preserveBrowserOnError,
+            usingCopiedProfile,
+        });
         let cleanupProfileLock = null;
         let terminatedRecordedChrome = false;
         let otherActiveBrowserTabLeases = null;
@@ -2247,8 +2307,8 @@ async function runRemoteBrowserMode(promptText, attachments, config, logger, opt
                 attachmentNames: attachmentExpectations,
                 onPromptSubmitted: markPromptSubmitted,
             };
-            const deepResearchTargetKeys = deepResearch && client
-                ? await captureDeepResearchTargetKeys(client).catch(() => [])
+            const deepResearchTargetBaseline = deepResearch && client
+                ? await captureDeepResearchTargetBaseline(client, logger)
                 : undefined;
             await runProviderSubmissionFlow(chatgptDomProvider, {
                 prompt,
@@ -2262,7 +2322,12 @@ async function runRemoteBrowserMode(promptText, attachments, config, logger, opt
             if (typeof providerBaselineTurns === "number" && Number.isFinite(providerBaselineTurns)) {
                 baselineTurns = providerBaselineTurns;
             }
-            return { baselineTurns, baselineAssistantText, deepResearchTargetKeys };
+            return {
+                baselineTurns,
+                baselineAssistantText,
+                deepResearchTargetKeys: deepResearchTargetBaseline?.targetKeys,
+                deepResearchTargetBaselineCaptured: deepResearchTargetBaseline?.captured,
+            };
         };
         const reloadPromptComposer = async () => {
             logger("[browser] Composer became unresponsive; reloading page and retrying once.");
@@ -2272,6 +2337,7 @@ async function runRemoteBrowserMode(promptText, attachments, config, logger, opt
         let baselineTurns = null;
         let baselineAssistantText = null;
         let deepResearchTargetKeys = [];
+        let deepResearchTargetBaselineCaptured = false;
         const submission = await runSubmissionWithRecovery({
             prompt: promptText,
             attachments,
@@ -2287,10 +2353,14 @@ async function runRemoteBrowserMode(promptText, attachments, config, logger, opt
         baselineTurns = submission.baselineTurns;
         baselineAssistantText = submission.baselineAssistantText;
         deepResearchTargetKeys = submission.deepResearchTargetKeys ?? [];
+        deepResearchTargetBaselineCaptured = submission.deepResearchTargetBaselineCaptured ?? false;
         const imageArtifactMinTurnIndex = baselineTurns;
         if (deepResearch) {
             await waitForResearchPlanAutoConfirm(Runtime, logger);
-            const researchResult = await waitForDeepResearchCompletion(Runtime, logger, config.timeoutMs, baselineTurns, Page, client, { ignoredTargetKeys: deepResearchTargetKeys });
+            const researchResult = await waitForDeepResearchCompletion(Runtime, logger, config.timeoutMs, baselineTurns, Page, client, {
+                ignoredTargetKeys: deepResearchTargetKeys,
+                targetBaselineCaptured: deepResearchTargetBaselineCaptured,
+            });
             await emitRuntimeHint();
             const durationMs = Date.now() - startedAt;
             const tokens = estimateTokenCount(researchResult.text);
@@ -2812,6 +2882,7 @@ export const __test__ = {
     listIgnoredRemoteChromeFlags,
     resolveManualLoginWaitMs,
     shouldCloseOwnedRunTargetAfterRun,
+    shouldKeepLocalBrowserOpen,
 };
 export { syncCookies } from "./cookies.js";
 export { navigateToChatGPT, ensureNotBlocked, ensurePromptReady, ensureModelSelection, submitPrompt, waitForAssistantResponse, captureAssistantMarkdown, uploadAttachmentFile, waitForAttachmentCompletion, } from "./pageActions.js";

package/dist/src/browser/keytarShim.js

@@ -0,0 +1,56 @@
+const defaultLabels = [
+    { service: 'Chrome Safe Storage', account: 'Chrome' },
+    { service: 'Chromium Safe Storage', account: 'Chromium' },
+    { service: 'Microsoft Edge Safe Storage', account: 'Microsoft Edge' },
+    { service: 'Brave Safe Storage', account: 'Brave' },
+    { service: 'Vivaldi Safe Storage', account: 'Vivaldi' },
+];
+function loadEnvLabels() {
+    const raw = process.env.ORACLE_KEYCHAIN_LABELS;
+    if (!raw)
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed)) {
+            return parsed
+                .map((entry) => (entry && typeof entry === 'object' ? entry : null))
+                .filter((entry) => Boolean(entry?.service && entry?.account));
+        }
+    }
+    catch {
+        // ignore invalid env payload
+    }
+    return [];
+}
+const fallbackLabels = [...loadEnvLabels(), ...defaultLabels];
+const disableKeytar = process.env.ORACLE_DISABLE_KEYTAR === '1' || process.env.CI === 'true';
+let keytar;
+if (disableKeytar) {
+    keytar = {
+        getPassword: async () => null,
+        setPassword: async () => undefined,
+        deletePassword: async () => false,
+    };
+}
+else {
+    const keytarModule = await import('keytar');
+    keytar = (keytarModule.default ?? keytarModule);
+    const originalGetPassword = keytar.getPassword.bind(keytar);
+    keytar.getPassword = async (service, account) => {
+        const primary = await originalGetPassword(service, account);
+        if (primary) {
+            return primary;
+        }
+        for (const label of fallbackLabels) {
+            if (label.service === service && label.account === account) {
+                continue; // already tried
+            }
+            const value = await originalGetPassword(label.service, label.account);
+            if (value) {
+                return value;
+            }
+        }
+        return null;
+    };
+}
+export default keytar;

package/dist/src/browser/profileCopy.js

@@ -0,0 +1,93 @@
+import { spawn } from "node:child_process";
+import { cp, mkdir, readFile, rm } from "node:fs/promises";
+import path from "node:path";
+/**
+ * Cache/derived subdirectories that bloat the copy and carry no signed-in-session
+ * signal, so they are skipped when seeding a copied Chrome profile.
+ */
+const RSYNC_EXCLUDES = [
+    "Cache/",
+    "Code Cache/",
+    "GPUCache/",
+    "DawnGraphiteCache/",
+    "DawnWebGPUCache/",
+    "GrShaderCache/",
+    "ShaderCache/",
+    "Service Worker/CacheStorage/",
+    "Service Worker/ScriptCache/",
+    "Service Worker/Database/",
+];
+/**
+ * Copy a signed-in Chrome user-data directory into `destDir` so a throwaway
+ * Chrome can launch on the copy and reuse the live session WITHOUT a manual
+ * sign-in. Copies the `Default/` profile (minus cache dirs) plus the top-level
+ * `Local State` file.
+ *
+ * `Local State` is required: on macOS it holds the Keychain-wrapped
+ * "Chrome Safe Storage" key that decrypts the profile's cookies — a cookies-only
+ * copy fails the logged-in check. Decryption only succeeds when the copy is
+ * launched by the real Chrome binary (the one on the Keychain ACL).
+ *
+ * Uses rsync (present on macOS/Linux) so a live, in-use source profile copies
+ * cleanly — rsync exit 24 ("source files vanished") is tolerated.
+ */
+export async function copyChromeProfile(srcUserDataDir, destDir, requestedProfile) {
+    try {
+        const localStatePath = path.join(srcUserDataDir, "Local State");
+        const copiedLocalStatePath = path.join(destDir, "Local State");
+        await cp(localStatePath, copiedLocalStatePath).catch((err) => {
+            throw new Error(`--copy-profile: could not copy required "Local State" from ${srcUserDataDir} ` +
+                `(needed to select and decrypt the signed-in profile): ${err.message}`);
+        });
+        const localState = await readFile(copiedLocalStatePath, "utf8");
+        const profileDirectory = resolveChromeProfileDirectory(srcUserDataDir, localState, requestedProfile);
+        const srcProfile = path.join(srcUserDataDir, profileDirectory);
+        const destProfile = path.join(destDir, profileDirectory);
+        await mkdir(destProfile, { recursive: true });
+        // `Local State` is required (holds the Keychain-wrapped key that decrypts the
+        // cookies), so a copy failure must fail fast — otherwise the run continues with
+        // a profile that silently looks logged-out.
+        const args = ["-a"];
+        for (const exclude of RSYNC_EXCLUDES) {
+            args.push("--exclude", exclude);
+        }
+        args.push(`${srcProfile}/`, `${destProfile}/`);
+        await new Promise((resolve, reject) => {
+            const child = spawn("rsync", args, { stdio: "ignore" });
+            child.on("error", (err) => reject(new Error(`--copy-profile requires rsync on PATH (spawn failed): ${err.message}`)));
+            child.on("close", (code) => code === 0 || code === 24
+                ? resolve()
+                : reject(new Error(`rsync failed copying Chrome profile (exit ${code})`)));
+        });
+        return profileDirectory;
+    }
+    catch (error) {
+        // The destination is always a newly-created throwaway profile. Remove partial
+        // session-bearing copies before surfacing setup failures.
+        await rm(destDir, { recursive: true, force: true }).catch(() => undefined);
+        throw error;
+    }
+}
+function resolveChromeProfileDirectory(srcUserDataDir, localState, requestedProfile) {
+    let profile = requestedProfile?.trim();
+    if (!profile) {
+        try {
+            const parsed = JSON.parse(localState);
+            profile =
+                typeof parsed.profile?.last_used === "string" ? parsed.profile.last_used.trim() : "";
+        }
+        catch (error) {
+            throw new Error(`--copy-profile: could not parse "Local State" to select the active Chrome profile: ${error.message}`);
+        }
+    }
+    profile ||= "Default";
+    const root = path.resolve(srcUserDataDir);
+    const resolved = path.resolve(root, profile);
+    if (path.dirname(resolved) !== root) {
+        throw new Error(`--copy-profile: Chrome profile must be a direct child of the user-data directory; received ${JSON.stringify(profile)}.`);
+    }
+    return path.basename(resolved);
+}
+export function resolveChromeProfileDirectoryForTest(srcUserDataDir, localState, requestedProfile) {
+    return resolveChromeProfileDirectory(srcUserDataDir, localState, requestedProfile);
+}