tau-coding-agent 0.1.0

package/extensions/websearch/browser/chromium.ts

@@ -0,0 +1,330 @@
+import { execFileSync } from "node:child_process";
+import { createDecipheriv, createHash, pbkdf2Sync } from "node:crypto";
+import { existsSync, readdirSync } from "node:fs";
+import { DatabaseSync } from "node:sqlite";
+import os from "node:os";
+import path from "node:path";
+
+import type { BrowserCookie, BrowserProfile } from "../types.js";
+import { withSqliteSnapshot } from "./sqlite.js";
+
+const MACOS_BROWSER_CONFIGS: ChromiumBrowserConfig[] = [
+  {
+    name: "Chromium",
+    baseDir: path.join(os.homedir(), "Library", "Application Support", "Chromium"),
+    keychainService: "Chromium Safe Storage",
+    keychainAccount: "Chromium",
+  },
+  {
+    name: "Chrome",
+    baseDir: path.join(os.homedir(), "Library", "Application Support", "Google", "Chrome"),
+    keychainService: "Chrome Safe Storage",
+    keychainAccount: "Chrome",
+  },
+  {
+    name: "Brave",
+    baseDir: path.join(
+      os.homedir(),
+      "Library",
+      "Application Support",
+      "BraveSoftware",
+      "Brave-Browser",
+    ),
+    keychainService: "Brave Safe Storage",
+    keychainAccount: "Brave",
+  },
+  {
+    name: "Edge",
+    baseDir: path.join(os.homedir(), "Library", "Application Support", "Microsoft Edge"),
+    keychainService: "Microsoft Edge Safe Storage",
+    keychainAccount: "Microsoft Edge",
+  },
+];
+
+const LINUX_BROWSER_CONFIGS: ChromiumBrowserConfig[] = [
+  {
+    name: "Chromium",
+    baseDir: path.join(os.homedir(), ".config", "chromium"),
+    secretToolApp: "chromium",
+  },
+  {
+    name: "Chrome",
+    baseDir: path.join(os.homedir(), ".config", "google-chrome"),
+    secretToolApp: "chrome",
+  },
+  {
+    name: "Brave",
+    baseDir: path.join(os.homedir(), ".config", "BraveSoftware", "Brave-Browser"),
+    secretToolApp: "brave",
+  },
+  {
+    name: "Edge",
+    baseDir: path.join(os.homedir(), ".config", "microsoft-edge"),
+    secretToolApp: "microsoft-edge",
+  },
+];
+
+interface ChromiumBrowserConfig {
+  name: string;
+  baseDir: string;
+  keychainService?: string;
+  keychainAccount?: string;
+  secretToolApp?: string;
+}
+
+const passwordCache = new Map<string, string | null>();
+
+function browserConfigs(): ChromiumBrowserConfig[] {
+  if (process.platform === "darwin") return MACOS_BROWSER_CONFIGS;
+  if (process.platform === "linux") return LINUX_BROWSER_CONFIGS;
+  return [];
+}
+
+export function discoverChromiumProfiles(preferredProfileName?: string): BrowserProfile[] {
+  const profiles: BrowserProfile[] = [];
+
+  for (const config of browserConfigs()) {
+    if (!existsSync(config.baseDir)) continue;
+
+    const candidates = ["Default", ...discoverProfileDirectories(config.baseDir)];
+    const seen = new Set<string>();
+    for (const directoryName of candidates) {
+      if (!directoryName || seen.has(directoryName)) continue;
+      seen.add(directoryName);
+
+      const profilePath = path.join(config.baseDir, directoryName);
+      const cookiesPath = path.join(profilePath, "Cookies");
+      if (!existsSync(cookiesPath)) continue;
+
+      profiles.push({
+        family: "chromium",
+        browserName: config.name,
+        profileName: directoryName,
+        profilePath,
+      });
+    }
+  }
+
+  const sorted = profiles.sort((left, right) => {
+    const leftPreferred = isPreferredChromiumProfile(left, preferredProfileName);
+    const rightPreferred = isPreferredChromiumProfile(right, preferredProfileName);
+    if (leftPreferred !== rightPreferred) return leftPreferred ? -1 : 1;
+
+    if (left.browserName !== right.browserName) {
+      return browserPriority(left.browserName) - browserPriority(right.browserName);
+    }
+
+    return left.profileName.localeCompare(right.profileName);
+  });
+
+  return preferredProfileName
+    ? sorted.filter((profile) => isPreferredChromiumProfile(profile, preferredProfileName))
+    : sorted;
+}
+
+function browserPriority(browserName: string): number {
+  const order = ["Chromium", "Chrome", "Brave", "Edge"];
+  const index = order.indexOf(browserName);
+  return index === -1 ? order.length : index;
+}
+
+function isPreferredChromiumProfile(
+  profile: BrowserProfile,
+  preferredProfileName?: string,
+): boolean {
+  if (!preferredProfileName) return false;
+  return profile.profileName === preferredProfileName;
+}
+
+function discoverProfileDirectories(baseDir: string): string[] {
+  try {
+    return readdirSync(baseDir, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => entry.name)
+      .filter((name) => name === "Default" || /^Profile\s+\d+$/.test(name));
+  } catch {
+    return [];
+  }
+}
+
+export function loadChromiumCookies(profile: BrowserProfile): BrowserCookie[] {
+  const browserConfig = browserConfigs().find((config) =>
+    profile.profilePath.startsWith(config.baseDir),
+  );
+  if (!browserConfig) return [];
+
+  const password = readBrowserPassword(browserConfig);
+  if (!password) return [];
+
+  const keyMaterial = pbkdf2Sync(
+    password,
+    "saltysalt",
+    process.platform === "darwin" ? 1003 : 1,
+    16,
+    "sha1",
+  );
+  const cookiesPath = path.join(profile.profilePath, "Cookies");
+  if (!existsSync(cookiesPath)) return [];
+
+  try {
+    return withSqliteSnapshot(cookiesPath, "websearch-chromium", (tempDbPath) => {
+      const db = new DatabaseSync(tempDbPath, { readOnly: true });
+      try {
+        const rows = db
+          .prepare(
+            "SELECT host_key, name, value, encrypted_value, path, is_secure FROM cookies ORDER BY host_key ASC, path DESC, expires_utc DESC",
+          )
+          .all() as Array<Record<string, unknown>>;
+
+        const cookies: BrowserCookie[] = [];
+        const seen = new Set<string>();
+        let sawEncryptedCookie = false;
+        let failedDecrypt = false;
+        for (const row of rows) {
+          const name = typeof row.name === "string" ? row.name : null;
+          const domain = typeof row.host_key === "string" ? row.host_key : null;
+          const cookiePath = typeof row.path === "string" ? row.path : "/";
+          if (!name || !domain) continue;
+
+          const key = `${name}\u0000${domain}\u0000${cookiePath}`;
+          if (seen.has(key)) continue;
+
+          const plainValue =
+            typeof row.value === "string" && row.value.length > 0 ? row.value : null;
+          if (plainValue !== null) {
+            seen.add(key);
+            cookies.push({
+              name,
+              value: plainValue,
+              domain,
+              path: cookiePath,
+              secure: Boolean(row.is_secure),
+            });
+            continue;
+          }
+
+          if (!(row.encrypted_value instanceof Uint8Array)) continue;
+          sawEncryptedCookie = true;
+          const decrypted = decryptCookieValue(row.encrypted_value, keyMaterial, domain);
+          if (decrypted !== null) {
+            seen.add(key);
+            cookies.push({
+              name,
+              value: decrypted,
+              domain,
+              path: cookiePath,
+              secure: Boolean(row.is_secure),
+            });
+          } else {
+            failedDecrypt = true;
+          }
+        }
+
+        if (cookies.length === 0 && sawEncryptedCookie && failedDecrypt) {
+          throw new Error(`Could not decrypt ${profile.browserName} cookies.`);
+        }
+
+        return cookies;
+      } finally {
+        db.close();
+      }
+    });
+  } catch (error) {
+    if (error instanceof Error) throw error;
+    throw new Error(`Could not read ${profile.browserName} cookies.`);
+  }
+}
+
+function decryptCookieValue(
+  encrypted: Uint8Array,
+  key: Buffer,
+  hostKey: string | null,
+): string | null {
+  const buffer = Buffer.from(encrypted);
+  if (buffer.length < 3) return null;
+
+  const prefix = buffer.subarray(0, 3).toString("utf8");
+  if (prefix !== "v10") return null;
+
+  try {
+    const iv = Buffer.alloc(16, 0x20);
+    const decipher = createDecipheriv("aes-128-cbc", key, iv);
+    decipher.setAutoPadding(false);
+    const decrypted = stripPkcs7Padding(
+      Buffer.concat([decipher.update(buffer.subarray(3)), decipher.final()]),
+    );
+    const normalized = stripHostKeyDigest(decrypted, hostKey);
+    const text = normalized.toString("utf8");
+    let start = 0;
+    while (text.charCodeAt(start) === 0) start += 1;
+    return text.slice(start);
+  } catch {
+    return null;
+  }
+}
+
+function stripPkcs7Padding(buffer: Buffer): Buffer {
+  if (buffer.length === 0) return buffer;
+  const padding = buffer[buffer.length - 1];
+  if (padding <= 0 || padding > 16) return buffer;
+  return buffer.subarray(0, buffer.length - padding);
+}
+
+function stripHostKeyDigest(buffer: Buffer, hostKey: string | null): Buffer {
+  if (!hostKey || buffer.length <= 32) return buffer;
+
+  const digest = createHash("sha256").update(hostKey).digest();
+  return buffer.subarray(0, 32).equals(digest) ? buffer.subarray(32) : buffer;
+}
+
+function readBrowserPassword(config: ChromiumBrowserConfig): string | null {
+  const cacheKey = `${config.name}:${config.baseDir}`;
+  if (passwordCache.has(cacheKey)) {
+    return passwordCache.get(cacheKey) ?? null;
+  }
+
+  let password: string | null = null;
+  if (process.platform === "darwin") {
+    if (!config.keychainAccount || !config.keychainService) return null;
+    password = readMacKeychainPassword(config.name, config.keychainAccount, config.keychainService);
+  } else if (process.platform === "linux") {
+    password = readLinuxPassword(config.secretToolApp);
+  }
+
+  if (password) {
+    passwordCache.set(cacheKey, password);
+  }
+  return password;
+}
+
+function readMacKeychainPassword(
+  browserName: string,
+  account: string,
+  service: string,
+): string | null {
+  try {
+    return (
+      execFileSync("security", ["find-generic-password", "-w", "-a", account, "-s", service], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+      }).trim() || null
+    );
+  } catch {
+    throw new Error(`Could not read ${browserName} cookie decryption password from Keychain.`);
+  }
+}
+
+function readLinuxPassword(secretToolApp?: string): string | null {
+  if (!secretToolApp) return "peanuts";
+
+  try {
+    return (
+      execFileSync("secret-tool", ["lookup", "application", secretToolApp], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+      }).trim() || "peanuts"
+    );
+  } catch {
+    return "peanuts";
+  }
+}

package/extensions/websearch/browser/discovery.ts

@@ -0,0 +1,75 @@
+import { discoverChromiumProfiles, loadChromiumCookies } from "./chromium.js";
+import { discoverFirefoxProfiles, loadFirefoxCookies } from "./firefox.js";
+import type {
+  BrowserCookie,
+  BrowserProfile,
+  BrowserSession,
+  WebsearchBrowserFamily,
+  WebsearchConfig,
+} from "../types.js";
+
+const COOKIE_CACHE_TTL_MS = 30_000;
+const cookieCache = new Map<string, { cookies: BrowserCookie[]; expiresAt: number }>();
+
+export function discoverProfiles(
+  browserFamilies: WebsearchBrowserFamily[],
+  preferredProfiles: WebsearchConfig["profiles"],
+): BrowserProfile[] {
+  const profiles: BrowserProfile[] = [];
+
+  for (const family of browserFamilies) {
+    if (family === "firefox") {
+      profiles.push(...discoverFirefoxProfiles(preferredProfiles.firefox));
+      continue;
+    }
+
+    profiles.push(...discoverChromiumProfiles(preferredProfiles.chromium));
+  }
+
+  return profiles;
+}
+
+export function loadCookies(profile: BrowserProfile): BrowserCookie[] {
+  const cacheKey = `${profile.family}:${profile.profilePath}`;
+  const cached = cookieCache.get(cacheKey);
+  if (cached && cached.expiresAt > Date.now()) return cached.cookies;
+  if (cached) cookieCache.delete(cacheKey);
+
+  const cookies =
+    profile.family === "firefox" ? loadFirefoxCookies(profile) : loadChromiumCookies(profile);
+
+  if (cookies.length > 0) {
+    cookieCache.set(cacheKey, {
+      cookies,
+      expiresAt: Date.now() + COOKIE_CACHE_TTL_MS,
+    });
+  }
+
+  return cookies;
+}
+
+export function createBrowserSession(
+  profile: BrowserProfile,
+  domains: string[],
+): BrowserSession | null {
+  const cookies = loadCookies(profile).filter((cookie) => {
+    return domains.some((domain) => matchesBrowserDomain(domain, cookie.domain));
+  });
+  if (cookies.length === 0) return null;
+
+  return {
+    profile,
+    cookies,
+  };
+}
+
+function matchesBrowserDomain(requestedDomain: string, cookieDomain: string): boolean {
+  const normalizedRequested = requestedDomain.toLowerCase().replace(/^\./, "");
+  const normalizedCookie = cookieDomain.toLowerCase().replace(/^\./, "");
+
+  return (
+    normalizedCookie === normalizedRequested ||
+    normalizedCookie.endsWith(`.${normalizedRequested}`) ||
+    normalizedRequested.endsWith(`.${normalizedCookie}`)
+  );
+}

package/extensions/websearch/browser/firefox.ts

@@ -0,0 +1,150 @@
+import { existsSync, readFileSync } from "node:fs";
+import { DatabaseSync } from "node:sqlite";
+import os from "node:os";
+import path from "node:path";
+
+import type { BrowserCookie, BrowserProfile } from "../types.js";
+import { withSqliteSnapshot } from "./sqlite.js";
+
+function firefoxBaseDir(): string | null {
+  if (process.platform === "darwin") {
+    return path.join(os.homedir(), "Library", "Application Support", "Firefox");
+  }
+
+  if (process.platform === "linux") {
+    return path.join(os.homedir(), ".mozilla", "firefox");
+  }
+
+  return null;
+}
+
+function parseIni(text: string): Array<Record<string, string>> {
+  const sections: Array<Record<string, string>> = [];
+  let current: Record<string, string> | null = null;
+
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith(";") || line.startsWith("#")) continue;
+
+    const sectionMatch = line.match(/^\[(.+)\]$/);
+    if (sectionMatch) {
+      current = { __section: sectionMatch[1] ?? "" };
+      sections.push(current);
+      continue;
+    }
+
+    if (!current) continue;
+
+    const separatorIndex = line.indexOf("=");
+    if (separatorIndex === -1) continue;
+    const key = line.slice(0, separatorIndex).trim();
+    const value = line.slice(separatorIndex + 1).trim();
+    current[key] = value;
+  }
+
+  return sections;
+}
+
+export function discoverFirefoxProfiles(preferredProfileName?: string): BrowserProfile[] {
+  const baseDir = firefoxBaseDir();
+  if (!baseDir) return [];
+
+  const profilesIniPath = path.join(baseDir, "profiles.ini");
+
+  let sections: Array<Record<string, string>> = [];
+  try {
+    sections = parseIni(readFileSync(profilesIniPath, "utf8"));
+  } catch {
+    return [];
+  }
+
+  const profiles: BrowserProfile[] = [];
+  for (const section of sections) {
+    if (!section.__section?.startsWith("Profile")) continue;
+    const profilePathValue = section.Path;
+    if (!profilePathValue) continue;
+
+    const profilePath =
+      section.IsRelative === "1" ? path.join(baseDir, profilePathValue) : profilePathValue;
+    const cookiesPath = path.join(profilePath, "cookies.sqlite");
+    if (!existsSync(cookiesPath)) continue;
+
+    profiles.push({
+      family: "firefox",
+      browserName: "Firefox",
+      profileName: section.Name?.trim() || path.basename(profilePath),
+      profilePath,
+    });
+  }
+
+  const sorted = profiles.sort((left, right) => {
+    const leftPreferred = isPreferredFirefoxProfile(left, preferredProfileName);
+    const rightPreferred = isPreferredFirefoxProfile(right, preferredProfileName);
+    if (leftPreferred !== rightPreferred) return leftPreferred ? -1 : 1;
+    return left.profileName.localeCompare(right.profileName);
+  });
+
+  return preferredProfileName
+    ? sorted.filter((profile) => isPreferredFirefoxProfile(profile, preferredProfileName))
+    : sorted;
+}
+
+function isPreferredFirefoxProfile(
+  profile: BrowserProfile,
+  preferredProfileName?: string,
+): boolean {
+  if (!preferredProfileName) return false;
+  return (
+    profile.profileName === preferredProfileName ||
+    path.basename(profile.profilePath) === preferredProfileName
+  );
+}
+
+export function loadFirefoxCookies(profile: BrowserProfile): BrowserCookie[] {
+  const cookiesPath = path.join(profile.profilePath, "cookies.sqlite");
+  if (!existsSync(cookiesPath)) return [];
+
+  try {
+    return withSqliteSnapshot(cookiesPath, "websearch-firefox", (tempDbPath) => {
+      const db = new DatabaseSync(tempDbPath, { readOnly: true });
+      try {
+        const rows = db
+          .prepare(
+            "SELECT name, value, host, path, isSecure FROM moz_cookies ORDER BY host ASC, path DESC, expiry DESC",
+          )
+          .all() as Array<Record<string, unknown>>;
+
+        const cookies: BrowserCookie[] = [];
+        const seen = new Set<string>();
+        for (const row of rows) {
+          const name = typeof row.name === "string" ? row.name : null;
+          const value = typeof row.value === "string" ? row.value : null;
+          const domain = typeof row.host === "string" ? row.host : null;
+          const cookiePath = typeof row.path === "string" ? row.path : "/";
+          if (!name || value === null || !domain) continue;
+
+          const key = `${name}\u0000${domain}\u0000${cookiePath}`;
+          if (seen.has(key)) continue;
+          seen.add(key);
+          cookies.push({
+            name,
+            value,
+            domain,
+            path: cookiePath,
+            secure: Boolean(row.isSecure),
+          });
+        }
+
+        return cookies;
+      } catch (error) {
+        if (error instanceof Error) throw error;
+        throw new Error("Could not read Firefox cookies.");
+      } finally {
+        db.close();
+      }
+    });
+  } catch (error) {
+    if (error instanceof Error) throw error;
+    throw new Error("Could not snapshot Firefox cookies.");
+  }
+}

package/extensions/websearch/browser/sqlite.ts

@@ -0,0 +1,38 @@
+import { copyFileSync, existsSync, mkdirSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+export function withSqliteSnapshot<T>(
+  sourceDbPath: string,
+  tempPrefix: string,
+  operation: (snapshotPath: string) => T,
+): T {
+  const tempDir = path.join(os.tmpdir(), `${tempPrefix}-${process.pid}-${Date.now()}`);
+  const snapshotPath = path.join(tempDir, path.basename(sourceDbPath));
+
+  try {
+    mkdirSync(tempDir, { recursive: true });
+    copyFileSync(sourceDbPath, snapshotPath);
+    copySidecar(sourceDbPath, snapshotPath, "-wal");
+    copySidecar(sourceDbPath, snapshotPath, "-shm");
+    copySidecar(sourceDbPath, snapshotPath, "-journal");
+    return operation(snapshotPath);
+  } finally {
+    rmSync(tempDir, { recursive: true, force: true });
+  }
+}
+
+export function copySidecar(sourceDbPath: string, targetDbPath: string, suffix: string): void {
+  const source = `${sourceDbPath}${suffix}`;
+  if (!existsSync(source)) return;
+
+  try {
+    copyFileSync(source, `${targetDbPath}${suffix}`);
+  } catch (error) {
+    const code =
+      error && typeof error === "object" && "code" in error
+        ? (error as { code?: string }).code
+        : undefined;
+    if (code !== "ENOENT") throw error;
+  }
+}

package/extensions/websearch/config.ts

@@ -0,0 +1,76 @@
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+
+import type { WebsearchConfig, WebsearchRouteId } from "./types.js";
+
+const WEBSEARCH_CONFIG_PATH = path.join(homedir(), ".pi", "websearch.json");
+
+const DEFAULT_ROUTES: WebsearchRouteId[] = [
+  "pi:openai-codex",
+  "pi:anthropic",
+  "pi:gemini",
+  "firefox:gemini",
+  "firefox:openai-codex",
+  "chromium:gemini",
+  "chromium:openai-codex",
+];
+
+function sanitizeRoutes(value: unknown): WebsearchRouteId[] {
+  if (value === undefined) return [...DEFAULT_ROUTES];
+  if (!Array.isArray(value)) {
+    throw new Error("websearch config routes must be an array.");
+  }
+
+  const valid = new Set<WebsearchRouteId>(DEFAULT_ROUTES);
+  const result: WebsearchRouteId[] = [];
+
+  for (const item of value) {
+    if (typeof item !== "string" || !valid.has(item as WebsearchRouteId)) {
+      throw new Error(`Invalid websearch route: ${String(item)}`);
+    }
+    if (!result.includes(item as WebsearchRouteId)) {
+      result.push(item as WebsearchRouteId);
+    }
+  }
+
+  return result;
+}
+
+function sanitizeProfileName(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : undefined;
+}
+
+export function loadConfig(): WebsearchConfig {
+  let raw: Record<string, unknown> = {};
+
+  try {
+    raw = JSON.parse(readFileSync(WEBSEARCH_CONFIG_PATH, "utf8")) as Record<string, unknown>;
+  } catch (error) {
+    const code =
+      error && typeof error === "object" && "code" in error
+        ? (error as { code?: string }).code
+        : undefined;
+    if (code === "ENOENT") {
+      raw = {};
+    } else {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new Error(`Invalid websearch config at ${WEBSEARCH_CONFIG_PATH}: ${message}`);
+    }
+  }
+
+  const profiles =
+    raw.profiles && typeof raw.profiles === "object"
+      ? (raw.profiles as Record<string, unknown>)
+      : {};
+
+  return {
+    routes: sanitizeRoutes(raw.routes),
+    profiles: {
+      firefox: sanitizeProfileName(profiles.firefox),
+      chromium: sanitizeProfileName(profiles.chromium),
+    },
+  };
+}