chrome-tools 1.1.5 → 1.1.7

package/dist/src/core/db.js

@@ -1 +1,90 @@
-import{existsSync as t,copyFileSync as e,mkdtempSync as r,unlinkSync as o,rmSync as a}from"node:fs";import{tmpdir as n}from"node:os";import{join as c,basename as s}from"node:path";import l from"better-sqlite3";export function queryDatabase(o,a,f=[]){if(!t(o))throw new Error(`Database file not found: ${o}`);const m=r(c(n(),"chrome-tools-")),h=c(m,s(o));try{e(o,h)}catch(t){throw i(h,m),new Error(`Failed to copy database file '${s(o)}': ${t.message}`)}let y;try{y=new l(h,{readonly:!0,timeout:5e3});const t=y.prepare(a);return f.length>0?t.all(...f):t.all()}catch(t){throw new Error(`Database query failed on '${s(o)}': ${t.message}`)}finally{if(y)try{y.close()}catch{}i(h,m)}}export function tableExists(t,e){try{return queryDatabase(t,"SELECT name FROM sqlite_master WHERE type='table' AND name=?",[e]).length>0}catch{return!1}}function i(t,e){try{o(t)}catch{}try{a(e,{recursive:!0,force:!0})}catch{}}
+import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, basename } from "node:path";
+import Database from "better-sqlite3";
+/**
+ * Creates a transactionally consistent snapshot of a Chrome SQLite database,
+ * executes a query against it, and cleans up. `VACUUM INTO` reads through
+ * SQLite itself, so live WAL contents are included without racing raw file
+ * copies while Chrome is writing.
+ *
+ * @param dbFilePath - Absolute path to the Chrome database file.
+ * @param sql - SQL query to execute.
+ * @param params - Bound parameters for the query.
+ * @returns Query result rows.
+ * @throws If the file doesn't exist or query fails.
+ */
+export function queryDatabase(dbFilePath, sql, params = []) {
+    if (!existsSync(dbFilePath)) {
+        throw new Error(`Database file not found: ${dbFilePath}`);
+    }
+    const tmpDir = mkdtempSync(join(tmpdir(), "chrome-tools-"));
+    const tmpDb = join(tmpDir, basename(dbFilePath));
+    let sourceDb;
+    try {
+        sourceDb = new Database(dbFilePath, {
+            readonly: true,
+            fileMustExist: true,
+            timeout: 5000,
+        });
+        sourceDb.prepare("VACUUM INTO ?").run(tmpDb);
+    }
+    catch (err) {
+        cleanupTmp(tmpDir);
+        throw new Error(`Failed to snapshot database file '${basename(dbFilePath)}': ${err.message}`);
+    }
+    finally {
+        if (sourceDb) {
+            try {
+                sourceDb.close();
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+    let db;
+    try {
+        db = new Database(tmpDb, { readonly: true, timeout: 5000 });
+        const stmt = db.prepare(sql);
+        return params.length > 0 ? stmt.all(...params) : stmt.all();
+    }
+    catch (err) {
+        throw new Error(`Database query failed on '${basename(dbFilePath)}': ${err.message}`);
+    }
+    finally {
+        if (db) {
+            try {
+                db.close();
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        cleanupTmp(tmpDir);
+    }
+}
+/**
+ * Checks whether a specific table exists in the given database file.
+ *
+ * @param dbFilePath - Absolute path to the database file.
+ * @param tableName - Name of the table to check.
+ * @returns True if the table exists.
+ */
+export function tableExists(dbFilePath, tableName) {
+    try {
+        const rows = queryDatabase(dbFilePath, `SELECT name FROM sqlite_master WHERE type='table' AND name=?`, [tableName]);
+        return rows.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+function cleanupTmp(tmpDir) {
+    try {
+        rmSync(tmpDir, { recursive: true, force: true });
+    }
+    catch {
+        /* ignore */
+    }
+}

package/dist/src/core/keychain.d.ts

@@ -17,6 +17,16 @@ export declare class KeychainAccessError extends Error {
  * Keychain permission (denied/dismissed prompt, locked, or non-interactive).
  */
 export declare function isKeychainAccessDenied(err: unknown): err is KeychainAccessError;
+export type KeychainPasswordProvider = (service: string) => string;
+/**
+ * Returns the current global keychain password provider hook.
+ */
+export declare function getKeychainPasswordProvider(): KeychainPasswordProvider | null;
+/**
+ * Sets the global keychain password provider hook, allowing downstream apps (like Electron)
+ * to intercept keychain password lookups and resolve them (e.g. via native node-keytar).
+ */
+export declare function setKeychainPasswordProvider(provider: KeychainPasswordProvider | null): void;
 /**
  * Retrieves a browser's "Safe Storage" password from the macOS Keychain.
  * Caches the result per service for subsequent calls within the same process.

package/dist/src/core/keychain.js

@@ -1 +1,191 @@
-import{execFileSync as e}from"node:child_process";import{pbkdf2Sync as n}from"node:crypto";const t=Buffer.from("saltysalt"),r="Chrome Safe Storage",s=44,o=36,i=45;export class KeychainAccessError extends Error{service;kind;constructor(e,n,t){super(e),this.name="KeychainAccessError",this.service=n,this.kind=t}get isAccessDenied(){return"access-denied"===this.kind}}export function isKeychainAccessDenied(e){return e instanceof KeychainAccessError&&e.isAccessDenied}const c=new Map,a=new Map;function h(e,n,t){const r="See docs/remote-keychain-access.md for non-interactive / SSH setup.";let c,a;n===s||/could not be found/i.test(t)?(c="not-found",a=`No '${e}' item found in the Keychain.\nRun this browser at least once on this machine so it creates the key.`):n===o||/interaction.*not allowed/i.test(t)?(c="access-denied",a="The Keychain needs a GUI authorization prompt that can't be shown here "+(Boolean(process.env.SSH_CONNECTION||process.env.SSH_TTY)||!process.env.TERM_PROGRAM?"(you appear to be on a remote/SSH session).\n":".\n")+'Authorize once from a GUI Terminal (click "Always Allow"), then unlock the\nkeychain in this session:\n  security unlock-keychain ~/Library/Keychains/login.keychain-db\n'+r):n===i?(c="access-denied",a=`Keychain authorization failed (wrong password or denied).\nTry: security unlock-keychain ~/Library/Keychains/login.keychain-db\n${r}`):(c="access-denied",a=`macOS showed a Keychain access prompt that was denied or dismissed.\nRe-run the command and click "Allow" (or "Always Allow"), or authorize once with:\n  security find-generic-password -w -s "${e}"\n${r}`);const h=[null!==n?`exit ${n}`:null,t||null].filter(Boolean).join(": ");return new KeychainAccessError(`Could not retrieve ${e} key from macOS Keychain.\n${a}`+(h?`\n(security: ${h})`:""),e,c)}export function getKeychainPassword(n=r){const t=c.get(n);if(void 0!==t)return t;let s;try{s=e("security",["find-generic-password","-w","-s",n],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim()}catch(e){const{status:t,stderr:r}=function(e){const n=e;return{status:"number"==typeof n?.status?n.status:null,stderr:(n?.stderr??"").toString().trim()}}(e);throw h(n,t,r)}if(!s)throw new KeychainAccessError(`Keychain returned an empty ${n} key.\nThe item may exist with no password. Re-run the browser to recreate it.`,n,"empty");return c.set(n,s),s}export function getChromeKeychainPassword(){return getKeychainPassword(r)}export function deriveEncryptionKey(e=r,s){const o=a.get(e);if(void 0!==o)return o;const i=s||getKeychainPassword(e);if(!i)throw new Error("Keychain password cannot be empty for key derivation.");const c=n(i,t,1003,16,"sha1");return a.set(e,c),c}export function clearKeychainCache(){c.clear(),a.clear()}
+import { execFileSync } from "node:child_process";
+import { pbkdf2Sync } from "node:crypto";
+const PBKDF2_ITERATIONS = 1003;
+const PBKDF2_KEY_LENGTH = 16;
+const PBKDF2_SALT = Buffer.from("saltysalt");
+/** Chrome's Keychain item, used when no browser-specific label is supplied. */
+const DEFAULT_SAFE_STORAGE_SERVICE = "Chrome Safe Storage";
+/**
+ * Exit codes returned by the macOS `security` CLI (mapped from OSStatus).
+ * Only the ones we explicitly handle are listed here.
+ */
+const SECURITY_EXIT = {
+    ITEM_NOT_FOUND: 44, // errSecItemNotFound
+    INTERACTION_NOT_ALLOWED: 36, // errSecInteractionNotAllowed (SSH / headless / locked)
+    AUTH_FAILED: 45, // errSecAuthFailed
+    USER_CANCELED: 128, // user clicked "Deny"/cancelled the GUI authorization prompt
+};
+/**
+ * Error thrown when a browser's Safe Storage key cannot be read from the
+ * Keychain. Carries the failing `service` and a `kind` so the CLI can show a
+ * clear "No keychain access" message instead of a generic failure.
+ */
+export class KeychainAccessError extends Error {
+    service;
+    kind;
+    constructor(message, service, kind) {
+        super(message);
+        this.name = "KeychainAccessError";
+        this.service = service;
+        this.kind = kind;
+    }
+    /** True when the failure means we couldn't get permission to read the key. */
+    get isAccessDenied() {
+        return this.kind === "access-denied";
+    }
+}
+/**
+ * Narrows an unknown error to a {@link KeychainAccessError} caused by missing
+ * Keychain permission (denied/dismissed prompt, locked, or non-interactive).
+ */
+export function isKeychainAccessDenied(err) {
+    return err instanceof KeychainAccessError && err.isAccessDenied;
+}
+// Caches keyed by Keychain service name so multiple browsers can be read in one
+// process (e.g. `--all-browsers`) without the cache returning the wrong key.
+const _cachedPasswords = new Map();
+const _cachedDerivedKeys = new Map();
+/** Heuristic: are we running without an interactive GUI (Aqua) session? */
+function isLikelyHeadless() {
+    return Boolean(process.env.SSH_CONNECTION || process.env.SSH_TTY) || !process.env.TERM_PROGRAM;
+}
+/** Normalizes the unknown error thrown by execFileSync into the bits we care about. */
+function parseSecurityError(err) {
+    const e = err;
+    return {
+        status: typeof e?.status === "number" ? e.status : null,
+        stderr: (e?.stderr ?? "").toString().trim(),
+    };
+}
+/** Builds a cause-specific, actionable error for a failed keychain read. */
+function buildKeychainError(service, status, stderr) {
+    const docs = "See docs/remote-keychain-access.md for non-interactive / SSH setup.";
+    let kind;
+    let hint;
+    if (status === SECURITY_EXIT.ITEM_NOT_FOUND || /could not be found/i.test(stderr)) {
+        kind = "not-found";
+        hint =
+            `No '${service}' item found in the Keychain.\n` +
+                "Run this browser at least once on this machine so it creates the key.";
+    }
+    else if (status === SECURITY_EXIT.INTERACTION_NOT_ALLOWED ||
+        /interaction.*not allowed/i.test(stderr)) {
+        kind = "access-denied";
+        hint =
+            "The Keychain needs a GUI authorization prompt that can't be shown here " +
+                (isLikelyHeadless() ? "(you appear to be on a remote/SSH session).\n" : ".\n") +
+                "Authorize once from a GUI Terminal (click \"Always Allow\"), then unlock the\n" +
+                "keychain in this session:\n" +
+                "  security unlock-keychain ~/Library/Keychains/login.keychain-db\n" +
+                docs;
+    }
+    else if (status === SECURITY_EXIT.AUTH_FAILED) {
+        kind = "access-denied";
+        hint =
+            "Keychain authorization failed (wrong password or denied).\n" +
+                `Try: security unlock-keychain ~/Library/Keychains/login.keychain-db\n${docs}`;
+    }
+    else {
+        // The remaining case — including user-cancelled prompts (exit 128) — is a
+        // denied/dismissed authorization, i.e. we simply don't have access.
+        kind = "access-denied";
+        hint =
+            "macOS showed a Keychain access prompt that was denied or dismissed.\n" +
+                `Re-run the command and click "Allow" (or "Always Allow"), or authorize once with:\n` +
+                `  security find-generic-password -w -s "${service}"\n${docs}`;
+    }
+    const detail = [
+        status !== null ? `exit ${status}` : null,
+        stderr || null,
+    ]
+        .filter(Boolean)
+        .join(": ");
+    return new KeychainAccessError(`Could not retrieve ${service} key from macOS Keychain.\n${hint}` +
+        (detail ? `\n(security: ${detail})` : ""), service, kind);
+}
+let _passwordProvider = null;
+/**
+ * Returns the current global keychain password provider hook.
+ */
+export function getKeychainPasswordProvider() {
+    return _passwordProvider;
+}
+/**
+ * Sets the global keychain password provider hook, allowing downstream apps (like Electron)
+ * to intercept keychain password lookups and resolve them (e.g. via native node-keytar).
+ */
+export function setKeychainPasswordProvider(provider) {
+    _passwordProvider = provider;
+}
+/**
+ * Retrieves a browser's "Safe Storage" password from the macOS Keychain.
+ * Caches the result per service for subsequent calls within the same process.
+ *
+ * @param service - Keychain service name, e.g. "Chrome Safe Storage".
+ * @returns The raw keychain password.
+ * @throws If the password could not be retrieved.
+ */
+export function getKeychainPassword(service = DEFAULT_SAFE_STORAGE_SERVICE) {
+    const cached = _cachedPasswords.get(service);
+    if (cached !== undefined) {
+        return cached;
+    }
+    let password;
+    if (_passwordProvider) {
+        password = _passwordProvider(service);
+    }
+    else {
+        try {
+            // execFileSync (no shell) avoids any quoting/injection concern around the
+            // service name, which now comes from the browser registry.
+            password = execFileSync("security", ["find-generic-password", "-w", "-s", service], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+        }
+        catch (err) {
+            const { status, stderr } = parseSecurityError(err);
+            throw buildKeychainError(service, status, stderr);
+        }
+    }
+    if (!password) {
+        // Command succeeded (exit 0) but returned nothing — treat as a usable failure.
+        throw new KeychainAccessError(`Keychain returned an empty ${service} key.\n` +
+            "The item may exist with no password. Re-run the browser to recreate it.", service, "empty");
+    }
+    _cachedPasswords.set(service, password);
+    return password;
+}
+/**
+ * Backward-compatible alias for {@link getKeychainPassword} using Chrome's item.
+ * @deprecated Prefer {@link getKeychainPassword} with an explicit service name.
+ */
+export function getChromeKeychainPassword() {
+    return getKeychainPassword(DEFAULT_SAFE_STORAGE_SERVICE);
+}
+/**
+ * Derives the AES-128-CBC key from a browser's Keychain password using PBKDF2.
+ * Caches the result per service.
+ *
+ * @param service - Keychain service name. Defaults to Chrome's.
+ * @param keychainPassword - The raw password. If omitted, fetched from Keychain.
+ * @returns The derived 16-byte key.
+ */
+export function deriveEncryptionKey(service = DEFAULT_SAFE_STORAGE_SERVICE, keychainPassword) {
+    const cached = _cachedDerivedKeys.get(service);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const password = keychainPassword || getKeychainPassword(service);
+    if (!password) {
+        throw new Error("Keychain password cannot be empty for key derivation.");
+    }
+    const key = pbkdf2Sync(password, PBKDF2_SALT, PBKDF2_ITERATIONS, PBKDF2_KEY_LENGTH, "sha1");
+    _cachedDerivedKeys.set(service, key);
+    return key;
+}
+/**
+ * Clears cached keychain data for all browsers. Useful for testing or
+ * re-authentication.
+ */
+export function clearKeychainCache() {
+    _cachedPasswords.clear();
+    _cachedDerivedKeys.clear();
+}

package/dist/src/core/limit.d.ts

@@ -0,0 +1,4 @@
+/** Normalizes the public limit option. Zero, negatives, and non-finite values mean unlimited. */
+export declare function normalizeLimit(limit: number | undefined): number | undefined;
+/** Applies a limit to the final combined result set across every profile. */
+export declare function limitResults<T>(results: T[], limit: number | undefined): T[];

package/dist/src/core/limit.js

@@ -0,0 +1,12 @@
+/** Normalizes the public limit option. Zero, negatives, and non-finite values mean unlimited. */
+export function normalizeLimit(limit) {
+    if (limit === undefined)
+        return undefined;
+    const parsed = Math.trunc(Number(limit));
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
+}
+/** Applies a limit to the final combined result set across every profile. */
+export function limitResults(results, limit) {
+    const normalized = normalizeLimit(limit);
+    return normalized === undefined ? results : results.slice(0, normalized);
+}

package/dist/src/core/platform/darwin.js

@@ -1 +1,31 @@
-import{homedir as r}from"node:os";import{join as o}from"node:path";import{deriveEncryptionKey as e,clearKeychainCache as t}from"../keychain.js";import{decryptValueBuffer as i}from"../crypto.js";import{getActiveBrowser as p}from"../browsers.js";export const darwin={name:"darwin",getDefaultChromeDir:()=>o(r(),"Library","Application Support",...p().dirs.darwin.split("/")),getDecryptionKey:()=>e(p().safeStorageLabel),decrypt:(r,o)=>i(r,o),clearCache(){t()}};
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { deriveEncryptionKey, clearKeychainCache } from "../keychain.js";
+import { decryptValueBuffer } from "../crypto.js";
+import { getActiveBrowser } from "../browsers.js";
+/**
+ * macOS backend.
+ *
+ * Key source: the active browser's "<Browser> Safe Storage" password from the
+ * login Keychain (e.g. "Chrome Safe Storage", "Microsoft Edge Safe Storage"),
+ * stretched with PBKDF2 (1003 iterations) — implemented in `core/keychain.ts`.
+ * Cipher: AES-128-CBC with a fixed 16-space IV — implemented in `core/crypto.ts`.
+ * The browser only changes *which* Keychain item and data dir are used; the
+ * crypto is identical across all Chromium forks.
+ */
+export const darwin = {
+    name: "darwin",
+    getDefaultChromeDir(browser = getActiveBrowser()) {
+        return join(homedir(), "Library", "Application Support", ...browser.dirs.darwin.split("/"));
+    },
+    getDecryptionKey(_chromeDir, browser = getActiveBrowser()) {
+        // The Keychain item is global to the machine, so chromeDir is irrelevant here.
+        return deriveEncryptionKey(browser.safeStorageLabel);
+    },
+    decrypt(blob, key) {
+        return decryptValueBuffer(blob, key);
+    },
+    clearCache() {
+        clearKeychainCache();
+    },
+};

package/dist/src/core/platform/index.d.ts

@@ -6,8 +6,9 @@
  * `decryptValue`, `decryptValueBuffer`, `clearKeyCache`) and stays OS-agnostic.
  */
 import type { ChromePlatform } from "./types.js";
+import { type BrowserDescriptor } from "../browsers.js";
 export type { ChromePlatform } from "./types.js";
-export { BROWSERS, listBrowsers, resolveBrowser, getActiveBrowser, setActiveBrowser, type BrowserId, type BrowserDescriptor, } from "../browsers.js";
+export { BROWSERS, listBrowsers, resolveBrowser, requireBrowser, getActiveBrowser, setActiveBrowser, type BrowserId, type BrowserDescriptor, } from "../browsers.js";
 export { KeychainAccessError, isKeychainAccessDenied, type KeychainErrorKind, } from "../keychain.js";
 /**
  * Returns the backend for the current OS, cached after first call.
@@ -15,12 +16,12 @@ export { KeychainAccessError, isKeychainAccessDenied, type KeychainErrorKind, }
  */
 export declare function selectPlatform(): ChromePlatform;
 /** Default Chrome User Data directory for the current OS. */
-export declare function getPlatformChromeDir(): string;
+export declare function getPlatformChromeDir(browser?: string | BrowserDescriptor): string;
 /**
  * Returns the symmetric key for decrypting this profile's secrets.
  * @param chromeDir - Needed on Windows, where the key lives in `Local State`.
  */
-export declare function deriveEncryptionKey(chromeDir?: string): Buffer;
+export declare function deriveEncryptionKey(chromeDir?: string, browser?: string | BrowserDescriptor): Buffer;
 /** Decrypts a Chrome blob and returns the plaintext bytes (or a placeholder string). */
 export declare function decryptValueBuffer(blob: Buffer | Uint8Array | null | undefined, key: Buffer): Buffer | string;
 /** Decrypts a Chrome blob and returns the plaintext as a UTF-8 string. */

package/dist/src/core/platform/index.js

@@ -1 +1,69 @@
-import{darwin as r}from"./darwin.js";import{win32 as e}from"./win32.js";import{linux as t}from"./linux.js";export{BROWSERS,listBrowsers,resolveBrowser,getActiveBrowser,setActiveBrowser}from"../browsers.js";export{KeychainAccessError,isKeychainAccessDenied}from"../keychain.js";let o=null;export function selectPlatform(){if(o)return o;switch(process.platform){case"darwin":o=r;break;case"win32":o=e;break;case"linux":o=t;break;default:throw new Error(`Unsupported platform: ${process.platform}. chrome-tools supports macOS, Windows, and Linux.`)}return o}export function getPlatformChromeDir(){return selectPlatform().getDefaultChromeDir()}export function deriveEncryptionKey(r){return selectPlatform().getDecryptionKey(r)}export function decryptValueBuffer(r,e){if(!r||0===r.length)return Buffer.alloc(0);const t=Buffer.isBuffer(r)?r:Buffer.from(r);return selectPlatform().decrypt(t,e)}export function decryptValue(r,e){const t=decryptValueBuffer(r,e);return Buffer.isBuffer(t)?t.toString("utf-8"):t}export function clearKeyCache(){selectPlatform().clearCache()}
+import { darwin } from "./darwin.js";
+import { win32 } from "./win32.js";
+import { linux } from "./linux.js";
+import { getActiveBrowser, requireBrowser } from "../browsers.js";
+// Browser selection is orthogonal to platform selection: the backends above
+// read the active browser's data dir + Safe Storage label from the registry.
+// Re-exported here so the rest of the codebase has one import site for both
+// "which OS" and "which browser".
+export { BROWSERS, listBrowsers, resolveBrowser, requireBrowser, getActiveBrowser, setActiveBrowser, } from "../browsers.js";
+// Keychain access failures (macOS) surface a typed error so the CLI can show a
+// clear "No keychain access" message instead of a generic failure.
+export { KeychainAccessError, isKeychainAccessDenied, } from "../keychain.js";
+let _active = null;
+/**
+ * Returns the backend for the current OS, cached after first call.
+ * @throws On an unsupported platform.
+ */
+export function selectPlatform() {
+    if (_active)
+        return _active;
+    switch (process.platform) {
+        case "darwin":
+            _active = darwin;
+            break;
+        case "win32":
+            _active = win32;
+            break;
+        case "linux":
+            _active = linux;
+            break;
+        default:
+            throw new Error(`Unsupported platform: ${process.platform}. ` +
+                "chrome-tools supports macOS, Windows, and Linux.");
+    }
+    return _active;
+}
+/** Default Chrome User Data directory for the current OS. */
+export function getPlatformChromeDir(browser) {
+    return selectPlatform().getDefaultChromeDir(resolveTargetBrowser(browser));
+}
+/**
+ * Returns the symmetric key for decrypting this profile's secrets.
+ * @param chromeDir - Needed on Windows, where the key lives in `Local State`.
+ */
+export function deriveEncryptionKey(chromeDir, browser) {
+    return selectPlatform().getDecryptionKey(chromeDir, resolveTargetBrowser(browser));
+}
+/** Decrypts a Chrome blob and returns the plaintext bytes (or a placeholder string). */
+export function decryptValueBuffer(blob, key) {
+    if (!blob || blob.length === 0) {
+        return Buffer.alloc(0);
+    }
+    const buf = Buffer.isBuffer(blob) ? blob : Buffer.from(blob);
+    return selectPlatform().decrypt(buf, key);
+}
+/** Decrypts a Chrome blob and returns the plaintext as a UTF-8 string. */
+export function decryptValue(blob, key) {
+    const decrypted = decryptValueBuffer(blob, key);
+    return Buffer.isBuffer(decrypted) ? decrypted.toString("utf-8") : decrypted;
+}
+/** Clears the active backend's cached key material. */
+export function clearKeyCache() {
+    selectPlatform().clearCache();
+}
+function resolveTargetBrowser(browser) {
+    if (!browser)
+        return getActiveBrowser();
+    return typeof browser === "string" ? requireBrowser(browser) : browser;
+}

package/dist/src/core/platform/linux.js

@@ -1 +1,64 @@
-import{execFileSync as o}from"node:child_process";import{homedir as r}from"node:os";import{join as t}from"node:path";import{pbkdf2Sync as e}from"node:crypto";import{decryptValueBuffer as n}from"../crypto.js";import{getActiveBrowser as i}from"../browsers.js";const p=Buffer.from("saltysalt"),c=new Map;export const linux={name:"linux",getDefaultChromeDir(){const o=process.env.XDG_CONFIG_HOME||t(r(),".config");return t(o,...i().dirs.linux.split("/"))},getDecryptionKey(){const r=i().linuxSecretApp||"chrome",t=c.get(r);if(void 0!==t)return t;const n=e(function(r){try{const t=o("secret-tool",["lookup","application",r],{encoding:"utf-8",stdio:["pipe","pipe","pipe"]}).trim();if(t)return t}catch{}return"peanuts"}(r),p,1,16,"sha1");return c.set(r,n),n},decrypt:(o,r)=>n(o,r),clearCache(){c.clear()}};
+import { execFileSync } from "node:child_process";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { pbkdf2Sync } from "node:crypto";
+import { decryptValueBuffer } from "../crypto.js";
+import { getActiveBrowser } from "../browsers.js";
+import { getKeychainPasswordProvider } from "../keychain.js";
+// Linux uses the same CBC scheme as macOS but with a single PBKDF2 iteration.
+const PBKDF2_ITERATIONS = 1;
+const PBKDF2_KEY_LENGTH = 16;
+const PBKDF2_SALT = Buffer.from("saltysalt");
+// Chrome's hardcoded fallback when no secret service (gnome-keyring/kwallet) is
+// available — yields the "Basic" (effectively unencrypted) storage scheme.
+const FALLBACK_PASSWORD = "peanuts";
+// Keyed by Secret Service `application` attribute so different browsers cache
+// independently (e.g. under `--all-browsers`).
+const _cachedKeys = new Map();
+/** Looks up the "Safe Storage" password via libsecret, falling back to "peanuts". */
+function getStoragePassword(application) {
+    const provider = getKeychainPasswordProvider();
+    if (provider) {
+        return provider(application);
+    }
+    try {
+        const out = execFileSync("secret-tool", ["lookup", "application", application], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+        if (out)
+            return out;
+    }
+    catch {
+        // secret-tool missing, or no keyring / no entry — fall through to default.
+    }
+    return FALLBACK_PASSWORD;
+}
+/**
+ * Linux backend.
+ *
+ * Key source: the active browser's "Safe Storage" password from the Secret
+ * Service (gnome-keyring / KWallet) via `secret-tool`, or the hardcoded
+ * "peanuts" fallback, stretched with PBKDF2 (1 iteration).
+ * Cipher: AES-128-CBC with a fixed 16-space IV (same primitive as macOS).
+ */
+export const linux = {
+    name: "linux",
+    getDefaultChromeDir(browser = getActiveBrowser()) {
+        const configHome = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
+        return join(configHome, ...browser.dirs.linux.split("/"));
+    },
+    getDecryptionKey(_chromeDir, browser = getActiveBrowser()) {
+        const application = browser.linuxSecretApp || "chrome";
+        const cached = _cachedKeys.get(application);
+        if (cached !== undefined) {
+            return cached;
+        }
+        const key = pbkdf2Sync(getStoragePassword(application), PBKDF2_SALT, PBKDF2_ITERATIONS, PBKDF2_KEY_LENGTH, "sha1");
+        _cachedKeys.set(application, key);
+        return key;
+    },
+    decrypt(blob, key) {
+        return decryptValueBuffer(blob, key);
+    },
+    clearCache() {
+        _cachedKeys.clear();
+    },
+};

package/dist/src/core/platform/types.d.ts

@@ -1,3 +1,4 @@
+import type { BrowserDescriptor } from "../browsers.js";
 /**
  * The platform-specific backend contract.
  *
@@ -11,7 +12,7 @@ export interface ChromePlatform {
     /** Node platform identifier this backend handles (e.g. "darwin", "win32", "linux"). */
     readonly name: string;
     /** Absolute path to Chrome's User Data directory for this OS. */
-    getDefaultChromeDir(): string;
+    getDefaultChromeDir(browser?: BrowserDescriptor): string;
     /**
      * Returns the symmetric key used to decrypt this profile's secrets, ready to
      * hand to {@link decrypt}. May read the OS key store and is cached internally.
@@ -20,7 +21,7 @@ export interface ChromePlatform {
      *   key lives inside `Local State`. Defaults to {@link getDefaultChromeDir}.
      * @throws An actionable Error if the key cannot be obtained.
      */
-    getDecryptionKey(chromeDir?: string): Buffer;
+    getDecryptionKey(chromeDir?: string, browser?: BrowserDescriptor): Buffer;
     /**
      * Decrypts a single Chrome `v10`/`v11` blob using this platform's scheme
      * (AES-128-CBC on macOS/Linux, AES-256-GCM on Windows).

package/dist/src/core/platform/types.js

@@ -1 +1 @@
-export{};
+export {};