agent-messenger 2.10.1 → 2.11.0

package/src/shared/chromium/browsers.ts

@@ -1,6 +1,6 @@
-import { existsSync, readdirSync } from 'node:fs'
+import { existsSync, readdirSync, readFileSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { join } from 'node:path'
+import { dirname, isAbsolute, join, resolve } from 'node:path'
 
 import type { BrowserConfig, KeychainVariant } from './types'
 
@@ -39,6 +39,17 @@ export const BROWSER_KEYCHAIN_VARIANTS: KeychainVariant[] = [
   { service: 'Chromium Safe Storage', account: 'Chromium' },
 ]
 
+interface AgentBrowserProfileDiscoveryOptions {
+  cwd?: string
+  env?: NodeJS.ProcessEnv
+  homeDir?: string
+  customProfileDirs?: string[]
+}
+
+type AgentBrowserConfig = {
+  profile?: unknown
+}
+
 export function getBrowserBasePath(browser: BrowserConfig, platform: NodeJS.Platform): string | null {
   let relative: string
   switch (platform) {
@@ -70,10 +81,41 @@ export function discoverBrowserProfileDirs(browserBase: string): string[] {
       if (!/^Profile \d+$/i.test(entry.name)) continue
       dirs.push(join(browserBase, entry.name))
     }
-  } catch {}
+  } catch {
+    return dirs
+  }
   return dirs
 }
 
+export function getAgentBrowserProfileDirs(options: AgentBrowserProfileDiscoveryOptions = {}): string[] {
+  const cwd = options.cwd ?? process.cwd()
+  const env = options.env ?? process.env
+  const homeDir = options.homeDir ?? homedir()
+  if (env.AGENT_MESSENGER_DISABLE_AGENT_BROWSER_PROFILE_DISCOVERY === '1') return []
+
+  const profileDirs: string[] = []
+
+  for (const profileDir of options.customProfileDirs ?? []) {
+    addAgentBrowserProfileDir(profileDirs, profileDir, cwd)
+  }
+
+  addAgentBrowserProfileDir(profileDirs, env.AGENT_BROWSER_PROFILE, cwd)
+
+  const configPaths = [
+    join(homeDir, '.agent-browser', 'config.json'),
+    join(cwd, 'agent-browser.json'),
+    env.AGENT_BROWSER_CONFIG,
+  ]
+
+  for (const configPath of configPaths) {
+    if (!configPath) continue
+    const config = readAgentBrowserConfig(configPath)
+    addAgentBrowserProfileDir(profileDirs, config?.profile, dirname(configPath))
+  }
+
+  return dedupePaths(profileDirs.flatMap((profileDir) => [profileDir, ...discoverBrowserProfileDirs(profileDir)]))
+}
+
 export function findLocalStatePath(cookieOrProfilePath: string): string | null {
   const parts = cookieOrProfilePath.split(/[/\\]/)
   for (let levels = 2; levels <= 4; levels++) {
@@ -84,3 +126,30 @@ export function findLocalStatePath(cookieOrProfilePath: string): string | null {
   }
   return null
 }
+
+function readAgentBrowserConfig(configPath: string): AgentBrowserConfig | null {
+  if (!existsSync(configPath)) return null
+  try {
+    const parsed = JSON.parse(readFileSync(configPath, 'utf8')) as unknown
+    if (!parsed || typeof parsed !== 'object') return null
+    return parsed as AgentBrowserConfig
+  } catch {
+    return null
+  }
+}
+
+function addAgentBrowserProfileDir(dirs: string[], profile: unknown, baseDir: string): void {
+  if (typeof profile !== 'string' || profile.length === 0) return
+  dirs.push(isAbsolute(profile) ? profile : resolve(baseDir, profile))
+}
+
+function dedupePaths(paths: string[]): string[] {
+  const seen = new Set<string>()
+  const result: string[] = []
+  for (const path of paths) {
+    if (seen.has(path)) continue
+    seen.add(path)
+    result.push(path)
+  }
+  return result
+}

package/src/shared/chromium/cli-options.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'bun:test'
+
+import { collectBrowserProfileOption } from './cli-options'
+
+describe('collectBrowserProfileOption', () => {
+  it('collects repeated browser profile options', () => {
+    // when
+    const first = collectBrowserProfileOption('/tmp/profile-a')
+    const second = collectBrowserProfileOption('/tmp/profile-b', first)
+
+    // then
+    expect(second).toEqual(['/tmp/profile-a', '/tmp/profile-b'])
+  })
+
+  it('splits comma-separated browser profile options', () => {
+    // when
+    const profiles = collectBrowserProfileOption('/tmp/profile-a, /tmp/profile-b,,')
+
+    // then
+    expect(profiles).toEqual(['/tmp/profile-a', '/tmp/profile-b'])
+  })
+})

package/src/shared/chromium/cli-options.ts

@@ -0,0 +1,12 @@
+export interface BrowserProfileOption {
+  browserProfile?: string[]
+}
+
+export function collectBrowserProfileOption(value: string, previous: string[] = []): string[] {
+  const paths = value
+    .split(',')
+    .map((path) => path.trim())
+    .filter((path) => path.length > 0)
+
+  return [...previous, ...paths]
+}

package/src/shared/chromium/cookie-reader.test.ts

@@ -1,5 +1,5 @@
 import { Database } from 'bun:sqlite'
-import { afterEach, describe, expect, test } from 'bun:test'
+import { afterEach, describe, expect, it } from 'bun:test'
 import { existsSync, mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -31,7 +31,7 @@ describe('ChromiumCookieReader', () => {
   })
 
   describe('queryAll', () => {
-    test('returns all matching rows from a real SQLite database', async () => {
+    it('returns all matching rows from a real SQLite database', async () => {
       // given
       const tempDir = mkdtempSync(join(tmpdir(), 'chromium-cookie-reader-'))
       tempDirs.push(tempDir)
@@ -55,7 +55,7 @@ describe('ChromiumCookieReader', () => {
       ])
     })
 
-    test('returns empty array when database file does not exist', async () => {
+    it('returns empty array when database file does not exist', async () => {
       // given
       const tempDir = mkdtempSync(join(tmpdir(), 'chromium-cookie-reader-'))
       tempDirs.push(tempDir)
@@ -69,7 +69,7 @@ describe('ChromiumCookieReader', () => {
       expect(result).toEqual([])
     })
 
-    test('returns empty array when query matches no rows', async () => {
+    it('returns empty array when query matches no rows', async () => {
       // given
       const tempDir = mkdtempSync(join(tmpdir(), 'chromium-cookie-reader-'))
       tempDirs.push(tempDir)
@@ -86,7 +86,7 @@ describe('ChromiumCookieReader', () => {
       expect(result).toEqual([])
     })
 
-    test('supports parameterized queries with params', async () => {
+    it('supports parameterized queries with params', async () => {
       // given
       const tempDir = mkdtempSync(join(tmpdir(), 'chromium-cookie-reader-'))
       tempDirs.push(tempDir)
@@ -108,7 +108,7 @@ describe('ChromiumCookieReader', () => {
       expect(result).toEqual([{ name: 'token', value: 'xyz789' }])
     })
 
-    test('cleans up temp file after query', async () => {
+    it('cleans up temp file after query', async () => {
       // given
       const tempDir = mkdtempSync(join(tmpdir(), 'chromium-cookie-reader-'))
       tempDirs.push(tempDir)
@@ -135,7 +135,7 @@ describe('ChromiumCookieReader', () => {
   })
 
   describe('queryFirst', () => {
-    test('returns first matching row from a real SQLite database', async () => {
+    it('returns first matching row from a real SQLite database', async () => {
       // given
       const tempDir = mkdtempSync(join(tmpdir(), 'chromium-cookie-reader-'))
       tempDirs.push(tempDir)
@@ -156,7 +156,7 @@ describe('ChromiumCookieReader', () => {
       expect(result).toEqual({ name: 'session', value: 'abc123' })
     })
 
-    test('returns null when database file does not exist', async () => {
+    it('returns null when database file does not exist', async () => {
       // given
       const tempDir = mkdtempSync(join(tmpdir(), 'chromium-cookie-reader-'))
       tempDirs.push(tempDir)
@@ -170,7 +170,7 @@ describe('ChromiumCookieReader', () => {
       expect(result).toBeNull()
     })
 
-    test('returns null when query matches no rows', async () => {
+    it('returns null when query matches no rows', async () => {
       // given
       const tempDir = mkdtempSync(join(tmpdir(), 'chromium-cookie-reader-'))
       tempDirs.push(tempDir)
@@ -187,7 +187,7 @@ describe('ChromiumCookieReader', () => {
       expect(result).toBeNull()
     })
 
-    test('supports parameterized queries with params', async () => {
+    it('supports parameterized queries with params', async () => {
       // given
       const tempDir = mkdtempSync(join(tmpdir(), 'chromium-cookie-reader-'))
       tempDirs.push(tempDir)
@@ -211,7 +211,7 @@ describe('ChromiumCookieReader', () => {
   })
 
   describe('edge cases', () => {
-    test('handles multiple calls to same reader instance', async () => {
+    it('handles multiple calls to same reader instance', async () => {
       // given
       const tempDir = mkdtempSync(join(tmpdir(), 'chromium-cookie-reader-'))
       tempDirs.push(tempDir)
@@ -241,7 +241,7 @@ describe('ChromiumCookieReader', () => {
       expect(firstRow).toEqual({ name: 'token', value: 'xyz789' })
     })
 
-    test('returns empty array for malformed SQL without throwing', async () => {
+    it('returns empty array for malformed SQL without throwing', async () => {
       // given
       const tempDir = mkdtempSync(join(tmpdir(), 'chromium-cookie-reader-'))
       tempDirs.push(tempDir)
@@ -256,7 +256,7 @@ describe('ChromiumCookieReader', () => {
       expect(result).toEqual([])
     })
 
-    test('returns null for malformed SQL without throwing', async () => {
+    it('returns null for malformed SQL without throwing', async () => {
       // given
       const tempDir = mkdtempSync(join(tmpdir(), 'chromium-cookie-reader-'))
       tempDirs.push(tempDir)

package/src/shared/chromium/decryptor.test.ts

@@ -1,4 +1,4 @@
-import { beforeEach, describe, expect, spyOn, test } from 'bun:test'
+import { beforeEach, describe, expect, spyOn, it } from 'bun:test'
 import { createCipheriv, pbkdf2Sync, randomBytes } from 'node:crypto'
 
 import * as linuxKeyring from '@/shared/utils/linux-keyring'
@@ -29,7 +29,7 @@ describe('ChromiumCookieDecryptor', () => {
   })
 
   describe('constructor', () => {
-    test('prepends appKeychainVariants before browser variants', () => {
+    it('prepends appKeychainVariants before browser variants', () => {
       // given
       const appVariants = [{ service: 'App Safe Storage', account: 'App' }]
 
@@ -40,7 +40,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect((decryptor as any).keychainVariants).toEqual([...appVariants, ...BROWSER_KEYCHAIN_VARIANTS])
     })
 
-    test('uses only browser variants when no appKeychainVariants provided', () => {
+    it('uses only browser variants when no appKeychainVariants provided', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'darwin' })
 
@@ -50,7 +50,7 @@ describe('ChromiumCookieDecryptor', () => {
   })
 
   describe('isEncryptedValue', () => {
-    test('returns true for v10 prefix with sufficient length', () => {
+    it('returns true for v10 prefix with sufficient length', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
 
@@ -61,7 +61,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect(result).toBe(true)
     })
 
-    test('returns true for v11 prefix with sufficient length', () => {
+    it('returns true for v11 prefix with sufficient length', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
 
@@ -72,7 +72,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect(result).toBe(true)
     })
 
-    test('returns false for non-v10/v11 prefix', () => {
+    it('returns false for non-v10/v11 prefix', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
 
@@ -83,7 +83,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect(result).toBe(false)
     })
 
-    test('returns false for too-short buffer (< 4 bytes)', () => {
+    it('returns false for too-short buffer (< 4 bytes)', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
 
@@ -94,7 +94,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect(result).toBe(false)
     })
 
-    test('returns false for null/empty buffer', () => {
+    it('returns false for null/empty buffer', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
 
@@ -105,7 +105,7 @@ describe('ChromiumCookieDecryptor', () => {
   })
 
   describe('decryptAESCBC / decryptAESCBCRaw', () => {
-    test('decrypts v10-prefixed AES-128-CBC data with correct key', () => {
+    it('decrypts v10-prefixed AES-128-CBC data with correct key', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
       const encrypted = encryptAESCBC('test-value', peanutsKey)
@@ -117,7 +117,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect(result).toBe('test-value')
     })
 
-    test('returns null with wrong key', () => {
+    it('returns null with wrong key', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
       const encrypted = encryptAESCBC('test-value', peanutsKey)
@@ -130,7 +130,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect(result).toBeNull()
     })
 
-    test('returns null for corrupted ciphertext', () => {
+    it('returns null for corrupted ciphertext', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
       const encrypted = encryptAESCBC('test-value', peanutsKey)
@@ -144,7 +144,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect(result).toBeNull()
     })
 
-    test('decryptAESCBC returns string, decryptAESCBCRaw returns Buffer', () => {
+    it('decryptAESCBC returns string, decryptAESCBCRaw returns Buffer', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
       const encrypted = encryptAESCBC('test-value', peanutsKey)
@@ -160,7 +160,7 @@ describe('ChromiumCookieDecryptor', () => {
   })
 
   describe('decryptAESGCM / decryptAESGCMRaw', () => {
-    test('decrypts v10-prefixed AES-256-GCM data with correct key', () => {
+    it('decrypts v10-prefixed AES-256-GCM data with correct key', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'win32' })
       const masterKey = randomBytes(32)
@@ -173,7 +173,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect(result).toBe('test-value')
     })
 
-    test('returns null with wrong key', () => {
+    it('returns null with wrong key', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'win32' })
       const masterKey = randomBytes(32)
@@ -186,7 +186,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect(result).toBeNull()
     })
 
-    test('returns null for data shorter than minimum length (3+12+16 = 31 bytes)', () => {
+    it('returns null for data shorter than minimum length (3+12+16 = 31 bytes)', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'win32' })
 
@@ -197,7 +197,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect(result).toBeNull()
     })
 
-    test('decryptAESGCM returns string, decryptAESGCMRaw returns Buffer', () => {
+    it('decryptAESGCM returns string, decryptAESGCMRaw returns Buffer', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'win32' })
       const masterKey = randomBytes(32)
@@ -214,7 +214,7 @@ describe('ChromiumCookieDecryptor', () => {
   })
 
   describe('decryptCookie / decryptCookieRaw', () => {
-    test('returns plaintext for non-encrypted values (no v10/v11 prefix)', () => {
+    it('returns plaintext for non-encrypted values (no v10/v11 prefix)', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
       const plaintext = Buffer.from('plain-cookie')
@@ -228,7 +228,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect(rawResult).toEqual(plaintext)
     })
 
-    test('dispatches to Linux decryption for linux platform with v10 prefix', () => {
+    it('dispatches to Linux decryption for linux platform with v10 prefix', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
       const encrypted = Buffer.from('v10cookie')
@@ -242,7 +242,7 @@ describe('ChromiumCookieDecryptor', () => {
       spy.mockRestore()
     })
 
-    test('returns null for unsupported platform (e.g. freebsd)', () => {
+    it('returns null for unsupported platform (e.g. freebsd)', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'freebsd' as NodeJS.Platform })
 
@@ -253,7 +253,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect(result).toBeNull()
     })
 
-    test('decryptCookie returns string, decryptCookieRaw returns Buffer', () => {
+    it('decryptCookie returns string, decryptCookieRaw returns Buffer', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
       const encrypted = encryptAESCBC('test-value', peanutsKey)
@@ -269,7 +269,7 @@ describe('ChromiumCookieDecryptor', () => {
   })
 
   describe('decryptLinuxCookieRaw', () => {
-    test('decrypts v10-prefixed cookie using peanuts key (known key, verifiable)', () => {
+    it('decrypts v10-prefixed cookie using peanuts key (known key, verifiable)', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
       const encrypted = encryptAESCBC('linux-cookie', peanutsKey)
@@ -281,7 +281,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect(result).toEqual(Buffer.from('linux-cookie'))
     })
 
-    test('falls back to peanuts key for v11 when no keyring app names configured', () => {
+    it('falls back to peanuts key for v11 when no keyring app names configured', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
       const encrypted = encryptAESCBC('linux-v11-cookie', peanutsKey, 'v11')
@@ -295,7 +295,7 @@ describe('ChromiumCookieDecryptor', () => {
   })
 
   describe('decryptDPAPI', () => {
-    test('returns null on non-win32 platforms', () => {
+    it('returns null on non-win32 platforms', () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
 
@@ -307,8 +307,73 @@ describe('ChromiumCookieDecryptor', () => {
     })
   })
 
+  describe('extractDPAPIPayload', () => {
+    it('extracts payload wrapped in markers', () => {
+      // given
+      const b64 = Buffer.from('hello').toString('base64')
+      const stdout = `<<<B64>>>${b64}<<<END>>>\r\n`
+
+      // when
+      const result = ChromiumCookieDecryptor.extractDPAPIPayload(stdout)
+
+      // then
+      expect(result).toBe(b64)
+    })
+
+    it('strips CLIXML progress-stream contamination before the payload', () => {
+      // given: PowerShell emits CLIXML on first module auto-load
+      const b64 = Buffer.from('secret-token').toString('base64')
+      const stdout =
+        '#< CLIXML\r\n' +
+        '<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04">' +
+        '<Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T>' +
+        '<T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record">' +
+        '<AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC>' +
+        '<T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj></Objs>' +
+        `<<<B64>>>${b64}<<<END>>>\r\n`
+
+      // when
+      const result = ChromiumCookieDecryptor.extractDPAPIPayload(stdout)
+
+      // then
+      expect(result).toBe(b64)
+    })
+
+    it('tolerates whitespace and line breaks inside the payload', () => {
+      // given
+      const b64 = Buffer.from('hello').toString('base64')
+      const chunked = b64.slice(0, 3) + '\r\n' + b64.slice(3)
+      const stdout = `<<<B64>>>${chunked}<<<END>>>`
+
+      // when
+      const result = ChromiumCookieDecryptor.extractDPAPIPayload(stdout)
+
+      // then
+      expect(result).toBe(b64)
+    })
+
+    it('returns null when markers are missing', () => {
+      // given: stdout contains only CLIXML noise, no real payload
+      const stdout = '#< CLIXML\r\n<Objs></Objs>\r\n'
+
+      // when
+      const result = ChromiumCookieDecryptor.extractDPAPIPayload(stdout)
+
+      // then
+      expect(result).toBeNull()
+    })
+
+    it('returns null when payload between markers is empty', () => {
+      // when
+      const result = ChromiumCookieDecryptor.extractDPAPIPayload('<<<B64>>><<<END>>>')
+
+      // then
+      expect(result).toBeNull()
+    })
+  })
+
   describe('stripIntegrityHash', () => {
-    test('returns input unchanged when length <= 32', () => {
+    it('returns input unchanged when length <= 32', () => {
       // given
       const decrypted = Buffer.alloc(32, 0x41)
 
@@ -319,7 +384,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect(result).toEqual(decrypted)
     })
 
-    test('strips first 32 bytes when they contain non-printable characters', () => {
+    it('strips first 32 bytes when they contain non-printable characters', () => {
       // given
       const hash = Buffer.concat([Buffer.from([0x00, 0x1f, 0xff]), Buffer.alloc(29, 0x01)])
       const value = Buffer.from('cookie-value')
@@ -331,7 +396,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect(result).toEqual(value)
     })
 
-    test('returns input unchanged when first 32 bytes are all printable ASCII', () => {
+    it('returns input unchanged when first 32 bytes are all printable ASCII', () => {
       // given
       const printablePrefix = Buffer.from('12345678901234567890123456789012')
       const decrypted = Buffer.concat([printablePrefix, Buffer.from('cookie-value')])
@@ -343,7 +408,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect(result).toEqual(decrypted)
     })
 
-    test('correctly strips binary hash prefix followed by readable cookie value', () => {
+    it('correctly strips binary hash prefix followed by readable cookie value', () => {
       // given
       const hash = randomBytes(32)
       const value = Buffer.from('readable-cookie-value')
@@ -355,7 +420,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect(result).toEqual(value)
     })
 
-    test('handles non-printable bytes that would be mangled by UTF-8 conversion (the v130+ fix)', () => {
+    it('handles non-printable bytes that would be mangled by UTF-8 conversion (the v130+ fix)', () => {
       // given
       const binaryPrefix = Buffer.from([
         ...Array.from({ length: 16 }, (_, i) => i),
@@ -372,7 +437,7 @@ describe('ChromiumCookieDecryptor', () => {
   })
 
   describe('loadCachedKey / clearKeyCache', () => {
-    test('loadCachedKey is no-op on non-darwin platform', async () => {
+    it('loadCachedKey is no-op on non-darwin platform', async () => {
       // given
       const keyCache = {
         get: async () => Buffer.from('should-not-be-used'),
@@ -392,7 +457,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect((decryptor as any).usedCachedKey).toBe(false)
     })
 
-    test('loadCachedKey is no-op when no keyCache configured', async () => {
+    it('loadCachedKey is no-op when no keyCache configured', async () => {
       // given
       const decryptor = new ChromiumCookieDecryptor({ platform: 'darwin', keyCachePlatform: 'slack' })
 
@@ -404,7 +469,7 @@ describe('ChromiumCookieDecryptor', () => {
       expect((decryptor as any).usedCachedKey).toBe(false)
     })
 
-    test('clearKeyCache resets cached key state', async () => {
+    it('clearKeyCache resets cached key state', async () => {
       // given
       const clear = async () => {}
       const keyCache = { get: async () => null, clear }
@@ -426,7 +491,7 @@ describe('ChromiumCookieDecryptor', () => {
   })
 
   describe('linux v11 keyring behavior', () => {
-    test('uses configured keyring password before falling back', () => {
+    it('uses configured keyring password before falling back', () => {
       // given
       const password = 'secret-from-keyring'
       const key = pbkdf2Sync(password, 'saltysalt', 1, 16, 'sha1')

package/src/shared/chromium/decryptor.ts

@@ -187,22 +187,43 @@ export class ChromiumCookieDecryptor {
     if (this.platform !== 'win32') return null
     try {
       const b64Input = encrypted.toString('base64')
+      // Silence progress/information/warning streams so PowerShell doesn't emit CLIXML
+      // ("#< CLIXML ...") alongside our base64 payload when modules auto-load on first use.
+      // Wrap the payload in explicit markers so we can recover it even if stray output leaks in.
       const script = [
+        "$ProgressPreference='SilentlyContinue'",
+        "$InformationPreference='SilentlyContinue'",
+        "$WarningPreference='SilentlyContinue'",
         'Add-Type -AssemblyName System.Security',
         `$d=[System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String("${b64Input}"),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)`,
-        '[Convert]::ToBase64String($d)',
+        "Write-Host ('<<<B64>>>'+[Convert]::ToBase64String($d)+'<<<END>>>')",
       ].join(';')
       const encodedCommand = Buffer.from(script, 'utf16le').toString('base64')
-      const result = execSync(`powershell -NoProfile -NonInteractive -EncodedCommand ${encodedCommand}`, {
-        encoding: 'utf8',
-        timeout: 10000,
-      }).trim()
-      return Buffer.from(result, 'base64')
+      const rawResult = execSync(
+        `powershell -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand ${encodedCommand}`,
+        { encoding: 'utf8', timeout: 10000 },
+      )
+      const b64 = ChromiumCookieDecryptor.extractDPAPIPayload(rawResult)
+      if (!b64) return null
+      return Buffer.from(b64, 'base64')
     } catch {
       return null
     }
   }
 
+  /**
+   * Extract the base64-encoded DPAPI payload from PowerShell stdout, stripping any
+   * CLIXML progress-stream contamination or other stray output. Returns null if
+   * no valid payload is found.
+   */
+  static extractDPAPIPayload(stdout: string): string | null {
+    const match = stdout.match(/<<<B64>>>([A-Za-z0-9+/=\r\n]*)<<<END>>>/)
+    if (!match) return null
+    const b64 = match[1].replace(/\s+/g, '')
+    if (!b64) return null
+    return b64
+  }
+
   static stripIntegrityHash(decrypted: Buffer): Buffer {
     if (decrypted.length <= 32) return decrypted
     const hasNonPrintablePrefix = decrypted.subarray(0, 32).some((b) => b < 0x20 || b > 0x7e)

package/src/shared/chromium/index.ts

@@ -4,8 +4,11 @@ export {
   CHROMIUM_BROWSERS,
   discoverBrowserProfileDirs,
   findLocalStatePath,
+  getAgentBrowserProfileDirs,
   getBrowserBasePath,
 } from './browsers'
 export { ChromiumCookieDecryptor } from './decryptor'
 export type { ChromiumDecryptorOptions } from './decryptor'
 export { ChromiumCookieReader } from './cookie-reader'
+export { collectBrowserProfileOption } from './cli-options'
+export type { BrowserProfileOption } from './cli-options'