pi-oracle 0.7.21 → 0.7.22

package/extensions/oracle/worker/auth-bootstrap.mjs

@@ -12,6 +12,7 @@ import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { getCookies } from "@steipete/sweet-cookie";
 import {
   assertNotKnownBrowserUserDataPath,
+  isNativeLinuxChromiumCookieSource,
   sweetCookieSafeStoragePasswordScrubbedEnv,
 } from "../shared/browser-profile-helpers.mjs";
 import { ensureAccountCookie, filterImportableAuthCookies } from "./auth-cookie-policy.mjs";
@@ -340,10 +341,19 @@ async function launchTargetBrowser() {
   await closeTargetBrowser();
   const args = [...targetBrowserBaseArgs({ withLaunchOptions: true, mode: "headed" }), "open", "about:blank"];
   await log(`Launching isolated browser: agent-browser ${JSON.stringify(args)}`);
-  const result = await spawnCommand(AGENT_BROWSER_BIN, args, { allowFailure: true, timeoutMs: AGENT_BROWSER_COMMAND_TIMEOUT_MS });
-  await log(`launch result: code=${result.code} stdout=${JSON.stringify(result.stdout)} stderr=${JSON.stringify(result.stderr)}`);
-  if (result.code !== 0) {
-    throw new Error(result.stderr || result.stdout || "Failed to launch isolated oracle browser");
+  const deadline = Date.now() + AGENT_BROWSER_COMMAND_TIMEOUT_MS;
+  while (true) {
+    const result = await spawnCommand(AGENT_BROWSER_BIN, args, { allowFailure: true, timeoutMs: Math.max(1, deadline - Date.now()) });
+    await log(`launch result: code=${result.code} stdout=${JSON.stringify(result.stdout)} stderr=${JSON.stringify(result.stderr)}`);
+    if (result.code === 0) return;
+    const message = result.stderr || result.stdout || "Failed to launch isolated oracle browser";
+    // agent-browser 0.39 can return from close before its daemon socket disappears.
+    // This configure failure happens before open is dispatched; other launch errors are not safe to retry.
+    if (!/Could not configure browser: Failed to connect: No such file or directory/i.test(message) || Date.now() >= deadline) {
+      throw new Error(message);
+    }
+    await log("Waiting for the closing agent-browser daemon before retrying launch");
+    await sleep(Math.min(250, deadline - Date.now()));
   }
 }
 
@@ -573,6 +583,15 @@ function formatAuthFailureGuidance(error) {
   return lines.join("\n");
 }
 
+function canUseCalibratedChromeKey(source) {
+  if (!source.includes("/") && !source.includes("\\")) return false;
+  // Match Sweet Cookie's candidate expansion, not normalized source qualification:
+  // a literal absolute Cookies path can retain a Brave selector before "..".
+  const candidate = source.startsWith("~/") ? join(homedir(), source.slice(2))
+    : isAbsolute(source) ? source : resolve(process.cwd(), source);
+  return !/bravesoftware|brave-browser|brave browser/i.test(candidate);
+}
+
 async function readRawSourceCookies() {
   if (config.auth.chromeCookiePath && config.auth.chromiumKeychain) {
     return await getCookiesFromConfiguredChromiumSource({
@@ -584,14 +603,24 @@ async function readRawSourceCookies() {
     });
   }
 
-  return await getCookies({
+  const options = {
     url: providerChatUrl(),
     origins: cookieOrigins(),
     browsers: ["chrome"],
     mode: "merge",
     chromeProfile: cookieSource(),
     timeoutMs: COOKIE_READ_TIMEOUT_MS,
-  });
+  };
+  if (process.platform === "linux") {
+    if (process.env.SWEET_COOKIE_CHROME_SAFE_STORAGE_PASSWORD?.trim() && canUseCalibratedChromeKey(options.chromeProfile)) {
+      return await getCookies(options);
+    }
+    if (isNativeLinuxChromiumCookieSource(options.chromeProfile)) {
+      const { getCookiesFromNativeLinuxChromium } = await import("./linux-chromium-cookie-source.mjs");
+      return await getCookiesFromNativeLinuxChromium(options, getCookies);
+    }
+  }
+  return await getCookies(options);
 }
 
 async function readSourceCookies() {

package/extensions/oracle/worker/chromium-cookie-source.mjs

@@ -1,8 +1,8 @@
-// Purpose: Read provider cookies from arbitrary macOS Chromium-family cookie stores when sweet-cookie's built-in browser list is too narrow.
-// Responsibilities: Snapshot a Chromium Cookies SQLite DB, decrypt AES-CBC cookie values with a configured Keychain item, and return sweet-cookie-shaped cookie objects.
-// Scope: macOS Chromium cookie extraction only; auth policy filtering and browser seeding stay in auth-bootstrap.mjs.
-// Usage: auth-bootstrap.mjs uses this when auth.chromiumKeychain is configured alongside auth.chromeCookiePath.
-// Invariants/Assumptions: The configured cookie path points at a Chromium Cookies DB and the configured Keychain item is the browser's safe-storage secret.
+// Purpose: Read provider cookies from configured macOS Chromium stores.
+// Responsibilities: Snapshot and decrypt configured macOS cookie stores.
+// Scope: macOS cookie extraction only; auth policy filtering and browser seeding stay in auth-bootstrap.mjs.
+// Usage: auth-bootstrap.mjs calls the configured macOS API after selecting the source.
+// Invariants/Assumptions: Configured Keychain items identify the browser secret; helper environments are scrubbed.
 import { spawn } from "node:child_process";
 import { sweetCookieSafeStoragePasswordScrubbedEnv } from "../shared/browser-profile-helpers.mjs";
 import { createDecipheriv, pbkdf2Sync } from "node:crypto";
@@ -11,10 +11,20 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 
+/** @typedef {import("./chromium-cookie-source.d.mts").ChromiumKeychainConfig} ChromiumKeychainConfig */
+/** @typedef {import("./chromium-cookie-source.d.mts").ConfiguredChromiumSourceOptions} ConfiguredChromiumSourceOptions */
+/** @typedef {import("./auth-cookie-policy.mjs").ImportedAuthCookie} ImportedAuthCookie */
+
 const CHROMIUM_EPOCH_OFFSET_SECONDS = 11_644_473_600n;
 const COOKIE_VALUE_DECODER = new TextDecoder("utf-8", { fatal: true });
 const MACOS_CHROMIUM_KEY_ITERATIONS = 1003;
 
+/**
+ * @param {string} command
+ * @param {string[]} args
+ * @param {{timeoutMs?: number}} [options]
+ * @returns {Promise<{ok: boolean, stdout: string, stderr: string, error: string}>}
+ */
 function spawnCapture(command, args, options = {}) {
   return new Promise((resolve) => {
     const child = spawn(command, args, { env: sweetCookieSafeStoragePasswordScrubbedEnv(), stdio: ["ignore", "pipe", "pipe"], shell: process.platform === "win32" });
@@ -46,9 +56,14 @@ function spawnCapture(command, args, options = {}) {
   });
 }
 
+/**
+ * @param {ChromiumKeychainConfig} keychain
+ * @param {number} timeoutMs
+ * @returns {Promise<{ok: true, password: string, service: string} | {ok: false, error: string}>}
+ */
 async function readKeychainPassword(keychain, timeoutMs) {
   const services = Array.isArray(keychain.services) && keychain.services.length > 0 ? keychain.services : [keychain.service];
-  for (const service of services.filter(Boolean)) {
+  for (const service of services.filter(/** @returns {service is string} */ (service) => Boolean(service))) {
     const result = await spawnCapture("security", ["find-generic-password", "-w", "-a", keychain.account, "-s", service], { timeoutMs });
     if (result.ok) {
       const password = result.stdout.trim();
@@ -59,6 +74,7 @@ async function readKeychainPassword(keychain, timeoutMs) {
   return { ok: false, error: `Failed to read macOS Keychain (${keychain.label || keychain.account}): no configured service returned a password.` };
 }
 
+/** @param {string} dbPath */
 function snapshotCookieDb(dbPath) {
   const tempDir = mkdtempSync(join(tmpdir(), "pi-oracle-chromium-cookies-"));
   const tempDbPath = join(tempDir, "Cookies");
@@ -73,6 +89,7 @@ function snapshotCookieDb(dbPath) {
   }
 }
 
+/** @param {string} sourceDbPath @param {string} targetPath @param {string} suffix */
 function copySidecar(sourceDbPath, targetPath, suffix) {
   const sidecarPath = `${sourceDbPath}${suffix}`;
   try {
@@ -83,10 +100,12 @@ function copySidecar(sourceDbPath, targetPath, suffix) {
   }
 }
 
+/** @param {unknown} error */
 function isMissingFileError(error) {
   return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
 }
 
+/** @param {DatabaseSync} db */
 function readMetaVersion(db) {
   try {
     const row = db.prepare("SELECT value FROM meta WHERE key = 'version'").get();
@@ -97,6 +116,7 @@ function readMetaVersion(db) {
   }
 }
 
+/** @param {string} host */
 function parentCookieDomains(host) {
   const labels = host.split(".").filter(Boolean);
   const domains = new Set([host, `.${host}`]);
@@ -108,11 +128,14 @@ function parentCookieDomains(host) {
   return [...domains];
 }
 
+/** @param {string} value */
 function sqlStringLiteral(value) {
   return `'${value.replaceAll("'", "''")}'`;
 }
 
+/** @param {string[]} origins */
 function buildHostWhereClause(origins) {
+  /** @type {Set<string>} */
   const domains = new Set();
   for (const origin of origins) {
     try {
@@ -125,11 +148,13 @@ function buildHostWhereClause(origins) {
   return `host_key IN (${[...domains].map(sqlStringLiteral).join(", ")})`;
 }
 
+/** @param {string[]} originHosts @param {string} hostKey */
 function hostMatchesAny(originHosts, hostKey) {
   const cookieDomain = hostKey.startsWith(".") ? hostKey.slice(1) : hostKey;
   return originHosts.some((host) => host === cookieDomain || host.endsWith(`.${cookieDomain}`));
 }
 
+/** @param {unknown} value */
 function chromiumExpirationToUnixSeconds(value) {
   if (value === undefined || value === null || String(value) === "0") return undefined;
   try {
@@ -142,6 +167,7 @@ function chromiumExpirationToUnixSeconds(value) {
   }
 }
 
+/** @param {unknown} value @returns {ImportedAuthCookie["sameSite"]} */
 function normalizeSameSite(value) {
   const normalized = String(value ?? "").toLowerCase();
   if (normalized === "2" || normalized === "strict") return "Strict";
@@ -150,10 +176,12 @@ function normalizeSameSite(value) {
   return undefined;
 }
 
+/** @param {string} password */
 function deriveMacosChromiumKey(password) {
   return pbkdf2Sync(password, "saltysalt", MACOS_CHROMIUM_KEY_ITERATIONS, 16, "sha1");
 }
 
+/** @param {Uint8Array} encryptedValue @param {Buffer} key @param {{stripHashPrefix: boolean}} options */
 function decryptCookieValue(encryptedValue, key, options) {
   const buffer = Buffer.from(encryptedValue);
   if (buffer.length < 3) return null;
@@ -172,6 +200,7 @@ function decryptCookieValue(encryptedValue, key, options) {
   }
 }
 
+/** @param {Buffer} value */
 function removePkcs7Padding(value) {
   if (!value.length) return value;
   const padding = value[value.length - 1];
@@ -179,6 +208,7 @@ function removePkcs7Padding(value) {
   return value.subarray(0, value.length - padding);
 }
 
+/** @param {Uint8Array} value @param {boolean} stripHashPrefix */
 function decodeCookieBytes(value, stripHashPrefix) {
   const bytes = stripHashPrefix && value.length >= 32 ? value.subarray(32) : value;
   try {
@@ -188,12 +218,19 @@ function decodeCookieBytes(value, stripHashPrefix) {
   }
 }
 
+/** @param {string} value */
 function stripLeadingControlChars(value) {
   let index = 0;
   while (index < value.length && value.charCodeAt(index) < 0x20) index += 1;
   return value.slice(index);
 }
 
+/**
+ * @param {Record<string, unknown>[]} rows
+ * @param {Pick<ConfiguredChromiumSourceOptions, "origins" | "profile" | "includeExpired"> & {stripHashPrefix: boolean}} options
+ * @param {Buffer} key
+ * @param {string[]} warnings
+ */
 function collectCookies(rows, options, key, warnings) {
   const cookies = [];
   const now = Math.floor(Date.now() / 1000);
@@ -221,6 +258,7 @@ function collectCookies(rows, options, key, warnings) {
     const expires = chromiumExpirationToUnixSeconds(row.expires_utc);
     if (!options.includeExpired && expires !== undefined && expires < now) continue;
 
+    /** @type {ImportedAuthCookie & {source: {browser: string, profile: string}}} */
     const cookie = {
       name,
       value,
@@ -239,7 +277,9 @@ function collectCookies(rows, options, key, warnings) {
   return dedupeCookies(cookies);
 }
 
+/** @param {ImportedAuthCookie[]} cookies */
 function dedupeCookies(cookies) {
+  /** @type {Map<string, ImportedAuthCookie>} */
   const seen = new Map();
   for (const cookie of cookies) {
     const key = `${cookie.domain}\t${cookie.path}\t${cookie.name}`;
@@ -248,6 +288,10 @@ function dedupeCookies(cookies) {
   return [...seen.values()];
 }
 
+/**
+ * @param {ConfiguredChromiumSourceOptions} options
+ * @returns {Promise<{cookies: ImportedAuthCookie[], warnings: string[]}>}
+ */
 export async function getCookiesFromConfiguredChromiumSource(options) {
   const warnings = [];
   if (!options.dbPath || !existsSync(options.dbPath)) {

package/extensions/oracle/worker/linux-chromium-cookie-source.d.mts

@@ -0,0 +1,6 @@
+import type { GetCookiesOptions, GetCookiesResult } from "@steipete/sweet-cookie";
+
+export function getCookiesFromNativeLinuxChromium(
+  options: GetCookiesOptions,
+  readCookies: typeof import("@steipete/sweet-cookie").getCookies,
+): Promise<GetCookiesResult>;

package/extensions/oracle/worker/linux-chromium-cookie-source.mjs

@@ -0,0 +1,98 @@
+// Purpose: Select native Linux Chromium's safe-storage key for the public Sweet Cookie parser.
+// Scope: Called only after source qualification in the short-lived auth worker.
+// Invariants: Restore password/backend overrides and scrub keyring helper environments.
+import { execFile } from "node:child_process";
+import { sweetCookieSafeStoragePasswordScrubbedEnv } from "../shared/browser-profile-helpers.mjs";
+
+// ponytail: Native Linux Chromium key selection only. Keep Sweet Cookie 0.3's
+// public parser/decryptor; remove when an upstream fix passes unchanged-path
+// performance checks. This API runs only in the short-lived auth worker.
+const PASSWORD_ENV = "SWEET_COOKIE_CHROME_SAFE_STORAGE_PASSWORD";
+const BRAVE_PASSWORD_ENV = "SWEET_COOKIE_BRAVE_SAFE_STORAGE_PASSWORD";
+const BACKEND_ENV = "SWEET_COOKIE_LINUX_KEYRING";
+
+/** @param {string} command @param {string[]} args @returns {Promise<string | undefined>} */
+function readHelper(command, args) {
+  return new Promise((resolve) => {
+    execFile(command, args, {
+      env: sweetCookieSafeStoragePasswordScrubbedEnv(),
+      encoding: "utf8", timeout: 3_000, killSignal: "SIGKILL",
+    }, (error, stdout) => resolve(error ? undefined : stdout.trim()));
+  });
+}
+
+function keyringBackend() {
+  const configured = process.env[BACKEND_ENV]?.trim().toLowerCase();
+  if (configured === "gnome" || configured === "kwallet" || configured === "basic") return configured;
+  const kde = process.env.XDG_CURRENT_DESKTOP?.split(":").some((part) => part.trim().toLowerCase() === "kde")
+    || Boolean(process.env.KDE_FULL_SESSION?.trim());
+  return kde ? "kwallet" : "gnome";
+}
+
+async function readChromiumPassword() {
+  const backend = keyringBackend();
+  if (backend === "basic") return { password: "", warnings: [] };
+  if (backend === "gnome") {
+    const password = await readHelper("secret-tool", ["lookup", "service", "Chromium Safe Storage", "account", "Chromium"])
+      || await readHelper("secret-tool", ["lookup", "application", "chromium"]);
+    return { password: password || "", warnings: password ? [] : [
+      "Failed to read Linux keyring via secret-tool; v11 cookies may be unavailable.",
+    ] };
+  }
+  const version = process.env.KDE_SESSION_VERSION?.trim();
+  const suffix = version === "5" || version === "6" ? version : "";
+  const wallet = await readHelper("dbus-send", [
+    "--session", "--print-reply=literal", `--dest=org.kde.kwalletd${suffix}`,
+    `/modules/kwalletd${suffix}`, "org.kde.KWallet.networkWallet",
+  ]);
+  const password = await readHelper("kwallet-query", [
+    "--read-password", "Chromium Safe Storage", "--folder", "Chromium Keys",
+    wallet?.replaceAll('"', "").trim() || "kdewallet",
+  ]);
+  return {
+    password: password?.toLowerCase().startsWith("failed to read") ? "" : password || "",
+    warnings: password === undefined ? [
+      "Failed to read Linux keyring via kwallet-query; v11 cookies may be unavailable.",
+    ] : [],
+  };
+}
+
+/**
+ * @param {import("@steipete/sweet-cookie").GetCookiesOptions} options
+ * @param {typeof import("@steipete/sweet-cookie").getCookies} readCookies
+ */
+export async function getCookiesFromNativeLinuxChromium(options, readCookies) {
+  const override = process.env[PASSWORD_ENV]?.trim();
+  const { password, warnings } = override
+    ? { password: override, warnings: [] }
+    : await readChromiumPassword();
+  const previous = {
+    [PASSWORD_ENV]: process.env[PASSWORD_ENV],
+    [BRAVE_PASSWORD_ENV]: process.env[BRAVE_PASSWORD_ENV],
+    [BACKEND_ENV]: process.env[BACKEND_ENV],
+  };
+  try {
+    // Sweet Cookie 0.3 classifies Brave by substrings anywhere in the DB path.
+    // Even a Chromium XDG/HOME ancestor can trigger it. Supply the selected
+    // Chromium key to either branch so neither can spawn a vendor keyring helper.
+    if (password) {
+      process.env[PASSWORD_ENV] = password;
+      process.env[BRAVE_PASSWORD_ENV] = password;
+    }
+    // Empty env values are ignored by Sweet Cookie. Its basic backend supplies
+    // the empty key without accidentally probing Chrome's keyring instead.
+    else {
+      delete process.env[PASSWORD_ENV];
+      delete process.env[BRAVE_PASSWORD_ENV];
+      process.env[BACKEND_ENV] = "basic";
+    }
+    const result = await readCookies(options);
+    result.warnings.unshift(...warnings);
+    return result;
+  } finally {
+    for (const [name, value] of Object.entries(previous)) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+  }
+}

package/extensions/oracle/worker/run-job.mjs

@@ -1534,7 +1534,7 @@ async function waitForModelConfigurationToSettle(job, options = {}) {
   throw new Error(`Could not verify requested model settings after configuration for ${job.selection.modelFamily}`);
 }
 
-async function configurePowerSlider(job) {
+async function configurePowerSlider(job, powerRef) {
   // The current picker retains the compact tier semantics, but exposes keyboard
   // interaction on a Power menuitem rather than accessible tier radio buttons.
   const tiers = ["Instant", "Medium", "High", "Extra High", "Pro"];
@@ -1543,10 +1543,10 @@ async function configurePowerSlider(job) {
     : job.selection.effort === "heavy" ? "Extra High"
     : job.selection.effort === "extended" ? "High" : "Medium";
   const target = tiers.indexOf(requested);
-  const selector = '[data-testid="composer-intelligence-picker-content"] [role="menuitem"][aria-label="Power"]';
-  await agentBrowser(job, "focus", selector);
+  const selector = '[role="menuitem"][aria-label="Power"]';
   const timeoutAt = Date.now() + MODEL_CONFIGURATION_SETTLE_TIMEOUT_MS;
   let moves = 0;
+  let focused = false;
   while (Date.now() < timeoutAt && moves < tiers.length) {
     const state = await evalPage(job, toJsonScript(`
       const control = document.querySelector(${JSON.stringify(selector)});
@@ -1566,6 +1566,10 @@ async function configurePowerSlider(job) {
     if (state.min !== "0" || state.max !== "4" || typeof state.value !== "string" || !Number.isInteger(value) || value < 0 || value > 4) {
       throw new Error("ChatGPT Power slider has an unrecognized range; refusing to guess model settings");
     }
+    if (!focused) {
+      await agentBrowser(job, "focus", powerRef);
+      focused = true;
+    }
     if (value === target) {
       if (!state.description.startsWith(`${requested}, ${target + 1} of ${tiers.length}.`)) {
         throw new Error(`Could not verify ChatGPT Power tier: ${requested}`);
@@ -1592,8 +1596,9 @@ async function configureModel(job) {
 
   await log(`Configuring model family=${job.selection.modelFamily} effort=${job.selection?.effort || "(none)"}`);
   let familySnapshot = await openModelConfiguration(job);
-  if (findEntry(familySnapshot, (entry) => entry.kind === "menuitem" && entry.label === "Power" && !entry.disabled)) {
-    await configurePowerSlider(job);
+  const powerEntry = findEntry(familySnapshot, (entry) => entry.kind === "menuitem" && entry.label === "Power" && !entry.disabled);
+  if (powerEntry) {
+    await configurePowerSlider(job, powerEntry.ref);
     return;
   }
   let verificationSnapshot = familySnapshot;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-oracle",
-  "version": "0.7.21",
+  "version": "0.7.22",
   "description": "ChatGPT and Grok web-oracle extension for pi with isolated browser auth, async jobs, and project-context archives.",
   "private": false,
   "license": "MIT",
@@ -38,6 +38,7 @@
     "scripts/platform-smoke",
     "scripts/oracle-real-smoke.mjs",
     "scripts/oracle-auth.test.mjs",
+    "scripts/oracle-cookie-import.test.mjs",
     "scripts/oracle-model.test.mjs",
     "scripts/oracle-chatgpt-preset-proof.mjs"
   ],
@@ -50,10 +51,10 @@
     ]
   },
   "scripts": {
-    "check:oracle-extension": "node --check extensions/oracle/shared/browser-profile-helpers.mjs && node --check extensions/oracle/shared/process-helpers.mjs && node --check extensions/oracle/shared/state-path-helpers.mjs && node --check extensions/oracle/shared/time-helpers.mjs && node --check extensions/oracle/shared/state-coordination-helpers.mjs && node --check extensions/oracle/shared/job-coordination-helpers.mjs && node --check extensions/oracle/shared/job-lifecycle-helpers.mjs && node --check extensions/oracle/shared/job-observability-helpers.mjs && node --check extensions/oracle/worker/run-job.mjs && node --check extensions/oracle/worker/state-locks.mjs && node --check extensions/oracle/worker/artifact-heuristics.mjs && node --check extensions/oracle/worker/chatgpt-ui-helpers.mjs && node --check extensions/oracle/worker/chatgpt-flow-helpers.mjs && node --check extensions/oracle/worker/auth-flow-helpers.mjs && node --check extensions/oracle/worker/auth-cookie-policy.mjs && node --check extensions/oracle/worker/chromium-cookie-source.mjs && node --check extensions/oracle/worker/auth-bootstrap.mjs && esbuild extensions/oracle/index.ts --bundle --platform=node --format=esm --external:@earendil-works/pi-ai --external:@earendil-works/pi-coding-agent --external:typebox --outfile=/tmp/pi-oracle-extension-check.js",
+    "check:oracle-extension": "node --check extensions/oracle/shared/browser-profile-helpers.mjs && node --check extensions/oracle/shared/process-helpers.mjs && node --check extensions/oracle/shared/state-path-helpers.mjs && node --check extensions/oracle/shared/time-helpers.mjs && node --check extensions/oracle/shared/state-coordination-helpers.mjs && node --check extensions/oracle/shared/job-coordination-helpers.mjs && node --check extensions/oracle/shared/job-lifecycle-helpers.mjs && node --check extensions/oracle/shared/job-observability-helpers.mjs && node --check extensions/oracle/worker/run-job.mjs && node --check extensions/oracle/worker/state-locks.mjs && node --check extensions/oracle/worker/artifact-heuristics.mjs && node --check extensions/oracle/worker/chatgpt-ui-helpers.mjs && node --check extensions/oracle/worker/chatgpt-flow-helpers.mjs && node --check extensions/oracle/worker/auth-flow-helpers.mjs && node --check extensions/oracle/worker/auth-cookie-policy.mjs && node --check extensions/oracle/worker/chromium-cookie-source.mjs && node --check extensions/oracle/worker/linux-chromium-cookie-source.mjs && node --check extensions/oracle/worker/auth-bootstrap.mjs && esbuild extensions/oracle/index.ts --bundle --platform=node --format=esm --external:@earendil-works/pi-ai --external:@earendil-works/pi-coding-agent --external:typebox --outfile=/tmp/pi-oracle-extension-check.js",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "typecheck:worker-helpers": "tsc --noEmit -p tsconfig.worker-helpers.json",
-    "sanity:oracle": "node --test scripts/oracle-auth.test.mjs scripts/oracle-model.test.mjs && node scripts/oracle-sanity-runner.mjs",
+    "sanity:oracle": "node --test scripts/oracle-auth.test.mjs scripts/oracle-cookie-import.test.mjs scripts/oracle-model.test.mjs && node scripts/oracle-sanity-runner.mjs",
     "pack:check": "npm pack --dry-run",
     "verify:oracle": "npm run check:oracle-extension && npm run check:platform-smoke && npm run check:oracle-real-smoke && npm run check:oracle-release-proof && npm run typecheck && npm run typecheck:worker-helpers && npm run sanity:oracle && npm run pack:check",
     "test": "npm run verify:oracle",
@@ -74,7 +75,7 @@
     "release:proof:chatgpt-presets": "node scripts/oracle-chatgpt-preset-proof.mjs check",
     "smoke:real:packed": "node scripts/oracle-real-smoke.mjs run --mode packed",
     "smoke:real:source": "node scripts/oracle-real-smoke.mjs run --mode source",
-    "sanity:oracle:platform": "node --test scripts/oracle-auth.test.mjs scripts/oracle-model.test.mjs && node scripts/oracle-sanity-runner.mjs --mode platform",
+    "sanity:oracle:platform": "node --test scripts/oracle-auth.test.mjs scripts/oracle-cookie-import.test.mjs scripts/oracle-model.test.mjs && node scripts/oracle-sanity-runner.mjs --mode platform",
     "verify:oracle:platform": "npm run check:oracle-extension && npm run check:platform-smoke && npm run check:oracle-real-smoke && npm run check:oracle-release-proof && npm run sanity:oracle:platform && npm run pack:check"
   },
   "dependencies": {
@@ -86,17 +87,17 @@
     "typebox": "*"
   },
   "overrides": {
-    "basic-ftp": "6.0.1",
-    "protobufjs": "7.6.1"
+    "basic-ftp": "6.2.1",
+    "protobufjs": "7.6.6"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "0.86.1",
-    "@earendil-works/pi-coding-agent": "0.86.1",
+    "@earendil-works/pi-ai": "1.0.0",
+    "@earendil-works/pi-coding-agent": "1.0.0",
     "@types/node": "^22.19.19",
     "esbuild": "^0.28.0",
     "tsx": "^4.22.3",
-    "typebox": "^1.1.39",
-    "typescript": "^6.0.3"
+    "typebox": "1.3.34",
+    "typescript": "^7.0.0"
   },
   "engines": {
     "node": ">=22.19.0"
@@ -106,7 +107,7 @@
     "linux",
     "win32"
   ],
-  "packageManager": "npm@11.16.0",
+  "packageManager": "npm@11.21.0",
   "peerDependenciesMeta": {
     "@earendil-works/pi-ai": {
       "optional": true

package/platform-smoke.config.mjs

@@ -6,33 +6,12 @@ export default {
   artifactRoot: ".artifacts/platform-smoke",
   requiredTargets: ["macos", "ubuntu", "windows-native"],
   requiredSuites: ["platform-build", "real-extension"],
-  workflows: {
-    everyday: {
-      description: "Fast local validation for normal iteration.",
-      commands: ["npm run verify:oracle"],
-    },
-    platformSensitive: {
-      description: "Doctor plus focused platform target/suite runs for platform-sensitive changes.",
-      commands: [
-        "npm run smoke:platform:doctor",
-        "node scripts/platform-smoke.mjs run --target <target> --suite <suite>",
-      ],
-    },
-    platformMatrix: {
-      description: "Doctor-first packed-install macOS/Ubuntu/Windows platform proof.",
-      commands: ["npm run smoke:platform:all"],
-    },
-    release: {
-      description: "Full release gate: local verification, fresh ChatGPT preset proof, plus the doctor-first platform matrix.",
-      commands: ["npm run release:check"],
-    },
-  },
   requiredCrabbox: {
     source: "https://github.com/openclaw/crabbox",
     minVersion: "0.26.0",
   },
   ubuntuContainerImage: "pi-oracle-platform-smoke:node24",
-  ubuntuContainerBaseImage: "cimg/node:24.16",
+  ubuntuContainerBaseImage: "cimg/node:24.21",
   windowsParallels: {
     sourceVm: "pi-extension-windows-template",
     snapshot: "crabbox-ready",

package/scripts/oracle-auth.test.mjs

@@ -46,6 +46,41 @@ function pollingHarness(overrides = {}) {
   return { poll, logs, get captures() { return captures; } };
 }
 
+test("auth launch waits for a closing daemon only on the known pre-launch socket failure", async () => {
+  const socketFailure = "Could not configure browser: Failed to connect: No such file or directory (os error 2)";
+  for (const [failures, message, succeeds] of [
+    [1, socketFailure, true],
+    [Infinity, socketFailure, false],
+    [1, "Chrome exited before startup", false],
+  ]) {
+    let now = 0;
+    let launches = 0;
+    const launch = vm.runInNewContext(`(${functionSource(bootstrap, "launchTargetBrowser")})`, {
+      Date: { now: () => now }, Math, Error, JSON,
+      AGENT_BROWSER_BIN: "agent-browser", AGENT_BROWSER_COMMAND_TIMEOUT_MS: 500,
+      closeTargetBrowser: async () => {},
+      targetBrowserBaseArgs: () => ["--session", "fixture-auth", "--profile", "/fixture/seed"],
+      log: async () => {},
+      sleep: async (ms) => { now += ms; },
+      spawnCommand: async (_command, args, options) => {
+        assert.equal(args.at(-1), "about:blank");
+        assert(options.timeoutMs > 0 && options.timeoutMs <= 500);
+        return ++launches <= failures
+          ? { code: 1, stdout: "", stderr: message }
+          : { code: 0, stdout: "Browser opened", stderr: "" };
+      },
+    });
+    if (succeeds) {
+      await launch();
+      assert.equal(launches, 2);
+    } else {
+      await assert.rejects(launch(), (error) => error.message === message);
+      if (message === socketFailure) assert(now <= 500 && launches > 1, "persistent socket failure must stop at the launch deadline");
+      else assert.equal(launches, 1, "other launch failures must not be retried");
+    }
+  }
+});
+
 test("auth polling retries a complete observation after each navigation-interrupted read", async () => {
   for (const read of ["getUrl", "snapshotText", "pageText", "loginProbe"]) {
     let calls = 0;

package/scripts/oracle-chatgpt-preset-proof.mjs

@@ -6,6 +6,7 @@
 
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -69,18 +70,24 @@ function currentGitStatus() {
 }
 
 function canonicalPresets() {
-  const configSource = readFileSync(resolve(REPO_ROOT, "extensions/oracle/lib/config.ts"), "utf8");
-  const registryMatch = configSource.match(/export const ORACLE_SUBMIT_PRESETS = \{([\s\S]*?)\n\} as const;/);
-  if (!registryMatch) throw new Error("Could not locate ORACLE_SUBMIT_PRESETS registry in extensions/oracle/lib/config.ts");
-  const entries = [...registryMatch[1].matchAll(
-    /^\s{2}([a-z0-9_]+):\s*\{\s*label:\s*"[^"]+",\s*modelFamily:\s*"([a-z]+)"\s+as const(?:,\s*effort:\s*"([a-z]+)"\s+as const)?,\s*autoSwitchToThinking:\s*(true|false)\s*\}/gm,
-  )];
-  if (entries.length === 0) throw new Error("Could not parse ORACLE_SUBMIT_PRESETS registry entries");
-  return Object.fromEntries(entries.map((match) => [match[1], {
-    modelFamily: match[2],
-    effort: match[3],
-    autoSwitchToThinking: match[4] === "true",
-  }]));
+  // Derive the canonical registry by importing the real config module so a
+  // formatting change in config.ts can never silently drop a preset from the
+  // release proof's required set.
+  const tsx = createRequire(import.meta.url).resolve("tsx");
+  const stdout = execFileSync(process.execPath, [
+    "--import", tsx,
+    "--input-type=module",
+    "--eval",
+    "const mod = await import('./extensions/oracle/lib/config.ts');" +
+    "const presets = Object.fromEntries(Object.entries(mod.ORACLE_SUBMIT_PRESETS).map(([id, preset]) => [id, {" +
+    "modelFamily: preset.modelFamily, effort: preset.effort, autoSwitchToThinking: preset.autoSwitchToThinking }]));" +
+    "process.stdout.write(JSON.stringify(presets));",
+  ], { cwd: REPO_ROOT, encoding: "utf8" });
+  const presets = JSON.parse(stdout);
+  if (!presets || typeof presets !== "object" || Object.keys(presets).length === 0) {
+    throw new Error("ORACLE_SUBMIT_PRESETS registry resolved to no presets");
+  }
+  return presets;
 }
 
 function canonicalPresetIds() {