agent-messenger 2.6.3 → 2.8.0

package/src/platforms/slack/commands/channel.ts

@@ -173,10 +173,7 @@ async function usersAction(channel: string, options: { includeBots?: boolean; pr
   }
 }
 
-async function createAction(
-  name: string,
-  options: { private?: boolean; pretty?: boolean },
-): Promise<void> {
+async function createAction(name: string, options: { private?: boolean; pretty?: boolean }): Promise<void> {
   try {
     const credManager = new CredentialManager()
     const workspace = await credManager.getWorkspace()

package/src/platforms/slack/commands/emoji.test.ts

@@ -7,10 +7,12 @@ describe('Emoji Commands', () => {
 
   beforeEach(() => {
     mockClient = {
-      listEmoji: mock(async (): Promise<Record<string, string>> => ({
-        party_blob: 'https://example.com/party_blob.gif',
-        cool_sunglasses: 'https://example.com/cool_sunglasses.png',
-      })),
+      listEmoji: mock(
+        async (): Promise<Record<string, string>> => ({
+          party_blob: 'https://example.com/party_blob.gif',
+          cool_sunglasses: 'https://example.com/cool_sunglasses.png',
+        }),
+      ),
     }
   })
 

package/src/platforms/slack/commands/emoji.ts

@@ -6,28 +6,26 @@ import { formatOutput } from '@/shared/utils/output'
 import { SlackClient } from '../client'
 import { CredentialManager } from '../credential-manager'
 
-export const emojiCommand = new Command('emoji')
-  .description('Emoji commands')
-  .addCommand(
-    new Command('list')
-      .description('List all custom emoji in workspace')
-      .option('--pretty', 'Pretty print JSON output')
-      .action(async (options) => {
-        try {
-          const credManager = new CredentialManager()
-          const ws = await credManager.getWorkspace()
+export const emojiCommand = new Command('emoji').description('Emoji commands').addCommand(
+  new Command('list')
+    .description('List all custom emoji in workspace')
+    .option('--pretty', 'Pretty print JSON output')
+    .action(async (options) => {
+      try {
+        const credManager = new CredentialManager()
+        const ws = await credManager.getWorkspace()
 
-          if (!ws) {
-            console.log(formatOutput({ error: 'No current workspace set. Run "auth extract" first.' }, options.pretty))
-            process.exit(1)
-          }
+        if (!ws) {
+          console.log(formatOutput({ error: 'No current workspace set. Run "auth extract" first.' }, options.pretty))
+          process.exit(1)
+        }
 
-          const client = await new SlackClient().login({ token: ws.token, cookie: ws.cookie })
-          const emoji = await client.listEmoji()
+        const client = await new SlackClient().login({ token: ws.token, cookie: ws.cookie })
+        const emoji = await client.listEmoji()
 
-          console.log(formatOutput(emoji, options.pretty))
-        } catch (error) {
-          handleError(error as Error)
-        }
-      }),
-  )
+        console.log(formatOutput(emoji, options.pretty))
+      } catch (error) {
+        handleError(error as Error)
+      }
+    }),
+)

package/src/platforms/slack/commands/message.ts

@@ -270,7 +270,12 @@ async function scheduleAction(
 
     const postAtTimestamp = Number(postAt)
     if (!Number.isInteger(postAtTimestamp) || postAtTimestamp <= 0) {
-      console.log(formatOutput({ error: 'Invalid post-at value. Use a Unix timestamp in seconds (e.g. 1700000000).' }, options.pretty))
+      console.log(
+        formatOutput(
+          { error: 'Invalid post-at value. Use a Unix timestamp in seconds (e.g. 1700000000).' },
+          options.pretty,
+        ),
+      )
       process.exit(1)
     }
 

package/src/platforms/slack/commands/pin.test.ts

@@ -10,19 +10,21 @@ describe('Pin Commands', () => {
     mockClient = {
       pinMessage: mock(async () => {}),
       unpinMessage: mock(async () => {}),
-      listPins: mock(async (): Promise<SlackPin[]> => [
-        {
-          channel: 'C001',
-          message: {
-            ts: '1234567890.123456',
-            text: 'Pinned message',
-            user: 'U001',
-            type: 'message',
+      listPins: mock(
+        async (): Promise<SlackPin[]> => [
+          {
+            channel: 'C001',
+            message: {
+              ts: '1234567890.123456',
+              text: 'Pinned message',
+              user: 'U001',
+              type: 'message',
+            },
+            date_created: 1234567890,
+            created_by: 'U001',
           },
-          date_created: 1234567890,
-          created_by: 'U001',
-        },
-      ]),
+        ],
+      ),
     }
   })
 

package/src/platforms/slack/commands/reminder.ts

@@ -6,11 +6,7 @@ import { formatOutput } from '@/shared/utils/output'
 import { SlackClient } from '../client'
 import { CredentialManager } from '../credential-manager'
 
-async function addAction(
-  text: string,
-  time: string,
-  options: { user?: string; pretty?: boolean },
-): Promise<void> {
+async function addAction(text: string, time: string, options: { user?: string; pretty?: boolean }): Promise<void> {
   try {
     const credManager = new CredentialManager()
     const ws = await credManager.getWorkspace()
@@ -22,7 +18,12 @@ async function addAction(
 
     const timeValue = Number(time)
     if (!Number.isInteger(timeValue) || timeValue <= 0) {
-      console.log(formatOutput({ error: 'Invalid time value. Use a Unix timestamp in seconds (e.g. 1700000000).' }, options.pretty))
+      console.log(
+        formatOutput(
+          { error: 'Invalid time value. Use a Unix timestamp in seconds (e.g. 1700000000).' },
+          options.pretty,
+        ),
+      )
       process.exit(1)
     }
 

package/src/platforms/slack/commands/user.ts

@@ -174,7 +174,12 @@ export const userCommand = new Command('user')
               ? (() => {
                   const ts = Number(options.expiration)
                   if (!Number.isInteger(ts) || ts <= 0) {
-                    console.log(formatOutput({ error: 'Invalid --expiration value. Use a Unix timestamp in seconds.' }, options.pretty))
+                    console.log(
+                      formatOutput(
+                        { error: 'Invalid --expiration value. Use a Unix timestamp in seconds.' },
+                        options.pretty,
+                      ),
+                    )
                     process.exit(1)
                   }
                   return ts

package/src/platforms/slack/commands/usergroup.test.ts

@@ -86,9 +86,9 @@ describe('Usergroup Commands', () => {
       mockClient.updateUsergroup = mock(async () => {
         throw new Error('no_such_subteam')
       })
-      await expect(
-        (mockClient as SlackClient).updateUsergroup('S999', { name: 'Nope' }),
-      ).rejects.toThrow('no_such_subteam')
+      await expect((mockClient as SlackClient).updateUsergroup('S999', { name: 'Nope' })).rejects.toThrow(
+        'no_such_subteam',
+      )
     })
   })
 

package/src/platforms/slack/commands/usergroup.ts

@@ -18,7 +18,11 @@ async function getClient(pretty?: boolean): Promise<SlackClient | null> {
   return await new SlackClient().login({ token: ws.token, cookie: ws.cookie })
 }
 
-async function listAction(options: { includeDisabled?: boolean; includeUsers?: boolean; pretty?: boolean }): Promise<void> {
+async function listAction(options: {
+  includeDisabled?: boolean
+  includeUsers?: boolean
+  pretty?: boolean
+}): Promise<void> {
   try {
     const client = await getClient(options.pretty)
     if (!client) return process.exit(1)
@@ -136,7 +140,10 @@ async function disableAction(usergroupId: string, options: { pretty?: boolean })
   }
 }
 
-async function membersAction(usergroupId: string, options: { includeDisabled?: boolean; pretty?: boolean }): Promise<void> {
+async function membersAction(
+  usergroupId: string,
+  options: { includeDisabled?: boolean; pretty?: boolean },
+): Promise<void> {
   try {
     const client = await getClient(options.pretty)
     if (!client) return process.exit(1)
@@ -151,11 +158,7 @@ async function membersAction(usergroupId: string, options: { includeDisabled?: b
   }
 }
 
-async function membersUpdateAction(
-  usergroupId: string,
-  users: string,
-  options: { pretty?: boolean },
-): Promise<void> {
+async function membersUpdateAction(usergroupId: string, users: string, options: { pretty?: boolean }): Promise<void> {
   try {
     const client = await getClient(options.pretty)
     if (!client) return process.exit(1)

package/src/platforms/slack/commands/whoami.test.ts

@@ -1,8 +1,8 @@
 import { afterEach, beforeEach, expect, spyOn, test } from 'bun:test'
 
 import { SlackClient } from '@/platforms/slack/client'
-import { CredentialManager } from '@/platforms/slack/credential-manager'
 import { whoamiAction, whoamiCommand } from '@/platforms/slack/commands/whoami'
+import { CredentialManager } from '@/platforms/slack/credential-manager'
 
 let credManagerSpy: ReturnType<typeof spyOn>
 let clientTestAuthSpy: ReturnType<typeof spyOn>

package/src/platforms/slack/commands/whoami.ts

@@ -1,6 +1,8 @@
 import { Command } from 'commander'
+
 import { handleError } from '@/shared/utils/error-handler'
 import { formatOutput } from '@/shared/utils/output'
+
 import { SlackClient } from '../client'
 import { CredentialManager } from '../credential-manager'
 

package/src/platforms/slack/index.ts

@@ -43,5 +43,3 @@ export {
   WorkspaceCredentialsSchema,
   ConfigSchema,
 } from './types'
-
-

package/src/platforms/slack/listener.test.ts

@@ -16,6 +16,7 @@ class MockWs {
   sent: string[] = []
 
   constructor(_url: string, _options?: any) {
+    // oxlint-disable-next-line typescript-eslint/no-this-alias
     mockWsInstance = this
   }
 

package/src/platforms/slack/token-extractor.test.ts

@@ -813,10 +813,7 @@ describe('TokenExtractor browser fallback', () => {
     mkdirSync(leveldbDir, { recursive: true })
     writeFileSync(join(leveldbDir, '000001.log'), `"${token}"T12345678"name":"desktop-workspace"`)
 
-    const extractFromBrowsersSpy = spyOn(
-      TokenExtractor.prototype as any,
-      'extractFromBrowsers',
-    ).mockResolvedValue([])
+    const extractFromBrowsersSpy = spyOn(TokenExtractor.prototype as any, 'extractFromBrowsers').mockResolvedValue([])
 
     // when
     const extractor = new TokenExtractor('darwin', slackDir)
@@ -843,10 +840,9 @@ describe('TokenExtractor browser fallback', () => {
       cookie: '',
     }
 
-    const extractFromBrowsersSpy = spyOn(
-      TokenExtractor.prototype as any,
-      'extractFromBrowsers',
-    ).mockResolvedValue([browserWorkspace])
+    const extractFromBrowsersSpy = spyOn(TokenExtractor.prototype as any, 'extractFromBrowsers').mockResolvedValue([
+      browserWorkspace,
+    ])
 
     // when
     const extractor = new TokenExtractor('darwin', slackDir)
@@ -871,10 +867,9 @@ describe('TokenExtractor browser fallback', () => {
       cookie: 'xoxd-browser-cookie',
     }
 
-    const extractFromBrowsersSpy = spyOn(
-      TokenExtractor.prototype as any,
-      'extractFromBrowsers',
-    ).mockResolvedValue([browserWorkspace])
+    const extractFromBrowsersSpy = spyOn(TokenExtractor.prototype as any, 'extractFromBrowsers').mockResolvedValue([
+      browserWorkspace,
+    ])
 
     // when
     const extractor = new TokenExtractor('darwin', slackDir)

package/src/platforms/slack/token-extractor.ts

@@ -7,61 +7,16 @@ import { join } from 'node:path'
 
 import { ClassicLevel } from 'classic-level'
 
+import {
+  CHROMIUM_BROWSERS,
+  ChromiumCookieDecryptor,
+  ChromiumCookieReader,
+  discoverBrowserProfileDirs,
+  getBrowserBasePath,
+} from '@/shared/chromium'
 import { DerivedKeyCache } from '@/shared/utils/derived-key-cache'
 import { lookupLinuxKeyringPassword } from '@/shared/utils/linux-keyring'
 
-interface BrowserConfig {
-  name: string
-  darwin: string
-  linux: string
-  win32: string
-}
-
-const BROWSERS: BrowserConfig[] = [
-  {
-    name: 'Chrome',
-    darwin: join('Google', 'Chrome'),
-    linux: 'google-chrome',
-    win32: join('Google', 'Chrome', 'User Data'),
-  },
-  {
-    name: 'Chrome Canary',
-    darwin: join('Google', 'Chrome Canary'),
-    linux: 'google-chrome-unstable',
-    win32: join('Google', 'Chrome SxS', 'User Data'),
-  },
-  {
-    name: 'Edge',
-    darwin: 'Microsoft Edge',
-    linux: 'microsoft-edge',
-    win32: join('Microsoft', 'Edge', 'User Data'),
-  },
-  {
-    name: 'Arc',
-    darwin: join('Arc', 'User Data'),
-    linux: '',
-    win32: join('Arc', 'User Data'),
-  },
-  {
-    name: 'Brave',
-    darwin: join('BraveSoftware', 'Brave-Browser'),
-    linux: join('BraveSoftware', 'Brave-Browser'),
-    win32: join('BraveSoftware', 'Brave-Browser', 'User Data'),
-  },
-  {
-    name: 'Vivaldi',
-    darwin: 'Vivaldi',
-    linux: 'vivaldi',
-    win32: join('Vivaldi', 'User Data'),
-  },
-  {
-    name: 'Chromium',
-    darwin: 'Chromium',
-    linux: 'chromium',
-    win32: join('Chromium', 'User Data'),
-  },
-]
-
 const require = createRequire(import.meta.url)
 
 export interface ExtractedWorkspace {
@@ -106,6 +61,8 @@ export class TokenExtractor {
   private slackDir: string
   private keyCache: DerivedKeyCache
   private debugLog: ((message: string) => void) | null
+  private browserDecryptor: ChromiumCookieDecryptor
+  private browserCookieReader: ChromiumCookieReader
 
   constructor(
     platform?: NodeJS.Platform,
@@ -122,6 +79,8 @@ export class TokenExtractor {
     this.slackDir = slackDir ?? this.getSlackDir()
     this.keyCache = keyCache ?? new DerivedKeyCache()
     this.debugLog = debugLog ?? null
+    this.browserDecryptor = new ChromiumCookieDecryptor({ platform: this.platform })
+    this.browserCookieReader = new ChromiumCookieReader()
   }
 
   private debug(message: string): void {
@@ -267,11 +226,11 @@ export class TokenExtractor {
     const results: ExtractedWorkspace[] = []
     const seenTokens = new Set<string>()
 
-    for (const browser of BROWSERS) {
-      const browserBase = this.getBrowserBasePath(browser)
+    for (const browser of CHROMIUM_BROWSERS) {
+      const browserBase = getBrowserBasePath(browser, this.platform)
       if (!browserBase) continue
 
-      const profileDirs = this.discoverBrowserProfileDirs(browserBase)
+      const profileDirs = discoverBrowserProfileDirs(browserBase)
       for (const profileDir of profileDirs) {
         const leveldbDir = join(profileDir, 'Local Storage', 'leveldb')
         if (!existsSync(leveldbDir)) continue
@@ -303,54 +262,8 @@ export class TokenExtractor {
     return results
   }
 
-  private getBrowserBasePath(browser: BrowserConfig): string | null {
-    let relative: string
-
-    switch (this.platform) {
-      case 'darwin':
-        relative = browser.darwin
-        if (!relative) return null
-        return join(homedir(), 'Library', 'Application Support', relative)
-      case 'linux':
-        relative = browser.linux
-        if (!relative) return null
-        return join(homedir(), '.config', relative)
-      case 'win32':
-        relative = browser.win32
-        if (!relative) return null
-        return join(
-          process.env.LOCALAPPDATA || join(homedir(), 'AppData', 'Local'),
-          relative,
-        )
-      default:
-        return null
-    }
-  }
-
-  private discoverBrowserProfileDirs(browserBase: string): string[] {
-    const dirs: string[] = []
-
-    dirs.push(join(browserBase, 'Default'))
-
-    if (!existsSync(browserBase)) return dirs
-
-    try {
-      const entries = readdirSync(browserBase, { withFileTypes: true })
-      for (const entry of entries) {
-        if (!entry.isDirectory()) continue
-        if (!/^Profile \d+$/i.test(entry.name)) continue
-        dirs.push(join(browserBase, entry.name))
-      }
-    } catch {}
-
-    return dirs
-  }
-
   private async extractCookieFromBrowserProfile(profileDir: string, browserBase: string): Promise<string> {
-    const cookiePaths = [
-      join(profileDir, 'Cookies'),
-      join(profileDir, 'Network', 'Cookies'),
-    ]
+    const cookiePaths = [join(profileDir, 'Cookies'), join(profileDir, 'Network', 'Cookies')]
 
     for (const cookiePath of cookiePaths) {
       if (!existsSync(cookiePath)) continue
@@ -363,166 +276,35 @@ export class TokenExtractor {
   }
 
   private async extractCookieFromBrowserSQLite(cookiesPath: string, browserBase: string): Promise<string> {
-    const tempDbPath = join(tmpdir(), `slack-browser-cookies-${Date.now()}-${Math.random().toString(36).slice(2)}.db`)
-
-    try {
-      copyFileSync(cookiesPath, tempDbPath)
-    } catch {
-      return ''
+    const sql = `SELECT value, encrypted_value
+         FROM cookies
+         WHERE name = 'd' AND host_key LIKE '%slack.com%'
+         ORDER BY last_access_utc DESC
+         LIMIT 1`
+
+    type CookieRow = {
+      value?: string
+      encrypted_value?: Uint8Array | Buffer
     }
 
-    try {
-      const sql = `SELECT value, encrypted_value
-           FROM cookies
-           WHERE name = 'd' AND host_key LIKE '%slack.com%'
-           ORDER BY last_access_utc DESC
-           LIMIT 1`
+    const row = await this.browserCookieReader.queryFirst<CookieRow>(cookiesPath, sql)
+    if (!row) return ''
 
-      type CookieRow = {
-        value?: string
-        encrypted_value?: Uint8Array | Buffer
-      } | null
+    if (row.value?.startsWith('xoxd-')) return row.value
 
-      let row: CookieRow
-      if (typeof globalThis.Bun !== 'undefined') {
-        const { Database } = require('bun:sqlite')
-        const db = new Database(tempDbPath, { readonly: true })
-        row = db.query(sql).get() as CookieRow
-        db.close()
-      } else {
-        const Database = require('better-sqlite3')
-        const db = new Database(tempDbPath, { readonly: true })
-        row = db.prepare(sql).get() as CookieRow
-        db.close()
-      }
-
-      if (!row) return ''
-
-      if (row.value?.startsWith('xoxd-')) return row.value
-
-      if (row.encrypted_value && row.encrypted_value.length > 0) {
-        return this.decryptBrowserCookieForSlack(Buffer.from(row.encrypted_value), browserBase) ?? ''
-      }
-
-      return ''
-    } catch {
-      return ''
-    } finally {
-      try {
-        rmSync(tempDbPath, { force: true })
-      } catch {}
-    }
-  }
-
-  private decryptBrowserCookieForSlack(encrypted: Buffer, browserBase: string): string | null {
-    const str = encrypted.toString('utf8')
-    if (str.startsWith('xoxd-')) return str
-
-    const prefix = encrypted.length > 3 ? encrypted.subarray(0, 3).toString() : ''
-
-    if (prefix === 'v10') {
-      if (this.platform === 'win32') {
-        return this.decryptBrowserV10CookieWindows(encrypted, browserBase)
-      }
-      if (this.platform === 'linux') {
-        return this.decryptV10CookieLinux(encrypted)
-      }
-      return this.decryptBrowserV10CookieMac(encrypted)
-    }
-
-    if (prefix === 'v11') {
-      if (this.platform === 'linux') {
-        return this.decryptV11CookieLinux(encrypted)
-      }
-      if (this.platform === 'darwin') {
-        return this.decryptBrowserV10CookieMac(encrypted)
-      }
-    }
-
-    if (this.platform === 'win32' && encrypted.length > 0) {
-      const decrypted = this.decryptDPAPI(encrypted)
+    if (row.encrypted_value && row.encrypted_value.length > 0) {
+      const localStatePath = join(browserBase, 'Local State')
+      const decrypted = this.browserDecryptor.decryptCookie(
+        Buffer.from(row.encrypted_value),
+        existsSync(localStatePath) ? localStatePath : undefined,
+      )
       if (decrypted) {
-        const text = decrypted.toString('utf8')
-        const match = text.match(/xoxd-[A-Za-z0-9%]+/)
-        return match ? match[0] : null
-      }
-    }
-
-    return null
-  }
-
-  private decryptBrowserV10CookieMac(encrypted: Buffer): string | null {
-    const keychainVariants = [
-      { service: 'Chrome Safe Storage', account: 'Chrome' },
-      { service: 'Chrome Canary Safe Storage', account: 'Chrome Canary' },
-      { service: 'Microsoft Edge Safe Storage', account: 'Microsoft Edge' },
-      { service: 'Arc Safe Storage', account: 'Arc' },
-      { service: 'Brave Safe Storage', account: 'Brave' },
-      { service: 'Vivaldi Safe Storage', account: 'Vivaldi' },
-      { service: 'Chromium Safe Storage', account: 'Chromium' },
-    ]
-
-    for (const variant of keychainVariants) {
-      try {
-        const password = execSync(
-          `security find-generic-password -s "${variant.service}" -a "${variant.account}" -w 2>/dev/null`,
-          { encoding: 'utf8' },
-        ).trim()
-
-        const key = pbkdf2Sync(password, 'saltysalt', 1003, 16, 'sha1')
-        const result = this.decryptLinuxCookieWithKey(encrypted, key)
-        if (result) return result
-      } catch {}
-    }
-
-    return null
-  }
-
-  private decryptBrowserV10CookieWindows(encrypted: Buffer, browserBase: string): string | null {
-    try {
-      const masterKey = this.getBrowserWindowsMasterKey(browserBase)
-      if (!masterKey) {
-        const decrypted = this.decryptDPAPI(encrypted.subarray(3))
-        if (!decrypted) return null
-        const text = decrypted.toString('utf8')
-        const match = text.match(/xoxd-[A-Za-z0-9%]+/)
-        return match ? match[0] : null
+        const match = decrypted.match(/xoxd-[A-Za-z0-9%]+/)
+        return match ? match[0] : ''
       }
-
-      const nonce = encrypted.subarray(3, 3 + 12)
-      const ciphertextWithTag = encrypted.subarray(3 + 12)
-      const tag = ciphertextWithTag.subarray(ciphertextWithTag.length - 16)
-      const ciphertext = ciphertextWithTag.subarray(0, ciphertextWithTag.length - 16)
-
-      const decipher = createDecipheriv('aes-256-gcm', masterKey, nonce)
-      decipher.setAuthTag(tag)
-      const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8')
-
-      const match = decrypted.match(/xoxd-[A-Za-z0-9%]+/)
-      return match ? match[0] : null
-    } catch {
-      return null
     }
-  }
-
-  private getBrowserWindowsMasterKey(browserBase: string): Buffer | null {
-    try {
-      const localStatePath = join(browserBase, 'Local State')
-      if (!existsSync(localStatePath)) return null
-
-      const localState = JSON.parse(readFileSync(localStatePath, 'utf8')) as {
-        os_crypt?: { encrypted_key?: string }
-      }
-      const encryptedKeyB64 = localState?.os_crypt?.encrypted_key
-      if (!encryptedKeyB64) return null
-
-      const encryptedKey = Buffer.from(encryptedKeyB64, 'base64')
-      if (encryptedKey.subarray(0, 5).toString() !== 'DPAPI') return null
 
-      return this.decryptDPAPI(encryptedKey.subarray(5))
-    } catch {
-      return null
-    }
+    return ''
   }
 
   private async extractTokensFromLevelDB(): Promise<TokenInfo[]> {
@@ -1157,7 +939,17 @@ export class TokenExtractor {
   }
 
   private decryptV11CookieLinux(encrypted: Buffer): string | null {
-    const appNames = ['Slack', 'slack', 'Chrome', 'chrome', 'Chromium', 'chromium', 'Microsoft Edge', 'Brave', 'Vivaldi']
+    const appNames = [
+      'Slack',
+      'slack',
+      'Chrome',
+      'chrome',
+      'Chromium',
+      'chromium',
+      'Microsoft Edge',
+      'Brave',
+      'Vivaldi',
+    ]
     for (const appName of appNames) {
       try {
         const keyringPassword = this.getLinuxKeyringPassword(appName)