@steipete/oracle 0.17.1 → 0.17.3

package/dist/src/browser/chromeCookies.js

@@ -0,0 +1,312 @@
+import path from 'node:path';
+import os from 'node:os';
+import fs from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import chromeCookies from 'chrome-cookies-secure';
+import { COOKIE_URLS } from './constants.js';
+import { ensureCookiesDirForFallback } from './windowsCookies.js';
+const COOKIE_READ_TIMEOUT_MS = readDuration('ORACLE_COOKIE_LOAD_TIMEOUT_MS', 5_000);
+const KEYCHAIN_PROBE_TIMEOUT_MS = readDuration('ORACLE_KEYCHAIN_PROBE_TIMEOUT_MS', 3_000);
+const MAC_KEYCHAIN_LABELS = loadKeychainLabels();
+export async function loadChromeCookies({ targetUrl, profile, explicitCookiePath, filterNames, }) {
+    if (process.platform === 'win32') {
+        throw new Error('Cookie sync is disabled on Windows; use --browser-manual-login (persistent profile) or inline cookies instead.');
+    }
+    const urlsToCheck = Array.from(new Set([stripQuery(targetUrl), ...COOKIE_URLS]));
+    const merged = new Map();
+    const cookieFile = await resolveCookieFilePath({ explicitPath: explicitCookiePath, profile });
+    const cookiesPath = await materializeCookieFile(cookieFile); // returns the copied file (or source on non-Windows)
+    const fallbackDir = await ensureCookiesDirForFallback(cookiesPath);
+    if (process.env.ORACLE_DEBUG_COOKIES === '1') {
+        // eslint-disable-next-line no-console
+        console.log(`[cookies] resolved cookie file: ${cookiesPath}`);
+        console.log(`[cookies] fallback dir for chrome-cookies-secure: ${fallbackDir}`);
+    }
+    await ensureMacKeychainReadable();
+    for (const url of urlsToCheck) {
+        let raw;
+        try {
+            const pathForSecure = await adaptPathForChromeCookies(fallbackDir);
+            raw = await settleWithTimeout(chromeCookies.getCookiesPromised(url, 'puppeteer', pathForSecure), COOKIE_READ_TIMEOUT_MS, `Timed out reading Chrome cookies from ${pathForSecure} (after ${COOKIE_READ_TIMEOUT_MS} ms)`);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            throw new Error(`Failed to load Chrome cookies for ${url}: ${message}`);
+        }
+        if (!Array.isArray(raw))
+            continue;
+        const fallbackHost = new URL(url).hostname;
+        for (const cookie of raw) {
+            if (filterNames && filterNames.size > 0 && !filterNames.has(cookie.name))
+                continue;
+            const normalized = normalizeCookie(cookie, fallbackHost);
+            if (!normalized)
+                continue;
+            const key = `${normalized.domain ?? fallbackHost}:${normalized.name}`;
+            if (!merged.has(key)) {
+                merged.set(key, normalized);
+            }
+        }
+    }
+    return Array.from(merged.values());
+}
+async function ensureMacKeychainReadable() {
+    if (process.platform === 'win32') {
+        return;
+    }
+    // chrome-cookies-secure can hang forever when the platform keyring rejects access (e.g., SSH/no GUI).
+    // Probe the keyring ourselves with a timeout so callers fail fast instead of blocking the run.
+    let keytar = null;
+    let keytarPath = null;
+    try {
+        const require = createRequire(import.meta.url);
+        keytarPath = require.resolve('keytar');
+        const keytarModule = await import('keytar');
+        keytar = (keytarModule.default ?? keytarModule);
+    }
+    catch (error) {
+        const base = error instanceof Error ? error.message : String(error);
+        const rebuildHint = keytarPath
+            ? ` You may need to rebuild keytar: PYTHON=/usr/bin/python3 /Users/steipete/Projects/oracle/runner npx node-gyp rebuild (run inside ${path.dirname(keytarPath)}).`
+            : '';
+        throw new Error(`Failed to load keytar for secure cookie copy (${base}). Install keyring deps (macOS Keychain / libsecret) or rerun with --render --copy to paste into ChatGPT manually.${rebuildHint}`);
+    }
+    const password = await settleWithTimeout(findKeychainPassword(keytar, MAC_KEYCHAIN_LABELS), KEYCHAIN_PROBE_TIMEOUT_MS, `Timed out reading macOS Keychain while looking up Chrome Safe Storage (after ${KEYCHAIN_PROBE_TIMEOUT_MS} ms). Unlock the login keychain or start oracle serve from a GUI session.`);
+    if (!password) {
+        throw new Error('macOS Keychain denied access to Chrome cookies. Unlock the login keychain or run oracle serve from a GUI session, then retry.');
+    }
+}
+async function findKeychainPassword(keytar, labels) {
+    let lastError = null;
+    for (const label of labels) {
+        try {
+            const value = await keytar.getPassword(label.service, label.account);
+            if (value)
+                return value;
+        }
+        catch (error) {
+            lastError = error instanceof Error ? error : new Error(String(error));
+        }
+    }
+    if (lastError) {
+        throw lastError;
+    }
+    return null;
+}
+function settleWithTimeout(promise, timeoutMs, timeoutMessage) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error(timeoutMessage)), timeoutMs);
+        timer.unref?.();
+        promise.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+}
+function normalizeCookie(cookie, fallbackHost) {
+    if (!cookie?.name)
+        return null;
+    const domain = cookie.domain?.startsWith('.') ? cookie.domain.slice(1) : cookie.domain ?? fallbackHost;
+    const expires = normalizeExpiration(cookie.expires);
+    const secure = typeof cookie.Secure === 'boolean' ? cookie.Secure : true;
+    const httpOnly = typeof cookie.HttpOnly === 'boolean' ? cookie.HttpOnly : false;
+    return {
+        name: cookie.name,
+        value: cleanValue(cookie.value ?? ''),
+        domain,
+        path: cookie.path ?? '/',
+        expires,
+        secure,
+        httpOnly,
+    };
+}
+function cleanValue(value) {
+    let i = 0;
+    while (i < value.length && value.charCodeAt(i) < 0x20)
+        i += 1;
+    return value.slice(i);
+}
+function normalizeExpiration(expires) {
+    if (!expires || Number.isNaN(expires)) {
+        return undefined;
+    }
+    const value = Number(expires);
+    if (value <= 0)
+        return undefined;
+    if (value > 1_000_000_000_000) {
+        return Math.round(value / 1_000_000 - 11644473600);
+    }
+    if (value > 1_000_000_000) {
+        return Math.round(value / 1000);
+    }
+    return Math.round(value);
+}
+async function resolveCookieFilePath({ explicitPath, profile, }) {
+    if (explicitPath && explicitPath.trim().length > 0) {
+        return ensureCookieFile(explicitPath);
+    }
+    if (profile && looksLikePath(profile)) {
+        return ensureCookieFile(profile);
+    }
+    const profileName = profile && profile.trim().length > 0 ? profile : 'Default';
+    const baseDir = await defaultProfileRoot();
+    return ensureCookieFile(path.join(baseDir, profileName));
+}
+async function adaptPathForChromeCookies(resolved) {
+    const stat = await fs.stat(resolved).catch(() => null);
+    if (stat?.isFile()) {
+        // chrome-cookies-secure appends "Cookies" when given a directory; if we already have the file, return its directory.
+        return path.dirname(resolved);
+    }
+    return resolved;
+}
+async function ensureCookieFile(inputPath) {
+    const expanded = expandPath(inputPath);
+    const stat = await fs.stat(expanded).catch(() => null);
+    if (!stat) {
+        throw new Error(`Unable to locate Chrome cookie DB at ${expanded}`);
+    }
+    if (stat.isDirectory()) {
+        const directFile = path.join(expanded, 'Cookies');
+        if (await fileExists(directFile))
+            return directFile;
+        const networkFile = path.join(expanded, 'Network', 'Cookies');
+        if (await fileExists(networkFile))
+            return networkFile;
+        throw new Error(`No Cookies DB found under ${expanded}`);
+    }
+    return expanded;
+}
+async function fileExists(candidate) {
+    try {
+        const stat = await fs.stat(candidate);
+        return stat.isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function expandPath(input) {
+    if (input.startsWith('~/')) {
+        return path.join(os.homedir(), input.slice(2));
+    }
+    return path.isAbsolute(input) ? input : path.resolve(process.cwd(), input);
+}
+function looksLikePath(value) {
+    return value.includes('/') || value.includes('\\');
+}
+async function materializeCookieFile(sourcePath) {
+    if (process.platform !== 'win32')
+        return sourcePath;
+    // Chrome can keep the Cookies DB locked; copy to a temp file so sqlite can open it reliably.
+    const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'oracle-cookies-'));
+    const tempPath = path.join(tempDir, 'Cookies');
+    try {
+        await fs.copyFile(sourcePath, tempPath);
+        return tempPath;
+    }
+    catch (_error) {
+        // Fall back to the original path if the copy fails; upstream error handling will surface issues.
+        return sourcePath;
+    }
+}
+async function defaultProfileRoot() {
+    const candidates = [];
+    if (process.platform === 'darwin') {
+        candidates.push(path.join(os.homedir(), 'Library', 'Application Support', 'Google', 'Chrome'), path.join(os.homedir(), 'Library', 'Application Support', 'Microsoft Edge'), path.join(os.homedir(), 'Library', 'Application Support', 'Chromium'));
+    }
+    else if (process.platform === 'linux') {
+        if (isWsl()) {
+            const windowsHomes = [process.env.USERPROFILE, process.env.WIN_HOME, process.env.HOME?.replace('/home', '/mnt/c/Users')]
+                .filter((p) => Boolean(p))
+                .map((p) => p.replace(/\\/g, '/'));
+            const wslCandidates = [];
+            for (const home of windowsHomes) {
+                const normalized = home.startsWith('/mnt/') ? home : `/mnt/c/Users/${path.basename(home)}`;
+                wslCandidates.push(path.join(normalized, 'AppData', 'Local', 'Google', 'Chrome', 'User Data'), path.join(normalized, 'AppData', 'Local', 'Microsoft', 'Edge', 'User Data'));
+            }
+            // Ensure we don't pick a non-user Default profile ahead of real ones.
+            for (const candidate of wslCandidates) {
+                const hasProfile = existsSync(path.join(candidate, 'Default'));
+                if (hasProfile) {
+                    candidates.push(candidate);
+                }
+            }
+        }
+        candidates.push(path.join(os.homedir(), '.config', 'google-chrome'), path.join(os.homedir(), '.config', 'microsoft-edge'), path.join(os.homedir(), '.config', 'chromium'), 
+        // Snap Chromium profiles
+        path.join(os.homedir(), 'snap', 'chromium', 'common', 'chromium'), path.join(os.homedir(), 'snap', 'chromium', 'current', 'chromium'));
+    }
+    else if (process.platform === 'win32') {
+        const localAppData = process.env.LOCALAPPDATA ?? path.join(os.homedir(), 'AppData', 'Local');
+        candidates.push(path.join(localAppData, 'Google', 'Chrome', 'User Data'), path.join(localAppData, 'Microsoft', 'Edge', 'User Data'), path.join(localAppData, 'Chromium', 'User Data'));
+    }
+    else {
+        throw new Error(`Unsupported platform: ${process.platform}`);
+    }
+    for (const candidate of candidates) {
+        if (existsSync(candidate)) {
+            return candidate;
+        }
+    }
+    // fallback: first candidate even if missing; upstream will throw clearer error
+    return candidates[0];
+}
+function stripQuery(url) {
+    try {
+        const parsed = new URL(url);
+        parsed.hash = '';
+        parsed.search = '';
+        return parsed.toString();
+    }
+    catch {
+        return url;
+    }
+}
+function readDuration(envKey, fallback) {
+    const raw = process.env[envKey];
+    if (!raw)
+        return fallback;
+    const parsed = Number.parseInt(raw, 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function isWsl() {
+    if (process.platform !== 'linux')
+        return false;
+    return Boolean(process.env.WSL_DISTRO_NAME || os.release().toLowerCase().includes('microsoft'));
+}
+function loadKeychainLabels() {
+    const defaults = [
+        { service: 'Chrome Safe Storage', account: 'Chrome' },
+        { service: 'Chromium Safe Storage', account: 'Chromium' },
+        { service: 'Microsoft Edge Safe Storage', account: 'Microsoft Edge' },
+        { service: 'Brave Safe Storage', account: 'Brave' },
+        { service: 'Vivaldi Safe Storage', account: 'Vivaldi' },
+    ];
+    const rawEnv = process.env.ORACLE_KEYCHAIN_LABELS;
+    if (!rawEnv)
+        return defaults;
+    try {
+        const parsed = JSON.parse(rawEnv);
+        if (!Array.isArray(parsed))
+            return defaults;
+        const envLabels = parsed
+            .map((entry) => (entry && typeof entry === 'object' ? entry : null))
+            .filter((entry) => Boolean(entry?.service && entry?.account));
+        return envLabels.length ? [...envLabels, ...defaults] : defaults;
+    }
+    catch {
+        return defaults;
+    }
+}
+// biome-ignore lint/style/useNamingConvention: test-only export used in vitest suite
+export const __test__ = {
+    normalizeExpiration,
+    cleanValue,
+    looksLikePath,
+    defaultProfileRoot,
+};

package/dist/src/browser/index.js

@@ -32,6 +32,7 @@ import { captureBrowserDiagnostics } from "./domDebug.js";
 import { archiveChatGptConversation, resolveBrowserArchiveDecision, } from "./actions/archiveConversation.js";
 import { assertManualLoginProfileReadyForRun, defaultManualLoginProfileDir, formatManualLoginSetupCommand, isManualLoginProfileInitialized, resolveManualLoginWaitMs, } from "./manualLoginProfile.js";
 import { describeBrowserControlPlan, formatBrowserControlPlan } from "./controlPlan.js";
+import { shouldSyncBrowserCookies } from "./policies.js";
 import { createConversationUrlMonitor, } from "./conversationUrlMonitor.js";
 import { extractStableConversationIdFromUrl as extractConversationIdFromUrl, isStableConversationUrl as isConversationUrl, } from "./conversationUrl.js";
 export { CHATGPT_URL, DEFAULT_MODEL_STRATEGY, DEFAULT_MODEL_TARGET } from "./constants.js";
@@ -864,7 +865,10 @@ export async function runBrowserMode(options) {
             await Network.clearBrowserCookies();
         }
         const manualLoginCookieSync = manualLogin && Boolean(config.manualLoginCookieSync);
-        const cookieSyncEnabled = config.cookieSync && (!profileIsPreSigned || manualLoginCookieSync);
+        const cookieSyncEnabled = shouldSyncBrowserCookies(config, {
+            manualLogin,
+            profileIsPreSigned,
+        });
         if (cookieSyncEnabled) {
             if (manualLoginCookieSync) {
                 logger("Manual login mode: seeding persistent profile with cookies from your Chrome profile.");

package/dist/src/browser/keytarShim.js

@@ -0,0 +1,56 @@
+const defaultLabels = [
+    { service: 'Chrome Safe Storage', account: 'Chrome' },
+    { service: 'Chromium Safe Storage', account: 'Chromium' },
+    { service: 'Microsoft Edge Safe Storage', account: 'Microsoft Edge' },
+    { service: 'Brave Safe Storage', account: 'Brave' },
+    { service: 'Vivaldi Safe Storage', account: 'Vivaldi' },
+];
+function loadEnvLabels() {
+    const raw = process.env.ORACLE_KEYCHAIN_LABELS;
+    if (!raw)
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed)) {
+            return parsed
+                .map((entry) => (entry && typeof entry === 'object' ? entry : null))
+                .filter((entry) => Boolean(entry?.service && entry?.account));
+        }
+    }
+    catch {
+        // ignore invalid env payload
+    }
+    return [];
+}
+const fallbackLabels = [...loadEnvLabels(), ...defaultLabels];
+const disableKeytar = process.env.ORACLE_DISABLE_KEYTAR === '1' || process.env.CI === 'true';
+let keytar;
+if (disableKeytar) {
+    keytar = {
+        getPassword: async () => null,
+        setPassword: async () => undefined,
+        deletePassword: async () => false,
+    };
+}
+else {
+    const keytarModule = await import('keytar');
+    keytar = (keytarModule.default ?? keytarModule);
+    const originalGetPassword = keytar.getPassword.bind(keytar);
+    keytar.getPassword = async (service, account) => {
+        const primary = await originalGetPassword(service, account);
+        if (primary) {
+            return primary;
+        }
+        for (const label of fallbackLabels) {
+            if (label.service === service && label.account === account) {
+                continue; // already tried
+            }
+            const value = await originalGetPassword(label.service, label.account);
+            if (value) {
+                return value;
+            }
+        }
+        return null;
+    };
+}
+export default keytar;

package/dist/src/browser/policies.js

@@ -24,6 +24,10 @@ export function buildAttachmentPlan(sections, { inlineFiles, bundleRequested, ma
         shouldBundle,
     };
 }
+export function shouldSyncBrowserCookies(config, { manualLogin, profileIsPreSigned = manualLogin, }) {
+    const explicitManualLoginSync = manualLogin && config.manualLoginCookieSync === true;
+    return config.cookieSync && (!profileIsPreSigned || explicitManualLoginSync);
+}
 export function buildCookiePlan(config) {
     if (config?.inlineCookies && config.inlineCookies.length > 0) {
         const source = config.inlineCookiesSource ?? "inline";

package/dist/src/browser/profileSync.js

@@ -0,0 +1,141 @@
+import { mkdir, rm, cp as copyDir } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { defaultProfileRoot, expandPath, looksLikePath } from './chromeCookies.js';
+const DIR_EXCLUDES = [
+    'Cache',
+    'Code Cache',
+    'GPUCache',
+    'Service Worker',
+    'Crashpad',
+    'BrowserMetrics*',
+    'GrShaderCache',
+    'ShaderCache',
+    'OptimizationGuide',
+];
+const FILE_EXCLUDES = [
+    'SingletonLock',
+    'SingletonSocket',
+    'SingletonCookie',
+    '*.lock',
+    'lockfile',
+    'Lock',
+    '*.tmp',
+    'DevToolsActivePort',
+    path.join('Default', 'DevToolsActivePort'),
+    path.join('Sessions', '*'),
+    'Current Session',
+    'Current Tabs',
+    'Last Session',
+    'Last Tabs',
+];
+export async function syncChromeProfile(options) {
+    const { targetDir } = options;
+    await mkdir(targetDir, { recursive: true });
+    const { sourceDir, profileName } = await resolveProfileSource(options.profile, options.explicitPath);
+    const logger = options.logger;
+    if (!existsSync(sourceDir)) {
+        throw new Error(`Chrome profile not found at ${sourceDir}. Log in once in Chrome, then retry.`);
+    }
+    // Clean any stale DevTools ports/locks in the target before copying.
+    await rm(targetDir, { recursive: true, force: true }).catch(() => undefined);
+    await mkdir(targetDir, { recursive: true });
+    const result = process.platform === 'win32'
+        ? await copyWithRobocopy(sourceDir, targetDir, logger)
+        : await copyWithRsync(sourceDir, targetDir, logger);
+    // Remove lock files in the copied profile to avoid "already running" errors.
+    await removeLocks(targetDir);
+    return {
+        source: sourceDir,
+        profileName,
+        method: result.method,
+        status: result.copied ? 'copied' : 'skipped',
+    };
+}
+async function copyWithRsync(sourceDir, targetDir, logger) {
+    const rsyncArgs = [
+        '-a',
+        '--delete',
+        ...DIR_EXCLUDES.flatMap((entry) => ['--exclude', entry]),
+        ...FILE_EXCLUDES.flatMap((entry) => ['--exclude', entry]),
+        `${sourceDir}/`,
+        `${targetDir}/`,
+    ];
+    const attempt = spawnSync('rsync', rsyncArgs, { stdio: 'pipe' });
+    if (!attempt.error && (attempt.status ?? 0) === 0) {
+        return { copied: true, method: 'rsync' };
+    }
+    logger?.('rsync unavailable or failed; falling back to Node copy');
+    await copyDirWithFilter(sourceDir, targetDir);
+    return copyWithNodeFs();
+}
+async function copyWithRobocopy(sourceDir, targetDir, logger) {
+    const args = [sourceDir, targetDir, '/MIR', '/NFL', '/NDL', '/NJH', '/NJS', '/NP', '/Z'];
+    if (DIR_EXCLUDES.length) {
+        args.push('/XD', ...DIR_EXCLUDES);
+    }
+    if (FILE_EXCLUDES.length) {
+        args.push('/XF', ...FILE_EXCLUDES);
+    }
+    const attempt = spawnSync('robocopy', args, { stdio: 'pipe' });
+    const exitCode = attempt.status ?? 0;
+    // Robocopy treats 0-7 as success/partial success; >=8 is failure.
+    if (!attempt.error && exitCode < 8) {
+        return { copied: true, method: 'robocopy' };
+    }
+    logger?.('robocopy failed; falling back to Node copy');
+    await copyDirWithFilter(sourceDir, targetDir);
+    return copyWithNodeFs();
+}
+function copyWithNodeFs() {
+    return { copied: true, method: 'node' };
+}
+function shouldExclude(relativePath) {
+    const normalized = relativePath.replace(/\\/g, '/');
+    return DIR_EXCLUDES.some((entry) => normalized === entry || normalized.startsWith(`${entry}/`)) ||
+        FILE_EXCLUDES.some((entry) => {
+            if (entry.endsWith('*')) {
+                return normalized.startsWith(entry.slice(0, -1));
+            }
+            if (entry.includes('*')) {
+                // simple glob support for BrowserMetrics*
+                const prefix = entry.replace('*', '');
+                return normalized.startsWith(prefix);
+            }
+            return path.basename(normalized) === entry || normalized.endsWith(`/${entry}`);
+        });
+}
+async function removeLocks(targetDir) {
+    const lockNames = ['SingletonLock', 'SingletonSocket', 'SingletonCookie', 'DevToolsActivePort'];
+    for (const lock of lockNames) {
+        await rm(path.join(targetDir, lock), { force: true }).catch(() => undefined);
+        await rm(path.join(targetDir, 'Default', lock), { force: true }).catch(() => undefined);
+    }
+}
+async function resolveProfileSource(profile, explicitPath) {
+    const profileName = profile?.trim() ? profile.trim() : 'Default';
+    if (explicitPath?.trim()) {
+        const resolved = expandPath(explicitPath.trim());
+        if (resolved.toLowerCase().endsWith('cookies')) {
+            return { sourceDir: path.dirname(resolved), profileName };
+        }
+        return { sourceDir: resolved, profileName };
+    }
+    if (looksLikePath(profileName)) {
+        return { sourceDir: expandPath(profileName), profileName };
+    }
+    const baseRoot = await defaultProfileRoot();
+    return { sourceDir: path.join(baseRoot, profileName), profileName };
+}
+async function copyDirWithFilter(sourceDir, targetDir) {
+    await copyDir(sourceDir, targetDir, {
+        recursive: true,
+        filter: async (source) => {
+            const rel = path.relative(sourceDir, source);
+            if (!rel)
+                return true;
+            return !shouldExclude(rel);
+        },
+    });
+}

package/dist/src/browser/projectSourcesRunner.js

@@ -13,6 +13,7 @@ import { assertManualLoginProfileReadyForRun, defaultManualLoginProfileDir, form
 import { openProjectSourcesTab, uploadProjectSources, waitForProjectSourcesReady, waitForProjectSourcesListSettled, } from "./actions/projectSources.js";
 import { normalizeProjectSourcesUrl } from "../projectSources/url.js";
 import { buildProjectSourcesUploadPlan, diffAddedProjectSources } from "../projectSources/plan.js";
+import { shouldSyncBrowserCookies } from "./policies.js";
 export async function runBrowserProjectSources(request) {
     const startedAt = Date.now();
     const logger = ((message) => request.log?.(message));
@@ -248,8 +249,7 @@ export async function runBrowserProjectSources(request) {
     }
 }
 async function applyProjectSourcesCookies({ config, network, manualLogin, logger, }) {
-    const manualLoginCookieSync = manualLogin && Boolean(config.manualLoginCookieSync);
-    const cookieSyncEnabled = config.cookieSync && (!manualLogin || manualLoginCookieSync);
+    const cookieSyncEnabled = shouldSyncBrowserCookies(config, { manualLogin });
     if (!cookieSyncEnabled) {
         logger(manualLogin
             ? "Skipping Chrome cookie sync (--browser-manual-login enabled); reuse the opened profile after signing in."

package/dist/src/browser/reattach.js

@@ -12,6 +12,7 @@ import { cleanupStaleProfileState } from "./profileState.js";
 import { readDevToolsActivePortInfo } from "./detect.js";
 import { pickTarget, extractConversationIdFromUrl, buildConversationUrl, withTimeout, openConversationFromSidebar, openConversationFromSidebarWithRetry, waitForLocationChange, readConversationTurnIndex, buildPromptEchoMatcher, recoverPromptEcho, alignPromptEchoMarkdown, } from "./reattachHelpers.js";
 import { waitForDeepResearchCompletion } from "./actions/deepResearch.js";
+import { shouldSyncBrowserCookies } from "./policies.js";
 export async function resumeBrowserSession(runtime, config, logger, deps = {}) {
     const recoverSession = deps.recoverSession ??
         (async (runtimeMeta, configMeta) => resumeBrowserSessionViaNewChrome(runtimeMeta, configMeta, logger, deps));
@@ -176,9 +177,37 @@ async function resumeBrowserSessionViaNewChrome(runtime, config, logger, deps) {
     if (manualLogin) {
         await mkdir(userDataDir, { recursive: true });
     }
-    const chrome = await launchChrome(resolved, userDataDir, logger);
-    const chromeHost = chrome.host ?? "127.0.0.1";
-    const client = await connectToChrome(chrome.port, logger, chromeHost);
+    const launch = deps.launchChrome ?? launchChrome;
+    const connectToLaunchedChrome = deps.connectToChrome ?? connectToChrome;
+    const chrome = await launch(resolved, userDataDir, logger);
+    const chromeHost = chrome && typeof chrome === "object" && "host" in chrome && typeof chrome.host === "string"
+        ? chrome.host
+        : "127.0.0.1";
+    const client = await connectToLaunchedChrome(chrome.port, logger, chromeHost);
+    const cleanup = async () => {
+        if (client && typeof client.close === "function") {
+            try {
+                await client.close();
+            }
+            catch {
+                // ignore
+            }
+        }
+        if (!resolved.keepBrowser) {
+            try {
+                await chrome.kill();
+            }
+            catch {
+                // ignore
+            }
+            if (manualLogin) {
+                await cleanupStaleProfileState(userDataDir, logger, { lockRemovalMode: "never" }).catch(() => undefined);
+            }
+            else {
+                await rm(userDataDir, { recursive: true, force: true }).catch(() => undefined);
+            }
+        }
+    };
     const { Network, Page, Runtime, DOM, Target } = client;
     if (Runtime?.enable) {
         await Runtime.enable();
@@ -190,14 +219,21 @@ async function resumeBrowserSessionViaNewChrome(runtime, config, logger, deps) {
         await positionChromeWindowOffscreen(client, logger);
     }
     let appliedCookies = 0;
-    if (!manualLogin && resolved.cookieSync) {
-        appliedCookies = await syncCookies(Network, resolved.url, resolved.chromeProfile, logger, {
-            allowErrors: resolved.allowCookieErrors,
-            filterNames: resolved.cookieNames ?? undefined,
-            inlineCookies: resolved.inlineCookies ?? undefined,
-            cookiePath: resolved.chromeCookiePath ?? undefined,
-            waitMs: resolved.cookieSyncWaitMs ?? 0,
-        });
+    if (shouldSyncBrowserCookies(resolved, { manualLogin })) {
+        const sync = deps.syncCookies ?? syncCookies;
+        try {
+            appliedCookies = await sync(Network, resolved.url, resolved.chromeProfile, logger, {
+                allowErrors: resolved.allowCookieErrors,
+                filterNames: resolved.cookieNames ?? undefined,
+                inlineCookies: resolved.inlineCookies ?? undefined,
+                cookiePath: resolved.chromeCookiePath ?? undefined,
+                waitMs: resolved.cookieSyncWaitMs ?? 0,
+            });
+        }
+        catch (error) {
+            await cleanup();
+            throw error;
+        }
     }
     await clearStaleChatGptConversationCookies(Network, Target, logger, {
         preserveConversationIds: [
@@ -242,30 +278,6 @@ async function resumeBrowserSessionViaNewChrome(runtime, config, logger, deps) {
     const waitForResponse = deps.waitForAssistantResponse ?? waitForAssistantResponse;
     const captureMarkdown = deps.captureAssistantMarkdown ?? captureAssistantMarkdown;
     const timeoutMs = resolved.timeoutMs ?? 120_000;
-    const cleanup = async () => {
-        if (client && typeof client.close === "function") {
-            try {
-                await client.close();
-            }
-            catch {
-                // ignore
-            }
-        }
-        if (!resolved.keepBrowser) {
-            try {
-                await chrome.kill();
-            }
-            catch {
-                // ignore
-            }
-            if (manualLogin) {
-                await cleanupStaleProfileState(userDataDir, logger, { lockRemovalMode: "never" }).catch(() => undefined);
-            }
-            else {
-                await rm(userDataDir, { recursive: true, force: true }).catch(() => undefined);
-            }
-        }
-    };
     const minTurnIndex = (await readPromptPreviewTurnIndex(Runtime, deps.promptPreview)) ??
         (deps.promptPreview ? null : await readConversationTurnIndex(Runtime, logger));
     if (resolved.researchMode === "deep") {