agent-messenger 2.7.0 → 2.9.0

package/src/shared/chromium/cookie-reader.ts

@@ -0,0 +1,111 @@
+import { copyFileSync, existsSync, rmSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+const require = createRequire(import.meta.url)
+
+/**
+ * Reads Chromium SQLite cookie databases with Bun/Node dual-runtime support.
+ * Copies the database to a temp file to avoid lock contention when the app is running.
+ */
+export class ChromiumCookieReader {
+  /**
+   * Copy SQLite DB to temp, run query, return all matching rows, cleanup.
+   * Returns empty array if db doesn't exist or query fails.
+   */
+  async queryAll<T>(dbPath: string, sql: string, params?: unknown[]): Promise<T[]> {
+    if (!existsSync(dbPath)) return []
+
+    const tempPath = this.createTempPath()
+
+    try {
+      copyFileSync(dbPath, tempPath)
+    } catch {
+      return []
+    }
+
+    try {
+      return this.executeQuery<T>(tempPath, sql, params, 'all')
+    } catch {
+      return []
+    } finally {
+      this.cleanupTemp(tempPath)
+    }
+  }
+
+  /**
+   * Copy SQLite DB to temp, run query, return first matching row, cleanup.
+   * Returns null if db doesn't exist, no rows match, or query fails.
+   */
+  async queryFirst<T>(dbPath: string, sql: string, params?: unknown[]): Promise<T | null> {
+    if (!existsSync(dbPath)) return null
+
+    const tempPath = this.createTempPath()
+
+    try {
+      copyFileSync(dbPath, tempPath)
+    } catch {
+      return null
+    }
+
+    try {
+      return this.executeQuery<T>(tempPath, sql, params, 'first')
+    } catch {
+      return null
+    } finally {
+      this.cleanupTemp(tempPath)
+    }
+  }
+
+  private createTempPath(): string {
+    return join(tmpdir(), `chromium-cookies-${Date.now()}-${Math.random().toString(36).slice(2)}.db`)
+  }
+
+  private executeQuery<T>(tempPath: string, sql: string, params: unknown[] | undefined, mode: 'all'): T[]
+  private executeQuery<T>(tempPath: string, sql: string, params: unknown[] | undefined, mode: 'first'): T | null
+  private executeQuery<T>(
+    tempPath: string,
+    sql: string,
+    params: unknown[] | undefined,
+    mode: 'all' | 'first',
+  ): T[] | T | null {
+    if (typeof globalThis.Bun !== 'undefined') {
+      const { Database } = require('bun:sqlite')
+      const db = new Database(tempPath, { readonly: true })
+
+      try {
+        const stmt = db.query(sql)
+        if (mode === 'all') {
+          return (params ? stmt.all(...params) : stmt.all()) as T[]
+        }
+
+        return (params ? stmt.get(...params) : stmt.get()) as T | null
+      } finally {
+        db.close()
+      }
+    }
+
+    const Database = require('better-sqlite3')
+    const db = new Database(tempPath, { readonly: true })
+
+    try {
+      const stmt = db.prepare(sql)
+      if (mode === 'all') {
+        return (params ? stmt.all(...params) : stmt.all()) as T[]
+      }
+
+      return (params ? stmt.get(...params) : stmt.get()) as T | null
+    } finally {
+      db.close()
+    }
+  }
+
+  private cleanupTemp(tempPath: string): void {
+    try {
+      rmSync(tempPath, { force: true })
+    } catch {
+      // Temp file cleanup failure is non-critical
+    }
+  }
+}

package/src/shared/chromium/decryptor.test.ts

@@ -0,0 +1,449 @@
+import { beforeEach, describe, expect, spyOn, test } from 'bun:test'
+import { createCipheriv, pbkdf2Sync, randomBytes } from 'node:crypto'
+
+import * as linuxKeyring from '@/shared/utils/linux-keyring'
+
+import { BROWSER_KEYCHAIN_VARIANTS } from './browsers'
+import { ChromiumCookieDecryptor } from './decryptor'
+
+function encryptAESCBC(value: string, key: Buffer, prefix = 'v10'): Buffer {
+  const iv = Buffer.alloc(16, 0x20)
+  const cipher = createCipheriv('aes-128-cbc', key, iv)
+  const ciphertext = Buffer.concat([cipher.update(value, 'utf8'), cipher.final()])
+  return Buffer.concat([Buffer.from(prefix), ciphertext])
+}
+
+function encryptAESGCM(value: string, key: Buffer, prefix = 'v10'): Buffer {
+  const iv = randomBytes(12)
+  const cipher = createCipheriv('aes-256-gcm', key, iv)
+  const ciphertext = Buffer.concat([cipher.update(value, 'utf8'), cipher.final()])
+  const authTag = cipher.getAuthTag()
+  return Buffer.concat([Buffer.from(prefix), iv, ciphertext, authTag])
+}
+
+describe('ChromiumCookieDecryptor', () => {
+  let peanutsKey: Buffer
+
+  beforeEach(() => {
+    peanutsKey = pbkdf2Sync('peanuts', 'saltysalt', 1, 16, 'sha1')
+  })
+
+  describe('constructor', () => {
+    test('prepends appKeychainVariants before browser variants', () => {
+      // given
+      const appVariants = [{ service: 'App Safe Storage', account: 'App' }]
+
+      // when
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'darwin', appKeychainVariants: appVariants })
+
+      // then
+      expect((decryptor as any).keychainVariants).toEqual([...appVariants, ...BROWSER_KEYCHAIN_VARIANTS])
+    })
+
+    test('uses only browser variants when no appKeychainVariants provided', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'darwin' })
+
+      // then
+      expect((decryptor as any).keychainVariants).toEqual(BROWSER_KEYCHAIN_VARIANTS)
+    })
+  })
+
+  describe('isEncryptedValue', () => {
+    test('returns true for v10 prefix with sufficient length', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
+
+      // when
+      const result = decryptor.isEncryptedValue(Buffer.from('v10x'))
+
+      // then
+      expect(result).toBe(true)
+    })
+
+    test('returns true for v11 prefix with sufficient length', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
+
+      // when
+      const result = decryptor.isEncryptedValue(Buffer.from('v11x'))
+
+      // then
+      expect(result).toBe(true)
+    })
+
+    test('returns false for non-v10/v11 prefix', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
+
+      // when
+      const result = decryptor.isEncryptedValue(Buffer.from('abcde'))
+
+      // then
+      expect(result).toBe(false)
+    })
+
+    test('returns false for too-short buffer (< 4 bytes)', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
+
+      // when
+      const result = decryptor.isEncryptedValue(Buffer.from('v10'))
+
+      // then
+      expect(result).toBe(false)
+    })
+
+    test('returns false for null/empty buffer', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
+
+      // when/then
+      expect(decryptor.isEncryptedValue(Buffer.alloc(0))).toBe(false)
+      expect(decryptor.isEncryptedValue(null as unknown as Buffer)).toBe(false)
+    })
+  })
+
+  describe('decryptAESCBC / decryptAESCBCRaw', () => {
+    test('decrypts v10-prefixed AES-128-CBC data with correct key', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
+      const encrypted = encryptAESCBC('test-value', peanutsKey)
+
+      // when
+      const result = decryptor.decryptAESCBC(encrypted, peanutsKey)
+
+      // then
+      expect(result).toBe('test-value')
+    })
+
+    test('returns null with wrong key', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
+      const encrypted = encryptAESCBC('test-value', peanutsKey)
+      const wrongKey = pbkdf2Sync('wrong-password', 'saltysalt', 1, 16, 'sha1')
+
+      // when
+      const result = decryptor.decryptAESCBC(encrypted, wrongKey)
+
+      // then
+      expect(result).toBeNull()
+    })
+
+    test('returns null for corrupted ciphertext', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
+      const encrypted = encryptAESCBC('test-value', peanutsKey)
+      const corrupted = Buffer.from(encrypted)
+      corrupted[corrupted.length - 1] ^= 0xff
+
+      // when
+      const result = decryptor.decryptAESCBC(corrupted, peanutsKey)
+
+      // then
+      expect(result).toBeNull()
+    })
+
+    test('decryptAESCBC returns string, decryptAESCBCRaw returns Buffer', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
+      const encrypted = encryptAESCBC('test-value', peanutsKey)
+
+      // when
+      const stringResult = decryptor.decryptAESCBC(encrypted, peanutsKey)
+      const rawResult = decryptor.decryptAESCBCRaw(encrypted, peanutsKey)
+
+      // then
+      expect(stringResult).toBe('test-value')
+      expect(rawResult).toEqual(Buffer.from('test-value'))
+    })
+  })
+
+  describe('decryptAESGCM / decryptAESGCMRaw', () => {
+    test('decrypts v10-prefixed AES-256-GCM data with correct key', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'win32' })
+      const masterKey = randomBytes(32)
+      const encrypted = encryptAESGCM('test-value', masterKey)
+
+      // when
+      const result = decryptor.decryptAESGCM(encrypted, masterKey)
+
+      // then
+      expect(result).toBe('test-value')
+    })
+
+    test('returns null with wrong key', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'win32' })
+      const masterKey = randomBytes(32)
+      const encrypted = encryptAESGCM('test-value', masterKey)
+
+      // when
+      const result = decryptor.decryptAESGCM(encrypted, randomBytes(32))
+
+      // then
+      expect(result).toBeNull()
+    })
+
+    test('returns null for data shorter than minimum length (3+12+16 = 31 bytes)', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'win32' })
+
+      // when
+      const result = decryptor.decryptAESGCM(Buffer.alloc(30), randomBytes(32))
+
+      // then
+      expect(result).toBeNull()
+    })
+
+    test('decryptAESGCM returns string, decryptAESGCMRaw returns Buffer', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'win32' })
+      const masterKey = randomBytes(32)
+      const encrypted = encryptAESGCM('test-value', masterKey)
+
+      // when
+      const stringResult = decryptor.decryptAESGCM(encrypted, masterKey)
+      const rawResult = decryptor.decryptAESGCMRaw(encrypted, masterKey)
+
+      // then
+      expect(stringResult).toBe('test-value')
+      expect(rawResult).toEqual(Buffer.from('test-value'))
+    })
+  })
+
+  describe('decryptCookie / decryptCookieRaw', () => {
+    test('returns plaintext for non-encrypted values (no v10/v11 prefix)', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
+      const plaintext = Buffer.from('plain-cookie')
+
+      // when
+      const stringResult = decryptor.decryptCookie(plaintext)
+      const rawResult = decryptor.decryptCookieRaw(plaintext)
+
+      // then
+      expect(stringResult).toBe('plain-cookie')
+      expect(rawResult).toEqual(plaintext)
+    })
+
+    test('dispatches to Linux decryption for linux platform with v10 prefix', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
+      const encrypted = Buffer.from('v10cookie')
+      const spy = spyOn(decryptor, 'decryptLinuxCookieRaw')
+
+      // when
+      decryptor.decryptCookieRaw(encrypted)
+
+      // then
+      expect(spy).toHaveBeenCalledWith(encrypted)
+      spy.mockRestore()
+    })
+
+    test('returns null for unsupported platform (e.g. freebsd)', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'freebsd' as NodeJS.Platform })
+
+      // when
+      const result = decryptor.decryptCookie(Buffer.from('v10cookie'))
+
+      // then
+      expect(result).toBeNull()
+    })
+
+    test('decryptCookie returns string, decryptCookieRaw returns Buffer', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
+      const encrypted = encryptAESCBC('test-value', peanutsKey)
+
+      // when
+      const stringResult = decryptor.decryptCookie(encrypted)
+      const rawResult = decryptor.decryptCookieRaw(encrypted)
+
+      // then
+      expect(stringResult).toBe('test-value')
+      expect(rawResult).toEqual(Buffer.from('test-value'))
+    })
+  })
+
+  describe('decryptLinuxCookieRaw', () => {
+    test('decrypts v10-prefixed cookie using peanuts key (known key, verifiable)', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
+      const encrypted = encryptAESCBC('linux-cookie', peanutsKey)
+
+      // when
+      const result = decryptor.decryptLinuxCookieRaw(encrypted)
+
+      // then
+      expect(result).toEqual(Buffer.from('linux-cookie'))
+    })
+
+    test('falls back to peanuts key for v11 when no keyring app names configured', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
+      const encrypted = encryptAESCBC('linux-v11-cookie', peanutsKey, 'v11')
+
+      // when
+      const result = decryptor.decryptLinuxCookieRaw(encrypted)
+
+      // then
+      expect(result).toEqual(Buffer.from('linux-v11-cookie'))
+    })
+  })
+
+  describe('decryptDPAPI', () => {
+    test('returns null on non-win32 platforms', () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'linux' })
+
+      // when
+      const result = decryptor.decryptDPAPI(Buffer.from('encrypted'))
+
+      // then
+      expect(result).toBeNull()
+    })
+  })
+
+  describe('stripIntegrityHash', () => {
+    test('returns input unchanged when length <= 32', () => {
+      // given
+      const decrypted = Buffer.alloc(32, 0x41)
+
+      // when
+      const result = ChromiumCookieDecryptor.stripIntegrityHash(decrypted)
+
+      // then
+      expect(result).toEqual(decrypted)
+    })
+
+    test('strips first 32 bytes when they contain non-printable characters', () => {
+      // given
+      const hash = Buffer.concat([Buffer.from([0x00, 0x1f, 0xff]), Buffer.alloc(29, 0x01)])
+      const value = Buffer.from('cookie-value')
+
+      // when
+      const result = ChromiumCookieDecryptor.stripIntegrityHash(Buffer.concat([hash, value]))
+
+      // then
+      expect(result).toEqual(value)
+    })
+
+    test('returns input unchanged when first 32 bytes are all printable ASCII', () => {
+      // given
+      const printablePrefix = Buffer.from('12345678901234567890123456789012')
+      const decrypted = Buffer.concat([printablePrefix, Buffer.from('cookie-value')])
+
+      // when
+      const result = ChromiumCookieDecryptor.stripIntegrityHash(decrypted)
+
+      // then
+      expect(result).toEqual(decrypted)
+    })
+
+    test('correctly strips binary hash prefix followed by readable cookie value', () => {
+      // given
+      const hash = randomBytes(32)
+      const value = Buffer.from('readable-cookie-value')
+
+      // when
+      const result = ChromiumCookieDecryptor.stripIntegrityHash(Buffer.concat([hash, value]))
+
+      // then
+      expect(result).toEqual(value)
+    })
+
+    test('handles non-printable bytes that would be mangled by UTF-8 conversion (the v130+ fix)', () => {
+      // given
+      const binaryPrefix = Buffer.from([
+        ...Array.from({ length: 16 }, (_, i) => i),
+        ...Array.from({ length: 16 }, (_, i) => 0x80 + i),
+      ])
+      const value = Buffer.from('v130-cookie-value')
+
+      // when
+      const result = ChromiumCookieDecryptor.stripIntegrityHash(Buffer.concat([binaryPrefix, value]))
+
+      // then
+      expect(result).toEqual(value)
+    })
+  })
+
+  describe('loadCachedKey / clearKeyCache', () => {
+    test('loadCachedKey is no-op on non-darwin platform', async () => {
+      // given
+      const keyCache = {
+        get: async () => Buffer.from('should-not-be-used'),
+        clear: async () => {},
+      }
+      const decryptor = new ChromiumCookieDecryptor({
+        platform: 'linux',
+        keyCache: keyCache as any,
+        keyCachePlatform: 'slack',
+      })
+
+      // when
+      await decryptor.loadCachedKey()
+
+      // then
+      expect((decryptor as any).cachedKey).toBeNull()
+      expect((decryptor as any).usedCachedKey).toBe(false)
+    })
+
+    test('loadCachedKey is no-op when no keyCache configured', async () => {
+      // given
+      const decryptor = new ChromiumCookieDecryptor({ platform: 'darwin', keyCachePlatform: 'slack' })
+
+      // when
+      await decryptor.loadCachedKey()
+
+      // then
+      expect((decryptor as any).cachedKey).toBeNull()
+      expect((decryptor as any).usedCachedKey).toBe(false)
+    })
+
+    test('clearKeyCache resets cached key state', async () => {
+      // given
+      const clear = async () => {}
+      const keyCache = { get: async () => null, clear }
+      const decryptor = new ChromiumCookieDecryptor({
+        platform: 'darwin',
+        keyCache: keyCache as any,
+        keyCachePlatform: 'slack',
+      })
+      ;(decryptor as any).cachedKey = Buffer.from('cached-key')
+      ;(decryptor as any).usedCachedKey = true
+
+      // when
+      await decryptor.clearKeyCache()
+
+      // then
+      expect((decryptor as any).cachedKey).toBeNull()
+      expect((decryptor as any).usedCachedKey).toBe(false)
+    })
+  })
+
+  describe('linux v11 keyring behavior', () => {
+    test('uses configured keyring password before falling back', () => {
+      // given
+      const password = 'secret-from-keyring'
+      const key = pbkdf2Sync(password, 'saltysalt', 1, 16, 'sha1')
+      const spy = spyOn(linuxKeyring, 'lookupLinuxKeyringPassword').mockImplementation(() => password)
+      const decryptor = new ChromiumCookieDecryptor({
+        platform: 'linux',
+        linuxKeyringAppNames: ['Discord'],
+      })
+      const encrypted = encryptAESCBC('linux-keyring-cookie', key, 'v11')
+
+      // when
+      const result = decryptor.decryptLinuxCookieRaw(encrypted)
+
+      // then
+      expect(spy).toHaveBeenCalledWith('Discord')
+      expect(result).toEqual(Buffer.from('linux-keyring-cookie'))
+      spy.mockRestore()
+    })
+  })
+})