grok-bot-cli 0.2.2 → 0.2.3

package/README.md

@@ -14,7 +14,7 @@ Manage [Grok Bot](https://cursor.com/help/grok-bot/plans) agents, groups, and me
 npm install --global grok-bot-cli
 ```
 
-Requires Node.js 18+ and the Grok Bot macOS app. Open Grok Bot and sign in once; `gbot` automatically uses the app's encrypted session and routing credentials. No token copying is required.
+Requires Node.js 18+ and the Grok Bot desktop app on macOS or Linux. Open Grok Bot and sign in once; `gbot` automatically uses the app's encrypted session and routing credentials. No token copying is required. On Linux the app keeps its session under `~/.config/Grok Bot` (or `$XDG_CONFIG_HOME`); when it is stored in the system keyring, `gbot` reads the key with `secret-tool` (package `libsecret-tools`).
 
 ## Use
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grok-bot-cli",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "CLI for Grok Bot agents and groups: create, update, message, inspect threads, and automate cleanup",
   "type": "module",
   "bin": {

package/src/app-session.js

@@ -4,7 +4,12 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
-const SAFE_STORAGE_PREFIX = Buffer.from("v10");
+// Chromium OSCrypt: "v10" = fixed password (macOS: the Keychain password; Linux: "peanuts"),
+// "v11" = Linux Secret Service password. macOS stretches with 1003 PBKDF2 rounds, Linux with 1.
+const SAFE_STORAGE_PREFIX_V10 = "v10";
+const SAFE_STORAGE_PREFIX_V11 = "v11";
+const LINUX_BASIC_TEXT_PASSWORD = "peanuts";
+const SUPPORTED_PLATFORMS = new Set(["darwin", "linux"]);
 
 export class GrokBotGatewaySessionError extends Error {
   constructor(code, message) {
@@ -49,13 +54,21 @@ function encryptedPayload(wrapped) {
   return encrypted;
 }
 
-export function decryptSafeStorageString(encryptedBase64, password) {
+function safeStorageKey(password, platform) {
+  const iterations = platform === "linux" ? 1 : 1003;
+  return crypto.pbkdf2Sync(password, "saltysalt", iterations, 16, "sha1");
+}
+
+export function decryptSafeStorageString(encryptedBase64, password, platform = "darwin") {
   const encrypted = Buffer.from(encryptedBase64, "base64");
-  if (!encrypted.subarray(0, 3).equals(SAFE_STORAGE_PREFIX)) {
+  const prefix = encrypted.subarray(0, 3).toString("latin1");
+  const linuxBasicText = platform === "linux" && prefix === SAFE_STORAGE_PREFIX_V10;
+  const keyring = prefix === SAFE_STORAGE_PREFIX_V10 || (platform === "linux" && prefix === SAFE_STORAGE_PREFIX_V11);
+  if (!keyring) {
     throw new Error("Unsupported Grok Bot Safe Storage format.");
   }
 
-  const key = crypto.pbkdf2Sync(password, "saltysalt", 1003, 16, "sha1");
+  const key = safeStorageKey(linuxBasicText ? LINUX_BASIC_TEXT_PASSWORD : password, platform);
   const decipher = crypto.createDecipheriv(
     "aes-128-cbc",
     key,
@@ -67,7 +80,11 @@ export function decryptSafeStorageString(encryptedBase64, password) {
   ]).toString("utf8");
 }
 
-export function grokBotGatewayDescriptorPath(home = homedir()) {
+export function grokBotGatewayDescriptorPath(home = homedir(), platform = process.platform, env = process.env) {
+  if (platform === "linux") {
+    const configHome = env.XDG_CONFIG_HOME || join(home, ".config");
+    return join(configHome, "Grok Bot/gateway-descriptor.json");
+  }
   return join(
     home,
     "Library/Application Support/Grok Bot/gateway-descriptor.json",
@@ -77,11 +94,19 @@ export function grokBotGatewayDescriptorPath(home = homedir()) {
 export function hasGrokBotGatewaySession({
   platform = process.platform,
   home = homedir(),
+  env = process.env,
 } = {}) {
-  return platform === "darwin" && existsSync(grokBotGatewayDescriptorPath(home));
+  return SUPPORTED_PLATFORMS.has(platform) && existsSync(grokBotGatewayDescriptorPath(home, platform, env));
 }
 
-function readKeychainPassword() {
+function readKeychainPassword(platform = process.platform) {
+  if (platform === "linux") {
+    return execFileSync(
+      "secret-tool",
+      ["lookup", "xdg:schema", "chrome_libsecret_os_crypt_password_v2", "application", "Grok Bot"],
+      { encoding: "utf8" },
+    ).trimEnd();
+  }
   return execFileSync(
     "/usr/bin/security",
     ["find-generic-password", "-w", "-s", "Grok Bot Safe Storage"],
@@ -92,18 +117,23 @@ function readKeychainPassword() {
 export function loadGrokBotGatewaySession({
   platform = process.platform,
   home = homedir(),
+  env = process.env,
   getKeychainPassword = readKeychainPassword,
 } = {}) {
-  if (platform !== "darwin") return null;
+  if (!SUPPORTED_PLATFORMS.has(platform)) return null;
 
-  const path = grokBotGatewayDescriptorPath(home);
+  const path = grokBotGatewayDescriptorPath(home, platform, env);
   if (!existsSync(path)) return null;
 
   const wrapped = JSON.parse(readFileSync(path, "utf8"));
   const encrypted = encryptedPayload(wrapped);
+  const prefix = Buffer.from(encrypted, "base64").subarray(0, 3).toString("latin1");
+  // Linux v10 is the keyring-less basic_text backend; no secret store to ask.
+  const needsKeychain = !(platform === "linux" && prefix === SAFE_STORAGE_PREFIX_V10);
   const clear = decryptSafeStorageString(
     encrypted,
-    getKeychainPassword(),
+    needsKeychain ? getKeychainPassword(platform) : LINUX_BASIC_TEXT_PASSWORD,
+    platform,
   );
   const descriptor = JSON.parse(clear);
   if (!descriptor.baseUrl || !descriptor.token) {