browser-cookie-bridge 1.0.0

package/src/app-installer.js

@@ -0,0 +1,54 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { appSupportDir, installedAppPath, projectRoot } from "./paths.js";
+
+export function installApp({ home = os.homedir(), open = true } = {}) {
+  if (process.platform !== "darwin") throw new Error("The desktop app supports macOS only.");
+
+  const packagePath = path.join(projectRoot(), "macos-app");
+  run("swift", ["build", "-c", "release", "--package-path", packagePath]);
+  const binPath = run("swift", [
+    "build",
+    "-c",
+    "release",
+    "--package-path",
+    packagePath,
+    "--show-bin-path",
+  ]).trim();
+
+  const staging = path.join(appSupportDir(home), "app-build", "Browser Cookie Bridge.app");
+  const contents = path.join(staging, "Contents");
+  const macos = path.join(contents, "MacOS");
+  const resources = path.join(contents, "Resources");
+  fs.mkdirSync(macos, { recursive: true, mode: 0o700 });
+  fs.mkdirSync(resources, { recursive: true, mode: 0o700 });
+
+  fs.copyFileSync(path.join(binPath, "BraveCodexSyncApp"), path.join(macos, "BraveCodexSyncApp"));
+  fs.chmodSync(path.join(macos, "BraveCodexSyncApp"), 0o755);
+  fs.copyFileSync(path.join(packagePath, "Info.plist"), path.join(contents, "Info.plist"));
+  fs.cpSync(path.join(packagePath, "Resources"), resources, { recursive: true, force: true });
+
+  run("codesign", ["--force", "--deep", "--sign", "-", staging]);
+
+  const destination = installedAppPath(home);
+  fs.mkdirSync(path.dirname(destination), { recursive: true, mode: 0o755 });
+  fs.rmSync(destination, { recursive: true, force: true });
+  fs.cpSync(staging, destination, { recursive: true, force: true });
+  for (const legacyName of ["Browser ChatGPT Sync.app", "Brave Codex Sync.app"]) {
+    const legacyDestination = path.join(home, "Applications", legacyName);
+    if (legacyDestination !== destination) fs.rmSync(legacyDestination, { recursive: true, force: true });
+  }
+  run("xattr", ["-dr", "com.apple.quarantine", destination], { allowFailure: true });
+  if (open) run("open", [destination]);
+  return destination;
+}
+
+function run(command, args, { allowFailure = false } = {}) {
+  const result = spawnSync(command, args, { encoding: "utf8" });
+  if (result.status !== 0 && !allowFailure) {
+    throw new Error(result.stderr.trim() || `${command} failed with exit code ${result.status}`);
+  }
+  return result.stdout || "";
+}

package/src/broker.js

@@ -0,0 +1,248 @@
+import crypto from "node:crypto";
+import http from "node:http";
+import { EXTENSION_ORIGIN } from "./paths.js";
+
+const MAX_BODY_BYTES = 64 * 1024 * 1024;
+
+export function createBroker({
+  token,
+  port,
+  timeoutMs = 300_000,
+  host = "127.0.0.1",
+  imports = { cookies: true, history: false },
+  sourceBrowser = "brave",
+  targetBrowser = "codex",
+  onEvent = () => {},
+}) {
+  const state = {
+    runId: crypto.randomUUID(),
+    payload: null,
+    completed: false,
+    result: null,
+    sourceSeen: false,
+    targetSeen: false,
+  };
+
+  let resolveCompletion;
+  let rejectCompletion;
+  const completion = new Promise((resolve, reject) => {
+    resolveCompletion = resolve;
+    rejectCompletion = reject;
+  });
+
+  const server = http.createServer(async (request, response) => {
+    try {
+      setSecurityHeaders(response);
+
+      if (request.method === "OPTIONS") {
+        response.writeHead(204);
+        response.end();
+        return;
+      }
+
+      if (!authorized(request, token)) {
+        sendJson(response, 401, { error: "unauthorized" });
+        return;
+      }
+
+      const url = new URL(request.url, `http://${host}:${port}`);
+      if (request.method === "GET" && url.pathname === "/v1/status") {
+        recordPresence(request, state, sourceBrowser, targetBrowser);
+        sendJson(response, 200, {
+          runId: state.runId,
+          sourceNeeded: state.payload === null,
+          targetNeeded: state.payload !== null && !state.completed,
+          imports,
+          sourceBrowser,
+          targetBrowser,
+        });
+        return;
+      }
+
+      if (request.method === "POST" && url.pathname === "/v1/failure") {
+        const body = await readJson(request);
+        const endpoint = body.endpoint === "source" ? "source" : body.endpoint === "target" ? "target" : null;
+        if (!endpoint) throw new ClientError("endpoint must be source or target");
+        const browser = endpoint === "source" ? sourceBrowser : targetBrowser;
+        const detail = safeDetail(body.message);
+        const action = endpoint === "source"
+          ? `${browserName(browser)} could not read the selected data. Reload Browser Cookie Bridge on its Extensions page, allow Cookies/History access, and try again.`
+          : `${browserName(browser)} could not finish the import. Reload Browser Cookie Bridge on its Extensions page, allow site access, and try again.`;
+        const error = new Error(detail ? `${action} Browser message: ${detail}` : action);
+        onEvent({ type: "failure", endpoint, browser, message: error.message });
+        rejectCompletion(error);
+        sendJson(response, 202, { accepted: true });
+        return;
+      }
+
+      if (request.method === "POST" && url.pathname === "/v1/source") {
+        const body = await readJson(request);
+        if (!Array.isArray(body.cookies) || !Array.isArray(body.history)) {
+          throw new ClientError("cookies and history must be arrays");
+        }
+        state.payload = { cookies: body.cookies, history: body.history };
+        onEvent({ type: "source", cookies: body.cookies.length, history: body.history.length });
+        sendJson(response, 202, {
+          acceptedCookies: body.cookies.length,
+          acceptedHistory: body.history.length,
+          runId: state.runId,
+        });
+        return;
+      }
+
+      if (request.method === "GET" && url.pathname === "/v1/payload") {
+        if (state.payload === null) {
+          sendJson(response, 204, null);
+          return;
+        }
+        sendJson(response, 200, { runId: state.runId, ...state.payload });
+        return;
+      }
+
+      if (request.method === "POST" && url.pathname === "/v1/complete") {
+        const body = await readJson(request);
+        state.completed = true;
+        state.result = {
+          imported: positiveInteger(body.imported),
+          failed: positiveInteger(body.failed),
+          skipped: positiveInteger(body.skipped),
+          historyImported: positiveInteger(body.historyImported),
+          historyFailed: positiveInteger(body.historyFailed),
+          historySkipped: positiveInteger(body.historySkipped),
+        };
+        state.payload = null;
+        onEvent({ type: "complete", ...state.result });
+        resolveCompletion(state.result);
+        sendJson(response, 200, { ok: true });
+        return;
+      }
+
+      sendJson(response, 404, { error: "not_found" });
+    } catch (error) {
+      const status = error instanceof ClientError ? 400 : 500;
+      sendJson(response, status, { error: error.message });
+    }
+  });
+
+  const timer = setTimeout(() => {
+    const error = new Error(timeoutGuidance(state, sourceBrowser, targetBrowser));
+    rejectCompletion(error);
+    server.close();
+  }, timeoutMs);
+  timer.unref();
+
+  completion.finally(() => {
+    clearTimeout(timer);
+    server.close();
+  }).catch(() => {});
+
+  return {
+    async listen() {
+      await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(port, host, resolve);
+      });
+      onEvent({ type: "listening", host, port, runId: state.runId });
+    },
+    close() {
+      clearTimeout(timer);
+      state.payload = null;
+      server.close();
+    },
+    completion,
+  };
+}
+
+function authorized(request, token) {
+  const supplied = request.headers.authorization || "";
+  const expected = `Bearer ${token}`;
+  if (supplied.length !== expected.length) return false;
+  const tokenMatches = crypto.timingSafeEqual(Buffer.from(supplied), Buffer.from(expected));
+  const origin = request.headers.origin;
+  return tokenMatches && (origin === undefined || origin === EXTENSION_ORIGIN);
+}
+
+function setSecurityHeaders(response) {
+  response.setHeader("Access-Control-Allow-Origin", EXTENSION_ORIGIN);
+  response.setHeader("Access-Control-Allow-Headers", "authorization, content-type, x-sync-browser, x-sync-role");
+  response.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+  response.setHeader("Cache-Control", "no-store");
+  response.setHeader("Content-Security-Policy", "default-src 'none'");
+  response.setHeader("X-Content-Type-Options", "nosniff");
+}
+
+function sendJson(response, status, value) {
+  if (status === 204) {
+    response.writeHead(status);
+    response.end();
+    return;
+  }
+  const body = JSON.stringify(value);
+  response.writeHead(status, { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) });
+  response.end(body);
+}
+
+async function readJson(request) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of request) {
+    size += chunk.length;
+    if (size > MAX_BODY_BYTES) throw new ClientError("request body is too large");
+    chunks.push(chunk);
+  }
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    throw new ClientError("invalid JSON");
+  }
+}
+
+function positiveInteger(value) {
+  return Number.isInteger(value) && value >= 0 ? value : 0;
+}
+
+function recordPresence(request, state, sourceBrowser, targetBrowser) {
+  const browser = request.headers["x-sync-browser"];
+  const role = request.headers["x-sync-role"];
+  if (browser === sourceBrowser && role === "browser") state.sourceSeen = true;
+  const targetRole = targetBrowser === "codex" ? "target" : "browser";
+  if (browser === targetBrowser && role === targetRole) state.targetSeen = true;
+}
+
+function timeoutGuidance(state, sourceBrowser, targetBrowser) {
+  const source = browserName(sourceBrowser);
+  const target = browserName(targetBrowser);
+  if (!state.sourceSeen && !state.targetSeen) {
+    return `Neither endpoint connected. Open ${source} and ${target}, then reload Browser Cookie Bridge on both Extensions pages.`;
+  }
+  if (!state.sourceSeen) {
+    return `${source} did not connect. Open it, then reload Browser Cookie Bridge on its Extensions page.`;
+  }
+  if (!state.targetSeen) {
+    return `${target} did not connect. Open it, then reload Browser Cookie Bridge on its Extensions page.`;
+  }
+  if (state.payload === null) {
+    return `${source} connected but did not provide data. Reload its extension, allow Cookies/History access, and try again.`;
+  }
+  return `${target} connected but did not finish the import. Reload its extension, allow site access, and try again.`;
+}
+
+function browserName(browser) {
+  return ({
+    brave: "Brave",
+    chrome: "Chrome",
+    edge: "Edge",
+    arc: "Arc",
+    vivaldi: "Vivaldi",
+    opera: "Opera",
+    comet: "Comet",
+    codex: "ChatGPT Codex",
+  })[browser] || browser;
+}
+
+function safeDetail(value) {
+  if (typeof value !== "string") return "";
+  return value.replace(/[\r\n\t]+/g, " ").trim().slice(0, 240);
+}
+
+class ClientError extends Error {}

package/src/chromium-reader.js

@@ -0,0 +1,190 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { DatabaseSync } from "node:sqlite";
+
+const CHROMIUM_EPOCH_OFFSET_SECONDS = 11_644_473_600;
+
+const BROWSERS = {
+  brave: {
+    root: ["BraveSoftware", "Brave-Browser"],
+    safeStorageService: "Brave Safe Storage",
+    safeStorageAccount: "Brave",
+  },
+  chrome: {
+    root: ["Google", "Chrome"],
+    safeStorageService: "Chrome Safe Storage",
+    safeStorageAccount: "Chrome",
+  },
+  edge: {
+    root: ["Microsoft Edge"],
+    safeStorageService: "Microsoft Edge Safe Storage",
+    safeStorageAccount: "Microsoft Edge",
+  },
+  arc: {
+    root: ["Arc", "User Data"],
+    safeStorageService: "Arc Safe Storage",
+    safeStorageAccount: "Arc",
+  },
+  vivaldi: {
+    root: ["Vivaldi"],
+    safeStorageService: "Vivaldi Safe Storage",
+    safeStorageAccount: "Vivaldi",
+  },
+  opera: {
+    root: ["com.operasoftware.Opera"],
+    directProfile: true,
+    safeStorageService: "Opera Safe Storage",
+    safeStorageAccount: "Opera",
+  },
+  comet: {
+    root: ["Comet"],
+    safeStorageService: "Comet Safe Storage",
+    safeStorageAccount: "Comet",
+  },
+};
+
+export function readChromiumProfile({
+  browser,
+  imports = { cookies: true, history: false },
+  home = os.homedir(),
+  password,
+} = {}) {
+  const definition = BROWSERS[browser];
+  if (!definition) throw new Error(`Unsupported Chromium source: ${browser}`);
+  const root = path.join(home, "Library", "Application Support", ...definition.root);
+  const profileName = definition.directProfile ? "Default" : activeProfileName(root);
+  const profilePath = definition.directProfile ? root : path.join(root, profileName);
+  if (!fs.existsSync(profilePath)) {
+    throw new Error(`${browserDisplayName(browser)} profile not found at ${profilePath}`);
+  }
+
+  const cookies = imports.cookies
+    ? readCookies({
+        databasePath: firstExisting([
+          path.join(profilePath, "Network", "Cookies"),
+          path.join(profilePath, "Cookies"),
+        ]),
+        password: password ?? readSafeStoragePassword(definition, browser),
+      })
+    : [];
+  const history = imports.history
+    ? readHistory(path.join(profilePath, "History"))
+    : [];
+
+  return { cookies, history, profileName, profilePath };
+}
+
+export function decryptChromiumCookieValue({ domain, encryptedValue, password }) {
+  const encoded = Buffer.from(encryptedValue);
+  if (encoded.length < 4 || (encoded.subarray(0, 3).toString() !== "v10" && encoded.subarray(0, 3).toString() !== "v11")) {
+    throw new Error("Unsupported Chromium cookie encryption format");
+  }
+  const key = crypto.pbkdf2Sync(password, "saltysalt", 1003, 16, "sha1");
+  const decipher = crypto.createDecipheriv("aes-128-cbc", key, Buffer.alloc(16, 0x20));
+  const plaintext = Buffer.concat([decipher.update(encoded.subarray(3)), decipher.final()]);
+  if (plaintext.length < 32) throw new Error("Invalid Chromium cookie payload");
+  const expected = crypto.createHash("sha256").update(domain).digest();
+  if (!crypto.timingSafeEqual(plaintext.subarray(0, 32), expected)) {
+    throw new Error("Chromium cookie host verification failed");
+  }
+  return plaintext.subarray(32).toString();
+}
+
+function readCookies({ databasePath, password }) {
+  if (databasePath === null) throw new Error("Cookie database was not found");
+  const database = new DatabaseSync(databasePath, { readOnly: true });
+  try {
+    const rows = database.prepare(`
+      SELECT host_key, top_frame_site_key, name, value, encrypted_value, path,
+             CAST(expires_utc AS TEXT) AS expires_utc,
+             is_secure, is_httponly, has_expires, is_persistent, samesite,
+             has_cross_site_ancestor
+      FROM cookies
+    `).all();
+    const cookies = [];
+    for (const row of rows) {
+      try {
+        const value = row.value || decryptChromiumCookieValue({
+          domain: row.host_key,
+          encryptedValue: row.encrypted_value,
+          password,
+        });
+        const persistent = Boolean(row.has_expires && row.is_persistent && row.expires_utc > 0);
+        cookies.push({
+          name: row.name,
+          value,
+          domain: row.host_key,
+          hostOnly: !row.host_key.startsWith("."),
+          path: row.path,
+          secure: Boolean(row.is_secure),
+          httpOnly: Boolean(row.is_httponly),
+          sameSite: ({ "-1": "unspecified", 0: "no_restriction", 1: "lax", 2: "strict" })[row.samesite] || "unspecified",
+          session: !persistent,
+          ...(persistent ? { expirationDate: chromiumToUnixSeconds(row.expires_utc) } : {}),
+          ...(row.top_frame_site_key ? {
+            partitionKey: {
+              topLevelSite: row.top_frame_site_key,
+              hasCrossSiteAncestor: Boolean(row.has_cross_site_ancestor),
+            },
+          } : {}),
+        });
+      } catch {
+        // An individual malformed or obsolete cookie must not block the rest of the profile.
+      }
+    }
+    return cookies;
+  } finally {
+    database.close();
+  }
+}
+
+function readHistory(databasePath) {
+  if (!fs.existsSync(databasePath)) return [];
+  const database = new DatabaseSync(databasePath, { readOnly: true });
+  try {
+    return database.prepare("SELECT url FROM urls WHERE url LIKE 'http://%' OR url LIKE 'https://%'")
+      .all()
+      .flatMap((row) => typeof row.url === "string" ? [{ url: row.url }] : []);
+  } finally {
+    database.close();
+  }
+}
+
+function readSafeStoragePassword(definition, browser) {
+  const args = ["find-generic-password", "-w", "-s", definition.safeStorageService];
+  if (definition.safeStorageAccount) args.push("-a", definition.safeStorageAccount);
+  const result = spawnSync("/usr/bin/security", args, { encoding: "utf8", maxBuffer: 1024 * 1024 });
+  if (result.status !== 0) {
+    throw new Error(
+      `${browserDisplayName(browser)} Safe Storage is unavailable. Open ${browserDisplayName(browser)} once, then try again.`,
+    );
+  }
+  return result.stdout.trimEnd();
+}
+
+function activeProfileName(root) {
+  try {
+    const localState = JSON.parse(fs.readFileSync(path.join(root, "Local State"), "utf8"));
+    const lastUsed = localState.profile?.last_used;
+    if (typeof lastUsed === "string" && lastUsed && fs.existsSync(path.join(root, lastUsed))) return lastUsed;
+  } catch {}
+  if (fs.existsSync(path.join(root, "Default"))) return "Default";
+  const candidate = fs.readdirSync(root, { withFileTypes: true })
+    .find((entry) => entry.isDirectory() && /^Profile \d+$/.test(entry.name));
+  return candidate?.name || "Default";
+}
+
+function firstExisting(candidates) {
+  return candidates.find((candidate) => fs.existsSync(candidate)) || null;
+}
+
+function chromiumToUnixSeconds(value) {
+  return Number(value) / 1_000_000 - CHROMIUM_EPOCH_OFFSET_SECONDS;
+}
+
+function browserDisplayName(browser) {
+  return ({ brave: "Brave", chrome: "Chrome", edge: "Edge", arc: "Arc", vivaldi: "Vivaldi", opera: "Opera", comet: "Comet" })[browser] || browser;
+}