agent-messenger 2.10.0 → 2.10.2

package/src/platforms/teams/token-extractor.test.ts

@@ -1,5 +1,6 @@
-import { beforeEach, describe, expect, spyOn, test } from 'bun:test'
-import { homedir } from 'node:os'
+import { beforeEach, describe, expect, spyOn, it } from 'bun:test'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { homedir, tmpdir } from 'node:os'
 import { join } from 'node:path'
 
 import { TeamsTokenExtractor } from './token-extractor'
@@ -12,62 +13,29 @@ describe('TeamsTokenExtractor', () => {
   })
 
   describe('getDesktopCookiesPaths', () => {
-    test('returns darwin desktop paths on macOS', () => {
+    it('returns darwin desktop paths on macOS', () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
       const paths = darwinExtractor.getDesktopCookiesPaths()
 
+      const darwinEbWebView = join(
+        homedir(),
+        'Library',
+        'Containers',
+        'com.microsoft.teams2',
+        'Data',
+        'Library',
+        'Application Support',
+        'Microsoft',
+        'MSTeams',
+        'EBWebView',
+      )
       expect(paths).toEqual([
-        {
-          path: join(
-            homedir(),
-            'Library',
-            'Containers',
-            'com.microsoft.teams2',
-            'Data',
-            'Library',
-            'Application Support',
-            'Microsoft',
-            'MSTeams',
-            'EBWebView',
-            'WV2Profile_tfw',
-            'Cookies',
-          ),
-          accountType: 'work',
-        },
-        {
-          path: join(
-            homedir(),
-            'Library',
-            'Containers',
-            'com.microsoft.teams2',
-            'Data',
-            'Library',
-            'Application Support',
-            'Microsoft',
-            'MSTeams',
-            'EBWebView',
-            'WV2Profile_tfl',
-            'Cookies',
-          ),
-          accountType: 'personal',
-        },
-        {
-          path: join(
-            homedir(),
-            'Library',
-            'Containers',
-            'com.microsoft.teams2',
-            'Data',
-            'Library',
-            'Application Support',
-            'Microsoft',
-            'MSTeams',
-            'EBWebView',
-            'Default',
-            'Cookies',
-          ),
-          accountType: 'work',
-        },
+        { path: join(darwinEbWebView, 'WV2Profile_tfw', 'Cookies'), accountType: 'work' },
+        { path: join(darwinEbWebView, 'WV2Profile_tfw', 'Network', 'Cookies'), accountType: 'work' },
+        { path: join(darwinEbWebView, 'WV2Profile_tfl', 'Cookies'), accountType: 'personal' },
+        { path: join(darwinEbWebView, 'WV2Profile_tfl', 'Network', 'Cookies'), accountType: 'personal' },
+        { path: join(darwinEbWebView, 'Default', 'Cookies'), accountType: 'work' },
+        { path: join(darwinEbWebView, 'Default', 'Network', 'Cookies'), accountType: 'work' },
         {
           path: join(homedir(), 'Library', 'Application Support', 'Microsoft', 'Teams', 'Cookies'),
           accountType: 'work',
@@ -75,7 +43,7 @@ describe('TeamsTokenExtractor', () => {
       ])
     })
 
-    test('returns linux desktop path on Linux', () => {
+    it('returns linux desktop path on Linux', () => {
       const linuxExtractor = new TeamsTokenExtractor('linux')
       const paths = linuxExtractor.getDesktopCookiesPaths()
 
@@ -87,70 +55,40 @@ describe('TeamsTokenExtractor', () => {
       ])
     })
 
-    test('returns win32 desktop paths on Windows', () => {
+    it('returns win32 desktop paths on Windows', () => {
       const winExtractor = new TeamsTokenExtractor('win32')
       const paths = winExtractor.getDesktopCookiesPaths()
 
       const localAppData = process.env.LOCALAPPDATA || join(homedir(), 'AppData', 'Local')
       const appdata = process.env.APPDATA || join(homedir(), 'AppData', 'Roaming')
+      const winEbWebView = join(
+        localAppData,
+        'Packages',
+        'MSTeams_8wekyb3d8bbwe',
+        'LocalCache',
+        'Microsoft',
+        'MSTeams',
+        'EBWebView',
+      )
       expect(paths).toEqual([
-        {
-          path: join(
-            localAppData,
-            'Packages',
-            'MSTeams_8wekyb3d8bbwe',
-            'LocalCache',
-            'Microsoft',
-            'MSTeams',
-            'EBWebView',
-            'WV2Profile_tfw',
-            'Cookies',
-          ),
-          accountType: 'work',
-        },
-        {
-          path: join(
-            localAppData,
-            'Packages',
-            'MSTeams_8wekyb3d8bbwe',
-            'LocalCache',
-            'Microsoft',
-            'MSTeams',
-            'EBWebView',
-            'WV2Profile_tfl',
-            'Cookies',
-          ),
-          accountType: 'personal',
-        },
-        {
-          path: join(
-            localAppData,
-            'Packages',
-            'MSTeams_8wekyb3d8bbwe',
-            'LocalCache',
-            'Microsoft',
-            'MSTeams',
-            'EBWebView',
-            'Default',
-            'Cookies',
-          ),
-          accountType: 'work',
-        },
-        {
-          path: join(appdata, 'Microsoft', 'Teams', 'Cookies'),
-          accountType: 'work',
-        },
+        { path: join(winEbWebView, 'WV2Profile_tfw', 'Cookies'), accountType: 'work' },
+        { path: join(winEbWebView, 'WV2Profile_tfw', 'Network', 'Cookies'), accountType: 'work' },
+        { path: join(winEbWebView, 'WV2Profile_tfl', 'Cookies'), accountType: 'personal' },
+        { path: join(winEbWebView, 'WV2Profile_tfl', 'Network', 'Cookies'), accountType: 'personal' },
+        { path: join(winEbWebView, 'Default', 'Cookies'), accountType: 'work' },
+        { path: join(winEbWebView, 'Default', 'Network', 'Cookies'), accountType: 'work' },
+        { path: join(appdata, 'Microsoft', 'Teams', 'Cookies'), accountType: 'work' },
       ])
     })
 
-    test('returns empty array for unsupported platform', () => {
+    it('returns empty array for unsupported platform', () => {
       const unsupportedExtractor = new TeamsTokenExtractor('freebsd' as NodeJS.Platform)
       expect(unsupportedExtractor.getDesktopCookiesPaths()).toEqual([])
     })
   })
 
   describe('getBrowserCookiesPaths', () => {
-    test('returns browser cookie paths on macOS (at least Default profile per browser)', () => {
+    it('returns browser cookie paths on macOS (at least Default profile per browser)', () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
       const paths = darwinExtractor.getBrowserCookiesPaths()
 
@@ -165,7 +103,7 @@ describe('TeamsTokenExtractor', () => {
       })
     })
 
-    test('returns browser cookie paths on Linux', () => {
+    it('returns browser cookie paths on Linux', () => {
       const linuxExtractor = new TeamsTokenExtractor('linux')
       const paths = linuxExtractor.getBrowserCookiesPaths()
 
@@ -176,7 +114,7 @@ describe('TeamsTokenExtractor', () => {
       })
     })
 
-    test('returns browser cookie paths on Windows', () => {
+    it('returns browser cookie paths on Windows', () => {
       const winExtractor = new TeamsTokenExtractor('win32')
       const paths = winExtractor.getBrowserCookiesPaths()
 
@@ -188,12 +126,12 @@ describe('TeamsTokenExtractor', () => {
       })
     })
 
-    test('returns empty array for unsupported platform', () => {
+    it('returns empty array for unsupported platform', () => {
       const unsupportedExtractor = new TeamsTokenExtractor('freebsd' as NodeJS.Platform)
       expect(unsupportedExtractor.getBrowserCookiesPaths()).toEqual([])
     })
 
-    test('all browser paths have accountType work', () => {
+    it('all browser paths have accountType work', () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
       const paths = darwinExtractor.getBrowserCookiesPaths()
       expect(paths.every((p) => p.accountType === 'work')).toBe(true)
@@ -201,7 +139,7 @@ describe('TeamsTokenExtractor', () => {
   })
 
   describe('getTeamsCookiesPaths', () => {
-    test('returns darwin paths on macOS with desktop paths first', () => {
+    it('returns darwin paths on macOS with desktop paths first', () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
       const paths = darwinExtractor.getTeamsCookiesPaths()
       const desktopPaths = darwinExtractor.getDesktopCookiesPaths()
@@ -209,7 +147,7 @@ describe('TeamsTokenExtractor', () => {
       expect(paths.slice(0, desktopPaths.length)).toEqual(desktopPaths)
     })
 
-    test('browser paths come after desktop paths on macOS', () => {
+    it('browser paths come after desktop paths on macOS', () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
       const paths = darwinExtractor.getTeamsCookiesPaths()
       const desktopPaths = darwinExtractor.getDesktopCookiesPaths()
@@ -219,7 +157,7 @@ describe('TeamsTokenExtractor', () => {
       expect(paths.slice(desktopPaths.length)).toEqual(browserPaths)
     })
 
-    test('returns linux paths with desktop first then browser paths', () => {
+    it('returns linux paths with desktop first then browser paths', () => {
       const linuxExtractor = new TeamsTokenExtractor('linux')
       const paths = linuxExtractor.getTeamsCookiesPaths()
       const desktopPaths = linuxExtractor.getDesktopCookiesPaths()
@@ -233,7 +171,7 @@ describe('TeamsTokenExtractor', () => {
       expect(paths.length).toBeGreaterThan(desktopPaths.length)
     })
 
-    test('returns win32 paths with desktop first then browser paths', () => {
+    it('returns win32 paths with desktop first then browser paths', () => {
       const winExtractor = new TeamsTokenExtractor('win32')
       const paths = winExtractor.getTeamsCookiesPaths()
       const desktopPaths = winExtractor.getDesktopCookiesPaths()
@@ -242,7 +180,7 @@ describe('TeamsTokenExtractor', () => {
       expect(paths.length).toBeGreaterThan(desktopPaths.length)
     })
 
-    test('returns empty array for unsupported platform', () => {
+    it('returns empty array for unsupported platform', () => {
       const unsupportedExtractor = new TeamsTokenExtractor('freebsd' as NodeJS.Platform)
       const paths = unsupportedExtractor.getTeamsCookiesPaths()
 
@@ -251,21 +189,21 @@ describe('TeamsTokenExtractor', () => {
   })
 
   describe('getLocalStatePath', () => {
-    test('returns darwin Local State path on macOS', () => {
+    it('returns darwin Local State path on macOS', () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
       const path = darwinExtractor.getLocalStatePath()
 
       expect(path).toBe(join(homedir(), 'Library', 'Application Support', 'Microsoft', 'Teams', 'Local State'))
     })
 
-    test('returns linux Local State path on Linux', () => {
+    it('returns linux Local State path on Linux', () => {
       const linuxExtractor = new TeamsTokenExtractor('linux')
       const path = linuxExtractor.getLocalStatePath()
 
       expect(path).toBe(join(homedir(), '.config', 'Microsoft', 'Microsoft Teams', 'Local State'))
     })
 
-    test('returns win32 Local State path on Windows', () => {
+    it('returns win32 Local State path on Windows', () => {
       const winExtractor = new TeamsTokenExtractor('win32')
       const path = winExtractor.getLocalStatePath()
 
@@ -275,7 +213,7 @@ describe('TeamsTokenExtractor', () => {
   })
 
   describe('getKeychainVariants', () => {
-    test('includes Teams-specific keychain entries', () => {
+    it('includes Teams-specific keychain entries', () => {
       const macExtractor = new TeamsTokenExtractor('darwin')
       const variants = macExtractor.getKeychainVariants()
 
@@ -288,7 +226,7 @@ describe('TeamsTokenExtractor', () => {
       expect(variants).toContainEqual({ service: 'Teams Safe Storage', account: 'Teams' })
     })
 
-    test('includes browser keychain entries appended after Teams entries', () => {
+    it('includes browser keychain entries appended after Teams entries', () => {
       const macExtractor = new TeamsTokenExtractor('darwin')
       const variants = macExtractor.getKeychainVariants()
 
@@ -300,7 +238,7 @@ describe('TeamsTokenExtractor', () => {
       expect(variants).toContainEqual({ service: 'Chromium Safe Storage', account: 'Chromium' })
     })
 
-    test('Teams entries come before browser entries', () => {
+    it('Teams entries come before browser entries', () => {
       const macExtractor = new TeamsTokenExtractor('darwin')
       const variants = macExtractor.getKeychainVariants()
 
@@ -311,59 +249,81 @@ describe('TeamsTokenExtractor', () => {
   })
 
   describe('isValidSkypeToken', () => {
-    test('validates JWT-like skype token format', () => {
+    it('validates JWT-like skype token format', () => {
       const validToken = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.signature'
       expect(extractor.isValidSkypeToken(validToken)).toBe(true)
     })
 
-    test('validates long base64 token format', () => {
+    it('validates long base64 token format', () => {
       const validToken = 'a'.repeat(100)
       expect(extractor.isValidSkypeToken(validToken)).toBe(true)
     })
 
-    test('rejects empty tokens', () => {
+    it('rejects empty tokens', () => {
       expect(extractor.isValidSkypeToken('')).toBe(false)
     })
 
-    test('rejects short tokens', () => {
+    it('rejects short tokens', () => {
       expect(extractor.isValidSkypeToken('short')).toBe(false)
     })
 
-    test('rejects null/undefined', () => {
+    it('rejects null/undefined', () => {
       expect(extractor.isValidSkypeToken(null as unknown as string)).toBe(false)
       expect(extractor.isValidSkypeToken(undefined as unknown as string)).toBe(false)
     })
+
+    // Regression for #156: PowerShell CLIXML leaks into DPAPI output on Windows.
+    it('rejects CLIXML progress-stream contamination', () => {
+      // given: the exact shape of the leak reported in #156
+      const clixml =
+        '#< CLIXML\r\n<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04">' +
+        '<Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T>' +
+        '<T>System.Object</T></TN><MS><I64 N="SourceId">1</I64></MS></Obj></Objs>'
+
+      // then
+      expect(extractor.isValidSkypeToken(clixml)).toBe(false)
+    })
+
+    it('rejects anything containing angle brackets or whitespace', () => {
+      expect(extractor.isValidSkypeToken('a'.repeat(60) + '<div>')).toBe(false)
+      expect(extractor.isValidSkypeToken('a'.repeat(40) + ' ' + 'b'.repeat(40))).toBe(false)
+      expect(extractor.isValidSkypeToken('a'.repeat(40) + '\n' + 'b'.repeat(40))).toBe(false)
+    })
+
+    it('rejects a bare 36-char UUID', () => {
+      expect(extractor.isValidSkypeToken('12345678-1234-1234-1234-123456789012')).toBe(false)
+    })
   })
 
   describe('isEncryptedValue', () => {
-    test('detects v10 encrypted values', () => {
+    it('detects v10 encrypted values', () => {
       const encrypted = Buffer.from('v10encrypted_data')
       expect(extractor.isEncryptedValue(encrypted)).toBe(true)
     })
 
-    test('detects v11 encrypted values', () => {
+    it('detects v11 encrypted values', () => {
       const encrypted = Buffer.from('v11encrypted_data')
       expect(extractor.isEncryptedValue(encrypted)).toBe(true)
     })
 
-    test('rejects non-encrypted values', () => {
+    it('rejects non-encrypted values', () => {
       const plain = Buffer.from('plain_text')
       expect(extractor.isEncryptedValue(plain)).toBe(false)
     })
 
-    test('rejects empty buffers', () => {
+    it('rejects empty buffers', () => {
       const empty = Buffer.alloc(0)
       expect(extractor.isEncryptedValue(empty)).toBe(false)
     })
 
-    test('rejects short buffers', () => {
+    it('rejects short buffers', () => {
       const short = Buffer.from('v1')
       expect(extractor.isEncryptedValue(short)).toBe(false)
     })
   })
 
   describe('extract', () => {
-    test('returns null when cookies path does not exist', async () => {
+    it('returns null when cookies path does not exist', async () => {
       const linuxExtractor = new TeamsTokenExtractor('linux')
       const extractFromCookiesDBSpy = spyOn(linuxExtractor as any, 'extractFromCookiesDB').mockResolvedValue([])
 
@@ -373,7 +333,7 @@ describe('TeamsTokenExtractor', () => {
       extractFromCookiesDBSpy.mockRestore()
     })
 
-    test('extracts token from cookies database when available', async () => {
+    it('extracts token from cookies database when available', async () => {
       const mockToken = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.signature_here'
 
       const linuxExtractor = new TeamsTokenExtractor('linux')
@@ -389,7 +349,7 @@ describe('TeamsTokenExtractor', () => {
       extractFromCookiesDBSpy.mockRestore()
     })
 
-    test('returns null when extraction fails', async () => {
+    it('returns null when extraction fails', async () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
       const extractFromCookiesDBSpy = spyOn(darwinExtractor as any, 'extractFromCookiesDB').mockResolvedValue([])
 
@@ -400,8 +360,122 @@ describe('TeamsTokenExtractor', () => {
     })
   })
 
+  describe('extractFromCookiesDB (Network/Cookies fallback)', () => {
+    const mockToken = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.signature_here'
+    let workDir: string
+
+    beforeEach(() => {
+      workDir = mkdtempSync(join(tmpdir(), 'teams-extractor-test-'))
+    })
+
+    const cleanup = () => rmSync(workDir, { recursive: true, force: true })
+
+    // Regression for #156: if only Network/Cookies exists, missing sibling must not poison accountType.
+    it('falls through to Network/Cookies when Cookies is missing', async () => {
+      // given: only Network/Cookies exists on disk for WV2Profile_tfl
+      const profileDir = join(workDir, 'WV2Profile_tfl')
+      const networkDir = join(profileDir, 'Network')
+      mkdirSync(networkDir, { recursive: true })
+      const cookiesPath = join(profileDir, 'Cookies')
+      const networkCookiesPath = join(networkDir, 'Cookies')
+      writeFileSync(networkCookiesPath, '')
+
+      const winExtractor = new TeamsTokenExtractor('win32')
+      const getPathsSpy = spyOn(winExtractor, 'getTeamsCookiesPaths').mockReturnValue([
+        { path: cookiesPath, accountType: 'personal' },
+        { path: networkCookiesPath, accountType: 'personal' },
+      ])
+      const tried: string[] = []
+      const copyAndExtractSpy = spyOn(winExtractor as any, 'copyAndExtract').mockImplementation(async (...args) => {
+        const path = args[0] as string
+        tried.push(path)
+        return mockToken
+      })
+
+      // when
+      const results = await (winExtractor as any).extractFromCookiesDB()
+
+      // then: the Cookies path was skipped (never passed to copyAndExtract),
+      // the Network/Cookies sibling was tried, and the token was returned.
+      expect(tried).toEqual([networkCookiesPath])
+      expect(results).toEqual([{ token: mockToken, accountType: 'personal' }])
+
+      getPathsSpy.mockRestore()
+      copyAndExtractSpy.mockRestore()
+      cleanup()
+    })
+
+    // Regression for #156: CLIXML-contaminated decrypt output must not short-circuit
+    // the work account, leaving other valid paths unvisited.
+    it('does not mark accountType seen when the first path yields CLIXML garbage', async () => {
+      // given: first work path returns CLIXML garbage, second work path returns a real token
+      const clixmlGarbage =
+        '#< CLIXML\r\n<Objs xmlns="http://schemas.microsoft.com/powershell/2004/04">' +
+        '<Obj S="progress"><TN><T>Progress</T></TN></Obj></Objs>\r\n' +
+        'a'.repeat(80)
+      const realToken = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.signature_here'
+
+      const winExtractor = new TeamsTokenExtractor('win32')
+      const firstPath = join(workDir, 'WV2Profile_tfw', 'Cookies')
+      const secondPath = join(workDir, 'Default', 'Network', 'Cookies')
+      const getPathsSpy = spyOn(winExtractor, 'getTeamsCookiesPaths').mockReturnValue([
+        { path: firstPath, accountType: 'work' },
+        { path: secondPath, accountType: 'work' },
+      ])
+      mkdirSync(join(workDir, 'WV2Profile_tfw'), { recursive: true })
+      mkdirSync(join(workDir, 'Default', 'Network'), { recursive: true })
+      writeFileSync(firstPath, '')
+      writeFileSync(secondPath, '')
+
+      const copyAndExtractSpy = spyOn(winExtractor as any, 'copyAndExtract')
+        .mockResolvedValueOnce(clixmlGarbage)
+        .mockResolvedValueOnce(realToken)
+
+      // when
+      const results = await (winExtractor as any).extractFromCookiesDB()
+
+      // then: garbage was rejected, loop continued to the real token
+      expect(copyAndExtractSpy).toHaveBeenCalledTimes(2)
+      expect(results).toEqual([{ token: realToken, accountType: 'work' }])
+
+      getPathsSpy.mockRestore()
+      copyAndExtractSpy.mockRestore()
+      cleanup()
+    })
+
+    it('a missing path does not mark the account type as seen', async () => {
+      // given: work account has Cookies missing but Network/Cookies present
+      const workProfile = join(workDir, 'WV2Profile_tfw')
+      const workNetworkDir = join(workProfile, 'Network')
+      mkdirSync(workNetworkDir, { recursive: true })
+      const workCookies = join(workProfile, 'Cookies')
+      const workNetworkCookies = join(workNetworkDir, 'Cookies')
+      writeFileSync(workNetworkCookies, '')
+
+      const winExtractor = new TeamsTokenExtractor('win32')
+      const getPathsSpy = spyOn(winExtractor, 'getTeamsCookiesPaths').mockReturnValue([
+        { path: workCookies, accountType: 'work' },
+        { path: workNetworkCookies, accountType: 'work' },
+      ])
+      const copyAndExtractSpy = spyOn(winExtractor as any, 'copyAndExtract').mockResolvedValue(mockToken)
+
+      // when
+      const results = await (winExtractor as any).extractFromCookiesDB()
+
+      // then: missing first path did not block the sibling; work token extracted
+      expect(results).toHaveLength(1)
+      expect(results[0].accountType).toBe('work')
+      expect(copyAndExtractSpy).toHaveBeenCalledTimes(1)
+      expect(copyAndExtractSpy).toHaveBeenCalledWith(workNetworkCookies)
+
+      getPathsSpy.mockRestore()
+      copyAndExtractSpy.mockRestore()
+      cleanup()
+    })
+  })
+
   describe('copyAndExtract', () => {
-    test('attempts to copy database to temp location', async () => {
+    it('attempts to copy database to temp location', async () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
 
       const copyFileSpy = spyOn(darwinExtractor as any, 'copyDatabaseToTemp').mockReturnValue('/tmp/test-cookies')
@@ -420,7 +494,7 @@ describe('TeamsTokenExtractor', () => {
       cleanupSpy.mockRestore()
     })
 
-    test('returns null when copy fails (file locked)', async () => {
+    it('returns null when copy fails (file locked)', async () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
 
       const copyFileSpy = spyOn(darwinExtractor as any, 'copyDatabaseToTemp').mockImplementation(() => {
@@ -437,7 +511,7 @@ describe('TeamsTokenExtractor', () => {
 
   describe('decryption', () => {
     describe('decryptAESGCM', () => {
-      test('returns null for invalid encrypted data', () => {
+      it('returns null for invalid encrypted data', () => {
         const darwinExtractor = new TeamsTokenExtractor('darwin')
         const invalidData = Buffer.from('too_short')
         const key = Buffer.alloc(32, 0)
@@ -446,7 +520,7 @@ describe('TeamsTokenExtractor', () => {
         expect(result).toBeNull()
       })
 
-      test('returns null when decryption fails', () => {
+      it('returns null when decryption fails', () => {
         const darwinExtractor = new TeamsTokenExtractor('darwin')
         const fakeEncrypted = Buffer.concat([
           Buffer.from('v10'),
@@ -462,7 +536,7 @@ describe('TeamsTokenExtractor', () => {
     })
 
     describe('getKeychainPassword (macOS)', () => {
-      test('tries multiple keychain variants', async () => {
+      it('tries multiple keychain variants', async () => {
         const darwinExtractor = new TeamsTokenExtractor('darwin')
         const execSyncSpy = spyOn(darwinExtractor as any, 'execSecurityCommand')
           .mockReturnValueOnce(null)
@@ -476,7 +550,7 @@ describe('TeamsTokenExtractor', () => {
         execSyncSpy.mockRestore()
       })
 
-      test('returns null when all keychain variants fail', async () => {
+      it('returns null when all keychain variants fail', async () => {
         const darwinExtractor = new TeamsTokenExtractor('darwin')
         const execSyncSpy = spyOn(darwinExtractor as any, 'execSecurityCommand').mockReturnValue(null)
 
@@ -491,7 +565,7 @@ describe('TeamsTokenExtractor', () => {
 
   describe('process management', () => {
     describe('isTeamsRunning', () => {
-      test('returns true when Teams process is found', async () => {
+      it('returns true when Teams process is found', async () => {
         const darwinExtractor = new TeamsTokenExtractor('darwin')
         const checkProcessRunningSpy = spyOn(darwinExtractor as any, 'checkProcessRunning').mockReturnValue(true)
 
@@ -501,7 +575,7 @@ describe('TeamsTokenExtractor', () => {
         checkProcessRunningSpy.mockRestore()
       })
 
-      test('returns false when no Teams process is found', async () => {
+      it('returns false when no Teams process is found', async () => {
         const darwinExtractor = new TeamsTokenExtractor('darwin')
         const checkProcessRunningSpy = spyOn(darwinExtractor as any, 'checkProcessRunning').mockReturnValue(false)
 
@@ -513,17 +587,17 @@ describe('TeamsTokenExtractor', () => {
     })
 
     describe('getProcessName', () => {
-      test('returns correct process name for macOS', () => {
+      it('returns correct process name for macOS', () => {
         const darwinExtractor = new TeamsTokenExtractor('darwin')
         expect((darwinExtractor as any).getProcessName()).toBe('Microsoft Teams')
       })
 
-      test('returns correct process name for Windows', () => {
+      it('returns correct process name for Windows', () => {
         const winExtractor = new TeamsTokenExtractor('win32')
         expect((winExtractor as any).getProcessName()).toBe('Teams.exe')
       })
 
-      test('returns correct process name for Linux', () => {
+      it('returns correct process name for Linux', () => {
         const linuxExtractor = new TeamsTokenExtractor('linux')
         expect((linuxExtractor as any).getProcessName()).toBe('teams')
       })
@@ -531,7 +605,7 @@ describe('TeamsTokenExtractor', () => {
   })
 
   describe('SQLite extraction', () => {
-    test('returns null when database path does not exist', async () => {
+    it('returns null when database path does not exist', async () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
 
       const result = await (darwinExtractor as any).extractFromSQLite('/nonexistent/path')
@@ -539,7 +613,7 @@ describe('TeamsTokenExtractor', () => {
       expect(result).toBeNull()
     })
 
-    test('returns null when extraction throws', async () => {
+    it('returns null when extraction throws', async () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
 
       const result = await (darwinExtractor as any).extractFromSQLite('/dev/null')