agent-messenger 1.14.0 → 2.0.0

package/src/platforms/channeltalk/token-extractor.ts

@@ -1,9 +1,13 @@
-import { copyFileSync, existsSync, unlinkSync } from 'node:fs'
+import { createDecipheriv } from 'node:crypto'
+import { copyFileSync, existsSync, readFileSync, unlinkSync } from 'node:fs'
+import { execSync } from 'node:child_process'
 import { homedir, tmpdir } from 'node:os'
 import { join } from 'node:path'
 
 import type { ExtractedChannelToken } from './types'
 
+type CookieRow = { name: string; value: string; encrypted_value: Uint8Array | Buffer }
+
 export class ChannelTokenExtractor {
   private platform: NodeJS.Platform
 
@@ -11,28 +15,56 @@ export class ChannelTokenExtractor {
     this.platform = platform ?? process.platform
   }
 
-  getCookiesPath(): string | null {
-    if (this.platform !== 'darwin') {
-      return null
+  getAppDataDir(): string | null {
+    switch (this.platform) {
+      case 'darwin': {
+        const sandboxedPath = join(
+          homedir(),
+          'Library',
+          'Containers',
+          'com.zoyi.channel.desk.osx',
+          'Data',
+          'Library',
+          'Application Support',
+          'Channel Talk',
+        )
+        if (existsSync(sandboxedPath)) {
+          return sandboxedPath
+        }
+        const directPath = join(homedir(), 'Library', 'Application Support', 'Channel Talk')
+        return existsSync(directPath) ? directPath : null
+      }
+      case 'win32': {
+        const appdata = process.env.APPDATA || join(homedir(), 'AppData', 'Roaming')
+        const appDir = join(appdata, 'Channel Talk')
+        return existsSync(appDir) ? appDir : null
+      }
+      default:
+        return null
     }
+  }
 
-    const sandboxedPath = join(
-      homedir(),
-      'Library',
-      'Containers',
-      'com.zoyi.channel.desk.osx',
-      'Data',
-      'Library',
-      'Application Support',
-      'Channel Talk',
-      'Cookies',
-    )
-    if (existsSync(sandboxedPath)) {
-      return sandboxedPath
+  getCookiesPath(): string | null {
+    const appDir = this.getAppDataDir()
+    if (!appDir) return null
+
+    switch (this.platform) {
+      case 'darwin':
+        return existsSync(join(appDir, 'Cookies')) ? join(appDir, 'Cookies') : null
+      case 'win32': {
+        const networkPath = join(appDir, 'Network', 'Cookies')
+        return existsSync(networkPath) ? networkPath : null
+      }
+      default:
+        return null
     }
+  }
 
-    const directPath = join(homedir(), 'Library', 'Application Support', 'Channel Talk', 'Cookies')
-    return existsSync(directPath) ? directPath : null
+  private getLocalStatePath(): string | null {
+    const appDir = this.getAppDataDir()
+    if (!appDir) return null
+    const localStatePath = join(appDir, 'Local State')
+    return existsSync(localStatePath) ? localStatePath : null
   }
 
   async extract(): Promise<ExtractedChannelToken | null> {
@@ -46,11 +78,10 @@ export class ChannelTokenExtractor {
     try {
       copyFileSync(cookiesPath, tempPath)
       const sql = `
-        SELECT name, value FROM cookies
+        SELECT name, value, encrypted_value FROM cookies
         WHERE name IN ('x-account', 'ch-session-1', 'ch-session')
         AND host_key LIKE '%.channel.io%'
       `
-      type CookieRow = { name: string; value: string }
       const rows: CookieRow[] = typeof globalThis.Bun !== 'undefined'
         ? await (async () => {
             const { Database } = await import('bun:sqlite')
@@ -69,14 +100,13 @@ export class ChannelTokenExtractor {
             return result
           })()
 
-      const accountCookie = rows.find((row) => row.name === 'x-account')?.value
+      const accountCookie = this.getCookieValue(rows, 'x-account')
       const sessionCookie =
-        rows.find((row) => row.name === 'ch-session-1')?.value ??
-        rows.find((row) => row.name === 'ch-session')?.value
+        this.getCookieValue(rows, 'ch-session-1') ??
+        this.getCookieValue(rows, 'ch-session')
 
       return accountCookie ? { accountCookie, sessionCookie } : null
     } catch {
-      /* extraction failed (e.g. SQLite error); return null */
       return null
     } finally {
       try {
@@ -88,4 +118,95 @@ export class ChannelTokenExtractor {
       }
     }
   }
+
+  private getCookieValue(rows: CookieRow[], name: string): string | undefined {
+    const row = rows.find((r) => r.name === name)
+    if (!row) return undefined
+
+    if (row.value && row.value.length > 0) {
+      return row.value
+    }
+
+    const encrypted = Buffer.from(row.encrypted_value)
+    if (encrypted.length === 0) return undefined
+
+    return this.decryptCookie(encrypted) ?? undefined
+  }
+
+  private decryptCookie(encryptedValue: Buffer): string | null {
+    if (!this.isEncryptedValue(encryptedValue)) {
+      return encryptedValue.toString('utf8')
+    }
+
+    if (this.platform === 'win32') {
+      return this.decryptWindowsCookie(encryptedValue)
+    }
+
+    return null
+  }
+
+  private isEncryptedValue(value: Buffer): boolean {
+    if (!value || value.length < 4) return false
+    const prefix = value.subarray(0, 3).toString('utf8')
+    return prefix === 'v10' || prefix === 'v11'
+  }
+
+  private decryptWindowsCookie(encryptedData: Buffer): string | null {
+    try {
+      const localStatePath = this.getLocalStatePath()
+      if (!localStatePath) return null
+
+      const localState = JSON.parse(readFileSync(localStatePath, 'utf8'))
+      const encryptedKey = Buffer.from(localState.os_crypt.encrypted_key, 'base64')
+
+      // Remove "DPAPI" prefix (5 bytes)
+      const dpapiBlobKey = encryptedKey.subarray(5)
+      const masterKey = this.decryptDPAPI(dpapiBlobKey)
+      if (!masterKey) return null
+
+      return this.decryptAESGCM(encryptedData, masterKey)
+    } catch {
+      return null
+    }
+  }
+
+  decryptDPAPI(encryptedBlob: Buffer): Buffer | null {
+    if (this.platform !== 'win32') return null
+    try {
+      const b64 = encryptedBlob.toString('base64')
+      const psScript = [
+        'Add-Type -AssemblyName System.Security',
+        `$bytes = [Convert]::FromBase64String('${b64}')`,
+        '$decrypted = [Security.Cryptography.ProtectedData]::Unprotect($bytes, $null, [Security.Cryptography.DataProtectionScope]::CurrentUser)',
+        '[Convert]::ToBase64String($decrypted)',
+      ].join('; ')
+
+      const result = execSync(`powershell -NoProfile -NonInteractive -Command "${psScript}"`, {
+        encoding: 'utf8',
+        timeout: 10000,
+      })
+      return Buffer.from(result.trim(), 'base64')
+    } catch {
+      return null
+    }
+  }
+
+  private decryptAESGCM(encryptedData: Buffer, key: Buffer): string | null {
+    try {
+      // Format: v10 (3 bytes) + IV (12 bytes) + ciphertext + auth tag (16 bytes)
+      if (encryptedData.length < 3 + 12 + 16) return null
+
+      const iv = encryptedData.subarray(3, 15)
+      const authTag = encryptedData.subarray(-16)
+      const ciphertext = encryptedData.subarray(15, -16)
+
+      const decipher = createDecipheriv('aes-256-gcm', key, iv)
+      decipher.setAuthTag(authTag)
+
+      const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()])
+      return decrypted.toString('utf8')
+    } catch {
+      return null
+    }
+  }
 }

package/src/platforms/channeltalk/types.ts

@@ -38,6 +38,8 @@ export interface Channel {
   updatedAt?: number
 }
 
+export type ChannelTalkChannel = Channel
+
 export interface ChannelManager {
   id: string
   channelId: string
@@ -336,7 +338,7 @@ export const ChannelSearchResponseSchema = z.object({
   directChats: z.array(ChannelDirectChatSchema).optional(),
   groups: z.array(ChannelGroupSchema).optional(),
   userChats: z.array(ChannelUserChatSchema).optional(),
-  users: z.array(z.object({ id: z.string() }).passthrough()).optional(),
+  users: z.array(z.looseObject({ id: z.string() })).optional(),
 })
 
 export const ExtractedChannelTokenSchema = z.object({

package/src/platforms/channeltalkbot/client.test.ts

@@ -49,7 +49,7 @@ describe('ChannelBotClient', () => {
   test('successful GET request returns unwrapped JSON', async () => {
     mockResponse({ channel: { id: 'ch-1', name: 'My Channel' } })
 
-    const client = new ChannelBotClient('key-1', 'secret-1')
+    const client = await new ChannelBotClient().login({ accessKey: 'key-1', accessSecret: 'secret-1' })
     const channel = await client.getChannel()
 
     expect(channel.id).toBe('ch-1')
@@ -60,7 +60,7 @@ describe('ChannelBotClient', () => {
     mockResponse({ channel: { id: 'ch-1', name: 'My Channel' } })
     mockResponse({ user: { id: 'u-1', channelId: 'ch-1' } })
 
-    const client = new ChannelBotClient('my-access-key', 'my-access-secret')
+    const client = await new ChannelBotClient().login({ accessKey: 'my-access-key', accessSecret: 'my-access-secret' })
     await client.getChannel()
     await client.getUser('u-1')
 
@@ -77,7 +77,7 @@ describe('ChannelBotClient', () => {
     mockResponse({ message: 'Rate limited' }, 429, { 'Retry-After': '0.05' })
     mockResponse({ channel: { id: 'ch-1', name: 'My Channel' } })
 
-    const client = new ChannelBotClient('key-1', 'secret-1')
+    const client = await new ChannelBotClient().login({ accessKey: 'key-1', accessSecret: 'secret-1' })
     const start = Date.now()
     const channel = await client.getChannel()
     const elapsed = Date.now() - start
@@ -92,7 +92,7 @@ describe('ChannelBotClient', () => {
     mockResponse({ message: 'Server error' }, 500)
     mockResponse({ channel: { id: 'ch-1', name: 'My Channel' } })
 
-    const client = new ChannelBotClient('key-1', 'secret-1')
+    const client = await new ChannelBotClient().login({ accessKey: 'key-1', accessSecret: 'secret-1' })
     const start = Date.now()
     const channel = await client.getChannel()
     const elapsed = Date.now() - start
@@ -105,7 +105,7 @@ describe('ChannelBotClient', () => {
   test('4xx non-429 throws immediately without retry', async () => {
     mockResponse({ message: 'Forbidden' }, 403)
 
-    const client = new ChannelBotClient('key-1', 'secret-1')
+    const client = await new ChannelBotClient().login({ accessKey: 'key-1', accessSecret: 'secret-1' })
     await expect(client.getChannel()).rejects.toThrow(ChannelBotError)
     expect(fetchCalls).toHaveLength(1)
   })
@@ -119,7 +119,7 @@ describe('ChannelBotClient', () => {
       throw new Error('socket hang up')
     }
 
-    const client = new ChannelBotClient('key-1', 'secret-1')
+    const client = await new ChannelBotClient().login({ accessKey: 'key-1', accessSecret: 'secret-1' })
 
     try {
       await client.getChannel()
@@ -134,7 +134,7 @@ describe('ChannelBotClient', () => {
   test('204 response returns undefined', async () => {
     mockResponse(null, 204)
 
-    const client = new ChannelBotClient('key-1', 'secret-1')
+    const client = await new ChannelBotClient().login({ accessKey: 'key-1', accessSecret: 'secret-1' })
     const result = await client.deleteUserChat('chat-1')
 
     expect(result).toBeUndefined()
@@ -149,7 +149,7 @@ describe('ChannelBotClient', () => {
   test('sendUserChatMessage includes botName in query string', async () => {
     mockResponse({ message: { id: 'm-1' } })
 
-    const client = new ChannelBotClient('key-1', 'secret-1')
+    const client = await new ChannelBotClient().login({ accessKey: 'key-1', accessSecret: 'secret-1' })
     await client.sendUserChatMessage('chat-1', [{ type: 'text', value: 'hello' }], 'SupportBot')
 
     expect(fetchCalls[0].url).toBe('https://api.channel.io/open/v5/user-chats/chat-1/messages?botName=SupportBot')
@@ -158,7 +158,7 @@ describe('ChannelBotClient', () => {
   test('sendGroupMessage includes botName in query string', async () => {
     mockResponse({ message: { id: 'm-1' } })
 
-    const client = new ChannelBotClient('key-1', 'secret-1')
+    const client = await new ChannelBotClient().login({ accessKey: 'key-1', accessSecret: 'secret-1' })
     await client.sendGroupMessage('grp-1', [{ type: 'text', value: 'hello' }], 'OpsBot')
 
     expect(fetchCalls[0].url).toBe('https://api.channel.io/open/v5/groups/grp-1/messages?botName=OpsBot')
@@ -167,7 +167,7 @@ describe('ChannelBotClient', () => {
   test('resolveGroup("@team-name") calls groups by name endpoint', async () => {
     mockResponse({ group: { id: 'grp-1', channelId: 'ch-1', name: 'team-name' } })
 
-    const client = new ChannelBotClient('key-1', 'secret-1')
+    const client = await new ChannelBotClient().login({ accessKey: 'key-1', accessSecret: 'secret-1' })
     await client.resolveGroup('@team-name')
 
     expect(fetchCalls[0].url).toBe('https://api.channel.io/open/v5/groups/@team-name')
@@ -176,7 +176,7 @@ describe('ChannelBotClient', () => {
   test('resolveGroup("grp123") calls groups by id endpoint', async () => {
     mockResponse({ group: { id: 'grp123', channelId: 'ch-1', name: 'team-name' } })
 
-    const client = new ChannelBotClient('key-1', 'secret-1')
+    const client = await new ChannelBotClient().login({ accessKey: 'key-1', accessSecret: 'secret-1' })
     await client.resolveGroup('grp123')
 
     expect(fetchCalls[0].url).toBe('https://api.channel.io/open/v5/groups/grp123')
@@ -185,7 +185,7 @@ describe('ChannelBotClient', () => {
   test('pagination params are included in query string', async () => {
     mockResponse({ messages: [] })
 
-    const client = new ChannelBotClient('key-1', 'secret-1')
+    const client = await new ChannelBotClient().login({ accessKey: 'key-1', accessSecret: 'secret-1' })
     await client.getUserChatMessages('chat-1', { since: 'cursor-1', limit: 25, sortOrder: 'desc' })
 
     const url = new URL(fetchCalls[0].url)

package/src/platforms/channeltalkbot/client.ts

@@ -10,6 +10,7 @@ import type {
 } from './types'
 import { ChannelBotError as ChannelBotErrorClass } from './types'
 import { wrapTextInBlocks } from './message-utils'
+import { ChannelBotCredentialManager } from './credential-manager'
 
 const BASE_URL = 'https://api.channel.io/open/v5'
 const MAX_RETRIES = 3
@@ -20,20 +21,38 @@ interface ChannelBotFileUrlResponse {
 }
 
 export class ChannelBotClient {
-  private accessKey: string
-  private accessSecret: string
+  private accessKey: string | null = null
+  private accessSecret: string | null = null
   private rateLimitRemaining: number | null = null
   private rateLimitResetAt: number = 0
 
-  constructor(accessKey: string, accessSecret: string) {
-    if (!accessKey) {
-      throw new ChannelBotErrorClass('Access key is required', 'missing_access_key')
+  async login(credentials?: { accessKey: string; accessSecret: string }): Promise<this> {
+    if (credentials) {
+      if (!credentials.accessKey) {
+        throw new ChannelBotErrorClass('Access key is required', 'missing_access_key')
+      }
+      if (!credentials.accessSecret) {
+        throw new ChannelBotErrorClass('Access secret is required', 'missing_access_secret')
+      }
+      this.accessKey = credentials.accessKey
+      this.accessSecret = credentials.accessSecret
+      return this
+    }
+
+    const creds = await new ChannelBotCredentialManager().getCredentials()
+    if (!creds) {
+      throw new ChannelBotErrorClass(
+        'No Channel Talk Bot credentials found. Set access key and secret via "agent-channeltalkbot auth set".',
+        'no_credentials',
+      )
     }
-    if (!accessSecret) {
-      throw new ChannelBotErrorClass('Access secret is required', 'missing_access_secret')
+    return this.login({ accessKey: creds.access_key, accessSecret: creds.access_secret })
+  }
+
+  private ensureAuth(): void {
+    if (this.accessKey === null || this.accessSecret === null) {
+      throw new ChannelBotErrorClass('Not authenticated. Call .login() first.', 'not_authenticated')
     }
-    this.accessKey = accessKey
-    this.accessSecret = accessSecret
   }
 
   static wrapTextInBlocks = wrapTextInBlocks
@@ -166,8 +185,8 @@ export class ChannelBotClient {
 
   private getHeaders(): Record<string, string> {
     return {
-      'x-access-key': this.accessKey,
-      'x-access-secret': this.accessSecret,
+      'x-access-key': this.accessKey!,
+      'x-access-secret': this.accessSecret!,
       'Content-Type': 'application/json',
     }
   }
@@ -199,6 +218,7 @@ export class ChannelBotClient {
   }
 
   private async request<T>(method: string, path: string, body?: unknown, unwrapKey?: string): Promise<T> {
+    this.ensureAuth()
     const url = `${BASE_URL}${path}`
     let lastError: Error | undefined
 

package/src/platforms/channeltalkbot/commands/auth.test.ts

@@ -13,11 +13,7 @@ const mockGetChannel = mock(() =>
 
 mock.module('../client', () => ({
   ChannelBotClient: class MockChannelBotClient {
-    constructor(accessKey: string, accessSecret: string) {
-      if (!accessKey || !accessSecret) {
-        throw new Error('Credentials required')
-      }
-    }
+    async login(_credentials?: any) { return this }
     getChannel = mockGetChannel
   },
 }))

package/src/platforms/channeltalkbot/commands/auth.ts

@@ -27,7 +27,7 @@ export async function setAction(
   options: ActionOptions,
 ): Promise<ActionResult> {
   try {
-    const client = new ChannelBotClient(accessKey, accessSecret)
+    const client = await new ChannelBotClient().login({ accessKey, accessSecret })
     const channel = await client.getChannel()
 
     const workspaceId = channel.id
@@ -66,7 +66,7 @@ export async function statusAction(options: ActionOptions): Promise<ActionResult
     let workspaceName: string | undefined
 
     try {
-      const client = new ChannelBotClient(creds.access_key, creds.access_secret)
+      const client = await new ChannelBotClient().login({ accessKey: creds.access_key, accessSecret: creds.access_secret })
       const channel = await client.getChannel()
       valid = true
       workspaceId = channel.id

package/src/platforms/channeltalkbot/commands/shared.ts

@@ -19,7 +19,7 @@ export async function getClient(options: WorkspaceOption): Promise<ChannelBotCli
     process.exit(1)
   }
 
-  return new ChannelBotClient(creds.access_key, creds.access_secret)
+  return new ChannelBotClient().login({ accessKey: creds.access_key, accessSecret: creds.access_secret })
 }
 
 export async function getCurrentWorkspace(options: WorkspaceOption): Promise<string> {

package/src/platforms/channeltalkbot/index.test.ts

@@ -0,0 +1,76 @@
+import { expect, test } from 'bun:test'
+
+import {
+  ChannelBotBotSchema,
+  ChannelBotChannelSchema,
+  ChannelBotClient,
+  ChannelBotConfigSchema,
+  ChannelBotCredentialManager,
+  ChannelBotCredentialsSchema,
+  ChannelBotError,
+  ChannelBotGroupSchema,
+  ChannelBotManagerSchema,
+  ChannelBotMessageSchema,
+  ChannelBotUserChatSchema,
+  ChannelBotUserSchema,
+  ChannelBotWorkspaceEntrySchema,
+  MessageBlockSchema,
+} from '@/platforms/channeltalkbot/index'
+
+test('ChannelBotClient is exported from barrel', () => {
+  expect(typeof ChannelBotClient).toBe('function')
+})
+
+test('ChannelBotError is exported from barrel', () => {
+  expect(typeof ChannelBotError).toBe('function')
+})
+
+test('ChannelBotCredentialManager is exported from barrel', () => {
+  expect(typeof ChannelBotCredentialManager).toBe('function')
+})
+
+test('ChannelBotBotSchema is exported from barrel', () => {
+  expect(typeof ChannelBotBotSchema.parse).toBe('function')
+})
+
+test('ChannelBotChannelSchema is exported from barrel', () => {
+  expect(typeof ChannelBotChannelSchema.parse).toBe('function')
+})
+
+test('ChannelBotConfigSchema is exported from barrel', () => {
+  expect(typeof ChannelBotConfigSchema.parse).toBe('function')
+})
+
+test('ChannelBotCredentialsSchema is exported from barrel', () => {
+  expect(typeof ChannelBotCredentialsSchema.parse).toBe('function')
+})
+
+test('ChannelBotGroupSchema is exported from barrel', () => {
+  expect(typeof ChannelBotGroupSchema.parse).toBe('function')
+})
+
+test('ChannelBotManagerSchema is exported from barrel', () => {
+  expect(typeof ChannelBotManagerSchema.parse).toBe('function')
+})
+
+test('ChannelBotMessageSchema is exported from barrel', () => {
+  expect(typeof ChannelBotMessageSchema.parse).toBe('function')
+})
+
+test('ChannelBotUserChatSchema is exported from barrel', () => {
+  expect(typeof ChannelBotUserChatSchema.parse).toBe('function')
+})
+
+test('ChannelBotUserSchema is exported from barrel', () => {
+  expect(typeof ChannelBotUserSchema.parse).toBe('function')
+})
+
+test('ChannelBotWorkspaceEntrySchema is exported from barrel', () => {
+  expect(typeof ChannelBotWorkspaceEntrySchema.parse).toBe('function')
+})
+
+test('MessageBlockSchema is exported from barrel', () => {
+  expect(typeof MessageBlockSchema.parse).toBe('function')
+})
+
+

package/src/platforms/channeltalkbot/index.ts

@@ -1,27 +1,30 @@
 export { ChannelBotClient } from './client'
 export { ChannelBotCredentialManager } from './credential-manager'
-export {
+export type {
   ChannelBotBot,
-  ChannelBotBotSchema,
   ChannelBotChannel,
-  ChannelBotChannelSchema,
   ChannelBotConfig,
-  ChannelBotConfigSchema,
   ChannelBotCredentials,
-  ChannelBotCredentialsSchema,
-  ChannelBotError,
   ChannelBotGroup,
-  ChannelBotGroupSchema,
   ChannelBotManager,
-  ChannelBotManagerSchema,
   ChannelBotMessage,
-  ChannelBotMessageSchema,
   ChannelBotUser,
   ChannelBotUserChat,
+  ChannelBotWorkspaceEntry,
+  MessageBlock,
+} from './types'
+export {
+  ChannelBotBotSchema,
+  ChannelBotChannelSchema,
+  ChannelBotConfigSchema,
+  ChannelBotCredentialsSchema,
+  ChannelBotError,
+  ChannelBotGroupSchema,
+  ChannelBotManagerSchema,
+  ChannelBotMessageSchema,
   ChannelBotUserChatSchema,
   ChannelBotUserSchema,
-  ChannelBotWorkspaceEntry,
   ChannelBotWorkspaceEntrySchema,
-  MessageBlock,
   MessageBlockSchema,
 } from './types'
+