agent-messenger 2.7.0 → 2.9.0

package/src/platforms/slack/token-extractor.ts

@@ -7,61 +7,16 @@ import { join } from 'node:path'
 
 import { ClassicLevel } from 'classic-level'
 
+import {
+  CHROMIUM_BROWSERS,
+  ChromiumCookieDecryptor,
+  ChromiumCookieReader,
+  discoverBrowserProfileDirs,
+  getBrowserBasePath,
+} from '@/shared/chromium'
 import { DerivedKeyCache } from '@/shared/utils/derived-key-cache'
 import { lookupLinuxKeyringPassword } from '@/shared/utils/linux-keyring'
 
-interface BrowserConfig {
-  name: string
-  darwin: string
-  linux: string
-  win32: string
-}
-
-const BROWSERS: BrowserConfig[] = [
-  {
-    name: 'Chrome',
-    darwin: join('Google', 'Chrome'),
-    linux: 'google-chrome',
-    win32: join('Google', 'Chrome', 'User Data'),
-  },
-  {
-    name: 'Chrome Canary',
-    darwin: join('Google', 'Chrome Canary'),
-    linux: 'google-chrome-unstable',
-    win32: join('Google', 'Chrome SxS', 'User Data'),
-  },
-  {
-    name: 'Edge',
-    darwin: 'Microsoft Edge',
-    linux: 'microsoft-edge',
-    win32: join('Microsoft', 'Edge', 'User Data'),
-  },
-  {
-    name: 'Arc',
-    darwin: join('Arc', 'User Data'),
-    linux: '',
-    win32: join('Arc', 'User Data'),
-  },
-  {
-    name: 'Brave',
-    darwin: join('BraveSoftware', 'Brave-Browser'),
-    linux: join('BraveSoftware', 'Brave-Browser'),
-    win32: join('BraveSoftware', 'Brave-Browser', 'User Data'),
-  },
-  {
-    name: 'Vivaldi',
-    darwin: 'Vivaldi',
-    linux: 'vivaldi',
-    win32: join('Vivaldi', 'User Data'),
-  },
-  {
-    name: 'Chromium',
-    darwin: 'Chromium',
-    linux: 'chromium',
-    win32: join('Chromium', 'User Data'),
-  },
-]
-
 const require = createRequire(import.meta.url)
 
 export interface ExtractedWorkspace {
@@ -106,6 +61,8 @@ export class TokenExtractor {
   private slackDir: string
   private keyCache: DerivedKeyCache
   private debugLog: ((message: string) => void) | null
+  private browserDecryptor: ChromiumCookieDecryptor
+  private browserCookieReader: ChromiumCookieReader
 
   constructor(
     platform?: NodeJS.Platform,
@@ -122,6 +79,8 @@ export class TokenExtractor {
     this.slackDir = slackDir ?? this.getSlackDir()
     this.keyCache = keyCache ?? new DerivedKeyCache()
     this.debugLog = debugLog ?? null
+    this.browserDecryptor = new ChromiumCookieDecryptor({ platform: this.platform })
+    this.browserCookieReader = new ChromiumCookieReader()
   }
 
   private debug(message: string): void {
@@ -267,11 +226,11 @@ export class TokenExtractor {
     const results: ExtractedWorkspace[] = []
     const seenTokens = new Set<string>()
 
-    for (const browser of BROWSERS) {
-      const browserBase = this.getBrowserBasePath(browser)
+    for (const browser of CHROMIUM_BROWSERS) {
+      const browserBase = getBrowserBasePath(browser, this.platform)
       if (!browserBase) continue
 
-      const profileDirs = this.discoverBrowserProfileDirs(browserBase)
+      const profileDirs = discoverBrowserProfileDirs(browserBase)
       for (const profileDir of profileDirs) {
         const leveldbDir = join(profileDir, 'Local Storage', 'leveldb')
         if (!existsSync(leveldbDir)) continue
@@ -303,54 +262,8 @@ export class TokenExtractor {
     return results
   }
 
-  private getBrowserBasePath(browser: BrowserConfig): string | null {
-    let relative: string
-
-    switch (this.platform) {
-      case 'darwin':
-        relative = browser.darwin
-        if (!relative) return null
-        return join(homedir(), 'Library', 'Application Support', relative)
-      case 'linux':
-        relative = browser.linux
-        if (!relative) return null
-        return join(homedir(), '.config', relative)
-      case 'win32':
-        relative = browser.win32
-        if (!relative) return null
-        return join(
-          process.env.LOCALAPPDATA || join(homedir(), 'AppData', 'Local'),
-          relative,
-        )
-      default:
-        return null
-    }
-  }
-
-  private discoverBrowserProfileDirs(browserBase: string): string[] {
-    const dirs: string[] = []
-
-    dirs.push(join(browserBase, 'Default'))
-
-    if (!existsSync(browserBase)) return dirs
-
-    try {
-      const entries = readdirSync(browserBase, { withFileTypes: true })
-      for (const entry of entries) {
-        if (!entry.isDirectory()) continue
-        if (!/^Profile \d+$/i.test(entry.name)) continue
-        dirs.push(join(browserBase, entry.name))
-      }
-    } catch {}
-
-    return dirs
-  }
-
   private async extractCookieFromBrowserProfile(profileDir: string, browserBase: string): Promise<string> {
-    const cookiePaths = [
-      join(profileDir, 'Cookies'),
-      join(profileDir, 'Network', 'Cookies'),
-    ]
+    const cookiePaths = [join(profileDir, 'Cookies'), join(profileDir, 'Network', 'Cookies')]
 
     for (const cookiePath of cookiePaths) {
       if (!existsSync(cookiePath)) continue
@@ -363,166 +276,35 @@ export class TokenExtractor {
   }
 
   private async extractCookieFromBrowserSQLite(cookiesPath: string, browserBase: string): Promise<string> {
-    const tempDbPath = join(tmpdir(), `slack-browser-cookies-${Date.now()}-${Math.random().toString(36).slice(2)}.db`)
-
-    try {
-      copyFileSync(cookiesPath, tempDbPath)
-    } catch {
-      return ''
+    const sql = `SELECT value, encrypted_value
+         FROM cookies
+         WHERE name = 'd' AND host_key LIKE '%slack.com%'
+         ORDER BY last_access_utc DESC
+         LIMIT 1`
+
+    type CookieRow = {
+      value?: string
+      encrypted_value?: Uint8Array | Buffer
     }
 
-    try {
-      const sql = `SELECT value, encrypted_value
-           FROM cookies
-           WHERE name = 'd' AND host_key LIKE '%slack.com%'
-           ORDER BY last_access_utc DESC
-           LIMIT 1`
+    const row = await this.browserCookieReader.queryFirst<CookieRow>(cookiesPath, sql)
+    if (!row) return ''
 
-      type CookieRow = {
-        value?: string
-        encrypted_value?: Uint8Array | Buffer
-      } | null
+    if (row.value?.startsWith('xoxd-')) return row.value
 
-      let row: CookieRow
-      if (typeof globalThis.Bun !== 'undefined') {
-        const { Database } = require('bun:sqlite')
-        const db = new Database(tempDbPath, { readonly: true })
-        row = db.query(sql).get() as CookieRow
-        db.close()
-      } else {
-        const Database = require('better-sqlite3')
-        const db = new Database(tempDbPath, { readonly: true })
-        row = db.prepare(sql).get() as CookieRow
-        db.close()
-      }
-
-      if (!row) return ''
-
-      if (row.value?.startsWith('xoxd-')) return row.value
-
-      if (row.encrypted_value && row.encrypted_value.length > 0) {
-        return this.decryptBrowserCookieForSlack(Buffer.from(row.encrypted_value), browserBase) ?? ''
-      }
-
-      return ''
-    } catch {
-      return ''
-    } finally {
-      try {
-        rmSync(tempDbPath, { force: true })
-      } catch {}
-    }
-  }
-
-  private decryptBrowserCookieForSlack(encrypted: Buffer, browserBase: string): string | null {
-    const str = encrypted.toString('utf8')
-    if (str.startsWith('xoxd-')) return str
-
-    const prefix = encrypted.length > 3 ? encrypted.subarray(0, 3).toString() : ''
-
-    if (prefix === 'v10') {
-      if (this.platform === 'win32') {
-        return this.decryptBrowserV10CookieWindows(encrypted, browserBase)
-      }
-      if (this.platform === 'linux') {
-        return this.decryptV10CookieLinux(encrypted)
-      }
-      return this.decryptBrowserV10CookieMac(encrypted)
-    }
-
-    if (prefix === 'v11') {
-      if (this.platform === 'linux') {
-        return this.decryptV11CookieLinux(encrypted)
-      }
-      if (this.platform === 'darwin') {
-        return this.decryptBrowserV10CookieMac(encrypted)
-      }
-    }
-
-    if (this.platform === 'win32' && encrypted.length > 0) {
-      const decrypted = this.decryptDPAPI(encrypted)
+    if (row.encrypted_value && row.encrypted_value.length > 0) {
+      const localStatePath = join(browserBase, 'Local State')
+      const decrypted = this.browserDecryptor.decryptCookie(
+        Buffer.from(row.encrypted_value),
+        existsSync(localStatePath) ? localStatePath : undefined,
+      )
       if (decrypted) {
-        const text = decrypted.toString('utf8')
-        const match = text.match(/xoxd-[A-Za-z0-9%]+/)
-        return match ? match[0] : null
-      }
-    }
-
-    return null
-  }
-
-  private decryptBrowserV10CookieMac(encrypted: Buffer): string | null {
-    const keychainVariants = [
-      { service: 'Chrome Safe Storage', account: 'Chrome' },
-      { service: 'Chrome Canary Safe Storage', account: 'Chrome Canary' },
-      { service: 'Microsoft Edge Safe Storage', account: 'Microsoft Edge' },
-      { service: 'Arc Safe Storage', account: 'Arc' },
-      { service: 'Brave Safe Storage', account: 'Brave' },
-      { service: 'Vivaldi Safe Storage', account: 'Vivaldi' },
-      { service: 'Chromium Safe Storage', account: 'Chromium' },
-    ]
-
-    for (const variant of keychainVariants) {
-      try {
-        const password = execSync(
-          `security find-generic-password -s "${variant.service}" -a "${variant.account}" -w 2>/dev/null`,
-          { encoding: 'utf8' },
-        ).trim()
-
-        const key = pbkdf2Sync(password, 'saltysalt', 1003, 16, 'sha1')
-        const result = this.decryptLinuxCookieWithKey(encrypted, key)
-        if (result) return result
-      } catch {}
-    }
-
-    return null
-  }
-
-  private decryptBrowserV10CookieWindows(encrypted: Buffer, browserBase: string): string | null {
-    try {
-      const masterKey = this.getBrowserWindowsMasterKey(browserBase)
-      if (!masterKey) {
-        const decrypted = this.decryptDPAPI(encrypted.subarray(3))
-        if (!decrypted) return null
-        const text = decrypted.toString('utf8')
-        const match = text.match(/xoxd-[A-Za-z0-9%]+/)
-        return match ? match[0] : null
+        const match = decrypted.match(/xoxd-[A-Za-z0-9%]+/)
+        return match ? match[0] : ''
       }
-
-      const nonce = encrypted.subarray(3, 3 + 12)
-      const ciphertextWithTag = encrypted.subarray(3 + 12)
-      const tag = ciphertextWithTag.subarray(ciphertextWithTag.length - 16)
-      const ciphertext = ciphertextWithTag.subarray(0, ciphertextWithTag.length - 16)
-
-      const decipher = createDecipheriv('aes-256-gcm', masterKey, nonce)
-      decipher.setAuthTag(tag)
-      const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8')
-
-      const match = decrypted.match(/xoxd-[A-Za-z0-9%]+/)
-      return match ? match[0] : null
-    } catch {
-      return null
     }
-  }
-
-  private getBrowserWindowsMasterKey(browserBase: string): Buffer | null {
-    try {
-      const localStatePath = join(browserBase, 'Local State')
-      if (!existsSync(localStatePath)) return null
-
-      const localState = JSON.parse(readFileSync(localStatePath, 'utf8')) as {
-        os_crypt?: { encrypted_key?: string }
-      }
-      const encryptedKeyB64 = localState?.os_crypt?.encrypted_key
-      if (!encryptedKeyB64) return null
-
-      const encryptedKey = Buffer.from(encryptedKeyB64, 'base64')
-      if (encryptedKey.subarray(0, 5).toString() !== 'DPAPI') return null
 
-      return this.decryptDPAPI(encryptedKey.subarray(5))
-    } catch {
-      return null
-    }
+    return ''
   }
 
   private async extractTokensFromLevelDB(): Promise<TokenInfo[]> {
@@ -1157,7 +939,17 @@ export class TokenExtractor {
   }
 
   private decryptV11CookieLinux(encrypted: Buffer): string | null {
-    const appNames = ['Slack', 'slack', 'Chrome', 'chrome', 'Chromium', 'chromium', 'Microsoft Edge', 'Brave', 'Vivaldi']
+    const appNames = [
+      'Slack',
+      'slack',
+      'Chrome',
+      'chrome',
+      'Chromium',
+      'chromium',
+      'Microsoft Edge',
+      'Brave',
+      'Vivaldi',
+    ]
     for (const appName of appNames) {
       try {
         const keyringPassword = this.getLinuxKeyringPassword(appName)

package/src/platforms/slackbot/cli.ts

@@ -3,7 +3,14 @@
 import { Command } from 'commander'
 
 import pkg from '../../../package.json' with { type: 'json' }
-import { authCommand, channelCommand, messageCommand, reactionCommand, userCommand, whoamiCommand } from './commands/index'
+import {
+  authCommand,
+  channelCommand,
+  messageCommand,
+  reactionCommand,
+  userCommand,
+  whoamiCommand,
+} from './commands/index'
 
 const program = new Command()
 

package/src/platforms/slackbot/commands/auth.test.ts

@@ -17,7 +17,9 @@ const mockTestAuth = mock(() =>
 
 mock.module('../client', () => ({
   SlackBotClient: class MockSlackBotClient {
-    async login(_credentials?: any) { return this }
+    async login(_credentials?: any) {
+      return this
+    }
     testAuth = mockTestAuth
   },
 }))

package/src/platforms/teams/client.ts

@@ -1,9 +1,9 @@
 import { readFile } from 'node:fs/promises'
 import { basename } from 'node:path'
 
+import { TeamsCredentialManager } from './credential-manager'
 import type { TeamsChannel, TeamsFile, TeamsMessage, TeamsTeam, TeamsUser } from './types'
 import { TeamsError } from './types'
-import { TeamsCredentialManager } from './credential-manager'
 
 interface RateLimitBucket {
   remaining: number

package/src/platforms/teams/commands/auth.test.ts

@@ -1,9 +1,9 @@
 import { afterEach, beforeEach, expect, spyOn, test } from 'bun:test'
 
-import { getNoTeamsTokenFoundMessage } from './auth'
 import { TeamsClient } from '../client'
 import { TeamsCredentialManager } from '../credential-manager'
 import { TeamsTokenExtractor } from '../token-extractor'
+import { getNoTeamsTokenFoundMessage } from './auth'
 
 let extractorExtractSpy: ReturnType<typeof spyOn>
 let clientTestAuthSpy: ReturnType<typeof spyOn>

package/src/platforms/teams/commands/auth.ts

@@ -292,7 +292,10 @@ export async function statusAction(options: { pretty?: boolean }): Promise<void>
 
       if (!isExpired) {
         try {
-          const client = await new TeamsClient().login({ token: account.token, tokenExpiresAt: account.token_expires_at ?? undefined })
+          const client = await new TeamsClient().login({
+            token: account.token,
+            tokenExpiresAt: account.token_expires_at ?? undefined,
+          })
           const authInfo = await client.testAuth()
           displayName = authInfo.displayName
           valid = true

package/src/platforms/teams/commands/snapshot.test.ts

@@ -8,7 +8,7 @@ test('snapshot: command is defined', () => {
 })
 
 test('snapshot: command has correct description', () => {
-  expect(snapshotCommand.description()).toContain('team state')
+  expect(snapshotCommand.description()).toContain('team overview')
 })
 
 test('snapshot: command has --channels-only option', () => {

package/src/platforms/teams/commands/snapshot.ts

@@ -11,6 +11,7 @@ import type { TeamsChannel } from '../types'
 export async function snapshotAction(options: {
   channelsOnly?: boolean
   usersOnly?: boolean
+  full?: boolean
   limit?: number
   teamId?: string
   pretty?: boolean
@@ -34,7 +35,6 @@ export async function snapshotAction(options: {
     }
 
     const client = await new TeamsClient().login({ token: cred.token, tokenExpiresAt: cred.tokenExpiresAt })
-    const messageLimit = options.limit || 20
 
     const snapshot: Record<string, unknown> = {}
 
@@ -45,47 +45,60 @@ export async function snapshotAction(options: {
       description: team.description,
     }
 
-    if (!options.usersOnly) {
-      const channels = await client.listChannels(teamId)
+    const isFull = options.full || options.channelsOnly || options.usersOnly
+    if (isFull) {
+      const messageLimit = options.limit || 20
 
-      snapshot.channels = channels.map((ch) => ({
-        id: ch.id,
-        name: ch.name,
-        type: ch.type,
-      }))
+      if (!options.usersOnly) {
+        const channels = await client.listChannels(teamId)
 
-      if (!options.channelsOnly) {
-        const channelMessages = await parallelMap(
-          channels,
-          async (channel: TeamsChannel) => {
-            const messages = await client.getMessages(teamId, channel.id, messageLimit)
-            return messages.map((msg) => ({
-              ...msg,
-              channel_name: channel.name,
-            }))
-          },
-          5,
-        )
-
-        snapshot.recent_messages = channelMessages.flat().map((msg) => ({
-          channel_id: msg.channel_id,
-          channel_name: msg.channel_name,
-          id: msg.id,
-          author: msg.author.displayName,
-          content: msg.content,
-          timestamp: msg.timestamp,
+        snapshot.channels = channels.map((ch) => ({
+          id: ch.id,
+          name: ch.name,
+          type: ch.type,
         }))
+
+        if (!options.channelsOnly) {
+          const channelMessages = await parallelMap(
+            channels,
+            async (channel: TeamsChannel) => {
+              const messages = await client.getMessages(teamId, channel.id, messageLimit)
+              return messages.map((msg) => ({
+                ...msg,
+                channel_name: channel.name,
+              }))
+            },
+            5,
+          )
+
+          snapshot.recent_messages = channelMessages.flat().map((msg) => ({
+            channel_id: msg.channel_id,
+            channel_name: msg.channel_name,
+            id: msg.id,
+            author: msg.author.displayName,
+            content: msg.content,
+            timestamp: msg.timestamp,
+          }))
+        }
       }
-    }
 
-    if (!options.channelsOnly) {
-      const users = await client.listUsers(teamId)
+      if (!options.channelsOnly) {
+        const users = await client.listUsers(teamId)
+
+        snapshot.members = users.map((u) => ({
+          id: u.id,
+          displayName: u.displayName,
+          email: u.email || null,
+        }))
+      }
+    } else {
+      if (!options.usersOnly) {
+        const channels = await client.listChannels(teamId)
+        snapshot.channels = channels.map((ch) => ({ id: ch.id, name: ch.name }))
+      }
 
-      snapshot.members = users.map((u) => ({
-        id: u.id,
-        displayName: u.displayName,
-        email: u.email || null,
-      }))
+      snapshot.hint =
+        "Use 'message list <channel>' for messages, 'channel info <channel>' for channel details, 'user list' for members."
     }
 
     console.log(formatOutput(snapshot, options.pretty))
@@ -95,16 +108,18 @@ export async function snapshotAction(options: {
 }
 
 export const snapshotCommand = new Command('snapshot')
-  .description('Get comprehensive team state for AI agents')
+  .description('Get team overview for AI agents (brief by default, use --full for comprehensive data)')
+  .option('--full', 'Include messages and members (verbose)')
   .option('--channels-only', 'Include only channels (exclude messages and members)')
   .option('--users-only', 'Include only members (exclude channels and messages)')
-  .option('--limit <n>', 'Number of recent messages per channel (default: 20)', '20')
+  .option('--limit <n>', 'Number of recent messages per channel with --full (default: 20)', '20')
   .option('--team-id <id>', 'Team ID (defaults to current team)')
   .option('--pretty', 'Pretty print JSON output')
   .action(async (options) => {
     await snapshotAction({
       channelsOnly: options.channelsOnly,
       usersOnly: options.usersOnly,
+      full: options.full,
       limit: parseInt(options.limit, 10),
       teamId: options.teamId,
       pretty: options.pretty,

package/src/platforms/teams/commands/whoami.test.ts

@@ -1,8 +1,8 @@
 import { afterEach, beforeEach, expect, spyOn, test } from 'bun:test'
 
 import { TeamsClient } from '@/platforms/teams/client'
-import { TeamsCredentialManager } from '@/platforms/teams/credential-manager'
 import { whoamiAction, whoamiCommand } from '@/platforms/teams/commands/whoami'
+import { TeamsCredentialManager } from '@/platforms/teams/credential-manager'
 
 let credManagerSpy: ReturnType<typeof spyOn>
 let clientTestAuthSpy: ReturnType<typeof spyOn>
@@ -76,8 +76,6 @@ test('whoami exits with error when not authenticated', async () => {
 
   await whoamiAction({})
 
-  expect(consoleLogSpy).toHaveBeenCalledWith(
-    JSON.stringify({ error: 'Not authenticated. Run "auth extract" first.' }),
-  )
+  expect(consoleLogSpy).toHaveBeenCalledWith(JSON.stringify({ error: 'Not authenticated. Run "auth extract" first.' }))
   expect(processExitSpy).toHaveBeenCalledWith(1)
 })

package/src/platforms/teams/commands/whoami.ts

@@ -1,6 +1,8 @@
 import { Command } from 'commander'
+
 import { handleError } from '@/shared/utils/error-handler'
 import { formatOutput } from '@/shared/utils/output'
+
 import { TeamsClient } from '../client'
 import { TeamsCredentialManager } from '../credential-manager'
 

package/src/platforms/teams/index.ts

@@ -27,4 +27,3 @@ export {
   TeamsTeamSchema,
   TeamsUserSchema,
 } from './types'
-