agent-messenger 2.10.1 → 2.11.0

package/src/platforms/teams/token-extractor.test.ts

@@ -1,4 +1,4 @@
-import { beforeEach, describe, expect, spyOn, test } from 'bun:test'
+import { beforeEach, describe, expect, spyOn, it } from 'bun:test'
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { homedir, tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -13,7 +13,7 @@ describe('TeamsTokenExtractor', () => {
   })
 
   describe('getDesktopCookiesPaths', () => {
-    test('returns darwin desktop paths on macOS', () => {
+    it('returns darwin desktop paths on macOS', () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
       const paths = darwinExtractor.getDesktopCookiesPaths()
 
@@ -30,20 +30,33 @@ describe('TeamsTokenExtractor', () => {
         'EBWebView',
       )
       expect(paths).toEqual([
-        { path: join(darwinEbWebView, 'WV2Profile_tfw', 'Cookies'), accountType: 'work' },
-        { path: join(darwinEbWebView, 'WV2Profile_tfw', 'Network', 'Cookies'), accountType: 'work' },
-        { path: join(darwinEbWebView, 'WV2Profile_tfl', 'Cookies'), accountType: 'personal' },
-        { path: join(darwinEbWebView, 'WV2Profile_tfl', 'Network', 'Cookies'), accountType: 'personal' },
-        { path: join(darwinEbWebView, 'Default', 'Cookies'), accountType: 'work' },
-        { path: join(darwinEbWebView, 'Default', 'Network', 'Cookies'), accountType: 'work' },
+        { path: join(darwinEbWebView, 'WV2Profile_tfw', 'Cookies'), accountType: 'work', accountTypeKnown: true },
+        {
+          path: join(darwinEbWebView, 'WV2Profile_tfw', 'Network', 'Cookies'),
+          accountType: 'work',
+          accountTypeKnown: true,
+        },
+        {
+          path: join(darwinEbWebView, 'WV2Profile_tfl', 'Cookies'),
+          accountType: 'personal',
+          accountTypeKnown: true,
+        },
+        {
+          path: join(darwinEbWebView, 'WV2Profile_tfl', 'Network', 'Cookies'),
+          accountType: 'personal',
+          accountTypeKnown: true,
+        },
+        { path: join(darwinEbWebView, 'Default', 'Cookies'), accountType: 'work', accountTypeKnown: false },
+        { path: join(darwinEbWebView, 'Default', 'Network', 'Cookies'), accountType: 'work', accountTypeKnown: false },
         {
           path: join(homedir(), 'Library', 'Application Support', 'Microsoft', 'Teams', 'Cookies'),
           accountType: 'work',
+          accountTypeKnown: false,
         },
       ])
     })
 
-    test('returns linux desktop path on Linux', () => {
+    it('returns linux desktop path on Linux', () => {
       const linuxExtractor = new TeamsTokenExtractor('linux')
       const paths = linuxExtractor.getDesktopCookiesPaths()
 
@@ -51,11 +64,12 @@ describe('TeamsTokenExtractor', () => {
         {
           path: join(homedir(), '.config', 'Microsoft', 'Microsoft Teams', 'Cookies'),
           accountType: 'work',
+          accountTypeKnown: false,
         },
       ])
     })
 
-    test('returns win32 desktop paths on Windows', () => {
+    it('returns win32 desktop paths on Windows', () => {
       const winExtractor = new TeamsTokenExtractor('win32')
       const paths = winExtractor.getDesktopCookiesPaths()
 
@@ -71,24 +85,32 @@ describe('TeamsTokenExtractor', () => {
         'EBWebView',
       )
       expect(paths).toEqual([
-        { path: join(winEbWebView, 'WV2Profile_tfw', 'Cookies'), accountType: 'work' },
-        { path: join(winEbWebView, 'WV2Profile_tfw', 'Network', 'Cookies'), accountType: 'work' },
-        { path: join(winEbWebView, 'WV2Profile_tfl', 'Cookies'), accountType: 'personal' },
-        { path: join(winEbWebView, 'WV2Profile_tfl', 'Network', 'Cookies'), accountType: 'personal' },
-        { path: join(winEbWebView, 'Default', 'Cookies'), accountType: 'work' },
-        { path: join(winEbWebView, 'Default', 'Network', 'Cookies'), accountType: 'work' },
-        { path: join(appdata, 'Microsoft', 'Teams', 'Cookies'), accountType: 'work' },
+        { path: join(winEbWebView, 'WV2Profile_tfw', 'Cookies'), accountType: 'work', accountTypeKnown: true },
+        {
+          path: join(winEbWebView, 'WV2Profile_tfw', 'Network', 'Cookies'),
+          accountType: 'work',
+          accountTypeKnown: true,
+        },
+        { path: join(winEbWebView, 'WV2Profile_tfl', 'Cookies'), accountType: 'personal', accountTypeKnown: true },
+        {
+          path: join(winEbWebView, 'WV2Profile_tfl', 'Network', 'Cookies'),
+          accountType: 'personal',
+          accountTypeKnown: true,
+        },
+        { path: join(winEbWebView, 'Default', 'Cookies'), accountType: 'work', accountTypeKnown: false },
+        { path: join(winEbWebView, 'Default', 'Network', 'Cookies'), accountType: 'work', accountTypeKnown: false },
+        { path: join(appdata, 'Microsoft', 'Teams', 'Cookies'), accountType: 'work', accountTypeKnown: false },
       ])
     })
 
-    test('returns empty array for unsupported platform', () => {
+    it('returns empty array for unsupported platform', () => {
       const unsupportedExtractor = new TeamsTokenExtractor('freebsd' as NodeJS.Platform)
       expect(unsupportedExtractor.getDesktopCookiesPaths()).toEqual([])
     })
   })
 
   describe('getBrowserCookiesPaths', () => {
-    test('returns browser cookie paths on macOS (at least Default profile per browser)', () => {
+    it('returns browser cookie paths on macOS (at least Default profile per browser)', () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
       const paths = darwinExtractor.getBrowserCookiesPaths()
 
@@ -96,14 +118,16 @@ describe('TeamsTokenExtractor', () => {
       expect(paths).toContainEqual({
         path: join(chromeBase, 'Default', 'Cookies'),
         accountType: 'work',
+        accountTypeKnown: false,
       })
       expect(paths).toContainEqual({
         path: join(chromeBase, 'Default', 'Network', 'Cookies'),
         accountType: 'work',
+        accountTypeKnown: false,
       })
     })
 
-    test('returns browser cookie paths on Linux', () => {
+    it('returns browser cookie paths on Linux', () => {
       const linuxExtractor = new TeamsTokenExtractor('linux')
       const paths = linuxExtractor.getBrowserCookiesPaths()
 
@@ -111,10 +135,11 @@ describe('TeamsTokenExtractor', () => {
       expect(paths).toContainEqual({
         path: join(chromeBase, 'Default', 'Cookies'),
         accountType: 'work',
+        accountTypeKnown: false,
       })
     })
 
-    test('returns browser cookie paths on Windows', () => {
+    it('returns browser cookie paths on Windows', () => {
       const winExtractor = new TeamsTokenExtractor('win32')
       const paths = winExtractor.getBrowserCookiesPaths()
 
@@ -123,23 +148,28 @@ describe('TeamsTokenExtractor', () => {
       expect(paths).toContainEqual({
         path: join(chromeBase, 'Default', 'Cookies'),
         accountType: 'work',
+        accountTypeKnown: false,
       })
     })
 
-    test('returns empty array for unsupported platform', () => {
+    it('returns empty array for unsupported platform', () => {
       const unsupportedExtractor = new TeamsTokenExtractor('freebsd' as NodeJS.Platform)
       expect(unsupportedExtractor.getBrowserCookiesPaths()).toEqual([])
     })
 
-    test('all browser paths have accountType work', () => {
+    // Regression for #163: browser paths must not assert accountType confidently because
+    // Chromium profile paths don't encode work vs personal. Desktop WV2Profile_tfw/_tfl
+    // paths are authoritative; browsers must be probed at validation time.
+    it('browser paths have accountTypeKnown=false so they get probed at validation', () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
       const paths = darwinExtractor.getBrowserCookiesPaths()
-      expect(paths.every((p) => p.accountType === 'work')).toBe(true)
+      expect(paths.length).toBeGreaterThan(0)
+      expect(paths.every((p) => p.accountTypeKnown === false)).toBe(true)
     })
   })
 
   describe('getTeamsCookiesPaths', () => {
-    test('returns darwin paths on macOS with desktop paths first', () => {
+    it('returns darwin paths on macOS with desktop paths first', () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
       const paths = darwinExtractor.getTeamsCookiesPaths()
       const desktopPaths = darwinExtractor.getDesktopCookiesPaths()
@@ -147,7 +177,7 @@ describe('TeamsTokenExtractor', () => {
       expect(paths.slice(0, desktopPaths.length)).toEqual(desktopPaths)
     })
 
-    test('browser paths come after desktop paths on macOS', () => {
+    it('browser paths come after desktop paths on macOS', () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
       const paths = darwinExtractor.getTeamsCookiesPaths()
       const desktopPaths = darwinExtractor.getDesktopCookiesPaths()
@@ -157,7 +187,7 @@ describe('TeamsTokenExtractor', () => {
       expect(paths.slice(desktopPaths.length)).toEqual(browserPaths)
     })
 
-    test('returns linux paths with desktop first then browser paths', () => {
+    it('returns linux paths with desktop first then browser paths', () => {
       const linuxExtractor = new TeamsTokenExtractor('linux')
       const paths = linuxExtractor.getTeamsCookiesPaths()
       const desktopPaths = linuxExtractor.getDesktopCookiesPaths()
@@ -166,12 +196,13 @@ describe('TeamsTokenExtractor', () => {
         {
           path: join(homedir(), '.config', 'Microsoft', 'Microsoft Teams', 'Cookies'),
           accountType: 'work',
+          accountTypeKnown: false,
         },
       ])
       expect(paths.length).toBeGreaterThan(desktopPaths.length)
     })
 
-    test('returns win32 paths with desktop first then browser paths', () => {
+    it('returns win32 paths with desktop first then browser paths', () => {
       const winExtractor = new TeamsTokenExtractor('win32')
       const paths = winExtractor.getTeamsCookiesPaths()
       const desktopPaths = winExtractor.getDesktopCookiesPaths()
@@ -180,7 +211,7 @@ describe('TeamsTokenExtractor', () => {
       expect(paths.length).toBeGreaterThan(desktopPaths.length)
     })
 
-    test('returns empty array for unsupported platform', () => {
+    it('returns empty array for unsupported platform', () => {
       const unsupportedExtractor = new TeamsTokenExtractor('freebsd' as NodeJS.Platform)
       const paths = unsupportedExtractor.getTeamsCookiesPaths()
 
@@ -189,21 +220,21 @@ describe('TeamsTokenExtractor', () => {
   })
 
   describe('getLocalStatePath', () => {
-    test('returns darwin Local State path on macOS', () => {
+    it('returns darwin Local State path on macOS', () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
       const path = darwinExtractor.getLocalStatePath()
 
       expect(path).toBe(join(homedir(), 'Library', 'Application Support', 'Microsoft', 'Teams', 'Local State'))
     })
 
-    test('returns linux Local State path on Linux', () => {
+    it('returns linux Local State path on Linux', () => {
       const linuxExtractor = new TeamsTokenExtractor('linux')
       const path = linuxExtractor.getLocalStatePath()
 
       expect(path).toBe(join(homedir(), '.config', 'Microsoft', 'Microsoft Teams', 'Local State'))
     })
 
-    test('returns win32 Local State path on Windows', () => {
+    it('returns win32 Local State path on Windows', () => {
       const winExtractor = new TeamsTokenExtractor('win32')
       const path = winExtractor.getLocalStatePath()
 
@@ -213,7 +244,7 @@ describe('TeamsTokenExtractor', () => {
   })
 
   describe('getKeychainVariants', () => {
-    test('includes Teams-specific keychain entries', () => {
+    it('includes Teams-specific keychain entries', () => {
       const macExtractor = new TeamsTokenExtractor('darwin')
       const variants = macExtractor.getKeychainVariants()
 
@@ -226,7 +257,7 @@ describe('TeamsTokenExtractor', () => {
       expect(variants).toContainEqual({ service: 'Teams Safe Storage', account: 'Teams' })
     })
 
-    test('includes browser keychain entries appended after Teams entries', () => {
+    it('includes browser keychain entries appended after Teams entries', () => {
       const macExtractor = new TeamsTokenExtractor('darwin')
       const variants = macExtractor.getKeychainVariants()
 
@@ -238,7 +269,7 @@ describe('TeamsTokenExtractor', () => {
       expect(variants).toContainEqual({ service: 'Chromium Safe Storage', account: 'Chromium' })
     })
 
-    test('Teams entries come before browser entries', () => {
+    it('Teams entries come before browser entries', () => {
       const macExtractor = new TeamsTokenExtractor('darwin')
       const variants = macExtractor.getKeychainVariants()
 
@@ -249,59 +280,81 @@ describe('TeamsTokenExtractor', () => {
   })
 
   describe('isValidSkypeToken', () => {
-    test('validates JWT-like skype token format', () => {
+    it('validates JWT-like skype token format', () => {
       const validToken = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.signature'
       expect(extractor.isValidSkypeToken(validToken)).toBe(true)
     })
 
-    test('validates long base64 token format', () => {
+    it('validates long base64 token format', () => {
       const validToken = 'a'.repeat(100)
       expect(extractor.isValidSkypeToken(validToken)).toBe(true)
     })
 
-    test('rejects empty tokens', () => {
+    it('rejects empty tokens', () => {
       expect(extractor.isValidSkypeToken('')).toBe(false)
     })
 
-    test('rejects short tokens', () => {
+    it('rejects short tokens', () => {
       expect(extractor.isValidSkypeToken('short')).toBe(false)
     })
 
-    test('rejects null/undefined', () => {
+    it('rejects null/undefined', () => {
       expect(extractor.isValidSkypeToken(null as unknown as string)).toBe(false)
       expect(extractor.isValidSkypeToken(undefined as unknown as string)).toBe(false)
     })
+
+    // Regression for #156: PowerShell CLIXML leaks into DPAPI output on Windows.
+    it('rejects CLIXML progress-stream contamination', () => {
+      // given: the exact shape of the leak reported in #156
+      const clixml =
+        '#< CLIXML\r\n<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04">' +
+        '<Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T>' +
+        '<T>System.Object</T></TN><MS><I64 N="SourceId">1</I64></MS></Obj></Objs>'
+
+      // then
+      expect(extractor.isValidSkypeToken(clixml)).toBe(false)
+    })
+
+    it('rejects anything containing angle brackets or whitespace', () => {
+      expect(extractor.isValidSkypeToken('a'.repeat(60) + '<div>')).toBe(false)
+      expect(extractor.isValidSkypeToken('a'.repeat(40) + ' ' + 'b'.repeat(40))).toBe(false)
+      expect(extractor.isValidSkypeToken('a'.repeat(40) + '\n' + 'b'.repeat(40))).toBe(false)
+    })
+
+    it('rejects a bare 36-char UUID', () => {
+      expect(extractor.isValidSkypeToken('12345678-1234-1234-1234-123456789012')).toBe(false)
+    })
   })
 
   describe('isEncryptedValue', () => {
-    test('detects v10 encrypted values', () => {
+    it('detects v10 encrypted values', () => {
       const encrypted = Buffer.from('v10encrypted_data')
       expect(extractor.isEncryptedValue(encrypted)).toBe(true)
     })
 
-    test('detects v11 encrypted values', () => {
+    it('detects v11 encrypted values', () => {
       const encrypted = Buffer.from('v11encrypted_data')
       expect(extractor.isEncryptedValue(encrypted)).toBe(true)
     })
 
-    test('rejects non-encrypted values', () => {
+    it('rejects non-encrypted values', () => {
       const plain = Buffer.from('plain_text')
       expect(extractor.isEncryptedValue(plain)).toBe(false)
     })
 
-    test('rejects empty buffers', () => {
+    it('rejects empty buffers', () => {
       const empty = Buffer.alloc(0)
       expect(extractor.isEncryptedValue(empty)).toBe(false)
     })
 
-    test('rejects short buffers', () => {
+    it('rejects short buffers', () => {
       const short = Buffer.from('v1')
       expect(extractor.isEncryptedValue(short)).toBe(false)
     })
   })
 
   describe('extract', () => {
-    test('returns null when cookies path does not exist', async () => {
+    it('returns null when cookies path does not exist', async () => {
       const linuxExtractor = new TeamsTokenExtractor('linux')
       const extractFromCookiesDBSpy = spyOn(linuxExtractor as any, 'extractFromCookiesDB').mockResolvedValue([])
 
@@ -311,12 +364,12 @@ describe('TeamsTokenExtractor', () => {
       extractFromCookiesDBSpy.mockRestore()
     })
 
-    test('extracts token from cookies database when available', async () => {
+    it('extracts token from cookies database when available', async () => {
       const mockToken = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.signature_here'
 
       const linuxExtractor = new TeamsTokenExtractor('linux')
       const extractFromCookiesDBSpy = spyOn(linuxExtractor as any, 'extractFromCookiesDB').mockResolvedValue([
-        { token: mockToken, accountType: 'work' },
+        { token: mockToken, accountType: 'work', accountTypeKnown: true },
       ])
 
       const result = await linuxExtractor.extract()
@@ -327,7 +380,7 @@ describe('TeamsTokenExtractor', () => {
       extractFromCookiesDBSpy.mockRestore()
     })
 
-    test('returns null when extraction fails', async () => {
+    it('returns null when extraction fails', async () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
       const extractFromCookiesDBSpy = spyOn(darwinExtractor as any, 'extractFromCookiesDB').mockResolvedValue([])
 
@@ -349,7 +402,7 @@ describe('TeamsTokenExtractor', () => {
     const cleanup = () => rmSync(workDir, { recursive: true, force: true })
 
     // Regression for #156: if only Network/Cookies exists, missing sibling must not poison accountType.
-    test('falls through to Network/Cookies when Cookies is missing', async () => {
+    it('falls through to Network/Cookies when Cookies is missing', async () => {
       // given: only Network/Cookies exists on disk for WV2Profile_tfl
       const profileDir = join(workDir, 'WV2Profile_tfl')
       const networkDir = join(profileDir, 'Network')
@@ -360,8 +413,8 @@ describe('TeamsTokenExtractor', () => {
 
       const winExtractor = new TeamsTokenExtractor('win32')
       const getPathsSpy = spyOn(winExtractor, 'getTeamsCookiesPaths').mockReturnValue([
-        { path: cookiesPath, accountType: 'personal' },
-        { path: networkCookiesPath, accountType: 'personal' },
+        { path: cookiesPath, accountType: 'personal', accountTypeKnown: true },
+        { path: networkCookiesPath, accountType: 'personal', accountTypeKnown: true },
       ])
       const tried: string[] = []
       const copyAndExtractSpy = spyOn(winExtractor as any, 'copyAndExtract').mockImplementation(async (...args) => {
@@ -376,14 +429,143 @@ describe('TeamsTokenExtractor', () => {
       // then: the Cookies path was skipped (never passed to copyAndExtract),
       // the Network/Cookies sibling was tried, and the token was returned.
       expect(tried).toEqual([networkCookiesPath])
-      expect(results).toEqual([{ token: mockToken, accountType: 'personal' }])
+      expect(results).toEqual([{ token: mockToken, accountType: 'personal', accountTypeKnown: true }])
+
+      getPathsSpy.mockRestore()
+      copyAndExtractSpy.mockRestore()
+      cleanup()
+    })
+
+    // Regression for #156: CLIXML-contaminated decrypt output must not short-circuit
+    // the work account, leaving other valid paths unvisited.
+    it('does not mark accountType seen when the first path yields CLIXML garbage', async () => {
+      // given: first work path returns CLIXML garbage, second work path returns a real token
+      const clixmlGarbage =
+        '#< CLIXML\r\n<Objs xmlns="http://schemas.microsoft.com/powershell/2004/04">' +
+        '<Obj S="progress"><TN><T>Progress</T></TN></Obj></Objs>\r\n' +
+        'a'.repeat(80)
+      const realToken = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.signature_here'
+
+      const winExtractor = new TeamsTokenExtractor('win32')
+      const firstPath = join(workDir, 'WV2Profile_tfw', 'Cookies')
+      const secondPath = join(workDir, 'Default', 'Network', 'Cookies')
+      const getPathsSpy = spyOn(winExtractor, 'getTeamsCookiesPaths').mockReturnValue([
+        { path: firstPath, accountType: 'work', accountTypeKnown: true },
+        { path: secondPath, accountType: 'work', accountTypeKnown: true },
+      ])
+      mkdirSync(join(workDir, 'WV2Profile_tfw'), { recursive: true })
+      mkdirSync(join(workDir, 'Default', 'Network'), { recursive: true })
+      writeFileSync(firstPath, '')
+      writeFileSync(secondPath, '')
+
+      const copyAndExtractSpy = spyOn(winExtractor as any, 'copyAndExtract')
+        .mockResolvedValueOnce(clixmlGarbage)
+        .mockResolvedValueOnce(realToken)
+
+      // when
+      const results = await (winExtractor as any).extractFromCookiesDB()
+
+      // then: garbage was rejected, loop continued to the real token
+      expect(copyAndExtractSpy).toHaveBeenCalledTimes(2)
+      expect(results).toEqual([{ token: realToken, accountType: 'work', accountTypeKnown: true }])
+
+      getPathsSpy.mockRestore()
+      copyAndExtractSpy.mockRestore()
+      cleanup()
+    })
+
+    // Regression for #163: browser-sourced tokens carry accountTypeKnown=false so that
+    // the auth command can probe both endpoints. The extraction loop must preserve the
+    // flag and must not dedupe an unknown-type browser token by its guessed accountType.
+    it('propagates accountTypeKnown=false for browser-sourced tokens', async () => {
+      // given: a browser Cookies path returning a valid token, guessed as work
+      const browserPath = join(workDir, 'Chrome', 'Default', 'Cookies')
+      mkdirSync(join(workDir, 'Chrome', 'Default'), { recursive: true })
+      writeFileSync(browserPath, '')
+
+      const winExtractor = new TeamsTokenExtractor('win32')
+      const getPathsSpy = spyOn(winExtractor, 'getTeamsCookiesPaths').mockReturnValue([
+        { path: browserPath, accountType: 'work', accountTypeKnown: false },
+      ])
+      const copyAndExtractSpy = spyOn(winExtractor as any, 'copyAndExtract').mockResolvedValue(mockToken)
+
+      // when
+      const results = await (winExtractor as any).extractFromCookiesDB()
+
+      // then: the flag is passed through so callers can probe
+      expect(results).toEqual([{ token: mockToken, accountType: 'work', accountTypeKnown: false }])
+
+      getPathsSpy.mockRestore()
+      copyAndExtractSpy.mockRestore()
+      cleanup()
+    })
+
+    // Regression for #163: when a desktop path (known=true) for 'work' already succeeded,
+    // a subsequent browser path (known=false) guessed as 'work' must still be explored —
+    // it might be a personal account misguessed as work. The dedup only kicks in for
+    // confidently labeled paths.
+    it('does not skip unknown-type path just because a known-type same-label succeeded', async () => {
+      const desktopPath = join(workDir, 'WV2Profile_tfw', 'Network', 'Cookies')
+      const browserPath = join(workDir, 'Chrome', 'Default', 'Cookies')
+      mkdirSync(join(workDir, 'WV2Profile_tfw', 'Network'), { recursive: true })
+      mkdirSync(join(workDir, 'Chrome', 'Default'), { recursive: true })
+      writeFileSync(desktopPath, '')
+      writeFileSync(browserPath, '')
+
+      const desktopToken = mockToken
+      const browserToken = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJicm93c2VyIn0.different_signature_here_abc'
+
+      const winExtractor = new TeamsTokenExtractor('win32')
+      const getPathsSpy = spyOn(winExtractor, 'getTeamsCookiesPaths').mockReturnValue([
+        { path: desktopPath, accountType: 'work', accountTypeKnown: true },
+        { path: browserPath, accountType: 'work', accountTypeKnown: false },
+      ])
+      const copyAndExtractSpy = spyOn(winExtractor as any, 'copyAndExtract')
+        .mockResolvedValueOnce(desktopToken)
+        .mockResolvedValueOnce(browserToken)
+
+      // when
+      const results = await (winExtractor as any).extractFromCookiesDB()
+
+      // then: both tokens returned; browser token keeps accountTypeKnown=false for probing
+      expect(results).toEqual([
+        { token: desktopToken, accountType: 'work', accountTypeKnown: true },
+        { token: browserToken, accountType: 'work', accountTypeKnown: false },
+      ])
+
+      getPathsSpy.mockRestore()
+      copyAndExtractSpy.mockRestore()
+      cleanup()
+    })
+
+    it('dedupes identical tokens extracted from multiple paths', async () => {
+      const path1 = join(workDir, 'Chrome', 'Default', 'Cookies')
+      const path2 = join(workDir, 'Edge', 'Default', 'Cookies')
+      mkdirSync(join(workDir, 'Chrome', 'Default'), { recursive: true })
+      mkdirSync(join(workDir, 'Edge', 'Default'), { recursive: true })
+      writeFileSync(path1, '')
+      writeFileSync(path2, '')
+
+      const winExtractor = new TeamsTokenExtractor('win32')
+      const getPathsSpy = spyOn(winExtractor, 'getTeamsCookiesPaths').mockReturnValue([
+        { path: path1, accountType: 'work', accountTypeKnown: false },
+        { path: path2, accountType: 'work', accountTypeKnown: false },
+      ])
+      const copyAndExtractSpy = spyOn(winExtractor as any, 'copyAndExtract').mockResolvedValue(mockToken)
+
+      // when
+      const results = await (winExtractor as any).extractFromCookiesDB()
+
+      // then: only one result despite two paths returning the same token
+      expect(results).toHaveLength(1)
+      expect(results[0].token).toBe(mockToken)
 
       getPathsSpy.mockRestore()
       copyAndExtractSpy.mockRestore()
       cleanup()
     })
 
-    test('a missing path does not mark the account type as seen', async () => {
+    it('a missing path does not mark the account type as seen', async () => {
       // given: work account has Cookies missing but Network/Cookies present
       const workProfile = join(workDir, 'WV2Profile_tfw')
       const workNetworkDir = join(workProfile, 'Network')
@@ -394,8 +576,8 @@ describe('TeamsTokenExtractor', () => {
 
       const winExtractor = new TeamsTokenExtractor('win32')
       const getPathsSpy = spyOn(winExtractor, 'getTeamsCookiesPaths').mockReturnValue([
-        { path: workCookies, accountType: 'work' },
-        { path: workNetworkCookies, accountType: 'work' },
+        { path: workCookies, accountType: 'work', accountTypeKnown: true },
+        { path: workNetworkCookies, accountType: 'work', accountTypeKnown: true },
       ])
       const copyAndExtractSpy = spyOn(winExtractor as any, 'copyAndExtract').mockResolvedValue(mockToken)
 
@@ -415,7 +597,7 @@ describe('TeamsTokenExtractor', () => {
   })
 
   describe('copyAndExtract', () => {
-    test('attempts to copy database to temp location', async () => {
+    it('attempts to copy database to temp location', async () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
 
       const copyFileSpy = spyOn(darwinExtractor as any, 'copyDatabaseToTemp').mockReturnValue('/tmp/test-cookies')
@@ -434,7 +616,7 @@ describe('TeamsTokenExtractor', () => {
       cleanupSpy.mockRestore()
     })
 
-    test('returns null when copy fails (file locked)', async () => {
+    it('returns null when copy fails (file locked)', async () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
 
       const copyFileSpy = spyOn(darwinExtractor as any, 'copyDatabaseToTemp').mockImplementation(() => {
@@ -451,7 +633,7 @@ describe('TeamsTokenExtractor', () => {
 
   describe('decryption', () => {
     describe('decryptAESGCM', () => {
-      test('returns null for invalid encrypted data', () => {
+      it('returns null for invalid encrypted data', () => {
         const darwinExtractor = new TeamsTokenExtractor('darwin')
         const invalidData = Buffer.from('too_short')
         const key = Buffer.alloc(32, 0)
@@ -460,7 +642,7 @@ describe('TeamsTokenExtractor', () => {
         expect(result).toBeNull()
       })
 
-      test('returns null when decryption fails', () => {
+      it('returns null when decryption fails', () => {
         const darwinExtractor = new TeamsTokenExtractor('darwin')
         const fakeEncrypted = Buffer.concat([
           Buffer.from('v10'),
@@ -476,7 +658,7 @@ describe('TeamsTokenExtractor', () => {
     })
 
     describe('getKeychainPassword (macOS)', () => {
-      test('tries multiple keychain variants', async () => {
+      it('tries multiple keychain variants', async () => {
         const darwinExtractor = new TeamsTokenExtractor('darwin')
         const execSyncSpy = spyOn(darwinExtractor as any, 'execSecurityCommand')
           .mockReturnValueOnce(null)
@@ -490,7 +672,7 @@ describe('TeamsTokenExtractor', () => {
         execSyncSpy.mockRestore()
       })
 
-      test('returns null when all keychain variants fail', async () => {
+      it('returns null when all keychain variants fail', async () => {
         const darwinExtractor = new TeamsTokenExtractor('darwin')
         const execSyncSpy = spyOn(darwinExtractor as any, 'execSecurityCommand').mockReturnValue(null)
 
@@ -505,7 +687,7 @@ describe('TeamsTokenExtractor', () => {
 
   describe('process management', () => {
     describe('isTeamsRunning', () => {
-      test('returns true when Teams process is found', async () => {
+      it('returns true when Teams process is found', async () => {
         const darwinExtractor = new TeamsTokenExtractor('darwin')
         const checkProcessRunningSpy = spyOn(darwinExtractor as any, 'checkProcessRunning').mockReturnValue(true)
 
@@ -515,7 +697,7 @@ describe('TeamsTokenExtractor', () => {
         checkProcessRunningSpy.mockRestore()
       })
 
-      test('returns false when no Teams process is found', async () => {
+      it('returns false when no Teams process is found', async () => {
         const darwinExtractor = new TeamsTokenExtractor('darwin')
         const checkProcessRunningSpy = spyOn(darwinExtractor as any, 'checkProcessRunning').mockReturnValue(false)
 
@@ -527,17 +709,17 @@ describe('TeamsTokenExtractor', () => {
     })
 
     describe('getProcessName', () => {
-      test('returns correct process name for macOS', () => {
+      it('returns correct process name for macOS', () => {
         const darwinExtractor = new TeamsTokenExtractor('darwin')
         expect((darwinExtractor as any).getProcessName()).toBe('Microsoft Teams')
       })
 
-      test('returns correct process name for Windows', () => {
+      it('returns correct process name for Windows', () => {
         const winExtractor = new TeamsTokenExtractor('win32')
         expect((winExtractor as any).getProcessName()).toBe('Teams.exe')
       })
 
-      test('returns correct process name for Linux', () => {
+      it('returns correct process name for Linux', () => {
         const linuxExtractor = new TeamsTokenExtractor('linux')
         expect((linuxExtractor as any).getProcessName()).toBe('teams')
       })
@@ -545,7 +727,7 @@ describe('TeamsTokenExtractor', () => {
   })
 
   describe('SQLite extraction', () => {
-    test('returns null when database path does not exist', async () => {
+    it('returns null when database path does not exist', async () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
 
       const result = await (darwinExtractor as any).extractFromSQLite('/nonexistent/path')
@@ -553,7 +735,7 @@ describe('TeamsTokenExtractor', () => {
       expect(result).toBeNull()
     })
 
-    test('returns null when extraction throws', async () => {
+    it('returns null when extraction throws', async () => {
       const darwinExtractor = new TeamsTokenExtractor('darwin')
 
       const result = await (darwinExtractor as any).extractFromSQLite('/dev/null')