pi-oracle 0.7.20 → 0.7.22

package/extensions/oracle/worker/auth-bootstrap.mjs

@@ -12,14 +12,15 @@ import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { getCookies } from "@steipete/sweet-cookie";
 import {
   assertNotKnownBrowserUserDataPath,
+  isNativeLinuxChromiumCookieSource,
   sweetCookieSafeStoragePasswordScrubbedEnv,
 } from "../shared/browser-profile-helpers.mjs";
 import { ensureAccountCookie, filterImportableAuthCookies } from "./auth-cookie-policy.mjs";
 import { getCookiesFromConfiguredChromiumSource } from "./chromium-cookie-source.mjs";
 import { parseSnapshotEntries } from "./artifact-heuristics.mjs";
-import { buildAllowedChatGptOrigins } from "./chatgpt-ui-helpers.mjs";
+import { buildAllowedChatGptOrigins, CHATGPT_COMPOSER_LABELS } from "./chatgpt-ui-helpers.mjs";
 import { stripUrlQueryAndHash } from "./chatgpt-flow-helpers.mjs";
-import { buildAccountChooserCandidateLabels, classifyChatAuthPage, normalizeLoginProbeResult } from "./auth-flow-helpers.mjs";
+import { buildAccountChooserCandidateLabels, classifyChatAuthPage, isAuthNavigationError, normalizeLoginProbeResult } from "./auth-flow-helpers.mjs";
 
 const rawConfig = process.argv[2];
 if (!rawConfig) {
@@ -340,10 +341,19 @@ async function launchTargetBrowser() {
   await closeTargetBrowser();
   const args = [...targetBrowserBaseArgs({ withLaunchOptions: true, mode: "headed" }), "open", "about:blank"];
   await log(`Launching isolated browser: agent-browser ${JSON.stringify(args)}`);
-  const result = await spawnCommand(AGENT_BROWSER_BIN, args, { allowFailure: true, timeoutMs: AGENT_BROWSER_COMMAND_TIMEOUT_MS });
-  await log(`launch result: code=${result.code} stdout=${JSON.stringify(result.stdout)} stderr=${JSON.stringify(result.stderr)}`);
-  if (result.code !== 0) {
-    throw new Error(result.stderr || result.stdout || "Failed to launch isolated oracle browser");
+  const deadline = Date.now() + AGENT_BROWSER_COMMAND_TIMEOUT_MS;
+  while (true) {
+    const result = await spawnCommand(AGENT_BROWSER_BIN, args, { allowFailure: true, timeoutMs: Math.max(1, deadline - Date.now()) });
+    await log(`launch result: code=${result.code} stdout=${JSON.stringify(result.stdout)} stderr=${JSON.stringify(result.stderr)}`);
+    if (result.code === 0) return;
+    const message = result.stderr || result.stdout || "Failed to launch isolated oracle browser";
+    // agent-browser 0.39 can return from close before its daemon socket disappears.
+    // This configure failure happens before open is dispatched; other launch errors are not safe to retry.
+    if (!/Could not configure browser: Failed to connect: No such file or directory/i.test(message) || Date.now() >= deadline) {
+      throw new Error(message);
+    }
+    await log("Waiting for the closing agent-browser daemon before retrying launch");
+    await sleep(Math.min(250, deadline - Date.now()));
   }
 }
 
@@ -427,7 +437,7 @@ async function snapshotText() {
 }
 
 async function pageText() {
-  const { stdout } = await targetCommand("get", "text", "body", { allowFailure: true, logLabel: "get text body" });
+  const { stdout } = await targetCommand("get", "text", "body", { logLabel: "get text body" });
   return stdout || "";
 }
 
@@ -515,7 +525,16 @@ function formatAuthFailureGuidance(error) {
   const reason = error instanceof Error ? error.message : String(error);
   const lines = ["Oracle auth failed.", "", `Reason: ${reason}`, "", "Likely causes:"];
 
-  if (usesConfiguredChromiumCookieSource()) {
+  if (isAuthNavigationError(error) || /browser was closed|Timed out verifying synced/i.test(reason)) {
+    lines.push(
+      "- the isolated browser navigated, closed, or never settled during verification",
+      "- this browser verification failure does not by itself prove the source cookies are invalid",
+      "",
+      "Next:",
+      "1. Re-run /oracle-auth and leave the isolated browser open while verification completes.",
+      "2. If it fails again, inspect the diagnostics below.",
+    );
+  } else if (usesConfiguredChromiumCookieSource()) {
     lines.push(
       "- the configured cookie DB is stale or from the wrong browser profile",
       `- ${providerName()} is logged out in that browser profile`,
@@ -564,6 +583,15 @@ function formatAuthFailureGuidance(error) {
   return lines.join("\n");
 }
 
+function canUseCalibratedChromeKey(source) {
+  if (!source.includes("/") && !source.includes("\\")) return false;
+  // Match Sweet Cookie's candidate expansion, not normalized source qualification:
+  // a literal absolute Cookies path can retain a Brave selector before "..".
+  const candidate = source.startsWith("~/") ? join(homedir(), source.slice(2))
+    : isAbsolute(source) ? source : resolve(process.cwd(), source);
+  return !/bravesoftware|brave-browser|brave browser/i.test(candidate);
+}
+
 async function readRawSourceCookies() {
   if (config.auth.chromeCookiePath && config.auth.chromiumKeychain) {
     return await getCookiesFromConfiguredChromiumSource({
@@ -575,14 +603,24 @@ async function readRawSourceCookies() {
     });
   }
 
-  return await getCookies({
+  const options = {
     url: providerChatUrl(),
     origins: cookieOrigins(),
     browsers: ["chrome"],
     mode: "merge",
     chromeProfile: cookieSource(),
     timeoutMs: COOKIE_READ_TIMEOUT_MS,
-  });
+  };
+  if (process.platform === "linux") {
+    if (process.env.SWEET_COOKIE_CHROME_SAFE_STORAGE_PASSWORD?.trim() && canUseCalibratedChromeKey(options.chromeProfile)) {
+      return await getCookies(options);
+    }
+    if (isNativeLinuxChromiumCookieSource(options.chromeProfile)) {
+      const { getCookiesFromNativeLinuxChromium } = await import("./linux-chromium-cookie-source.mjs");
+      return await getCookiesFromNativeLinuxChromium(options, getCookies);
+    }
+  }
+  return await getCookies(options);
 }
 
 async function readSourceCookies() {
@@ -708,6 +746,7 @@ function buildLoginProbeScript(timeoutMs) {
     let bodyKeys = [];
     let bodyHasId = false;
     let bodyHasEmail = false;
+    let bodyIsAnonymous = false;
     let resultName = '';
     let responsePreview = '';
     try {
@@ -727,6 +766,7 @@ function buildLoginProbeScript(timeoutMs) {
             if (data && typeof data === 'object' && !Array.isArray(data)) {
               bodyKeys = Object.keys(data).slice(0, 12);
               bodyHasId = typeof data.id === 'string' && data.id.length > 0;
+              bodyIsAnonymous = typeof data.id === 'string' && data.id.startsWith('ua-');
               bodyHasEmail = typeof data.email === 'string' && data.email.includes('@');
               const name = typeof data.name === 'string' ? data.name.trim() : '';
               if (name) resultName = name;
@@ -757,6 +797,7 @@ function buildLoginProbeScript(timeoutMs) {
       bodyKeys,
       bodyHasId,
       bodyHasEmail,
+      bodyIsAnonymous,
       name: resultName,
       responsePreview,
     };
@@ -868,13 +909,25 @@ async function waitForImportedAuthReady() {
   let iteration = 0;
   while (Date.now() < timeoutAt) {
     iteration += 1;
-    const [url, snapshot, body, probe] = await Promise.all([getUrl(), snapshotText(), pageText(), loginProbe()]);
+    // Drain all reads before retrying or closing the browser. Promise.all can
+    // reject while the other CDP commands are still running against the page.
+    const reads = await Promise.allSettled([getUrl(), snapshotText(), pageText(), loginProbe()]);
+    const failures = reads.filter((read) => read.status === "rejected");
+    const fatal = failures.find((read) => !isAuthNavigationError(read.reason));
+    if (fatal) throw fatal.reason;
+    if (failures.length > 0) {
+      await log(`poll ${iteration}: auth page navigated during verification; discarding partial reads and retrying`);
+      await ensureBrowserConnected();
+      await sleep(config.auth.pollMs);
+      continue;
+    }
+    const [url, snapshot, body, probe] = reads.map((read) => read.value);
     await writeFile(URL_PATH, `${url}\n`, { mode: 0o600 }).catch(() => undefined);
     await writeFile(SNAPSHOT_PATH, `${snapshot}\n`, { mode: 0o600 }).catch(() => undefined);
     await writeFile(BODY_PATH, `${body}\n`, { mode: 0o600 }).catch(() => undefined);
     const classification = classifyChatPage({ url, snapshot, body, probe });
     await log(
-      `poll ${iteration}: url=${JSON.stringify(url)} probe=${JSON.stringify(probe)} classification=${classification.state} hasComposer=${preferredProvider() === "grok" ? snapshot.includes('Ask Grok anything') || snapshot.includes('contenteditable') : snapshot.includes(`textbox \"${CHATGPT_LABELS.composer}\"`)} hasAddFiles=${preferredProvider() === "grok" ? snapshot.includes('button \"Attach\"') : snapshot.includes(`button \"${CHATGPT_LABELS.addFiles}\"`)}`,
+      `poll ${iteration}: url=${JSON.stringify(url)} probe=${JSON.stringify(probe)} classification=${classification.state} hasComposer=${preferredProvider() === "grok" ? snapshot.includes('Ask Grok anything') || snapshot.includes('contenteditable') : CHATGPT_COMPOSER_LABELS.some((label) => snapshot.includes(`textbox \"${label}\"`))} hasAddFiles=${preferredProvider() === "grok" ? snapshot.includes('button \"Attach\"') : snapshot.includes(`button \"${CHATGPT_LABELS.addFiles}\"`)}`,
     );
     if (classification.state === "authenticated_and_ready") return classification;
     if (classification.state === "auth_transitioning") {

package/extensions/oracle/worker/auth-flow-helpers.d.mts

@@ -8,6 +8,7 @@ export interface OracleAuthLoginProbe {
   bodyKeys?: string[];
   bodyHasId?: boolean;
   bodyHasEmail?: boolean;
+  bodyIsAnonymous?: boolean;
   name?: string;
   responsePreview?: string;
 }
@@ -26,6 +27,7 @@ export interface OracleAuthPageClassification {
 }
 
 export declare function normalizeLoginProbeResult(result: unknown): OracleAuthLoginProbe;
+export declare function isAuthNavigationError(error: unknown): boolean;
 export declare function buildAccountChooserCandidateLabels(name?: string): string[];
 export declare function classifyChatAuthPage(args: {
   url: string;

package/extensions/oracle/worker/auth-flow-helpers.mjs

@@ -4,7 +4,7 @@
 // Usage: Imported by auth-bootstrap.mjs and sanity tests to exercise auth classification behavior without driving a browser.
 // Invariants/Assumptions: Inputs are already captured snapshots/probe results from the live browser session; outputs are deterministic and side-effect free.
 
-import { snapshotHasUsableComposerControls } from "./chatgpt-ui-helpers.mjs";
+import { CHATGPT_COMPOSER_LABELS, snapshotHasUsableComposerControls } from "./chatgpt-ui-helpers.mjs";
 
 /** @typedef {import("./auth-flow-helpers.d.mts").OracleAuthLoginProbe} OracleAuthLoginProbe */
 /** @typedef {import("./auth-flow-helpers.d.mts").OracleAuthPageClassification} OracleAuthPageClassification */
@@ -31,11 +31,23 @@ export function normalizeLoginProbeResult(result) {
     bodyKeys: Array.isArray(value.bodyKeys) ? value.bodyKeys.filter((entry) => typeof entry === "string") : [],
     bodyHasId: value.bodyHasId === true,
     bodyHasEmail: value.bodyHasEmail === true,
+    bodyIsAnonymous: value.bodyIsAnonymous === true,
     name: typeof value.name === "string" ? value.name : undefined,
     responsePreview: typeof value.responsePreview === "string" ? value.responsePreview : undefined,
   };
 }
 
+/**
+ * CDP evaluations can be interrupted by normal redirects. Do not retry arbitrary
+ * protocol failures or explicitly closed/disconnected browser errors.
+ * @param {unknown} error
+ * @returns {boolean}
+ */
+export function isAuthNavigationError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return /Inspected target navigated or closed|Execution context was destroyed|Cannot find context with specified id/i.test(message);
+}
+
 /**
  * @param {string | undefined} name
  * @returns {string[]}
@@ -69,7 +81,7 @@ export function classifyChatAuthPage(args) {
   const onAllowedOrigin = args.allowedOrigins.some((origin) => args.url.startsWith(origin));
   const hasComposer = args.snapshot.includes(`textbox "${composerLabel}"`);
   const hasAddFiles = args.snapshot.includes(`button "${addFilesLabel}"`);
-  const hasUsableComposer = composerLabel === DEFAULT_COMPOSER_LABEL && addFilesLabel === DEFAULT_ADD_FILES_LABEL
+  const hasUsableComposer = CHATGPT_COMPOSER_LABELS.includes(composerLabel) && addFilesLabel === DEFAULT_ADD_FILES_LABEL
     ? snapshotHasUsableComposerControls(args.snapshot)
     : hasComposer && hasAddFiles;
 
@@ -112,7 +124,16 @@ export function classifyChatAuthPage(args) {
     return { state: "transient_outage_error", message: `ChatGPT is showing a transient outage/error page. Logs: ${args.logPath}` };
   }
 
-  const probeHasAccountIdentity = args.probe?.bodyHasId === true || args.probe?.bodyHasEmail === true;
+  // /backend-api/me also returns HTTP 200 and an id for anonymous visitors.
+  // Those ua-* identities must not drive account selection or auth reloads.
+  if (args.probe?.bodyIsAnonymous && (args.probe?.onAuthPage || args.probe?.domLoginCta)) {
+    return {
+      state: "login_required",
+      message: `Synced cookies from ${args.cookieSourceLabel}, but ChatGPT returned an anonymous visitor session, not a signed-in account. Sign in to ChatGPT in the source browser profile, quit that browser, then rerun /oracle-auth. Logs: ${args.logPath}`,
+    };
+  }
+
+  const probeHasAccountIdentity = !args.probe?.bodyIsAnonymous && (args.probe?.bodyHasId === true || args.probe?.bodyHasEmail === true);
 
   if (args.probe?.status === 401 || (args.probe?.status === 403 && (!onAllowedOrigin || !hasUsableComposer))) {
     return {

package/extensions/oracle/worker/chatgpt-flow-helpers.mjs

@@ -4,6 +4,8 @@
 // Usage: Imported by run-job.mjs and sanity tests to validate conversation-state heuristics without driving a browser.
 // Invariants/Assumptions: Snapshot text comes from agent-browser `snapshot -i`; URL inputs may be malformed and must fail safely.
 
+import { CHATGPT_COMPOSER_LABELS } from "./chatgpt-ui-helpers.mjs";
+
 /** @typedef {import("./chatgpt-flow-helpers.d.mts").OracleStableValueState} OracleStableValueState */
 /** @typedef {import("./chatgpt-flow-helpers.d.mts").OracleSendAcceptanceState} OracleSendAcceptanceState */
 
@@ -23,8 +25,9 @@ export function assistantSnapshotSlice(snapshot, composerLabel, responseIndex) {
   const nextAssistantIndex = assistantHeadingIndices[responseIndex + 1];
   if (nextAssistantIndex !== undefined) endCandidates.push(nextAssistantIndex);
 
+  const composerLabels = CHATGPT_COMPOSER_LABELS.includes(composerLabel) ? CHATGPT_COMPOSER_LABELS : [composerLabel];
   const composerIndex = lines.findIndex(
-    (line, index) => index > startIndex && line.includes(`textbox "${composerLabel}"`),
+    (line, index) => index > startIndex && composerLabels.some((label) => line.includes(`textbox "${label}"`)),
   );
   if (composerIndex !== -1) endCandidates.push(composerIndex);
 

package/extensions/oracle/worker/chatgpt-ui-helpers.d.mts

@@ -7,6 +7,7 @@ export interface OracleUiSelection {
   autoSwitchToThinking?: boolean;
 }
 
+export declare const CHATGPT_COMPOSER_LABELS: readonly string[];
 export declare const CHATGPT_CANONICAL_APP_ORIGINS: readonly string[];
 
 export declare function buildAllowedChatGptOrigins(chatUrl: string, authUrl?: string): string[];

package/extensions/oracle/worker/chatgpt-ui-helpers.mjs

@@ -13,6 +13,8 @@ import { parseSnapshotEntries } from "./artifact-heuristics.mjs";
 /** @typedef {{ responseText: string; artifactLabels?: string[]; suspiciousArtifactLabels?: string[] }} CompletionSignatureArgs */
 /** @typedef {{ hasStopStreaming: boolean; hasTargetCopyResponse: boolean; responseText: string; artifactLabels?: string[]; suspiciousArtifactLabels?: string[] }} DerivedCompletionSignatureArgs */
 
+export const CHATGPT_COMPOSER_LABELS = Object.freeze(["Chat with ChatGPT", "Ask ChatGPT"]);
+
 export const CHATGPT_CANONICAL_APP_ORIGINS = Object.freeze([
   "https://chatgpt.com",
   "https://chat.openai.com",
@@ -132,7 +134,7 @@ export function requestedEffortLabel(selection) {
  * @returns {string}
  */
 function normalizeChipLabel(label) {
-  return normalizeText(label).replace(/, click to remove$/i, "").trim();
+  return normalizeText(label).replace(/, click to remove$/i, "").replace(/^\d+(?:\.\d+)?\s+(?=Pro$)/i, "").trim();
 }
 
 function parseComposerChipSelection(label) {
@@ -503,7 +505,9 @@ export function snapshotHasModelConfigurationUi(snapshot) {
   const hasEffortCombobox = entries.some(
     (entry) => entry.kind === "combobox" && EFFORT_LABELS.has(entry.value || "") && !entry.disabled,
   );
-  return visibleFamilies.size >= 2 || visibleRadioFamilies.size >= 2 || visibleCompactControls.length >= 2 || hasCompactIntelligenceMenu || hasIntelligenceHeading || hasEffortCombobox;
+  const hasPowerSliderMenu = entries.some((entry) => entry.kind === "menuitem" && entry.label === "Power" && !entry.disabled)
+    && entries.some((entry) => entry.kind === "menuitem" && entry.label === "Select model" && !entry.disabled);
+  return visibleFamilies.size >= 2 || visibleRadioFamilies.size >= 2 || visibleCompactControls.length >= 2 || hasCompactIntelligenceMenu || hasIntelligenceHeading || hasEffortCombobox || hasPowerSliderMenu;
 }
 
 /**
@@ -513,7 +517,7 @@ export function snapshotHasModelConfigurationUi(snapshot) {
 export function snapshotHasUsableComposerControls(snapshot) {
   /** @type {SnapshotEntry[]} */
   const entries = parseSnapshotEntries(snapshot);
-  const hasComposer = entries.some((entry) => entry.kind === "textbox" && entry.label === "Chat with ChatGPT" && !entry.disabled);
+  const hasComposer = entries.some((entry) => entry.kind === "textbox" && CHATGPT_COMPOSER_LABELS.includes(entry.label || "") && !entry.disabled);
   const hasAddFiles = entries.some((entry) => entry.kind === "button" && entry.label === "Add files and more" && !entry.disabled);
   return hasComposer && hasAddFiles;
 }

package/extensions/oracle/worker/chromium-cookie-source.mjs

@@ -1,8 +1,8 @@
-// Purpose: Read provider cookies from arbitrary macOS Chromium-family cookie stores when sweet-cookie's built-in browser list is too narrow.
-// Responsibilities: Snapshot a Chromium Cookies SQLite DB, decrypt AES-CBC cookie values with a configured Keychain item, and return sweet-cookie-shaped cookie objects.
-// Scope: macOS Chromium cookie extraction only; auth policy filtering and browser seeding stay in auth-bootstrap.mjs.
-// Usage: auth-bootstrap.mjs uses this when auth.chromiumKeychain is configured alongside auth.chromeCookiePath.
-// Invariants/Assumptions: The configured cookie path points at a Chromium Cookies DB and the configured Keychain item is the browser's safe-storage secret.
+// Purpose: Read provider cookies from configured macOS Chromium stores.
+// Responsibilities: Snapshot and decrypt configured macOS cookie stores.
+// Scope: macOS cookie extraction only; auth policy filtering and browser seeding stay in auth-bootstrap.mjs.
+// Usage: auth-bootstrap.mjs calls the configured macOS API after selecting the source.
+// Invariants/Assumptions: Configured Keychain items identify the browser secret; helper environments are scrubbed.
 import { spawn } from "node:child_process";
 import { sweetCookieSafeStoragePasswordScrubbedEnv } from "../shared/browser-profile-helpers.mjs";
 import { createDecipheriv, pbkdf2Sync } from "node:crypto";
@@ -11,10 +11,20 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 
+/** @typedef {import("./chromium-cookie-source.d.mts").ChromiumKeychainConfig} ChromiumKeychainConfig */
+/** @typedef {import("./chromium-cookie-source.d.mts").ConfiguredChromiumSourceOptions} ConfiguredChromiumSourceOptions */
+/** @typedef {import("./auth-cookie-policy.mjs").ImportedAuthCookie} ImportedAuthCookie */
+
 const CHROMIUM_EPOCH_OFFSET_SECONDS = 11_644_473_600n;
 const COOKIE_VALUE_DECODER = new TextDecoder("utf-8", { fatal: true });
 const MACOS_CHROMIUM_KEY_ITERATIONS = 1003;
 
+/**
+ * @param {string} command
+ * @param {string[]} args
+ * @param {{timeoutMs?: number}} [options]
+ * @returns {Promise<{ok: boolean, stdout: string, stderr: string, error: string}>}
+ */
 function spawnCapture(command, args, options = {}) {
   return new Promise((resolve) => {
     const child = spawn(command, args, { env: sweetCookieSafeStoragePasswordScrubbedEnv(), stdio: ["ignore", "pipe", "pipe"], shell: process.platform === "win32" });
@@ -46,9 +56,14 @@ function spawnCapture(command, args, options = {}) {
   });
 }
 
+/**
+ * @param {ChromiumKeychainConfig} keychain
+ * @param {number} timeoutMs
+ * @returns {Promise<{ok: true, password: string, service: string} | {ok: false, error: string}>}
+ */
 async function readKeychainPassword(keychain, timeoutMs) {
   const services = Array.isArray(keychain.services) && keychain.services.length > 0 ? keychain.services : [keychain.service];
-  for (const service of services.filter(Boolean)) {
+  for (const service of services.filter(/** @returns {service is string} */ (service) => Boolean(service))) {
     const result = await spawnCapture("security", ["find-generic-password", "-w", "-a", keychain.account, "-s", service], { timeoutMs });
     if (result.ok) {
       const password = result.stdout.trim();
@@ -59,6 +74,7 @@ async function readKeychainPassword(keychain, timeoutMs) {
   return { ok: false, error: `Failed to read macOS Keychain (${keychain.label || keychain.account}): no configured service returned a password.` };
 }
 
+/** @param {string} dbPath */
 function snapshotCookieDb(dbPath) {
   const tempDir = mkdtempSync(join(tmpdir(), "pi-oracle-chromium-cookies-"));
   const tempDbPath = join(tempDir, "Cookies");
@@ -73,6 +89,7 @@ function snapshotCookieDb(dbPath) {
   }
 }
 
+/** @param {string} sourceDbPath @param {string} targetPath @param {string} suffix */
 function copySidecar(sourceDbPath, targetPath, suffix) {
   const sidecarPath = `${sourceDbPath}${suffix}`;
   try {
@@ -83,10 +100,12 @@ function copySidecar(sourceDbPath, targetPath, suffix) {
   }
 }
 
+/** @param {unknown} error */
 function isMissingFileError(error) {
   return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
 }
 
+/** @param {DatabaseSync} db */
 function readMetaVersion(db) {
   try {
     const row = db.prepare("SELECT value FROM meta WHERE key = 'version'").get();
@@ -97,6 +116,7 @@ function readMetaVersion(db) {
   }
 }
 
+/** @param {string} host */
 function parentCookieDomains(host) {
   const labels = host.split(".").filter(Boolean);
   const domains = new Set([host, `.${host}`]);
@@ -108,11 +128,14 @@ function parentCookieDomains(host) {
   return [...domains];
 }
 
+/** @param {string} value */
 function sqlStringLiteral(value) {
   return `'${value.replaceAll("'", "''")}'`;
 }
 
+/** @param {string[]} origins */
 function buildHostWhereClause(origins) {
+  /** @type {Set<string>} */
   const domains = new Set();
   for (const origin of origins) {
     try {
@@ -125,11 +148,13 @@ function buildHostWhereClause(origins) {
   return `host_key IN (${[...domains].map(sqlStringLiteral).join(", ")})`;
 }
 
+/** @param {string[]} originHosts @param {string} hostKey */
 function hostMatchesAny(originHosts, hostKey) {
   const cookieDomain = hostKey.startsWith(".") ? hostKey.slice(1) : hostKey;
   return originHosts.some((host) => host === cookieDomain || host.endsWith(`.${cookieDomain}`));
 }
 
+/** @param {unknown} value */
 function chromiumExpirationToUnixSeconds(value) {
   if (value === undefined || value === null || String(value) === "0") return undefined;
   try {
@@ -142,6 +167,7 @@ function chromiumExpirationToUnixSeconds(value) {
   }
 }
 
+/** @param {unknown} value @returns {ImportedAuthCookie["sameSite"]} */
 function normalizeSameSite(value) {
   const normalized = String(value ?? "").toLowerCase();
   if (normalized === "2" || normalized === "strict") return "Strict";
@@ -150,10 +176,12 @@ function normalizeSameSite(value) {
   return undefined;
 }
 
+/** @param {string} password */
 function deriveMacosChromiumKey(password) {
   return pbkdf2Sync(password, "saltysalt", MACOS_CHROMIUM_KEY_ITERATIONS, 16, "sha1");
 }
 
+/** @param {Uint8Array} encryptedValue @param {Buffer} key @param {{stripHashPrefix: boolean}} options */
 function decryptCookieValue(encryptedValue, key, options) {
   const buffer = Buffer.from(encryptedValue);
   if (buffer.length < 3) return null;
@@ -172,6 +200,7 @@ function decryptCookieValue(encryptedValue, key, options) {
   }
 }
 
+/** @param {Buffer} value */
 function removePkcs7Padding(value) {
   if (!value.length) return value;
   const padding = value[value.length - 1];
@@ -179,6 +208,7 @@ function removePkcs7Padding(value) {
   return value.subarray(0, value.length - padding);
 }
 
+/** @param {Uint8Array} value @param {boolean} stripHashPrefix */
 function decodeCookieBytes(value, stripHashPrefix) {
   const bytes = stripHashPrefix && value.length >= 32 ? value.subarray(32) : value;
   try {
@@ -188,12 +218,19 @@ function decodeCookieBytes(value, stripHashPrefix) {
   }
 }
 
+/** @param {string} value */
 function stripLeadingControlChars(value) {
   let index = 0;
   while (index < value.length && value.charCodeAt(index) < 0x20) index += 1;
   return value.slice(index);
 }
 
+/**
+ * @param {Record<string, unknown>[]} rows
+ * @param {Pick<ConfiguredChromiumSourceOptions, "origins" | "profile" | "includeExpired"> & {stripHashPrefix: boolean}} options
+ * @param {Buffer} key
+ * @param {string[]} warnings
+ */
 function collectCookies(rows, options, key, warnings) {
   const cookies = [];
   const now = Math.floor(Date.now() / 1000);
@@ -221,6 +258,7 @@ function collectCookies(rows, options, key, warnings) {
     const expires = chromiumExpirationToUnixSeconds(row.expires_utc);
     if (!options.includeExpired && expires !== undefined && expires < now) continue;
 
+    /** @type {ImportedAuthCookie & {source: {browser: string, profile: string}}} */
     const cookie = {
       name,
       value,
@@ -239,7 +277,9 @@ function collectCookies(rows, options, key, warnings) {
   return dedupeCookies(cookies);
 }
 
+/** @param {ImportedAuthCookie[]} cookies */
 function dedupeCookies(cookies) {
+  /** @type {Map<string, ImportedAuthCookie>} */
   const seen = new Map();
   for (const cookie of cookies) {
     const key = `${cookie.domain}\t${cookie.path}\t${cookie.name}`;
@@ -248,6 +288,10 @@ function dedupeCookies(cookies) {
   return [...seen.values()];
 }
 
+/**
+ * @param {ConfiguredChromiumSourceOptions} options
+ * @returns {Promise<{cookies: ImportedAuthCookie[], warnings: string[]}>}
+ */
 export async function getCookiesFromConfiguredChromiumSource(options) {
   const warnings = [];
   if (!options.dbPath || !existsSync(options.dbPath)) {

package/extensions/oracle/worker/linux-chromium-cookie-source.d.mts

@@ -0,0 +1,6 @@
+import type { GetCookiesOptions, GetCookiesResult } from "@steipete/sweet-cookie";
+
+export function getCookiesFromNativeLinuxChromium(
+  options: GetCookiesOptions,
+  readCookies: typeof import("@steipete/sweet-cookie").getCookies,
+): Promise<GetCookiesResult>;

package/extensions/oracle/worker/linux-chromium-cookie-source.mjs

@@ -0,0 +1,98 @@
+// Purpose: Select native Linux Chromium's safe-storage key for the public Sweet Cookie parser.
+// Scope: Called only after source qualification in the short-lived auth worker.
+// Invariants: Restore password/backend overrides and scrub keyring helper environments.
+import { execFile } from "node:child_process";
+import { sweetCookieSafeStoragePasswordScrubbedEnv } from "../shared/browser-profile-helpers.mjs";
+
+// ponytail: Native Linux Chromium key selection only. Keep Sweet Cookie 0.3's
+// public parser/decryptor; remove when an upstream fix passes unchanged-path
+// performance checks. This API runs only in the short-lived auth worker.
+const PASSWORD_ENV = "SWEET_COOKIE_CHROME_SAFE_STORAGE_PASSWORD";
+const BRAVE_PASSWORD_ENV = "SWEET_COOKIE_BRAVE_SAFE_STORAGE_PASSWORD";
+const BACKEND_ENV = "SWEET_COOKIE_LINUX_KEYRING";
+
+/** @param {string} command @param {string[]} args @returns {Promise<string | undefined>} */
+function readHelper(command, args) {
+  return new Promise((resolve) => {
+    execFile(command, args, {
+      env: sweetCookieSafeStoragePasswordScrubbedEnv(),
+      encoding: "utf8", timeout: 3_000, killSignal: "SIGKILL",
+    }, (error, stdout) => resolve(error ? undefined : stdout.trim()));
+  });
+}
+
+function keyringBackend() {
+  const configured = process.env[BACKEND_ENV]?.trim().toLowerCase();
+  if (configured === "gnome" || configured === "kwallet" || configured === "basic") return configured;
+  const kde = process.env.XDG_CURRENT_DESKTOP?.split(":").some((part) => part.trim().toLowerCase() === "kde")
+    || Boolean(process.env.KDE_FULL_SESSION?.trim());
+  return kde ? "kwallet" : "gnome";
+}
+
+async function readChromiumPassword() {
+  const backend = keyringBackend();
+  if (backend === "basic") return { password: "", warnings: [] };
+  if (backend === "gnome") {
+    const password = await readHelper("secret-tool", ["lookup", "service", "Chromium Safe Storage", "account", "Chromium"])
+      || await readHelper("secret-tool", ["lookup", "application", "chromium"]);
+    return { password: password || "", warnings: password ? [] : [
+      "Failed to read Linux keyring via secret-tool; v11 cookies may be unavailable.",
+    ] };
+  }
+  const version = process.env.KDE_SESSION_VERSION?.trim();
+  const suffix = version === "5" || version === "6" ? version : "";
+  const wallet = await readHelper("dbus-send", [
+    "--session", "--print-reply=literal", `--dest=org.kde.kwalletd${suffix}`,
+    `/modules/kwalletd${suffix}`, "org.kde.KWallet.networkWallet",
+  ]);
+  const password = await readHelper("kwallet-query", [
+    "--read-password", "Chromium Safe Storage", "--folder", "Chromium Keys",
+    wallet?.replaceAll('"', "").trim() || "kdewallet",
+  ]);
+  return {
+    password: password?.toLowerCase().startsWith("failed to read") ? "" : password || "",
+    warnings: password === undefined ? [
+      "Failed to read Linux keyring via kwallet-query; v11 cookies may be unavailable.",
+    ] : [],
+  };
+}
+
+/**
+ * @param {import("@steipete/sweet-cookie").GetCookiesOptions} options
+ * @param {typeof import("@steipete/sweet-cookie").getCookies} readCookies
+ */
+export async function getCookiesFromNativeLinuxChromium(options, readCookies) {
+  const override = process.env[PASSWORD_ENV]?.trim();
+  const { password, warnings } = override
+    ? { password: override, warnings: [] }
+    : await readChromiumPassword();
+  const previous = {
+    [PASSWORD_ENV]: process.env[PASSWORD_ENV],
+    [BRAVE_PASSWORD_ENV]: process.env[BRAVE_PASSWORD_ENV],
+    [BACKEND_ENV]: process.env[BACKEND_ENV],
+  };
+  try {
+    // Sweet Cookie 0.3 classifies Brave by substrings anywhere in the DB path.
+    // Even a Chromium XDG/HOME ancestor can trigger it. Supply the selected
+    // Chromium key to either branch so neither can spawn a vendor keyring helper.
+    if (password) {
+      process.env[PASSWORD_ENV] = password;
+      process.env[BRAVE_PASSWORD_ENV] = password;
+    }
+    // Empty env values are ignored by Sweet Cookie. Its basic backend supplies
+    // the empty key without accidentally probing Chrome's keyring instead.
+    else {
+      delete process.env[PASSWORD_ENV];
+      delete process.env[BRAVE_PASSWORD_ENV];
+      process.env[BACKEND_ENV] = "basic";
+    }
+    const result = await readCookies(options);
+    result.warnings.unshift(...warnings);
+    return result;
+  } finally {
+    for (const [name, value] of Object.entries(previous)) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+  }
+}