agent-messenger 2.6.3 → 2.8.0

package/src/platforms/instagram/credential-manager.ts

@@ -2,12 +2,8 @@ import { existsSync } from 'node:fs'
 import { mkdir, readFile, rm, writeFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
-import {
-  createAccountId,
-  type InstagramAccount,
-  type InstagramAccountPaths,
-  type InstagramConfig,
-} from './types'
+
+import { createAccountId, type InstagramAccount, type InstagramAccountPaths, type InstagramConfig } from './types'
 
 export class InstagramCredentialManager {
   private configDir: string

package/src/platforms/instagram/ensure-auth.test.ts

@@ -26,10 +26,7 @@ const validPaths = {
 beforeEach(() => {
   getAccountSpy = spyOn(InstagramCredentialManager.prototype, 'getAccount').mockResolvedValue(null)
 
-  getAccountPathsSpy = spyOn(
-    InstagramCredentialManager.prototype,
-    'getAccountPaths',
-  ).mockReturnValue(validPaths)
+  getAccountPathsSpy = spyOn(InstagramCredentialManager.prototype, 'getAccountPaths').mockReturnValue(validPaths)
 
   existsSyncSpy = spyOn(fs, 'existsSync').mockReturnValue(false)
 

package/src/platforms/instagram/ensure-auth.ts

@@ -68,8 +68,11 @@ export async function ensureInstagramAuth(): Promise<void> {
     }
   } catch {}
 
-  console.log(formatOutput({
-    error: 'Not authenticated. Run "agent-instagram auth extract" to extract from browser, or "agent-instagram auth login --username <username>" to log in.',
-  }))
+  console.log(
+    formatOutput({
+      error:
+        'Not authenticated. Run "agent-instagram auth extract" to extract from browser, or "agent-instagram auth login --username <username>" to log in.',
+    }),
+  )
   process.exit(1)
 }

package/src/platforms/instagram/listener.test.ts

@@ -1,4 +1,4 @@
-import { afterEach, beforeEach, describe, expect, spyOn, test } from 'bun:test'
+import { afterEach, describe, expect, spyOn, test } from 'bun:test'
 
 import { InstagramListener } from '@/platforms/instagram/listener'
 import type { InstagramChatSummary } from '@/platforms/instagram/types'
@@ -106,7 +106,9 @@ describe('InstagramListener', () => {
     listener = new InstagramListener(client, { pollInterval: 60_000 })
 
     let called = false
-    const handler = () => { called = true }
+    const handler = () => {
+      called = true
+    }
     listener.on('disconnected', handler)
     listener.off('disconnected', handler)
     listener.stop()
@@ -119,7 +121,9 @@ describe('InstagramListener', () => {
     listener = new InstagramListener(client, { pollInterval: 60_000 })
 
     let count = 0
-    listener.once('connected', () => { count++ })
+    listener.once('connected', () => {
+      count++
+    })
 
     await listener.start()
     listener.stop()

package/src/platforms/instagram/token-extractor.test.ts

@@ -182,10 +182,7 @@ describe('InstagramTokenExtractor', () => {
       const getBrowserCookiesPathsSpy = spyOn(linuxExtractor, 'getBrowserCookiesPaths').mockReturnValue([
         '/fake/path/Cookies',
       ])
-      const existsSyncSpy = spyOn(
-        await import('node:fs'),
-        'existsSync',
-      ).mockReturnValue(true)
+      const existsSyncSpy = spyOn(await import('node:fs'), 'existsSync').mockReturnValue(true)
       const copyAndExtractSpy = spyOn(linuxExtractor as any, 'copyAndExtract').mockResolvedValue(mockCookies)
 
       const result = await linuxExtractor.extract()
@@ -208,10 +205,7 @@ describe('InstagramTokenExtractor', () => {
         '/fake/path1/Cookies',
         '/fake/path2/Cookies',
       ])
-      const existsSyncSpy = spyOn(
-        await import('node:fs'),
-        'existsSync',
-      ).mockReturnValue(true)
+      const existsSyncSpy = spyOn(await import('node:fs'), 'existsSync').mockReturnValue(true)
       const copyAndExtractSpy = spyOn(darwinExtractor as any, 'copyAndExtract')
         .mockResolvedValueOnce(null)
         .mockResolvedValueOnce(mockCookies)
@@ -242,10 +236,7 @@ describe('InstagramTokenExtractor', () => {
         '/fake/profile1/Cookies',
         '/fake/profile2/Cookies',
       ])
-      const existsSyncSpy = spyOn(
-        await import('node:fs'),
-        'existsSync',
-      ).mockReturnValue(true)
+      const existsSyncSpy = spyOn(await import('node:fs'), 'existsSync').mockReturnValue(true)
       const copyAndExtractSpy = spyOn(linuxExtractor as any, 'copyAndExtract')
         .mockResolvedValueOnce(mockCookies1)
         .mockResolvedValueOnce(mockCookies2)
@@ -272,10 +263,7 @@ describe('InstagramTokenExtractor', () => {
         '/fake/profile1/Cookies',
         '/fake/profile2/Cookies',
       ])
-      const existsSyncSpy = spyOn(
-        await import('node:fs'),
-        'existsSync',
-      ).mockReturnValue(true)
+      const existsSyncSpy = spyOn(await import('node:fs'), 'existsSync').mockReturnValue(true)
       const copyAndExtractSpy = spyOn(linuxExtractor as any, 'copyAndExtract').mockResolvedValue(mockCookies)
 
       const result = await linuxExtractor.extract()

package/src/platforms/instagram/token-extractor.ts

@@ -1,13 +1,17 @@
 import { execSync } from 'node:child_process'
-import { createDecipheriv, pbkdf2Sync } from 'node:crypto'
-import { copyFileSync, existsSync, readFileSync, readdirSync, unlinkSync } from 'node:fs'
-import { createRequire } from 'node:module'
-import { homedir, tmpdir } from 'node:os'
+import { existsSync } from 'node:fs'
 import { join } from 'node:path'
 
-import { DerivedKeyCache } from '@/shared/utils/derived-key-cache'
-
-const require = createRequire(import.meta.url)
+import {
+  BROWSER_KEYCHAIN_VARIANTS,
+  CHROMIUM_BROWSERS,
+  ChromiumCookieDecryptor,
+  ChromiumCookieReader,
+  discoverBrowserProfileDirs,
+  findLocalStatePath,
+  getBrowserBasePath,
+} from '@/shared/chromium'
+import type { KeychainVariant } from '@/shared/chromium'
 
 export interface ExtractedInstagramCookies {
   sessionid: string
@@ -18,95 +22,30 @@ export interface ExtractedInstagramCookies {
   rur?: string
 }
 
-interface BrowserConfig {
-  name: string
-  darwin: string
-  linux: string
-  win32: string
-  localStateDarwin?: string
-  localStateLinux?: string
-  localStateWin32?: string
-}
-
-interface KeychainVariant {
-  service: string
-  account: string
-}
-
-const BROWSERS: BrowserConfig[] = [
-  {
-    name: 'Chrome',
-    darwin: join('Google', 'Chrome'),
-    linux: 'google-chrome',
-    win32: join('Google', 'Chrome', 'User Data'),
-  },
-  {
-    name: 'Chrome Canary',
-    darwin: join('Google', 'Chrome Canary'),
-    linux: 'google-chrome-unstable',
-    win32: join('Google', 'Chrome SxS', 'User Data'),
-  },
-  {
-    name: 'Edge',
-    darwin: 'Microsoft Edge',
-    linux: 'microsoft-edge',
-    win32: join('Microsoft', 'Edge', 'User Data'),
-  },
-  {
-    name: 'Arc',
-    darwin: join('Arc', 'User Data'),
-    linux: '',
-    win32: join('Arc', 'User Data'),
-  },
-  {
-    name: 'Brave',
-    darwin: join('BraveSoftware', 'Brave-Browser'),
-    linux: join('BraveSoftware', 'Brave-Browser'),
-    win32: join('BraveSoftware', 'Brave-Browser', 'User Data'),
-  },
-  {
-    name: 'Vivaldi',
-    darwin: 'Vivaldi',
-    linux: 'vivaldi',
-    win32: join('Vivaldi', 'User Data'),
-  },
-  {
-    name: 'Chromium',
-    darwin: 'Chromium',
-    linux: 'chromium',
-    win32: join('Chromium', 'User Data'),
-  },
-]
-
 const INSTAGRAM_HOST_KEYS = ['.instagram.com', 'www.instagram.com', 'i.instagram.com']
 const INSTAGRAM_COOKIE_NAMES = ['sessionid', 'ds_user_id', 'csrftoken', 'mid', 'ig_did', 'rur']
 
 export class InstagramTokenExtractor {
   private platform: NodeJS.Platform
   private debugLog: ((message: string) => void) | null
-  private cachedKey: Buffer | null = null
+  private decryptor: ChromiumCookieDecryptor
+  private cookieReader: ChromiumCookieReader
 
-  constructor(
-    platform?: NodeJS.Platform,
-    debugLog?: (message: string) => void,
-    _keyCache?: DerivedKeyCache,
-  ) {
+  constructor(platform?: NodeJS.Platform, debugLog?: (message: string) => void) {
     this.platform = platform ?? process.platform
     this.debugLog = debugLog ?? null
-  }
-
-  private debug(message: string): void {
-    this.debugLog?.(message)
+    this.decryptor = new ChromiumCookieDecryptor({ platform: this.platform })
+    this.cookieReader = new ChromiumCookieReader()
   }
 
   getBrowserCookiesPaths(): string[] {
     const paths: string[] = []
 
-    for (const browser of BROWSERS) {
-      const browserBase = this.getBrowserBasePath(browser)
+    for (const browser of CHROMIUM_BROWSERS) {
+      const browserBase = getBrowserBasePath(browser, this.platform)
       if (!browserBase) continue
 
-      const profileDirs = this.discoverProfileDirs(browserBase)
+      const profileDirs = discoverBrowserProfileDirs(browserBase)
       for (const profileDir of profileDirs) {
         paths.push(join(profileDir, 'Cookies'))
         paths.push(join(profileDir, 'Network', 'Cookies'))
@@ -119,8 +58,8 @@ export class InstagramTokenExtractor {
   getLocalStatePaths(): string[] {
     const paths: string[] = []
 
-    for (const browser of BROWSERS) {
-      const browserBase = this.getBrowserBasePath(browser)
+    for (const browser of CHROMIUM_BROWSERS) {
+      const browserBase = getBrowserBasePath(browser, this.platform)
       if (!browserBase) continue
 
       paths.push(join(browserBase, 'Local State'))
@@ -129,65 +68,12 @@ export class InstagramTokenExtractor {
     return paths
   }
 
-  private getBrowserBasePath(browser: BrowserConfig): string | null {
-    let relative: string
-
-    switch (this.platform) {
-      case 'darwin':
-        relative = browser.darwin
-        if (!relative) return null
-        return join(homedir(), 'Library', 'Application Support', relative)
-      case 'linux':
-        relative = browser.linux
-        if (!relative) return null
-        return join(homedir(), '.config', relative)
-      case 'win32':
-        relative = browser.win32
-        if (!relative) return null
-        return join(
-          process.env.LOCALAPPDATA || join(homedir(), 'AppData', 'Local'),
-          relative,
-        )
-      default:
-        return null
-    }
-  }
-
-  private discoverProfileDirs(browserBase: string): string[] {
-    const dirs: string[] = []
-
-    dirs.push(join(browserBase, 'Default'))
-
-    if (!existsSync(browserBase)) return dirs
-
-    try {
-      const entries = readdirSync(browserBase, { withFileTypes: true })
-      for (const entry of entries) {
-        if (!entry.isDirectory()) continue
-        if (!/^Profile \d+$/i.test(entry.name)) continue
-        dirs.push(join(browserBase, entry.name))
-      }
-    } catch {}
-
-    return dirs
-  }
-
   getKeychainVariants(): KeychainVariant[] {
-    return [
-      { service: 'Chrome Safe Storage', account: 'Chrome' },
-      { service: 'Chrome Canary Safe Storage', account: 'Chrome Canary' },
-      { service: 'Microsoft Edge Safe Storage', account: 'Microsoft Edge' },
-      { service: 'Arc Safe Storage', account: 'Arc' },
-      { service: 'Brave Safe Storage', account: 'Brave' },
-      { service: 'Vivaldi Safe Storage', account: 'Vivaldi' },
-      { service: 'Chromium Safe Storage', account: 'Chromium' },
-    ]
+    return BROWSER_KEYCHAIN_VARIANTS
   }
 
   isEncryptedValue(value: Buffer): boolean {
-    if (!value || value.length < 4) return false
-    const prefix = value.subarray(0, 3).toString('utf8')
-    return prefix === 'v10' || prefix === 'v11'
+    return this.decryptor.isEncryptedValue(value)
   }
 
   isValidSessionId(sessionid: string): boolean {
@@ -219,39 +105,30 @@ export class InstagramTokenExtractor {
     return results
   }
 
+  private debug(message: string): void {
+    this.debugLog?.(message)
+  }
+
   private async copyAndExtract(dbPath: string): Promise<ExtractedInstagramCookies | null> {
-    const tempPath = join(tmpdir(), `instagram-cookies-${Date.now()}`)
+    let tempPath = dbPath
 
     try {
-      this.copyDatabaseToTemp(dbPath, tempPath)
-      const cookies = await this.extractFromSQLite(tempPath, dbPath)
-      this.cleanupTempFile(tempPath)
-      return cookies
+      tempPath = this.copyDatabaseToTemp(dbPath, dbPath)
+      return await this.extractFromSQLite(tempPath, dbPath)
     } catch {
-      this.cleanupTempFile(tempPath)
       return null
+    } finally {
+      this.cleanupTempFile(tempPath)
     }
   }
 
-  private copyDatabaseToTemp(sourcePath: string, destPath: string): string {
-    copyFileSync(sourcePath, destPath)
-    return destPath
+  private copyDatabaseToTemp(sourcePath: string, _destPath: string): string {
+    return sourcePath
   }
 
-  private cleanupTempFile(tempPath: string): void {
-    try {
-      if (existsSync(tempPath)) {
-        unlinkSync(tempPath)
-      }
-    } catch {
-      // Ignore cleanup errors
-    }
-  }
+  private cleanupTempFile(_tempPath: string): void {}
 
-  private async extractFromSQLite(
-    dbPath: string,
-    originalPath: string,
-  ): Promise<ExtractedInstagramCookies | null> {
+  private async extractFromSQLite(dbPath: string, originalPath: string): Promise<ExtractedInstagramCookies | null> {
     try {
       const placeholders = INSTAGRAM_HOST_KEYS.map(() => '?').join(', ')
       const sql = `
@@ -262,18 +139,8 @@ export class InstagramTokenExtractor {
 
       type CookieRow = { name: string; value?: string; encrypted_value?: Uint8Array | Buffer }
 
-      let rows: CookieRow[]
-      if (typeof globalThis.Bun !== 'undefined') {
-        const { Database } = require('bun:sqlite')
-        const db = new Database(dbPath, { readonly: true })
-        rows = db.query(sql).all(...INSTAGRAM_HOST_KEYS) as CookieRow[]
-        db.close()
-      } else {
-        const Database = require('better-sqlite3')
-        const db = new Database(dbPath, { readonly: true })
-        rows = db.prepare(sql).all(...INSTAGRAM_HOST_KEYS) as CookieRow[]
-        db.close()
-      }
+      const rows = await this.cookieReader.queryAll<CookieRow>(dbPath, sql, INSTAGRAM_HOST_KEYS)
+      const localStatePath = findLocalStatePath(originalPath) ?? undefined
 
       const cookieMap: Record<string, string> = {}
       for (const row of rows) {
@@ -281,14 +148,14 @@ export class InstagramTokenExtractor {
 
         let value = ''
         if (row.encrypted_value && row.encrypted_value.length > 0) {
-          const encBuf = Buffer.from(row.encrypted_value)
-          if (this.isEncryptedValue(encBuf)) {
-            const decrypted = this.decryptCookie(encBuf, originalPath)
-            if (decrypted) {
-              value = decrypted
+          const encryptedValue = Buffer.from(row.encrypted_value)
+          if (this.decryptor.isEncryptedValue(encryptedValue)) {
+            const decryptedBuf = this.decryptor.decryptCookieRaw(encryptedValue, localStatePath)
+            if (decryptedBuf) {
+              value = ChromiumCookieDecryptor.stripIntegrityHash(decryptedBuf).toString('utf8')
             }
           } else {
-            value = encBuf.toString('utf8')
+            value = encryptedValue.toString('utf8')
           }
         } else if (row.value) {
           value = row.value
@@ -323,91 +190,14 @@ export class InstagramTokenExtractor {
     }
   }
 
-  private decryptCookie(encryptedValue: Buffer, dbPath: string): string | null {
-    if (!this.isEncryptedValue(encryptedValue)) {
-      return encryptedValue.toString('utf8')
-    }
-
-    if (this.platform === 'win32') {
-      return this.decryptWindowsCookie(encryptedValue, dbPath)
-    } else if (this.platform === 'darwin') {
-      return this.decryptMacCookie(encryptedValue)
-    } else if (this.platform === 'linux') {
-      return this.decryptLinuxCookie(encryptedValue)
-    }
-
-    return null
-  }
-
-  private decryptWindowsCookie(encryptedData: Buffer, dbPath: string): string | null {
-    try {
-      const localStatePath = this.findLocalStateForCookiePath(dbPath)
-      if (!localStatePath || !existsSync(localStatePath)) return null
-
-      const localState = JSON.parse(readFileSync(localStatePath, 'utf8'))
-      const encryptedKey = Buffer.from(localState.os_crypt.encrypted_key, 'base64')
-      const dpapiBlobKey = encryptedKey.subarray(5)
-      const masterKey = this.decryptDPAPI(dpapiBlobKey)
-      if (!masterKey) return null
-
-      return this.decryptAESGCM(encryptedData, masterKey)
-    } catch {
-      return null
-    }
-  }
-
-  private findLocalStateForCookiePath(cookiePath: string): string | null {
-    const parts = cookiePath.split(/[/\\]/)
-    for (let levels = 2; levels <= 4; levels++) {
-      if (parts.length < levels) break
-      const base = parts.slice(0, parts.length - levels).join('/')
-      const candidate = join(base, 'Local State')
-      if (existsSync(candidate)) return candidate
-    }
-    return null
-  }
-
-  private decryptDPAPI(encryptedBlob: Buffer): Buffer | null {
-    try {
-      const b64 = encryptedBlob.toString('base64')
-      const psScript = `
-        Add-Type -AssemblyName System.Security
-        $bytes = [Convert]::FromBase64String('${b64}')
-        $decrypted = [Security.Cryptography.ProtectedData]::Unprotect($bytes, $null, 'CurrentUser')
-        [Convert]::ToBase64String($decrypted)
-      `.replace(/\n/g, ' ')
-
-      const result = execSync(`powershell -Command "${psScript}"`, { encoding: 'utf8' })
-      return Buffer.from(result.trim(), 'base64')
-    } catch {
-      return null
-    }
-  }
-
-  private decryptMacCookie(encryptedData: Buffer): string | null {
-    if (this.cachedKey) {
-      const decrypted = this.decryptAESCBC(encryptedData, this.cachedKey)
-      if (decrypted) return decrypted
-    }
-
-    for (const variant of this.getKeychainVariants()) {
-      const password = this.execSecurityCommand(variant.service, variant.account)
-      if (!password) continue
-
-      const key = pbkdf2Sync(password, 'saltysalt', 1003, 16, 'sha1')
-      const decrypted = this.decryptAESCBC(encryptedData, key)
-      if (decrypted) {
-        this.cachedKey = key
-        return decrypted
-      }
-    }
-
-    return null
+  private decryptAESCBC(encryptedData: Buffer, key: Buffer): string | null {
+    const buf = this.decryptor.decryptAESCBCRaw(encryptedData, key)
+    if (!buf) return null
+    return ChromiumCookieDecryptor.stripIntegrityHash(buf).toString('utf8')
   }
 
-  private decryptLinuxCookie(encryptedData: Buffer): string | null {
-    const key = pbkdf2Sync('peanuts', 'saltysalt', 1, 16, 'sha1')
-    return this.decryptAESCBC(encryptedData, key)
+  private decryptAESGCM(encryptedData: Buffer, key: Buffer): string | null {
+    return this.decryptor.decryptAESGCM(encryptedData, key)
   }
 
   private getKeychainPassword(): string | null {
@@ -415,6 +205,7 @@ export class InstagramTokenExtractor {
       const password = this.execSecurityCommand(variant.service, variant.account)
       if (password) return password
     }
+
     return null
   }
 
@@ -422,55 +213,10 @@ export class InstagramTokenExtractor {
     try {
       const safeService = service.replace(/"/g, '\\"')
       const safeAccount = account.replace(/"/g, '\\"')
-      const result = execSync(
-        `security find-generic-password -s "${safeService}" -a "${safeAccount}" -w 2>/dev/null`,
-        { encoding: 'utf8' },
-      )
-      return result.trim()
-    } catch {
-      return null
-    }
-  }
-
-  private decryptAESCBC(encryptedData: Buffer, key: Buffer): string | null {
-    try {
-      const ciphertext = encryptedData.subarray(3)
-      const iv = Buffer.alloc(16, 0x20)
-
-      const decipher = createDecipheriv('aes-128-cbc', key, iv)
-      decipher.setAutoPadding(true)
-
-      const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()])
-
-      // Chromium v130+ prepends a 32-byte integrity hash before the actual cookie value.
-      // Detect by checking if the first bytes contain non-printable characters.
-      if (decrypted.length > 32) {
-        const hasNonPrintablePrefix = decrypted.subarray(0, 32).some((b) => b < 0x20 || b > 0x7e)
-        if (hasNonPrintablePrefix) {
-          return decrypted.subarray(32).toString('utf8')
-        }
-      }
-
-      return decrypted.toString('utf8')
-    } catch {
-      return null
-    }
-  }
-
-  private decryptAESGCM(encryptedData: Buffer, key: Buffer): string | null {
-    try {
-      // Format: v10 (3 bytes) + IV (12 bytes) + ciphertext + auth tag (16 bytes)
-      if (encryptedData.length < 3 + 12 + 16) return null
-
-      const iv = encryptedData.subarray(3, 15)
-      const authTag = encryptedData.subarray(-16)
-      const ciphertext = encryptedData.subarray(15, -16)
-
-      const decipher = createDecipheriv('aes-256-gcm', key, iv)
-      decipher.setAuthTag(authTag)
-
-      const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()])
-      return decrypted.toString('utf8')
+      const result = execSync(`security find-generic-password -s "${safeService}" -a "${safeAccount}" -w 2>/dev/null`, {
+        encoding: 'utf8',
+      })
+      return result.trim() || null
     } catch {
       return null
     }

package/src/platforms/instagram/types.test.ts

@@ -1,10 +1,6 @@
 import { describe, expect, it } from 'bun:test'
-import {
-  InstagramError,
-  createAccountId,
-  extractMessageText,
-  getMessageType,
-} from './types'
+
+import { InstagramError, createAccountId, extractMessageText, getMessageType } from './types'
 
 describe('createAccountId', () => {
   it('normalizes plain username', () => {

package/src/platforms/instagram/types.ts

@@ -83,8 +83,10 @@ export function getMessageType(item: Record<string, unknown>): string {
   switch (itemType) {
     case 'clip':
     case 'felix_share':
-    case 'reel_share': return 'reel_share'
-    default: return itemType
+    case 'reel_share':
+      return 'reel_share'
+    default:
+      return itemType
   }
 }