pi-oracle 0.7.21 → 0.7.23

package/extensions/oracle/shared/browser-profile-helpers.mjs

@@ -97,6 +97,38 @@ export function linuxChromiumCookieImportUserDataDirs(options = {}) {
   return LINUX_COOKIE_IMPORT_USER_DATA_RELATIVE_DIRS.map((segments) => join(configHome, ...segments));
 }
 
+/**
+ * Match only native Chromium sources under the same roots as autodetection.
+ * Profile names alone remain Chrome selectors, as in Sweet Cookie.
+ * @param {string} source
+ * @param {BrowserPathOptions} [options]
+ * @returns {boolean}
+ */
+export function isNativeLinuxChromiumCookieSource(source, options = {}) {
+  if (!source.includes("/") && !source.includes("\\")) return false;
+  if (isAbsolute(source) && !source.includes("chromium")) return false;
+  return matchesNativeLinuxChromiumCookieSource(source, options);
+}
+
+/**
+ * @param {string} source
+ * @param {BrowserPathOptions} options
+ * @returns {boolean}
+ */
+function matchesNativeLinuxChromiumCookieSource(source, options) {
+  const path = normalizedAbsolutePath(source, options);
+  let profile = path;
+  if (basename(profile) === "Cookies") {
+    profile = dirname(profile);
+    if (basename(profile) === "Network") profile = dirname(profile);
+  }
+  const root = dirname(profile);
+  if (basename(root) !== "chromium" && basename(root) !== "chromium-browser") return false;
+  if (!linuxChromiumCookieImportUserDataDirs(options).includes(root)) return false;
+  return basename(path) === "Cookies" ? existsSync(path)
+    : existsSync(join(profile, "Cookies")) || existsSync(join(profile, "Network", "Cookies"));
+}
+
 /**
  * @param {BrowserPathOptions} [options]
  * @returns {string[]}

package/extensions/oracle/worker/auth-bootstrap.mjs

@@ -12,6 +12,7 @@ import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { getCookies } from "@steipete/sweet-cookie";
 import {
   assertNotKnownBrowserUserDataPath,
+  isNativeLinuxChromiumCookieSource,
   sweetCookieSafeStoragePasswordScrubbedEnv,
 } from "../shared/browser-profile-helpers.mjs";
 import { ensureAccountCookie, filterImportableAuthCookies } from "./auth-cookie-policy.mjs";
@@ -340,10 +341,19 @@ async function launchTargetBrowser() {
   await closeTargetBrowser();
   const args = [...targetBrowserBaseArgs({ withLaunchOptions: true, mode: "headed" }), "open", "about:blank"];
   await log(`Launching isolated browser: agent-browser ${JSON.stringify(args)}`);
-  const result = await spawnCommand(AGENT_BROWSER_BIN, args, { allowFailure: true, timeoutMs: AGENT_BROWSER_COMMAND_TIMEOUT_MS });
-  await log(`launch result: code=${result.code} stdout=${JSON.stringify(result.stdout)} stderr=${JSON.stringify(result.stderr)}`);
-  if (result.code !== 0) {
-    throw new Error(result.stderr || result.stdout || "Failed to launch isolated oracle browser");
+  const deadline = Date.now() + AGENT_BROWSER_COMMAND_TIMEOUT_MS;
+  while (true) {
+    const result = await spawnCommand(AGENT_BROWSER_BIN, args, { allowFailure: true, timeoutMs: Math.max(1, deadline - Date.now()) });
+    await log(`launch result: code=${result.code} stdout=${JSON.stringify(result.stdout)} stderr=${JSON.stringify(result.stderr)}`);
+    if (result.code === 0) return;
+    const message = result.stderr || result.stdout || "Failed to launch isolated oracle browser";
+    // agent-browser 0.39 can return from close before its daemon socket disappears.
+    // This configure failure happens before open is dispatched; other launch errors are not safe to retry.
+    if (!/Could not configure browser: Failed to connect: No such file or directory/i.test(message) || Date.now() >= deadline) {
+      throw new Error(message);
+    }
+    await log("Waiting for the closing agent-browser daemon before retrying launch");
+    await sleep(Math.min(250, deadline - Date.now()));
   }
 }
 
@@ -573,6 +583,15 @@ function formatAuthFailureGuidance(error) {
   return lines.join("\n");
 }
 
+function canUseCalibratedChromeKey(source) {
+  if (!source.includes("/") && !source.includes("\\")) return false;
+  // Match Sweet Cookie's candidate expansion, not normalized source qualification:
+  // a literal absolute Cookies path can retain a Brave selector before "..".
+  const candidate = source.startsWith("~/") ? join(homedir(), source.slice(2))
+    : isAbsolute(source) ? source : resolve(process.cwd(), source);
+  return !/bravesoftware|brave-browser|brave browser/i.test(candidate);
+}
+
 async function readRawSourceCookies() {
   if (config.auth.chromeCookiePath && config.auth.chromiumKeychain) {
     return await getCookiesFromConfiguredChromiumSource({
@@ -584,14 +603,24 @@ async function readRawSourceCookies() {
     });
   }
 
-  return await getCookies({
+  const options = {
     url: providerChatUrl(),
     origins: cookieOrigins(),
     browsers: ["chrome"],
     mode: "merge",
     chromeProfile: cookieSource(),
     timeoutMs: COOKIE_READ_TIMEOUT_MS,
-  });
+  };
+  if (process.platform === "linux") {
+    if (process.env.SWEET_COOKIE_CHROME_SAFE_STORAGE_PASSWORD?.trim() && canUseCalibratedChromeKey(options.chromeProfile)) {
+      return await getCookies(options);
+    }
+    if (isNativeLinuxChromiumCookieSource(options.chromeProfile)) {
+      const { getCookiesFromNativeLinuxChromium } = await import("./linux-chromium-cookie-source.mjs");
+      return await getCookiesFromNativeLinuxChromium(options, getCookies);
+    }
+  }
+  return await getCookies(options);
 }
 
 async function readSourceCookies() {

package/extensions/oracle/worker/chatgpt-ui-helpers.d.mts

@@ -16,6 +16,7 @@ export declare function matchesModelFamilyLabel(label: string | undefined, famil
 export declare function matchesRequestedModelControlLabel(label: string | undefined, selection: OracleUiSelection): boolean;
 export declare function matchesCompactIntelligenceControlLabel(label: string | undefined): boolean;
 export declare function matchesCompactIntelligenceOpenerLabel(label: string | undefined): boolean;
+export declare function matchesModelConfigurationOpener(entry: import("./artifact-heuristics.mjs").SnapshotEntry): boolean;
 export declare function requestedEffortLabel(selection: OracleUiSelection): string | undefined;
 export declare function effortSelectionVisible(snapshot: string, effortLabel: string | undefined): boolean;
 export declare function thinkingChipVisible(snapshot: string): boolean;

package/extensions/oracle/worker/chatgpt-ui-helpers.mjs

@@ -522,24 +522,29 @@ export function snapshotHasUsableComposerControls(snapshot) {
   return hasComposer && hasAddFiles;
 }
 
+/**
+ * @param {SnapshotEntry} entry
+ * @returns {boolean}
+ */
+export function matchesModelConfigurationOpener(entry) {
+  if (entry.disabled || entry.kind !== "button" || typeof entry.label !== "string") return false;
+  const label = normalizeChipLabel(entry.label);
+  return label === "Model"
+    || label === "Model selector"
+    || label === "Select ChatGPT model"
+    || matchesCompactIntelligenceOpenerLabel(label)
+    || BARE_EFFORT_PATTERN.test(label)
+    || ["instant", "thinking", "pro"].some((family) => matchesModelFamilyLabel(label, /** @type {OracleUiModelFamily} */ (family)))
+    || THINKING_CHIP_PATTERN.test(label)
+    || PRO_CHIP_PATTERN.test(label);
+}
+
 /**
  * @param {string} snapshot
  * @returns {boolean}
  */
 export function snapshotHasModelOpener(snapshot) {
-  /** @type {SnapshotEntry[]} */
-  const entries = parseSnapshotEntries(snapshot);
-  return entries.some((entry) => {
-    if (entry.disabled || entry.kind !== "button" || typeof entry.label !== "string") return false;
-    const label = normalizeChipLabel(entry.label);
-    return label === "Model"
-      || label === "Model selector"
-      || COMPACT_INTELLIGENCE_OPENER_PATTERN.test(label)
-      || EFFORT_LABELS.has(label)
-      || ["instant", "thinking", "pro"].some((family) => matchesModelFamilyLabel(label, /** @type {OracleUiModelFamily} */ (family)))
-      || THINKING_CHIP_PATTERN.test(label)
-      || PRO_CHIP_PATTERN.test(label);
-  });
+  return parseSnapshotEntries(snapshot).some(matchesModelConfigurationOpener);
 }
 
 /**

package/extensions/oracle/worker/chromium-cookie-source.mjs

@@ -1,8 +1,8 @@
-// Purpose: Read provider cookies from arbitrary macOS Chromium-family cookie stores when sweet-cookie's built-in browser list is too narrow.
-// Responsibilities: Snapshot a Chromium Cookies SQLite DB, decrypt AES-CBC cookie values with a configured Keychain item, and return sweet-cookie-shaped cookie objects.
-// Scope: macOS Chromium cookie extraction only; auth policy filtering and browser seeding stay in auth-bootstrap.mjs.
-// Usage: auth-bootstrap.mjs uses this when auth.chromiumKeychain is configured alongside auth.chromeCookiePath.
-// Invariants/Assumptions: The configured cookie path points at a Chromium Cookies DB and the configured Keychain item is the browser's safe-storage secret.
+// Purpose: Read provider cookies from configured macOS Chromium stores.
+// Responsibilities: Snapshot and decrypt configured macOS cookie stores.
+// Scope: macOS cookie extraction only; auth policy filtering and browser seeding stay in auth-bootstrap.mjs.
+// Usage: auth-bootstrap.mjs calls the configured macOS API after selecting the source.
+// Invariants/Assumptions: Configured Keychain items identify the browser secret; helper environments are scrubbed.
 import { spawn } from "node:child_process";
 import { sweetCookieSafeStoragePasswordScrubbedEnv } from "../shared/browser-profile-helpers.mjs";
 import { createDecipheriv, pbkdf2Sync } from "node:crypto";
@@ -11,10 +11,20 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 
+/** @typedef {import("./chromium-cookie-source.d.mts").ChromiumKeychainConfig} ChromiumKeychainConfig */
+/** @typedef {import("./chromium-cookie-source.d.mts").ConfiguredChromiumSourceOptions} ConfiguredChromiumSourceOptions */
+/** @typedef {import("./auth-cookie-policy.mjs").ImportedAuthCookie} ImportedAuthCookie */
+
 const CHROMIUM_EPOCH_OFFSET_SECONDS = 11_644_473_600n;
 const COOKIE_VALUE_DECODER = new TextDecoder("utf-8", { fatal: true });
 const MACOS_CHROMIUM_KEY_ITERATIONS = 1003;
 
+/**
+ * @param {string} command
+ * @param {string[]} args
+ * @param {{timeoutMs?: number}} [options]
+ * @returns {Promise<{ok: boolean, stdout: string, stderr: string, error: string}>}
+ */
 function spawnCapture(command, args, options = {}) {
   return new Promise((resolve) => {
     const child = spawn(command, args, { env: sweetCookieSafeStoragePasswordScrubbedEnv(), stdio: ["ignore", "pipe", "pipe"], shell: process.platform === "win32" });
@@ -46,9 +56,14 @@ function spawnCapture(command, args, options = {}) {
   });
 }
 
+/**
+ * @param {ChromiumKeychainConfig} keychain
+ * @param {number} timeoutMs
+ * @returns {Promise<{ok: true, password: string, service: string} | {ok: false, error: string}>}
+ */
 async function readKeychainPassword(keychain, timeoutMs) {
   const services = Array.isArray(keychain.services) && keychain.services.length > 0 ? keychain.services : [keychain.service];
-  for (const service of services.filter(Boolean)) {
+  for (const service of services.filter(/** @returns {service is string} */ (service) => Boolean(service))) {
     const result = await spawnCapture("security", ["find-generic-password", "-w", "-a", keychain.account, "-s", service], { timeoutMs });
     if (result.ok) {
       const password = result.stdout.trim();
@@ -59,6 +74,7 @@ async function readKeychainPassword(keychain, timeoutMs) {
   return { ok: false, error: `Failed to read macOS Keychain (${keychain.label || keychain.account}): no configured service returned a password.` };
 }
 
+/** @param {string} dbPath */
 function snapshotCookieDb(dbPath) {
   const tempDir = mkdtempSync(join(tmpdir(), "pi-oracle-chromium-cookies-"));
   const tempDbPath = join(tempDir, "Cookies");
@@ -73,6 +89,7 @@ function snapshotCookieDb(dbPath) {
   }
 }
 
+/** @param {string} sourceDbPath @param {string} targetPath @param {string} suffix */
 function copySidecar(sourceDbPath, targetPath, suffix) {
   const sidecarPath = `${sourceDbPath}${suffix}`;
   try {
@@ -83,10 +100,12 @@ function copySidecar(sourceDbPath, targetPath, suffix) {
   }
 }
 
+/** @param {unknown} error */
 function isMissingFileError(error) {
   return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
 }
 
+/** @param {DatabaseSync} db */
 function readMetaVersion(db) {
   try {
     const row = db.prepare("SELECT value FROM meta WHERE key = 'version'").get();
@@ -97,6 +116,7 @@ function readMetaVersion(db) {
   }
 }
 
+/** @param {string} host */
 function parentCookieDomains(host) {
   const labels = host.split(".").filter(Boolean);
   const domains = new Set([host, `.${host}`]);
@@ -108,11 +128,14 @@ function parentCookieDomains(host) {
   return [...domains];
 }
 
+/** @param {string} value */
 function sqlStringLiteral(value) {
   return `'${value.replaceAll("'", "''")}'`;
 }
 
+/** @param {string[]} origins */
 function buildHostWhereClause(origins) {
+  /** @type {Set<string>} */
   const domains = new Set();
   for (const origin of origins) {
     try {
@@ -125,11 +148,13 @@ function buildHostWhereClause(origins) {
   return `host_key IN (${[...domains].map(sqlStringLiteral).join(", ")})`;
 }
 
+/** @param {string[]} originHosts @param {string} hostKey */
 function hostMatchesAny(originHosts, hostKey) {
   const cookieDomain = hostKey.startsWith(".") ? hostKey.slice(1) : hostKey;
   return originHosts.some((host) => host === cookieDomain || host.endsWith(`.${cookieDomain}`));
 }
 
+/** @param {unknown} value */
 function chromiumExpirationToUnixSeconds(value) {
   if (value === undefined || value === null || String(value) === "0") return undefined;
   try {
@@ -142,6 +167,7 @@ function chromiumExpirationToUnixSeconds(value) {
   }
 }
 
+/** @param {unknown} value @returns {ImportedAuthCookie["sameSite"]} */
 function normalizeSameSite(value) {
   const normalized = String(value ?? "").toLowerCase();
   if (normalized === "2" || normalized === "strict") return "Strict";
@@ -150,10 +176,12 @@ function normalizeSameSite(value) {
   return undefined;
 }
 
+/** @param {string} password */
 function deriveMacosChromiumKey(password) {
   return pbkdf2Sync(password, "saltysalt", MACOS_CHROMIUM_KEY_ITERATIONS, 16, "sha1");
 }
 
+/** @param {Uint8Array} encryptedValue @param {Buffer} key @param {{stripHashPrefix: boolean}} options */
 function decryptCookieValue(encryptedValue, key, options) {
   const buffer = Buffer.from(encryptedValue);
   if (buffer.length < 3) return null;
@@ -172,6 +200,7 @@ function decryptCookieValue(encryptedValue, key, options) {
   }
 }
 
+/** @param {Buffer} value */
 function removePkcs7Padding(value) {
   if (!value.length) return value;
   const padding = value[value.length - 1];
@@ -179,6 +208,7 @@ function removePkcs7Padding(value) {
   return value.subarray(0, value.length - padding);
 }
 
+/** @param {Uint8Array} value @param {boolean} stripHashPrefix */
 function decodeCookieBytes(value, stripHashPrefix) {
   const bytes = stripHashPrefix && value.length >= 32 ? value.subarray(32) : value;
   try {
@@ -188,12 +218,19 @@ function decodeCookieBytes(value, stripHashPrefix) {
   }
 }
 
+/** @param {string} value */
 function stripLeadingControlChars(value) {
   let index = 0;
   while (index < value.length && value.charCodeAt(index) < 0x20) index += 1;
   return value.slice(index);
 }
 
+/**
+ * @param {Record<string, unknown>[]} rows
+ * @param {Pick<ConfiguredChromiumSourceOptions, "origins" | "profile" | "includeExpired"> & {stripHashPrefix: boolean}} options
+ * @param {Buffer} key
+ * @param {string[]} warnings
+ */
 function collectCookies(rows, options, key, warnings) {
   const cookies = [];
   const now = Math.floor(Date.now() / 1000);
@@ -221,6 +258,7 @@ function collectCookies(rows, options, key, warnings) {
     const expires = chromiumExpirationToUnixSeconds(row.expires_utc);
     if (!options.includeExpired && expires !== undefined && expires < now) continue;
 
+    /** @type {ImportedAuthCookie & {source: {browser: string, profile: string}}} */
     const cookie = {
       name,
       value,
@@ -239,7 +277,9 @@ function collectCookies(rows, options, key, warnings) {
   return dedupeCookies(cookies);
 }
 
+/** @param {ImportedAuthCookie[]} cookies */
 function dedupeCookies(cookies) {
+  /** @type {Map<string, ImportedAuthCookie>} */
   const seen = new Map();
   for (const cookie of cookies) {
     const key = `${cookie.domain}\t${cookie.path}\t${cookie.name}`;
@@ -248,6 +288,10 @@ function dedupeCookies(cookies) {
   return [...seen.values()];
 }
 
+/**
+ * @param {ConfiguredChromiumSourceOptions} options
+ * @returns {Promise<{cookies: ImportedAuthCookie[], warnings: string[]}>}
+ */
 export async function getCookiesFromConfiguredChromiumSource(options) {
   const warnings = [];
   if (!options.dbPath || !existsSync(options.dbPath)) {

package/extensions/oracle/worker/linux-chromium-cookie-source.d.mts

@@ -0,0 +1,6 @@
+import type { GetCookiesOptions, GetCookiesResult } from "@steipete/sweet-cookie";
+
+export function getCookiesFromNativeLinuxChromium(
+  options: GetCookiesOptions,
+  readCookies: typeof import("@steipete/sweet-cookie").getCookies,
+): Promise<GetCookiesResult>;

package/extensions/oracle/worker/linux-chromium-cookie-source.mjs

@@ -0,0 +1,98 @@
+// Purpose: Select native Linux Chromium's safe-storage key for the public Sweet Cookie parser.
+// Scope: Called only after source qualification in the short-lived auth worker.
+// Invariants: Restore password/backend overrides and scrub keyring helper environments.
+import { execFile } from "node:child_process";
+import { sweetCookieSafeStoragePasswordScrubbedEnv } from "../shared/browser-profile-helpers.mjs";
+
+// ponytail: Native Linux Chromium key selection only. Keep Sweet Cookie 0.3's
+// public parser/decryptor; remove when an upstream fix passes unchanged-path
+// performance checks. This API runs only in the short-lived auth worker.
+const PASSWORD_ENV = "SWEET_COOKIE_CHROME_SAFE_STORAGE_PASSWORD";
+const BRAVE_PASSWORD_ENV = "SWEET_COOKIE_BRAVE_SAFE_STORAGE_PASSWORD";
+const BACKEND_ENV = "SWEET_COOKIE_LINUX_KEYRING";
+
+/** @param {string} command @param {string[]} args @returns {Promise<string | undefined>} */
+function readHelper(command, args) {
+  return new Promise((resolve) => {
+    execFile(command, args, {
+      env: sweetCookieSafeStoragePasswordScrubbedEnv(),
+      encoding: "utf8", timeout: 3_000, killSignal: "SIGKILL",
+    }, (error, stdout) => resolve(error ? undefined : stdout.trim()));
+  });
+}
+
+function keyringBackend() {
+  const configured = process.env[BACKEND_ENV]?.trim().toLowerCase();
+  if (configured === "gnome" || configured === "kwallet" || configured === "basic") return configured;
+  const kde = process.env.XDG_CURRENT_DESKTOP?.split(":").some((part) => part.trim().toLowerCase() === "kde")
+    || Boolean(process.env.KDE_FULL_SESSION?.trim());
+  return kde ? "kwallet" : "gnome";
+}
+
+async function readChromiumPassword() {
+  const backend = keyringBackend();
+  if (backend === "basic") return { password: "", warnings: [] };
+  if (backend === "gnome") {
+    const password = await readHelper("secret-tool", ["lookup", "service", "Chromium Safe Storage", "account", "Chromium"])
+      || await readHelper("secret-tool", ["lookup", "application", "chromium"]);
+    return { password: password || "", warnings: password ? [] : [
+      "Failed to read Linux keyring via secret-tool; v11 cookies may be unavailable.",
+    ] };
+  }
+  const version = process.env.KDE_SESSION_VERSION?.trim();
+  const suffix = version === "5" || version === "6" ? version : "";
+  const wallet = await readHelper("dbus-send", [
+    "--session", "--print-reply=literal", `--dest=org.kde.kwalletd${suffix}`,
+    `/modules/kwalletd${suffix}`, "org.kde.KWallet.networkWallet",
+  ]);
+  const password = await readHelper("kwallet-query", [
+    "--read-password", "Chromium Safe Storage", "--folder", "Chromium Keys",
+    wallet?.replaceAll('"', "").trim() || "kdewallet",
+  ]);
+  return {
+    password: password?.toLowerCase().startsWith("failed to read") ? "" : password || "",
+    warnings: password === undefined ? [
+      "Failed to read Linux keyring via kwallet-query; v11 cookies may be unavailable.",
+    ] : [],
+  };
+}
+
+/**
+ * @param {import("@steipete/sweet-cookie").GetCookiesOptions} options
+ * @param {typeof import("@steipete/sweet-cookie").getCookies} readCookies
+ */
+export async function getCookiesFromNativeLinuxChromium(options, readCookies) {
+  const override = process.env[PASSWORD_ENV]?.trim();
+  const { password, warnings } = override
+    ? { password: override, warnings: [] }
+    : await readChromiumPassword();
+  const previous = {
+    [PASSWORD_ENV]: process.env[PASSWORD_ENV],
+    [BRAVE_PASSWORD_ENV]: process.env[BRAVE_PASSWORD_ENV],
+    [BACKEND_ENV]: process.env[BACKEND_ENV],
+  };
+  try {
+    // Sweet Cookie 0.3 classifies Brave by substrings anywhere in the DB path.
+    // Even a Chromium XDG/HOME ancestor can trigger it. Supply the selected
+    // Chromium key to either branch so neither can spawn a vendor keyring helper.
+    if (password) {
+      process.env[PASSWORD_ENV] = password;
+      process.env[BRAVE_PASSWORD_ENV] = password;
+    }
+    // Empty env values are ignored by Sweet Cookie. Its basic backend supplies
+    // the empty key without accidentally probing Chrome's keyring instead.
+    else {
+      delete process.env[PASSWORD_ENV];
+      delete process.env[BRAVE_PASSWORD_ENV];
+      process.env[BACKEND_ENV] = "basic";
+    }
+    const result = await readCookies(options);
+    result.warnings.unshift(...warnings);
+    return result;
+  } finally {
+    for (const [name, value] of Object.entries(previous)) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+  }
+}