agent-messenger 2.7.0 → 2.9.0

package/src/shared/chromium/decryptor.ts

@@ -0,0 +1,227 @@
+import { execSync } from 'node:child_process'
+import { createDecipheriv, pbkdf2Sync } from 'node:crypto'
+import { existsSync, readFileSync } from 'node:fs'
+
+import { DerivedKeyCache, type Platform } from '@/shared/utils/derived-key-cache'
+import { lookupLinuxKeyringPassword } from '@/shared/utils/linux-keyring'
+
+import { BROWSER_KEYCHAIN_VARIANTS } from './browsers'
+import type { KeychainVariant } from './types'
+
+export interface ChromiumDecryptorOptions {
+  platform: NodeJS.Platform
+  /** App-specific keychain entries, prepended before browser variants */
+  appKeychainVariants?: KeychainVariant[]
+  /** Optional key cache for avoiding repeated macOS Keychain prompts */
+  keyCache?: DerivedKeyCache
+  /** Platform identifier for key cache (e.g. 'slack', 'discord') */
+  keyCachePlatform?: Platform
+  /** App names to try for Linux v11 keyring lookup (e.g. ['discord', 'Discord']) */
+  linuxKeyringAppNames?: string[]
+}
+
+export class ChromiumCookieDecryptor {
+  private platform: NodeJS.Platform
+  private keychainVariants: KeychainVariant[]
+  private keyCache: DerivedKeyCache | null
+  private keyCachePlatform: Platform | null
+  private linuxKeyringAppNames: string[]
+  private cachedKey: Buffer | null = null
+  private usedCachedKey = false
+
+  constructor(options: ChromiumDecryptorOptions) {
+    this.platform = options.platform
+    // App-specific variants come first, browser variants as fallback
+    this.keychainVariants = [...(options.appKeychainVariants ?? []), ...BROWSER_KEYCHAIN_VARIANTS]
+    this.keyCache = options.keyCache ?? null
+    this.keyCachePlatform = options.keyCachePlatform ?? null
+    this.linuxKeyringAppNames = options.linuxKeyringAppNames ?? []
+  }
+
+  isEncryptedValue(value: Buffer): boolean {
+    if (!value || value.length < 4) return false
+    const prefix = value.subarray(0, 3).toString('utf8')
+    return prefix === 'v10' || prefix === 'v11'
+  }
+
+  async loadCachedKey(): Promise<void> {
+    if (this.platform !== 'darwin' || !this.keyCache || !this.keyCachePlatform) return
+    const cached = await this.keyCache.get(this.keyCachePlatform)
+    if (cached) {
+      this.cachedKey = cached
+      this.usedCachedKey = true
+    }
+  }
+
+  async clearKeyCache(): Promise<void> {
+    if (this.keyCache && this.keyCachePlatform) {
+      await this.keyCache.clear(this.keyCachePlatform)
+    }
+    this.cachedKey = null
+    this.usedCachedKey = false
+  }
+
+  decryptCookie(encryptedValue: Buffer, localStatePath?: string): string | null {
+    return this.decryptCookieRaw(encryptedValue, localStatePath)?.toString('utf8') ?? null
+  }
+
+  decryptCookieRaw(encryptedValue: Buffer, localStatePath?: string): Buffer | null {
+    if (!this.isEncryptedValue(encryptedValue)) {
+      return encryptedValue
+    }
+    if (this.platform === 'win32') {
+      return this.decryptWindowsCookieRaw(encryptedValue, localStatePath)
+    } else if (this.platform === 'darwin') {
+      return this.decryptMacCookieRaw(encryptedValue)
+    } else if (this.platform === 'linux') {
+      return this.decryptLinuxCookieRaw(encryptedValue)
+    }
+    return null
+  }
+
+  decryptMacCookie(encryptedData: Buffer): string | null {
+    return this.decryptMacCookieRaw(encryptedData)?.toString('utf8') ?? null
+  }
+
+  decryptMacCookieRaw(encryptedData: Buffer): Buffer | null {
+    if (this.cachedKey) {
+      const decrypted = this.decryptAESCBCRaw(encryptedData, this.cachedKey)
+      if (decrypted) return decrypted
+    }
+
+    for (const variant of this.keychainVariants) {
+      const password = this.execKeychainLookup(variant.service, variant.account)
+      if (!password) continue
+
+      const key = pbkdf2Sync(password, 'saltysalt', 1003, 16, 'sha1')
+      const decrypted = this.decryptAESCBCRaw(encryptedData, key)
+      if (decrypted) {
+        this.cachedKey = key
+        if (this.keyCache && this.keyCachePlatform) {
+          this.keyCache.set(this.keyCachePlatform, key).catch(() => {})
+        }
+        return decrypted
+      }
+    }
+
+    return null
+  }
+
+  decryptLinuxCookie(encryptedData: Buffer): string | null {
+    return this.decryptLinuxCookieRaw(encryptedData)?.toString('utf8') ?? null
+  }
+
+  decryptLinuxCookieRaw(encryptedData: Buffer): Buffer | null {
+    const prefix = encryptedData.subarray(0, 3).toString('utf8')
+
+    if (prefix === 'v11' && this.linuxKeyringAppNames.length > 0) {
+      for (const appName of this.linuxKeyringAppNames) {
+        try {
+          const keyringPassword = lookupLinuxKeyringPassword(appName)
+          const key = pbkdf2Sync(keyringPassword, 'saltysalt', 1, 16, 'sha1')
+          const result = this.decryptAESCBCRaw(encryptedData, key)
+          if (result) return result
+        } catch {}
+      }
+    }
+
+    const key = pbkdf2Sync('peanuts', 'saltysalt', 1, 16, 'sha1')
+    return this.decryptAESCBCRaw(encryptedData, key)
+  }
+
+  decryptWindowsCookie(encryptedData: Buffer, localStatePath?: string): string | null {
+    return this.decryptWindowsCookieRaw(encryptedData, localStatePath)?.toString('utf8') ?? null
+  }
+
+  decryptWindowsCookieRaw(encryptedData: Buffer, localStatePath?: string): Buffer | null {
+    if (!localStatePath || !existsSync(localStatePath)) return null
+    try {
+      const localState = JSON.parse(readFileSync(localStatePath, 'utf8'))
+      const encryptedKey = Buffer.from(localState.os_crypt.encrypted_key, 'base64')
+      const dpapiBlobKey = encryptedKey.subarray(5)
+      const masterKey = this.decryptDPAPI(dpapiBlobKey)
+      if (!masterKey) return null
+      return this.decryptAESGCMRaw(encryptedData, masterKey)
+    } catch {
+      return null
+    }
+  }
+
+  decryptAESCBC(encryptedData: Buffer, key: Buffer): string | null {
+    const buf = this.decryptAESCBCRaw(encryptedData, key)
+    return buf?.toString('utf8') ?? null
+  }
+
+  decryptAESCBCRaw(encryptedData: Buffer, key: Buffer): Buffer | null {
+    try {
+      const ciphertext = encryptedData.subarray(3)
+      const iv = Buffer.alloc(16, 0x20)
+      const decipher = createDecipheriv('aes-128-cbc', key, iv)
+      decipher.setAutoPadding(true)
+      return Buffer.concat([decipher.update(ciphertext), decipher.final()])
+    } catch {
+      return null
+    }
+  }
+
+  decryptAESGCM(encryptedData: Buffer, key: Buffer): string | null {
+    const buf = this.decryptAESGCMRaw(encryptedData, key)
+    return buf?.toString('utf8') ?? null
+  }
+
+  decryptAESGCMRaw(encryptedData: Buffer, key: Buffer): Buffer | null {
+    try {
+      if (encryptedData.length < 3 + 12 + 16) return null
+      const iv = encryptedData.subarray(3, 15)
+      const authTag = encryptedData.subarray(-16)
+      const ciphertext = encryptedData.subarray(15, -16)
+      const decipher = createDecipheriv('aes-256-gcm', key, iv)
+      decipher.setAuthTag(authTag)
+      return Buffer.concat([decipher.update(ciphertext), decipher.final()])
+    } catch {
+      return null
+    }
+  }
+
+  decryptDPAPI(encrypted: Buffer): Buffer | null {
+    if (this.platform !== 'win32') return null
+    try {
+      const b64Input = encrypted.toString('base64')
+      const script = [
+        'Add-Type -AssemblyName System.Security',
+        `$d=[System.Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String("${b64Input}"),$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)`,
+        '[Convert]::ToBase64String($d)',
+      ].join(';')
+      const encodedCommand = Buffer.from(script, 'utf16le').toString('base64')
+      const result = execSync(`powershell -NoProfile -NonInteractive -EncodedCommand ${encodedCommand}`, {
+        encoding: 'utf8',
+        timeout: 10000,
+      }).trim()
+      return Buffer.from(result, 'base64')
+    } catch {
+      return null
+    }
+  }
+
+  static stripIntegrityHash(decrypted: Buffer): Buffer {
+    if (decrypted.length <= 32) return decrypted
+    const hasNonPrintablePrefix = decrypted.subarray(0, 32).some((b) => b < 0x20 || b > 0x7e)
+    if (hasNonPrintablePrefix) {
+      return decrypted.subarray(32)
+    }
+    return decrypted
+  }
+
+  private execKeychainLookup(service: string, account: string): string | null {
+    try {
+      const safeService = service.replace(/"/g, '\\"')
+      const safeAccount = account.replace(/"/g, '\\"')
+      const result = execSync(`security find-generic-password -s "${safeService}" -a "${safeAccount}" -w 2>/dev/null`, {
+        encoding: 'utf8',
+      })
+      return result.trim() || null
+    } catch {
+      return null
+    }
+  }
+}

package/src/shared/chromium/index.ts

@@ -0,0 +1,11 @@
+export type { BrowserConfig, KeychainVariant } from './types'
+export {
+  BROWSER_KEYCHAIN_VARIANTS,
+  CHROMIUM_BROWSERS,
+  discoverBrowserProfileDirs,
+  findLocalStatePath,
+  getBrowserBasePath,
+} from './browsers'
+export { ChromiumCookieDecryptor } from './decryptor'
+export type { ChromiumDecryptorOptions } from './decryptor'
+export { ChromiumCookieReader } from './cookie-reader'

package/src/shared/chromium/types.ts

@@ -0,0 +1,11 @@
+export interface BrowserConfig {
+  name: string
+  darwin: string
+  linux: string
+  win32: string
+}
+
+export interface KeychainVariant {
+  service: string
+  account: string
+}

package/src/shared/utils/derived-key-cache.ts

@@ -3,7 +3,7 @@ import { mkdir, readFile, rm, writeFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
 
-export type Platform = 'slack' | 'discord' | 'teams' | 'webex'
+export type Platform = 'slack' | 'discord' | 'teams' | 'instagram' | 'channeltalk'
 
 /**
  * Caches derived encryption keys to avoid repeated macOS Keychain prompts.

package/src/shared/utils/linux-keyring.ts

@@ -1,8 +1,8 @@
 import { execSync } from 'node:child_process'
 
 export function lookupLinuxKeyringPassword(appName: string): string {
-  return execSync(
-    `secret-tool lookup xdg:schema chrome_libsecret_os_crypt_password_v2 application ${appName}`,
-    { timeout: 5000, encoding: 'utf8' },
-  ).trim()
+  return execSync(`secret-tool lookup xdg:schema chrome_libsecret_os_crypt_password_v2 application ${appName}`, {
+    timeout: 5000,
+    encoding: 'utf8',
+  }).trim()
 }

package/src/tui/adapters/kakaotalk-adapter.ts

@@ -64,7 +64,12 @@ export class KakaoTalkAdapter implements PlatformAdapter {
     if (!creds) throw new Error(`Account ${accountId} not found`)
 
     const client = new KakaoTalkClient()
-    await client.login({ oauthToken: creds.oauth_token, userId: creds.user_id, deviceUuid: creds.device_uuid, deviceType: creds.device_type })
+    await client.login({
+      oauthToken: creds.oauth_token,
+      userId: creds.user_id,
+      deviceUuid: creds.device_uuid,
+      deviceType: creds.device_type,
+    })
     this.client = client
     this.currentAccount = { id: creds.account_id, name: creds.account_id }
   }

package/src/tui/adapters/telegram-adapter.ts

@@ -1,5 +1,5 @@
-import { TelegramCredentialManager } from '@/platforms/telegram/credential-manager'
 import { TelegramTdlibClient } from '@/platforms/telegram/client'
+import { TelegramCredentialManager } from '@/platforms/telegram/credential-manager'
 
 import type { AuthHint, AuthIO, PlatformAdapter, UnifiedChannel, UnifiedMessage, Workspace } from './types'
 

package/src/tui/adapters/webex-adapter.ts

@@ -1,8 +1,8 @@
 import { exec } from 'node:child_process'
 
+import { getWebexAppCredentials } from '@/platforms/webex/app-config'
 import { WebexClient } from '@/platforms/webex/client'
 import { WebexCredentialManager } from '@/platforms/webex/credential-manager'
-import { getWebexAppCredentials } from '@/platforms/webex/app-config'
 
 import type { AuthHint, AuthIO, PlatformAdapter, UnifiedChannel, UnifiedMessage } from './types'
 

package/src/tui/app.ts

@@ -1,19 +1,19 @@
 import blessed from 'blessed'
 
-import { SlackAdapter } from './adapters/slack-adapter'
+import { ChannelTalkAdapter } from './adapters/channeltalk-adapter'
 import { DiscordAdapter } from './adapters/discord-adapter'
-import { TeamsAdapter } from './adapters/teams-adapter'
-import { WebexAdapter } from './adapters/webex-adapter'
-import { TelegramAdapter } from './adapters/telegram-adapter'
-import { WhatsAppAdapter } from './adapters/whatsapp-adapter'
-import { LineAdapter } from './adapters/line-adapter'
 import { InstagramAdapter } from './adapters/instagram-adapter'
 import { KakaoTalkAdapter } from './adapters/kakaotalk-adapter'
-import { ChannelTalkAdapter } from './adapters/channeltalk-adapter'
+import { LineAdapter } from './adapters/line-adapter'
+import { SlackAdapter } from './adapters/slack-adapter'
+import { TeamsAdapter } from './adapters/teams-adapter'
+import { TelegramAdapter } from './adapters/telegram-adapter'
 import type { AuthIO, PlatformAdapter, UnifiedChannel, UnifiedMessage, Workspace } from './adapters/types'
+import { WebexAdapter } from './adapters/webex-adapter'
+import { WhatsAppAdapter } from './adapters/whatsapp-adapter'
+import { formatTimestamp } from './utils'
 import { ChannelPicker } from './views/channel-picker'
 import { WorkspacePicker } from './views/workspace-picker'
-import { formatTimestamp } from './utils'
 
 type AppMode = 'selection' | 'read' | 'write' | 'auth'
 type NavLevel = 'platform' | 'workspace' | 'channel'
@@ -34,18 +34,97 @@ export async function createApp(): Promise<void> {
   let activePlatformIndex = -1
   let activeChannelId: string | null = null
 
-
   const platformStates: PlatformState[] = [
-    { adapter: new SlackAdapter(), label: 'Slack', enabled: false, channels: null, workspaces: null, listening: false, lastChannelId: null },
-    { adapter: new DiscordAdapter(), label: 'Discord', enabled: false, channels: null, workspaces: null, listening: false, lastChannelId: null },
-    { adapter: new TeamsAdapter(), label: 'Teams', enabled: false, channels: null, workspaces: null, listening: false, lastChannelId: null },
-    { adapter: new WebexAdapter(), label: 'Webex', enabled: false, channels: null, workspaces: null, listening: false, lastChannelId: null },
-    { adapter: new TelegramAdapter(), label: 'Telegram', enabled: false, channels: null, workspaces: null, listening: false, lastChannelId: null },
-    { adapter: new WhatsAppAdapter(), label: 'WhatsApp', enabled: false, channels: null, workspaces: null, listening: false, lastChannelId: null },
-    { adapter: new LineAdapter(), label: 'LINE', enabled: false, channels: null, workspaces: null, listening: false, lastChannelId: null },
-    { adapter: new InstagramAdapter(), label: 'Instagram', enabled: false, channels: null, workspaces: null, listening: false, lastChannelId: null },
-    { adapter: new KakaoTalkAdapter(), label: 'KakaoTalk', enabled: false, channels: null, workspaces: null, listening: false, lastChannelId: null },
-    { adapter: new ChannelTalkAdapter(), label: 'Channel Talk', enabled: false, channels: null, workspaces: null, listening: false, lastChannelId: null },
+    {
+      adapter: new SlackAdapter(),
+      label: 'Slack',
+      enabled: false,
+      channels: null,
+      workspaces: null,
+      listening: false,
+      lastChannelId: null,
+    },
+    {
+      adapter: new DiscordAdapter(),
+      label: 'Discord',
+      enabled: false,
+      channels: null,
+      workspaces: null,
+      listening: false,
+      lastChannelId: null,
+    },
+    {
+      adapter: new TeamsAdapter(),
+      label: 'Teams',
+      enabled: false,
+      channels: null,
+      workspaces: null,
+      listening: false,
+      lastChannelId: null,
+    },
+    {
+      adapter: new WebexAdapter(),
+      label: 'Webex',
+      enabled: false,
+      channels: null,
+      workspaces: null,
+      listening: false,
+      lastChannelId: null,
+    },
+    {
+      adapter: new TelegramAdapter(),
+      label: 'Telegram',
+      enabled: false,
+      channels: null,
+      workspaces: null,
+      listening: false,
+      lastChannelId: null,
+    },
+    {
+      adapter: new WhatsAppAdapter(),
+      label: 'WhatsApp',
+      enabled: false,
+      channels: null,
+      workspaces: null,
+      listening: false,
+      lastChannelId: null,
+    },
+    {
+      adapter: new LineAdapter(),
+      label: 'LINE',
+      enabled: false,
+      channels: null,
+      workspaces: null,
+      listening: false,
+      lastChannelId: null,
+    },
+    {
+      adapter: new InstagramAdapter(),
+      label: 'Instagram',
+      enabled: false,
+      channels: null,
+      workspaces: null,
+      listening: false,
+      lastChannelId: null,
+    },
+    {
+      adapter: new KakaoTalkAdapter(),
+      label: 'KakaoTalk',
+      enabled: false,
+      channels: null,
+      workspaces: null,
+      listening: false,
+      lastChannelId: null,
+    },
+    {
+      adapter: new ChannelTalkAdapter(),
+      label: 'Channel Talk',
+      enabled: false,
+      channels: null,
+      workspaces: null,
+      listening: false,
+      lastChannelId: null,
+    },
   ]
 
   const screen = blessed.screen({
@@ -222,9 +301,7 @@ export async function createApp(): Promise<void> {
       hints.push('{gray-fg}Ctrl+C{/}: Quit')
       statusBar.setContent(' ' + hints.join('  '))
     } else if (mode === 'auth') {
-      statusBar.setContent(
-        ' {gray-fg}Enter{/}: Submit  {gray-fg}Esc{/}: Cancel  {gray-fg}Ctrl+C{/}: Quit',
-      )
+      statusBar.setContent(' {gray-fg}Enter{/}: Submit  {gray-fg}Esc{/}: Cancel  {gray-fg}Ctrl+C{/}: Quit')
     } else if (mode === 'read') {
       statusBar.setContent(
         ' {gray-fg}Enter{/}: Write  {gray-fg}Esc{/}: Selection  {gray-fg}Ctrl+K{/}: Channel  {gray-fg}Ctrl+W{/}: Workspace  {gray-fg}Ctrl+C{/}: Quit',
@@ -353,9 +430,15 @@ export async function createApp(): Promise<void> {
 
     if (level) {
       switch (level) {
-        case 'platform': showPlatformLevel(); break
-        case 'workspace': showWorkspaceLevel(); break
-        case 'channel': showChannelLevel(); break
+        case 'platform':
+          showPlatformLevel()
+          break
+        case 'workspace':
+          showWorkspaceLevel()
+          break
+        case 'channel':
+          showChannelLevel()
+          break
       }
     } else {
       if (activePlatformIndex >= 0) {
@@ -543,23 +626,29 @@ export async function createApp(): Promise<void> {
     if (mode === 'selection' || mode === 'auth' || channelPicker.isActive() || workspacePicker.isActive()) return
     const p = activePlatform()
     if (!p?.adapter.getWorkspaces) return
-    p.adapter.getWorkspaces().then((workspaces) => {
-      if (workspaces.length <= 1) return
-      workspacePicker.open(workspaces, (workspace) => {
-        if (!p.adapter.switchWorkspace) return
-        p.adapter.switchWorkspace(workspace.id).then(() => {
-          p.channels = null
-          p.workspaces = null
-          renderHeader()
-          if (activeChannelId) {
-            activeChannelId = null
-            messageLog.setContent('')
-            messageLog.setLabel(' Messages ')
-          }
-          enterSelectionMode('channel')
-        }).catch(() => {})
+    p.adapter
+      .getWorkspaces()
+      .then((workspaces) => {
+        if (workspaces.length <= 1) return
+        workspacePicker.open(workspaces, (workspace) => {
+          if (!p.adapter.switchWorkspace) return
+          p.adapter
+            .switchWorkspace(workspace.id)
+            .then(() => {
+              p.channels = null
+              p.workspaces = null
+              renderHeader()
+              if (activeChannelId) {
+                activeChannelId = null
+                messageLog.setContent('')
+                messageLog.setLabel(' Messages ')
+              }
+              enterSelectionMode('channel')
+            })
+            .catch(() => {})
+        })
       })
-    }).catch(() => {})
+      .catch(() => {})
   })
 
   inputBox.on('keypress', (_ch: string, key: blessed.Widgets.Events.IKeyEventArg) => {
@@ -615,26 +704,29 @@ export async function createApp(): Promise<void> {
         const p = activePlatform()
         inputBox.clearValue()
         screen.render()
-        p?.adapter.sendMessage(activeChannelId, text).then(() => {
-          if (!p?.listening) {
+        p?.adapter
+          .sendMessage(activeChannelId, text)
+          .then(() => {
+            if (!p?.listening) {
+              appendMessage({
+                id: Date.now().toString(),
+                channelId: activeChannelId!,
+                author: 'you',
+                content: text,
+                timestamp: (Date.now() / 1000).toString(),
+              })
+            }
+          })
+          .catch((err: unknown) => {
+            const detail = err instanceof Error ? err.message : String(err)
             appendMessage({
-              id: Date.now().toString(),
+              id: 'err',
               channelId: activeChannelId!,
-              author: 'you',
-              content: text,
+              author: 'system',
+              content: `{red-fg}Send failed: ${detail}{/red-fg}`,
               timestamp: (Date.now() / 1000).toString(),
             })
-          }
-        }).catch((err: unknown) => {
-          const detail = err instanceof Error ? err.message : String(err)
-          appendMessage({
-            id: 'err',
-            channelId: activeChannelId!,
-            author: 'system',
-            content: `{red-fg}Send failed: ${detail}{/red-fg}`,
-            timestamp: (Date.now() / 1000).toString(),
           })
-        })
       }
       return
     }
@@ -662,9 +754,7 @@ export async function createApp(): Promise<void> {
     return true
   }
   process.stderr.write = () => true
-  const results = await Promise.allSettled(
-    platformStates.map((p) => p.adapter.login()),
-  )
+  const results = await Promise.allSettled(platformStates.map((p) => p.adapter.login()))
   process.stdout.write = origStdoutWrite
   process.stderr.write = origStderrWrite
   screen.alloc()