agent-messenger 2.5.0 → 2.6.0

package/skills/agent-kakaotalk/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-kakaotalk
 description: Interact with KakaoTalk - send messages, read chats, manage conversations
-version: 2.5.0
+version: 2.6.0
 allowed-tools: Bash(agent-kakaotalk:*)
 metadata:
   openclaw:
@@ -16,7 +16,7 @@ metadata:
 
 # Agent KakaoTalk
 
-A TypeScript CLI tool that enables AI agents and humans to interact with KakaoTalk through a simple command interface. Features credential extraction from the KakaoTalk desktop app and sub-device login that keeps your desktop app running.
+A TypeScript CLI tool that enables AI agents and humans to interact with KakaoTalk through a simple command interface. Features sub-device login that keeps your desktop app running.
 
 ## Key Concepts
 
@@ -32,12 +32,9 @@ Before diving in, a few things about KakaoTalk's architecture:
 ## Quick Start
 
 ```bash
-# Login (recommended — registers as sub-device, desktop app stays running)
+# Login (registers as sub-device, desktop app stays running)
 agent-kakaotalk auth login
 
-# Or extract credentials from desktop app (kicks desktop session)
-agent-kakaotalk auth extract
-
 # List chat rooms
 agent-kakaotalk chat list
 
@@ -53,10 +50,6 @@ agent-kakaotalk whoami
 
 ## Authentication
 
-KakaoTalk offers two authentication methods:
-
-### Method 1: Login (Recommended)
-
 Registers the CLI as a sub-device (tablet slot by default). Your desktop app keeps running.
 
 ```bash
@@ -77,18 +70,7 @@ agent-kakaotalk auth login --email user@example.com --password mypass
 3. The CLI polls until you confirm on your phone
 4. Login completes automatically after confirmation
 
-**IMPORTANT**: NEVER guide the user to open a web browser, use DevTools, or manually copy tokens. Always use `agent-kakaotalk auth login` or `agent-kakaotalk auth extract`.
-
-### Method 2: Extract from Desktop App
-
-Extracts OAuth tokens directly from the KakaoTalk desktop app's cache. This **kicks the desktop session** because it reuses the desktop's credentials.
-
-```bash
-agent-kakaotalk auth extract
-agent-kakaotalk auth extract --debug
-```
-
-On macOS, reads from `~/Library/Containers/com.kakao.KakaoTalkMac/Data/Library/Caches/Cache.db`. On Windows, reads from the registry and `%LocalAppData%\Kakao\login_list.dat`.
+**IMPORTANT**: NEVER guide the user to open a web browser, use DevTools, or manually copy tokens. Always use `agent-kakaotalk auth login`.
 
 ### Agent Behavior (MANDATORY)
 
@@ -102,21 +84,13 @@ agent-kakaotalk auth status
 
 If authenticated → retry the original command.
 
-**Step 2: Try credential extraction first**
-
-```bash
-agent-kakaotalk auth extract
-```
-
-If extraction succeeds → retry the original command. Extraction is silent and requires no user input.
-
-**Step 3: If extraction fails, use login flow**
+**Step 2: Login (registers as sub-device — desktop app stays running)**
 
 ```bash
 agent-kakaotalk auth login
 ```
 
-The CLI will auto-extract the email from the desktop app. On fresh installs, the CLI may prompt for the KakaoTalk password once (one-time device registration). After registration, the password is never needed again.
+The CLI auto-extracts the email (and password if available) from the desktop app. On fresh installs, the CLI may prompt for the KakaoTalk password once (one-time device registration). After registration, the password is never needed again.
 
 Possible responses:
 
@@ -134,7 +108,7 @@ agent-kakaotalk auth login --password-file /tmp/.kakao-pw
 
 The `--password-file` flag reads the password from the file and **deletes the file immediately after reading**. The password never appears in chat, shell history, or process list.
 
-**Step 4: Retry the original command**
+**Step 3: Retry the original command**
 After successful auth, immediately execute whatever the user originally asked for.
 
 ### Device Slots
@@ -157,7 +131,7 @@ agent-kakaotalk auth login --device-type tablet --force
 
 ## Multi-Account
 
-KakaoTalk supports multiple accounts. Each login or extraction stores credentials separately, keyed by user ID.
+KakaoTalk supports multiple accounts. Each login stores credentials separately, keyed by user ID.
 
 ### Listing Accounts
 
@@ -262,11 +236,6 @@ agent-kakaotalk auth login --email <email> --password <password>
 agent-kakaotalk auth login --device-type pc --force
 agent-kakaotalk auth login --debug
 
-# Extract credentials from KakaoTalk desktop app
-agent-kakaotalk auth extract
-agent-kakaotalk auth extract --debug
-agent-kakaotalk auth extract --unsafely-show-secrets
-
 # Check auth status
 agent-kakaotalk auth status
 
@@ -434,7 +403,7 @@ All commands return consistent error format:
 
 Common errors:
 
-- `No KakaoTalk credentials found` — not authenticated. Run `auth login` or `auth extract`.
+- `No KakaoTalk credentials found` — not authenticated. Run `auth login`.
 - `bad_credentials` — wrong email or password. Cached credentials from the desktop app may be stale. Ask the user to provide credentials manually with `--email` and `--password`.
 - `login_failed` — device slot conflict or unknown login error. Run with `--debug` for the full server response.
 - `passcode_request_failed` — failed to request device verification code.
@@ -519,7 +488,7 @@ See the [KakaoTalk SDK documentation](https://agent-messenger.dev/docs/sdk/kakao
 
 ## Limitations
 
-- macOS and Windows only (desktop app required for credential extraction)
+- macOS and Windows only (desktop app needed for auto-extracting email/password during login)
 - No Linux support (KakaoTalk desktop not available on Linux)
 - No file upload or download
 - No channel/chat room creation or management
@@ -555,17 +524,9 @@ pnpm dlx --package agent-messenger agent-kakaotalk chat list --pretty
 
 **NEVER run `npx agent-kakaotalk`, `bunx agent-kakaotalk`, or `pnpm dlx agent-kakaotalk`** without `--package agent-messenger`. It will fail or install a wrong package since `agent-kakaotalk` is not the npm package name.
 
-### No credentials found
-
-If `auth extract` fails:
-
-1. Make sure the KakaoTalk desktop app is installed and you're logged in
-2. Run `agent-kakaotalk auth extract --debug` for detailed diagnostics
-3. If extraction still fails, use `agent-kakaotalk auth login` instead (recommended)
-
 ### Password prompt on fresh install
 
-On fresh installs, the macOS desktop app hashes the password before caching, so the CLI cannot extract it automatically. The CLI will prompt for the password once to register the device. After registration, the password is never needed again.
+On fresh installs, the desktop app (macOS or Windows) may hash or omit the password from its cache, so the CLI cannot extract it automatically. The CLI will prompt for the password once to register the device — via a native dialog on macOS (AppKit) and Windows (PowerShell WinForms), or via a TTY prompt if a terminal is available. After registration, the password is never needed again.
 
 When the CLI returns `{"next_action": "run_interactive", ...}`, use a tmux session to let the user type their password securely. See "Handling `run_interactive`" above for the exact steps.
 
@@ -597,19 +558,6 @@ If the passcode expires before you confirm on your phone:
 2. Confirm the code on your phone within the time limit
 3. The CLI automatically completes login after confirmation
 
-### Cache.db not found (macOS)
-
-The CLI looks for KakaoTalk's cache at:
-
-```
-~/Library/Containers/com.kakao.KakaoTalkMac/Data/Library/Caches/Cache.db
-```
-
-If this file doesn't exist:
-1. Install KakaoTalk from the Mac App Store
-2. Log in and send at least one message (to populate the cache)
-3. Run `agent-kakaotalk auth extract` again
-
 ## References
 
 - [Authentication Guide](references/authentication.md)

package/skills/agent-kakaotalk/references/authentication.md

@@ -2,12 +2,9 @@
 
 ## Overview
 
-agent-kakaotalk supports two authentication methods:
+agent-kakaotalk authenticates by registering the CLI as a sub-device (tablet or PC slot) using KakaoTalk's Android sub-device API. Your desktop app and phone keep running.
 
-1. **Login** (recommended) — registers the CLI as a sub-device (tablet or PC slot). Your desktop app and phone keep running.
-2. **Extract** — reads OAuth tokens from the KakaoTalk desktop app's local cache. This reuses the desktop's credentials, which kicks the desktop session.
-
-## Method 1: Login Flow
+## Login Flow
 
 ### How It Works
 
@@ -107,65 +104,6 @@ Each device is identified by a UUID. The CLI generates one on first login and re
 
 The UUID is stored in the credentials file alongside the OAuth token.
 
-## Method 2: Extract from Desktop App
-
-### How It Works
-
-The KakaoTalk desktop app (macOS) caches HTTP requests in a SQLite database (`Cache.db`). These cached requests contain:
-
-- `Authorization` header with the OAuth token
-- Login form body with email, password, and device UUID
-- Refresh token from token renewal requests
-
-The CLI reads this cache and stores the extracted credentials.
-
-### macOS
-
-```bash
-agent-kakaotalk auth extract
-```
-
-Cache location:
-```
-~/Library/Containers/com.kakao.KakaoTalkMac/Data/Library/Caches/Cache.db
-```
-
-The CLI:
-1. Copies `Cache.db` (and WAL/SHM journals) to a temp directory
-2. Queries for requests to `talk-pilsner.kakao.com` (messaging API)
-3. Parses binary plist blobs for the OAuth token
-4. Extracts device UUID and refresh token from `login.json` / `renew_token.json` cached requests
-5. Stores extracted credentials
-
-### Windows
-
-```bash
-agent-kakaotalk auth extract
-```
-
-The CLI reads from:
-- Registry: `HKCU\Software\Kakao\KakaoTalk\DeviceInfo` (device UUID)
-- File: `%LocalAppData%\Kakao\login_list.dat` (login credentials)
-
-### Troubleshooting Extraction
-
-Use `--debug` for detailed logs:
-
-```bash
-agent-kakaotalk auth extract --debug
-```
-
-This shows:
-- Which cache path was found
-- How many cached requests were discovered
-- Which tokens were successfully extracted
-
-Use `--unsafely-show-secrets` to see full token values (debug mode only):
-
-```bash
-agent-kakaotalk auth extract --unsafely-show-secrets
-```
-
 ## Credential Storage
 
 ### Location
@@ -237,13 +175,13 @@ Output when not authenticated:
 
 ```json
 {
-  "error": "No account configured. Run \"auth login\" or \"auth extract\" first."
+  "error": "No account configured. Run \"auth login\" first."
 }
 ```
 
 ## Multi-Account
 
-KakaoTalk supports multiple accounts. Each login or extraction stores credentials separately, keyed by user ID.
+KakaoTalk supports multiple accounts. Each login stores credentials separately, keyed by user ID.
 
 ### Listing Accounts
 
@@ -316,9 +254,6 @@ If commands start failing with auth errors:
 # Try login again (reuses saved device UUID to skip passcode)
 agent-kakaotalk auth login
 
-# Or re-extract from desktop app
-agent-kakaotalk auth extract
-
 # Verify it worked
 agent-kakaotalk auth status
 ```

package/skills/agent-kakaotalk/references/common-patterns.md

@@ -391,6 +391,19 @@ try {
 }
 ```
 
+When passing credentials manually, include `deviceType` to control which session slot the LOCO connection uses:
+
+```typescript
+const client = await new KakaoTalkClient().login({
+  oauthToken: 'token',
+  userId: '1234567890',
+  deviceUuid: 'uuid',
+  deviceType: 'tablet', // 'tablet' (default, safe) or 'pc' (kicks desktop app)
+})
+```
+
+The `deviceType` determines the LOCO protocol identity: `'tablet'` sends `os: 'android'` (tablet sub-device slot), while `'pc'` sends `os: 'mac'` on macOS or `os: 'win'` on Windows (PC slot, conflicts with the desktop app). When using auto-login (`.login()` with no arguments), `deviceType` is read from stored credentials automatically.
+
 ### Auto-Reconnect
 
 `getChats`, `getMessages`, and `sendMessage` automatically reconnect once when the LOCO session dies (e.g. the KakaoTalk desktop app reclaims the session or the network drops). The reconnect is transparent — callers don't need to handle session-drop errors.

package/skills/agent-line/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-line
 description: Interact with LINE - send messages, read chats, manage conversations
-version: 2.5.0
+version: 2.6.0
 allowed-tools: Bash(agent-line:*)
 metadata:
   openclaw:

package/skills/agent-slack/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-slack
 description: Interact with Slack workspaces - send messages, read channels, manage reactions
-version: 2.5.0
+version: 2.6.0
 allowed-tools: Bash(agent-slack:*)
 metadata:
   openclaw:

package/skills/agent-slackbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-slackbot
 description: Interact with Slack workspaces using bot tokens - send messages, read channels, manage reactions
-version: 2.5.0
+version: 2.6.0
 allowed-tools: Bash(agent-slackbot:*)
 metadata:
   openclaw:

package/skills/agent-teams/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-teams
 description: Interact with Microsoft Teams - send messages, read channels, manage reactions
-version: 2.5.0
+version: 2.6.0
 allowed-tools: Bash(agent-teams:*)
 metadata:
   openclaw:

package/skills/agent-telegram/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-telegram
 description: Interact with Telegram through TDLib - authenticate, inspect chats, and send messages
-version: 2.5.0
+version: 2.6.0
 allowed-tools: Bash(agent-telegram:*)
 ---
 

package/skills/agent-webex/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-webex
 description: Interact with Cisco Webex - send messages, read spaces, manage memberships
-version: 2.5.0
+version: 2.6.0
 allowed-tools: Bash(agent-webex:*)
 metadata:
   openclaw:

package/skills/agent-wechatbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-wechatbot
 description: Interact with WeChat Official Account using API credentials - send messages, manage templates, list followers
-version: 2.5.0
+version: 2.6.0
 allowed-tools: Bash(agent-wechatbot:*)
 metadata:
   openclaw:

package/skills/agent-whatsapp/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-whatsapp
 description: Interact with WhatsApp - send messages, read chats, manage conversations
-version: 2.5.0
+version: 2.6.0
 allowed-tools: Bash(agent-whatsapp:*)
 metadata:
   openclaw:

package/skills/agent-whatsappbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-whatsappbot
 description: Interact with WhatsApp using Cloud API credentials - send messages, manage templates
-version: 2.5.0
+version: 2.6.0
 allowed-tools: Bash(agent-whatsappbot:*)
 metadata:
   openclaw:

package/src/platforms/kakaotalk/client.ts

@@ -6,10 +6,10 @@ import { join } from 'node:path'
 
 import { warn } from '@/shared/utils/stderr'
 
-import { APP_VERSION, LANG, OS } from './protocol/config'
+import { LANG, PC_OS_NAME, getLocoDeviceConfig } from './protocol/config'
 import { LocoSession } from './protocol/session'
 import type { ChatListResponse, LoginListResponse, SyncState } from './protocol/types'
-import type { KakaoChat, KakaoMessage, KakaoProfile, KakaoSendResult } from './types'
+import type { KakaoChat, KakaoDeviceType, KakaoMessage, KakaoProfile, KakaoSendResult } from './types'
 
 export class KakaoTalkError extends Error {
   code: string
@@ -231,12 +231,13 @@ export class KakaoTalkClient {
   private oauthToken: string | null = null
   private userId: string | null = null
   private deviceUuid: string | null = null
+  private deviceType: KakaoDeviceType = 'tablet'
   private state: SessionState | null = null
   private initPromise: Promise<SessionState> | null = null
   private closed = false
 
   async login(
-    credentials?: { oauthToken: string; userId: string; deviceUuid?: string },
+    credentials?: { oauthToken: string; userId: string; deviceUuid?: string; deviceType?: KakaoDeviceType },
     accountId?: string,
   ): Promise<this> {
     if (credentials) {
@@ -245,19 +246,26 @@ export class KakaoTalkClient {
       this.oauthToken = credentials.oauthToken
       this.userId = credentials.userId
       this.deviceUuid = credentials.deviceUuid ?? `agent-messenger-${credentials.userId}`
+      this.deviceType = credentials.deviceType ?? 'tablet'
       return this
     }
     const { ensureKakaoAuth } = await import('./ensure-auth')
     const account = await ensureKakaoAuth(accountId)
-    return this.login({ oauthToken: account.oauth_token, userId: account.user_id, deviceUuid: account.device_uuid })
+    return this.login({
+      oauthToken: account.oauth_token,
+      userId: account.user_id,
+      deviceUuid: account.device_uuid,
+      deviceType: account.device_type,
+    })
   }
 
-  getCredentials(): { oauthToken: string; userId: string; deviceUuid: string } {
+  getCredentials(): { oauthToken: string; userId: string; deviceUuid: string; deviceType: KakaoDeviceType } {
     this.ensureAuth()
     return {
       oauthToken: this.oauthToken!,
       userId: this.userId!,
       deviceUuid: this.deviceUuid!,
+      deviceType: this.deviceType,
     }
   }
 
@@ -315,7 +323,7 @@ export class KakaoTalkClient {
     const session = new LocoSession()
     try {
       const syncState = await loadSyncState(this.deviceUuid!)
-      const loginResult = await session.login(this.oauthToken!, this.userId!, this.deviceUuid!, syncState)
+      const loginResult = await session.login(this.oauthToken!, this.userId!, this.deviceUuid!, syncState, this.deviceType)
 
       const newSyncState = mergeSyncState(syncState, loginResult)
       await saveSyncState(this.deviceUuid!, newSyncState)
@@ -500,17 +508,24 @@ export class KakaoTalkClient {
   async getProfile(): Promise<KakaoProfile> {
     this.ensureAuth()
     try {
+      const deviceConfig = getLocoDeviceConfig(this.deviceType)
+      const isPC = deviceConfig.os !== 'android'
+      const apiPrefix = isPC ? 'mac' : 'android'
+      const userAgent = isPC
+        ? `KT/${deviceConfig.appVersion} Md/${PC_OS_NAME} ${LANG}`
+        : `KT/${deviceConfig.appVersion} An/13 ${LANG}`
+
       const headers = {
         Authorization: `${this.oauthToken}-${this.deviceUuid}`,
-        A: `${OS}/${APP_VERSION}/${LANG}`,
-        'User-Agent': `KT/${APP_VERSION} Md/macOS ${LANG}`,
+        A: `${deviceConfig.os}/${deviceConfig.appVersion}/${LANG}`,
+        'User-Agent': userAgent,
         Accept: '*/*',
         'Accept-Language': LANG,
       }
 
       const [profileRes, settingsRes] = await Promise.all([
-        fetch('https://katalk.kakao.com/mac/profile3/me.json', { headers }),
-        fetch('https://katalk.kakao.com/mac/account/more_settings.json?since=0&lang=ko', { headers }),
+        fetch(`https://katalk.kakao.com/${apiPrefix}/profile3/me.json`, { headers }),
+        fetch(`https://katalk.kakao.com/${apiPrefix}/account/more_settings.json?since=0&lang=ko`, { headers }),
       ])
 
       if (!profileRes.ok) {

package/src/platforms/kakaotalk/commands/auth.ts

@@ -6,7 +6,7 @@ import { handleError } from '@/shared/utils/error-handler'
 import { formatOutput } from '@/shared/utils/output'
 import { info, error, debug } from '@/shared/utils/stderr'
 
-import { generateDeviceUuid, loginFlow } from '../auth/kakao-login'
+import { loginFlow } from '../auth/kakao-login'
 import { CredentialManager } from '../credential-manager'
 import { KakaoTokenExtractor } from '../token-extractor'
 import {
@@ -23,7 +23,9 @@ function isInteractiveSession(): boolean {
 function hasTTY(): boolean {
   try {
     const { openSync, closeSync } = require('node:fs') as typeof import('node:fs')
-    const fd = openSync('/dev/tty', 'r')
+    // CONIN$ is the Windows console input device; /dev/tty is the Unix equivalent
+    const ttyDevice = process.platform === 'win32' ? 'CONIN$' : '/dev/tty'
+    const fd = openSync(ttyDevice, 'r')
     closeSync(fd)
     return true
   } catch { return false }
@@ -178,6 +180,20 @@ async function promptHidden(message: string): Promise<string | undefined> {
 }
 
 async function promptHiddenTTY(message: string): Promise<string | undefined> {
+  if (process.platform === 'win32') {
+    const { execSync } = require('node:child_process') as typeof import('node:child_process')
+    try {
+      const escapedMessage = message.replace(/'/g, "''")
+      const ps = `$p = Read-Host '${escapedMessage}' -AsSecureString; [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($p))`
+      const result = execSync(`powershell -NoProfile -Command "${ps}"`, {
+        encoding: 'utf-8',
+        timeout: 120_000,
+        stdio: ['inherit', 'pipe', 'inherit'],
+      })
+      return result.trim() || undefined
+    } catch { return undefined }
+  }
+
   const { createReadStream } = await import('node:fs')
   const { createInterface } = await import('node:readline/promises')
   const ttyIn = createReadStream('/dev/tty')
@@ -277,7 +293,8 @@ async function loginAction(options: KakaoAuthOptions): Promise<void> {
 
     const existing = await credManager.getAccount()
     const pendingState = await credManager.loadPendingLogin()
-    const savedDeviceUuid = pendingState?.device_uuid ?? existing?.device_uuid
+    const existingUuid = existing?.auth_method === 'login' ? existing?.device_uuid : undefined
+    const savedDeviceUuid = pendingState?.device_uuid ?? existingUuid
 
     const onPasscodeDisplay = (code: string) => {
       if (interactive) {
@@ -355,6 +372,7 @@ async function handleLoginResult(
       refresh_token: result.credentials.refresh_token,
       device_uuid: result.credentials.device_uuid,
       device_type: result.credentials.device_type,
+      auth_method: 'login',
       created_at: now,
       updated_at: now,
     })
@@ -372,67 +390,6 @@ async function handleLoginResult(
   }
 }
 
-async function extractAction(options: {
-  pretty?: boolean
-  debug?: boolean
-  unsafelyShowSecrets?: boolean
-}): Promise<void> {
-  try {
-    if (options.unsafelyShowSecrets) {
-      options.debug = true
-    }
-    const debugLog = options.debug ? (msg: string) => debug(`[debug] ${msg}`) : undefined
-    const extractor = new KakaoTokenExtractor(undefined, debugLog)
-
-    const token = await extractor.extract()
-
-    if (!token) {
-      console.log(
-        formatOutput(
-          {
-            error: 'No credentials found. Make sure KakaoTalk desktop app is installed and logged in.',
-            hint: options.debug ? undefined : 'Run with --debug for more info.',
-          },
-          options.pretty,
-        ),
-      )
-      process.exit(1)
-    }
-
-    if (options.debug) {
-      const display = options.unsafelyShowSecrets
-        ? token.oauth_token
-        : `${token.oauth_token.substring(0, 12)}...`
-      debug(`[debug] oauth_token: ${display}`)
-      debug(`[debug] user_id: ${token.user_id}`)
-    }
-
-    const credManager = new CredentialManager()
-    const accountId = token.user_id || 'default'
-    const now = new Date().toISOString()
-
-    await credManager.setAccount({
-      account_id: accountId,
-      oauth_token: token.oauth_token,
-      user_id: token.user_id,
-      refresh_token: token.refresh_token,
-      device_uuid: token.device_uuid ?? generateDeviceUuid(),
-      device_type: 'tablet',
-      created_at: now,
-      updated_at: now,
-    })
-
-    const config = await credManager.load()
-    if (!config.current_account) {
-      await credManager.setCurrentAccount(accountId)
-    }
-
-    console.log(formatOutput({ account_id: accountId, user_id: token.user_id, extracted: true }, options.pretty))
-  } catch (error) {
-    handleError(error as Error)
-  }
-}
-
 async function listAction(options: { pretty?: boolean }): Promise<void> {
   try {
     const credManager = new CredentialManager()
@@ -483,7 +440,7 @@ async function statusAction(options: { account?: string; pretty?: boolean }): Pr
     const account = await credManager.getAccount(options.account)
 
     if (!account) {
-      console.log(formatOutput({ error: 'No account configured. Run "auth login" or "auth extract" first.' }, options.pretty))
+      console.log(formatOutput({ error: 'No account configured. Run "auth login" first.' }, options.pretty))
       process.exit(1)
     }
 
@@ -533,14 +490,6 @@ export const authCommand = new Command('auth')
       .option('--debug', 'Show debug output')
       .action(loginAction),
   )
-  .addCommand(
-    new Command('extract')
-      .description('Extract credentials from KakaoTalk desktop app (kicks desktop session)')
-      .option('--pretty', 'Pretty print JSON output')
-      .option('--debug', 'Show debug output for troubleshooting')
-      .option('--unsafely-show-secrets', 'Show full token values in debug output')
-      .action(extractAction),
-  )
   .addCommand(
     new Command('list')
       .description('List all authenticated KakaoTalk accounts')

package/src/platforms/kakaotalk/credential-manager.ts

@@ -34,6 +34,7 @@ export class KakaoCredentialManager {
 
   async save(config: KakaoConfig): Promise<void> {
     await mkdir(this.configDir, { recursive: true })
+    // TODO: Windows does not honor mode 0o600 — consider platform-specific credential storage
     await writeFile(this.credentialsPath, JSON.stringify(config, null, 2))
     await chmod(this.credentialsPath, 0o600)
   }

package/src/platforms/kakaotalk/index.ts

@@ -4,6 +4,7 @@ export { KakaoTalkListener } from './listener'
 export type { PendingLoginState } from './credential-manager'
 export type {
   KakaoAccountCredentials,
+  KakaoAuthMethod,
   KakaoChat,
   KakaoConfig,
   KakaoDeviceType,

package/src/platforms/kakaotalk/listener.test.ts

@@ -45,7 +45,7 @@ mock.module('./protocol/session', () => ({ LocoSession: MockLocoSession }))
 
 function createMockClient(overrides: Record<string, unknown> = {}) {
   return {
-    getCredentials: mock(() => ({ oauthToken: 'token', userId: 'user1', deviceUuid: 'device1' })),
+    getCredentials: mock(() => ({ oauthToken: 'token', userId: 'user1', deviceUuid: 'device1', deviceType: 'tablet' as const })),
     ...overrides,
   } as any
 }
@@ -68,7 +68,7 @@ describe('KakaoTalkListener', () => {
       await listener.start()
 
       expect(mockLogin).toHaveBeenCalledTimes(1)
-      expect(mockLogin).toHaveBeenCalledWith('token', 'user1', 'device1')
+      expect(mockLogin).toHaveBeenCalledWith('token', 'user1', 'device1', undefined, 'tablet')
     })
 
     test('is idempotent', async () => {