agent-messenger 2.10.1 → 2.11.0

package/src/platforms/slack/token-extractor.test.ts

@@ -1,16 +1,25 @@
 import { Database } from 'bun:sqlite'
-import { afterEach, describe, expect, spyOn, test } from 'bun:test'
+import { afterEach, describe, expect, spyOn, it } from 'bun:test'
 import { createCipheriv, randomBytes } from 'node:crypto'
 import * as fs from 'node:fs'
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 
+import { ChromiumCookieDecryptor } from '@/shared/chromium'
+
 import { ExtractedWorkspace, TokenExtractor } from './token-extractor'
 
 const tempDirs: string[] = []
+const originalAgentBrowserProfile = process.env.AGENT_BROWSER_PROFILE
 
 afterEach(() => {
+  if (originalAgentBrowserProfile) {
+    process.env.AGENT_BROWSER_PROFILE = originalAgentBrowserProfile
+  } else {
+    delete process.env.AGENT_BROWSER_PROFILE
+  }
+
   for (const dir of tempDirs) {
     rmSync(dir, { recursive: true, force: true })
   }
@@ -33,7 +42,7 @@ function createCookiesDb(
 }
 
 describe('TokenExtractor token deduplication', () => {
-  test('keeps first token per team and upgrades unknown team name', async () => {
+  it('keeps first token per team and upgrades unknown team name', async () => {
     // given — two .log entries for the same team: first has unknown name, second has a name
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-dedup-'))
     tempDirs.push(slackDir)
@@ -59,7 +68,7 @@ describe('TokenExtractor token deduplication', () => {
     expect(result[0].workspace_name).toBe('workspace-name')
   })
 
-  test('prefers Local Storage token over IndexedDB token for same team', async () => {
+  it('prefers Local Storage token over IndexedDB token for same team', async () => {
     // given — same team in Local Storage (valid) and IndexedDB (stale)
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-dedup-tier-'))
     tempDirs.push(slackDir)
@@ -87,7 +96,7 @@ describe('TokenExtractor token deduplication', () => {
     expect(result[0].workspace_name).toBe('valid-workspace')
   })
 
-  test('prefers IndexedDB token when Local Storage has no token for team', async () => {
+  it('prefers IndexedDB token when Local Storage has no token for team', async () => {
     // given — token only in IndexedDB
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-dedup-idb-only-'))
     tempDirs.push(slackDir)
@@ -108,7 +117,7 @@ describe('TokenExtractor token deduplication', () => {
     expect(result[0].token).toBe(token)
   })
 
-  test('prefers storage dir token over IndexedDB token for same team', async () => {
+  it('prefers storage dir token over IndexedDB token for same team', async () => {
     // given — structured JSON in storage dir vs raw token in IndexedDB
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-dedup-storage-'))
     tempDirs.push(slackDir)
@@ -136,7 +145,7 @@ describe('TokenExtractor token deduplication', () => {
     expect(result[0].workspace_name).toBe('storage-workspace')
   })
 
-  test('prefers .log tokens over .ldb tokens for same team', async () => {
+  it('prefers .log tokens over .ldb tokens for same team', async () => {
     // given — same team ID in both .log (fresh) and .ldb (stale)
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-dedup-order-'))
     tempDirs.push(slackDir)
@@ -160,7 +169,7 @@ describe('TokenExtractor token deduplication', () => {
     expect(result[0].token).toBe(freshToken)
   })
 
-  test('keeps all tokens with unknown teamId instead of merging them', async () => {
+  it('keeps all tokens with unknown teamId instead of merging them', async () => {
     // given — two different tokens without team ID context (no T[A-Z0-9] nearby)
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-dedup-unknown-'))
     tempDirs.push(slackDir)
@@ -203,7 +212,7 @@ describe('TokenExtractor LevelDB fragmentation markers', () => {
     return Buffer.concat([prefix, segments[0] ? Buffer.concat(segments) : Buffer.alloc(0), suffix])
   }
 
-  test('extracts token with old fragmentation marker [19 0d f0 NN]', async () => {
+  it('extracts token with old fragmentation marker [19 0d f0 NN]', async () => {
     // given
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-marker-old-'))
     tempDirs.push(slackDir)
@@ -225,7 +234,7 @@ describe('TokenExtractor LevelDB fragmentation markers', () => {
     expect(result[0].token).toBe(`xoxc-1111111111-2222222222-3333333333-${hex64}`)
   })
 
-  test('extracts token with new fragmentation marker [15 0b f0 43]', async () => {
+  it('extracts token with new fragmentation marker [15 0b f0 43]', async () => {
     // given — marker whose 4th byte (0x43 = "C") is a valid hex char
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-marker-new-'))
     tempDirs.push(slackDir)
@@ -248,7 +257,7 @@ describe('TokenExtractor LevelDB fragmentation markers', () => {
     expect(result[0].token).not.toContain('C')
   })
 
-  test('extracts token with new fragmentation marker [15 0b f0 58]', async () => {
+  it('extracts token with new fragmentation marker [15 0b f0 58]', async () => {
     // given — marker whose 4th byte (0x58 = "X") is not a valid hex char
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-marker-58-'))
     tempDirs.push(slackDir)
@@ -272,7 +281,7 @@ describe('TokenExtractor LevelDB fragmentation markers', () => {
 })
 
 describe('TokenExtractor Linux cookie decryption', () => {
-  test('decrypts v10 cookie using peanuts password on Linux', async () => {
+  it('decrypts v10 cookie using peanuts password on Linux', async () => {
     // given — LevelDB with valid token + v10-encrypted cookie using Linux key
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-linux-'))
     tempDirs.push(slackDir)
@@ -311,7 +320,7 @@ describe('TokenExtractor Linux cookie decryption', () => {
 })
 
 describe('TokenExtractor Linux v11 cookie decryption', () => {
-  test('decrypts v11 cookie using gnome-keyring password on Linux', () => {
+  it('decrypts v11 cookie using gnome-keyring password on Linux', () => {
     // given — v11-prefixed cookie encrypted with a known keyring password
     const { createCipheriv, pbkdf2Sync } = require('node:crypto')
     const testPassword = 'test-gnome-keyring-password'
@@ -338,7 +347,7 @@ describe('TokenExtractor Linux v11 cookie decryption', () => {
     keyringPasswordSpy.mockRestore()
   })
 
-  test('falls back to peanuts key when keyring is unavailable for v11 cookie', () => {
+  it('falls back to peanuts key when keyring is unavailable for v11 cookie', () => {
     // given — v11-prefixed cookie encrypted with peanuts (tests fallback code path)
     const { createCipheriv, pbkdf2Sync } = require('node:crypto')
     const key = pbkdf2Sync('peanuts', 'saltysalt', 1, 16, 'sha1')
@@ -363,7 +372,7 @@ describe('TokenExtractor Linux v11 cookie decryption', () => {
 })
 
 describe('TokenExtractor debug logging', () => {
-  test('calls debugLog callback during extraction', async () => {
+  it('calls debugLog callback during extraction', async () => {
     // given
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-debug-'))
     tempDirs.push(slackDir)
@@ -380,7 +389,7 @@ describe('TokenExtractor debug logging', () => {
     expect(messages.length).toBeGreaterThan(0)
   })
 
-  test('does not throw when debugLog is not provided', async () => {
+  it('does not throw when debugLog is not provided', async () => {
     // given
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-no-debug-'))
     tempDirs.push(slackDir)
@@ -394,12 +403,12 @@ describe('TokenExtractor debug logging', () => {
 })
 
 describe('TokenExtractor Windows DPAPI', () => {
-  test('decryptDPAPI returns null on non-win32 platform', () => {
+  it('decryptDPAPI returns null on non-win32 platform', () => {
     const extractor = new TokenExtractor('darwin', '/tmp/slack-test')
     expect(extractor.decryptDPAPI(Buffer.from('test'))).toBeNull()
   })
 
-  test('decryptV10CookieWindows decrypts AES-256-GCM with master key from Local State', () => {
+  it('decryptV10CookieWindows decrypts AES-256-GCM with master key from Local State', () => {
     // given — known master key and AES-256-GCM encrypted cookie
     const masterKey = randomBytes(32)
 
@@ -423,7 +432,7 @@ describe('TokenExtractor Windows DPAPI', () => {
     expect(extractor.tryDecryptCookie(encrypted)).toBe(plaintext)
   })
 
-  test('decryptV10CookieWindows falls back to direct DPAPI when no Local State', () => {
+  it('decryptV10CookieWindows falls back to direct DPAPI when no Local State', () => {
     class TestTokenExtractor extends TokenExtractor {
       override getWindowsMasterKey(): null {
         return null
@@ -439,7 +448,7 @@ describe('TokenExtractor Windows DPAPI', () => {
     expect(extractor.tryDecryptCookie(encrypted)).toBe('xoxd-dpapiDirectCookie%2B')
   })
 
-  test('tryDecryptCookie handles Windows pre-v80 cookies without version prefix', () => {
+  it('tryDecryptCookie handles Windows pre-v80 cookies without version prefix', () => {
     class TestTokenExtractor extends TokenExtractor {
       override decryptDPAPI(_encrypted: Buffer): Buffer | null {
         return Buffer.from('xoxd-preV80Cookie%2B')
@@ -452,7 +461,7 @@ describe('TokenExtractor Windows DPAPI', () => {
     expect(extractor.tryDecryptCookie(encrypted)).toBe('xoxd-preV80Cookie%2B')
   })
 
-  test('getWindowsMasterKey reads and decrypts key from Local State file', () => {
+  it('getWindowsMasterKey reads and decrypts key from Local State file', () => {
     // given
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-win-'))
     tempDirs.push(slackDir)
@@ -477,7 +486,7 @@ describe('TokenExtractor Windows DPAPI', () => {
     expect(extractor.getWindowsMasterKey()).toEqual(fakeDecryptedKey)
   })
 
-  test('getWindowsMasterKey returns null when Local State is missing', () => {
+  it('getWindowsMasterKey returns null when Local State is missing', () => {
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-no-ls-'))
     tempDirs.push(slackDir)
 
@@ -485,7 +494,7 @@ describe('TokenExtractor Windows DPAPI', () => {
     expect(extractor.getWindowsMasterKey()).toBeNull()
   })
 
-  test('getWindowsMasterKey returns null when encrypted_key has no DPAPI prefix', () => {
+  it('getWindowsMasterKey returns null when encrypted_key has no DPAPI prefix', () => {
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-bad-ls-'))
     tempDirs.push(slackDir)
 
@@ -496,7 +505,7 @@ describe('TokenExtractor Windows DPAPI', () => {
     expect(extractor.getWindowsMasterKey()).toBeNull()
   })
 
-  test('extract throws descriptive error when cookie file is locked (EBUSY)', async () => {
+  it('extract throws descriptive error when cookie file is locked (EBUSY)', async () => {
     // given — LevelDB with a valid token but Cookies file locked by Slack
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-ebusy-'))
     tempDirs.push(slackDir)
@@ -523,7 +532,7 @@ describe('TokenExtractor Windows DPAPI', () => {
     }
   })
 
-  test('extract decrypts Windows v10 cookies end-to-end with mocked DPAPI', async () => {
+  it('extract decrypts Windows v10 cookies end-to-end with mocked DPAPI', async () => {
     // given — SQLite DB with v10-encrypted cookie, Local State with master key, LevelDB with token
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-win-e2e-'))
     tempDirs.push(slackDir)
@@ -582,7 +591,7 @@ describe('TokenExtractor Windows DPAPI', () => {
 })
 
 describe('TokenExtractor IndexedDB blob files', () => {
-  test('extracts token from blob file when not in LevelDB', async () => {
+  it('extracts token from blob file when not in LevelDB', async () => {
     // given — token only exists in an IndexedDB blob file, not in LevelDB
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-blob-'))
     tempDirs.push(slackDir)
@@ -604,7 +613,7 @@ describe('TokenExtractor IndexedDB blob files', () => {
     expect(result[0].workspace_id).toBe('T12345678')
   })
 
-  test('extracts tokens from both LevelDB and blob files for different teams', async () => {
+  it('extracts tokens from both LevelDB and blob files for different teams', async () => {
     // given — one workspace token in LevelDB, another in blob file
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-blob-multi-'))
     tempDirs.push(slackDir)
@@ -632,7 +641,7 @@ describe('TokenExtractor IndexedDB blob files', () => {
     expect(teamIds).toEqual(['TAAAAAAAA', 'TBBBBBBBBB'])
   })
 
-  test('LevelDB token wins over blob file token for same team', async () => {
+  it('LevelDB token wins over blob file token for same team', async () => {
     // given — same team in both LevelDB (.log = highest raw priority) and blob file
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-blob-dedup-'))
     tempDirs.push(slackDir)
@@ -659,7 +668,7 @@ describe('TokenExtractor IndexedDB blob files', () => {
     expect(result[0].token).toBe(ldbToken)
   })
 
-  test('merges same token from LDB and blob with different teamIds', async () => {
+  it('merges same token from LDB and blob with different teamIds', async () => {
     // given — same token in LevelDB (correct teamId) and blob file (false-positive teamId from binary)
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-blob-dup-'))
     tempDirs.push(slackDir)
@@ -685,7 +694,7 @@ describe('TokenExtractor IndexedDB blob files', () => {
     expect(result[0].token).toBe(token)
   })
 
-  test('skips blob files larger than 10MB', async () => {
+  it('skips blob files larger than 10MB', async () => {
     // given — blob file exceeds size limit
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-blob-large-'))
     tempDirs.push(slackDir)
@@ -710,7 +719,7 @@ describe('TokenExtractor IndexedDB blob files', () => {
 })
 
 describe('TokenExtractor getWorkspaceDomains', () => {
-  test('reads workspace domains from root-state.json', () => {
+  it('reads workspace domains from root-state.json', () => {
     // given
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-domains-'))
     tempDirs.push(slackDir)
@@ -735,7 +744,7 @@ describe('TokenExtractor getWorkspaceDomains', () => {
     expect(domains).toEqual({ T111: 'acme-corp', T222: 'devteam' })
   })
 
-  test('returns empty when root-state.json is missing', () => {
+  it('returns empty when root-state.json is missing', () => {
     // given
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-no-rootstate-'))
     tempDirs.push(slackDir)
@@ -748,7 +757,7 @@ describe('TokenExtractor getWorkspaceDomains', () => {
     expect(domains).toEqual({})
   })
 
-  test('returns empty when root-state.json has no workspaces', () => {
+  it('returns empty when root-state.json has no workspaces', () => {
     // given
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-empty-rootstate-'))
     tempDirs.push(slackDir)
@@ -765,7 +774,7 @@ describe('TokenExtractor getWorkspaceDomains', () => {
     expect(domains).toEqual({})
   })
 
-  test('skips workspaces without domain field', () => {
+  it('skips workspaces without domain field', () => {
     // given
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-partial-rootstate-'))
     tempDirs.push(slackDir)
@@ -792,7 +801,7 @@ describe('TokenExtractor getWorkspaceDomains', () => {
 })
 
 describe('TokenExtractor browser fallback', () => {
-  test('extractFromBrowsers returns empty array when no browser profiles have tokens', async () => {
+  it('extractFromBrowsers returns empty array when no browser profiles have tokens', async () => {
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-nonexistent-'))
     tempDirs.push(slackDir)
     rmSync(slackDir, { recursive: true, force: true })
@@ -802,7 +811,53 @@ describe('TokenExtractor browser fallback', () => {
     expect(result).toEqual([])
   })
 
-  test('extract tries desktop before browser profiles', async () => {
+  it('resolves Local State from agent-browser profile root for encrypted cookies', async () => {
+    // given
+    const agentBrowserProfile = mkdtempSync(join(tmpdir(), 'agent-browser-slack-profile-'))
+    tempDirs.push(agentBrowserProfile)
+    process.env.AGENT_BROWSER_PROFILE = agentBrowserProfile
+
+    const hex64 = 'c'.repeat(64)
+    const token = `xoxc-1111111111-2222222222-3333333333-${hex64}`
+    const profileDir = join(agentBrowserProfile, 'Default')
+    const leveldbDir = join(profileDir, 'Local Storage', 'leveldb')
+    const networkDir = join(profileDir, 'Network')
+    mkdirSync(leveldbDir, { recursive: true })
+    mkdirSync(networkDir, { recursive: true })
+    writeFileSync(join(leveldbDir, '000001.log'), `"${token}"T12345678"name":"agent-browser-workspace"`)
+    writeFileSync(join(agentBrowserProfile, 'Local State'), '{}')
+    createCookiesDb(join(networkDir, 'Cookies'), [
+      {
+        name: 'd',
+        value: '',
+        encrypted_value: new Uint8Array([1, 2, 3]),
+        host_key: '.slack.com',
+        last_access_utc: 1,
+      },
+    ])
+    const decryptSpy = spyOn(ChromiumCookieDecryptor.prototype, 'decryptCookie').mockReturnValue('xoxd-AgentBrowser')
+
+    try {
+      // when
+      const extractor = new TokenExtractor('darwin', join(agentBrowserProfile, 'missing-desktop'))
+      const result = await extractor.extractFromBrowsers()
+
+      // then
+      expect(result).toEqual([
+        {
+          workspace_id: 'T12345678',
+          workspace_name: 'agent-browser-workspace',
+          token,
+          cookie: 'xoxd-AgentBrowser',
+        },
+      ])
+      expect(decryptSpy).toHaveBeenCalledWith(Buffer.from([1, 2, 3]), join(agentBrowserProfile, 'Local State'))
+    } finally {
+      decryptSpy.mockRestore()
+    }
+  })
+
+  it('extract tries desktop before browser profiles', async () => {
     // given — slackDir with LevelDB token data
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-fallback-desktop-'))
     tempDirs.push(slackDir)
@@ -826,7 +881,48 @@ describe('TokenExtractor browser fallback', () => {
     extractFromBrowsersSpy.mockRestore()
   })
 
-  test('extract falls back to browser profiles when desktop has no tokens', async () => {
+  it('custom browser profile can upgrade desktop token with a cookie', async () => {
+    // given
+    const slackDir = mkdtempSync(join(tmpdir(), 'slack-custom-cookie-upgrade-'))
+    tempDirs.push(slackDir)
+
+    const hex64 = 'd'.repeat(64)
+    const token = `xoxc-1111111111-2222222222-3333333333-${hex64}`
+    const leveldbDir = join(slackDir, 'Local Storage', 'leveldb')
+    mkdirSync(leveldbDir, { recursive: true })
+    writeFileSync(join(leveldbDir, '000001.log'), `"${token}"T12345678"name":"desktop-workspace"`)
+
+    const browserWorkspace: ExtractedWorkspace = {
+      workspace_id: 'T12345678',
+      workspace_name: 'browser-workspace',
+      token,
+      cookie: 'xoxd-browser-cookie',
+    }
+    const extractFromBrowsersSpy = spyOn(TokenExtractor.prototype as any, 'extractFromBrowsers').mockResolvedValue([
+      browserWorkspace,
+    ])
+
+    try {
+      // when
+      const extractor = new TokenExtractor('darwin', slackDir, undefined, undefined, ['/tmp/custom-profile'])
+      const result = await extractor.extract()
+
+      // then
+      expect(extractFromBrowsersSpy).toHaveBeenCalled()
+      expect(result).toEqual([
+        {
+          workspace_id: 'T12345678',
+          workspace_name: 'desktop-workspace',
+          token,
+          cookie: 'xoxd-browser-cookie',
+        },
+      ])
+    } finally {
+      extractFromBrowsersSpy.mockRestore()
+    }
+  })
+
+  it('extract falls back to browser profiles when desktop has no tokens', async () => {
     // given — empty slackDir (no tokens)
     const slackDir = mkdtempSync(join(tmpdir(), 'slack-fallback-browser-'))
     tempDirs.push(slackDir)
@@ -855,7 +951,7 @@ describe('TokenExtractor browser fallback', () => {
     extractFromBrowsersSpy.mockRestore()
   })
 
-  test('extract falls back to browser when slackDir does not exist', async () => {
+  it('extract falls back to browser when slackDir does not exist', async () => {
     // given — non-existent slackDir
     const slackDir = '/nonexistent/slack/dir'
     const hex64 = 'c'.repeat(64)

package/src/platforms/slack/token-extractor.ts

@@ -12,7 +12,9 @@ import {
   ChromiumCookieDecryptor,
   ChromiumCookieReader,
   discoverBrowserProfileDirs,
+  findLocalStatePath,
   getBrowserBasePath,
+  getAgentBrowserProfileDirs,
 } from '@/shared/chromium'
 import { DerivedKeyCache } from '@/shared/utils/derived-key-cache'
 import { lookupLinuxKeyringPassword } from '@/shared/utils/linux-keyring'
@@ -63,12 +65,14 @@ export class TokenExtractor {
   private debugLog: ((message: string) => void) | null
   private browserDecryptor: ChromiumCookieDecryptor
   private browserCookieReader: ChromiumCookieReader
+  private customBrowserProfileDirs: string[]
 
   constructor(
     platform?: NodeJS.Platform,
     slackDir?: string,
     keyCache?: DerivedKeyCache,
     debugLog?: (message: string) => void,
+    customBrowserProfileDirs?: string[],
   ) {
     this.platform = platform ?? process.platform
 
@@ -79,6 +83,7 @@ export class TokenExtractor {
     this.slackDir = slackDir ?? this.getSlackDir()
     this.keyCache = keyCache ?? new DerivedKeyCache()
     this.debugLog = debugLog ?? null
+    this.customBrowserProfileDirs = customBrowserProfileDirs ?? []
     this.browserDecryptor = new ChromiumCookieDecryptor({ platform: this.platform })
     this.browserCookieReader = new ChromiumCookieReader()
   }
@@ -188,6 +193,9 @@ export class TokenExtractor {
   }
 
   async extract(): Promise<ExtractedWorkspace[]> {
+    const results: ExtractedWorkspace[] = []
+    const seenTokens = new Set<string>()
+
     if (existsSync(this.slackDir)) {
       await this.getDerivedKeyAsync()
 
@@ -201,27 +209,55 @@ export class TokenExtractor {
           if (this.cachedKey) {
             await this.keyCache.set('slack', this.cachedKey)
             const retryCookie = await this.extractCookieFromSQLite()
-            return tokens.map((t) => ({
-              workspace_id: t.teamId,
-              workspace_name: t.teamName,
-              token: t.token,
-              cookie: retryCookie,
-            }))
+            this.addExtractedWorkspaces(results, seenTokens, tokens, retryCookie)
+            return this.customBrowserProfileDirs.length > 0 ? this.mergeBrowserResults(results, seenTokens) : results
           }
         }
 
-        return tokens.map((t) => ({
-          workspace_id: t.teamId,
-          workspace_name: t.teamName,
-          token: t.token,
-          cookie: cookie,
-        }))
+        this.addExtractedWorkspaces(results, seenTokens, tokens, cookie)
+        return this.customBrowserProfileDirs.length > 0 ? this.mergeBrowserResults(results, seenTokens) : results
       }
     }
 
     return this.extractFromBrowsers()
   }
 
+  private async mergeBrowserResults(
+    results: ExtractedWorkspace[],
+    seenTokens: Set<string>,
+  ): Promise<ExtractedWorkspace[]> {
+    for (const workspace of await this.extractFromBrowsers()) {
+      const existing = results.find((item) => item.token === workspace.token)
+      if (existing) {
+        if (!existing.cookie && workspace.cookie) {
+          existing.cookie = workspace.cookie
+        }
+        continue
+      }
+      seenTokens.add(workspace.token)
+      results.push(workspace)
+    }
+    return results
+  }
+
+  private addExtractedWorkspaces(
+    results: ExtractedWorkspace[],
+    seenTokens: Set<string>,
+    tokens: TokenInfo[],
+    cookie: string,
+  ): void {
+    for (const token of tokens) {
+      if (seenTokens.has(token.token)) continue
+      seenTokens.add(token.token)
+      results.push({
+        workspace_id: token.teamId,
+        workspace_name: token.teamName,
+        token: token.token,
+        cookie,
+      })
+    }
+  }
+
   async extractFromBrowsers(): Promise<ExtractedWorkspace[]> {
     const results: ExtractedWorkspace[] = []
     const seenTokens = new Set<string>()
@@ -259,6 +295,33 @@ export class TokenExtractor {
       }
     }
 
+    for (const profileDir of getAgentBrowserProfileDirs({ customProfileDirs: this.customBrowserProfileDirs })) {
+      const leveldbDir = join(profileDir, 'Local Storage', 'leveldb')
+      if (!existsSync(leveldbDir)) continue
+
+      let tokenInfos: TokenInfo[]
+      try {
+        tokenInfos = await this.extractFromLevelDB(leveldbDir, 'local-storage')
+      } catch {
+        continue
+      }
+
+      if (tokenInfos.length === 0) continue
+
+      const cookie = await this.extractCookieFromBrowserProfile(profileDir, profileDir)
+
+      for (const t of tokenInfos) {
+        if (seenTokens.has(t.token)) continue
+        seenTokens.add(t.token)
+        results.push({
+          workspace_id: t.teamId,
+          workspace_name: t.teamName,
+          token: t.token,
+          cookie,
+        })
+      }
+    }
+
     return results
   }
 
@@ -293,7 +356,7 @@ export class TokenExtractor {
     if (row.value?.startsWith('xoxd-')) return row.value
 
     if (row.encrypted_value && row.encrypted_value.length > 0) {
-      const localStatePath = join(browserBase, 'Local State')
+      const localStatePath = findLocalStatePath(cookiesPath) ?? join(browserBase, 'Local State')
       const decrypted = this.browserDecryptor.decryptCookie(
         Buffer.from(row.encrypted_value),
         existsSync(localStatePath) ? localStatePath : undefined,