tau-coding-agent 0.1.4 → 0.1.6

package/extensions/sandbox/macos-sandbox-shell.mjs

@@ -0,0 +1,202 @@
+#!/usr/bin/env node
+
+/**
+ * Compatibility workaround for sandbox-runtime on macOS.
+ *
+ * The runtime routes Git-over-SSH through BSD nc, which cannot authenticate to
+ * its SOCKS5 proxy. This shell preserves normal bash execution while replacing
+ * that transport with an authenticated HTTP CONNECT tunnel.
+ *
+ * Remove once the upstream fix ships:
+ * https://github.com/anthropic-experimental/sandbox-runtime/pull/385
+ */
+
+import { spawn } from "node:child_process";
+import { connect } from "node:net";
+import { fileURLToPath } from "node:url";
+
+const PROXY_CONNECT_MODE = "--proxy-connect";
+const CONNECT_TIMEOUT_MS = 15_000;
+const MAX_RESPONSE_HEADER_BYTES = 64 * 1024;
+
+if (process.argv[2] === PROXY_CONNECT_MODE) {
+  connectThroughSandboxProxy(process.argv[3], process.argv[4]);
+} else {
+  runBash(process.argv.slice(2));
+}
+
+function runBash(args) {
+  if (hasAuthenticatedSandboxProxy()) {
+    const scriptPath = fileURLToPath(import.meta.url);
+    const proxyCommand = [
+      shellQuote(escapeSshPercent(process.execPath)),
+      shellQuote(escapeSshPercent(scriptPath)),
+      PROXY_CONNECT_MODE,
+      "%h",
+      "%p",
+    ].join(" ");
+    process.env.GIT_SSH_COMMAND = [
+      "ssh",
+      "-o ControlMaster=no",
+      "-o ControlPath=none",
+      `-o ProxyCommand=${shellQuote(proxyCommand)}`,
+    ].join(" ");
+  }
+
+  const child = spawn("bash", args, {
+    env: process.env,
+    stdio: "inherit",
+  });
+  child.once("error", (error) => {
+    console.error(error.message);
+    process.exitCode = 1;
+  });
+  child.once("exit", (code, signal) => {
+    if (signal) {
+      process.kill(process.pid, signal);
+      return;
+    }
+    process.exitCode = code ?? 1;
+  });
+}
+
+function hasAuthenticatedSandboxProxy() {
+  try {
+    const proxy = getSandboxProxyUrl();
+    return proxy.protocol === "http:" && Boolean(proxy.username || proxy.password);
+  } catch {
+    return false;
+  }
+}
+
+function connectThroughSandboxProxy(targetHost, targetPortText) {
+  const targetPort = Number(targetPortText);
+  if (
+    !targetHost ||
+    /[\r\n]/u.test(targetHost) ||
+    !Number.isInteger(targetPort) ||
+    targetPort < 1 ||
+    targetPort > 65_535
+  ) {
+    fail("Invalid SSH proxy target.");
+  }
+
+  let proxy;
+  try {
+    proxy = getSandboxProxyUrl();
+  } catch (error) {
+    fail(error);
+  }
+  if (proxy.protocol !== "http:") {
+    fail(`Unsupported sandbox proxy protocol: ${proxy.protocol}`);
+  }
+
+  const proxyPort = Number(proxy.port || 80);
+  const authority = targetHost.includes(":")
+    ? `[${targetHost}]:${targetPort}`
+    : `${targetHost}:${targetPort}`;
+  let username;
+  let password;
+  try {
+    username = decodeURIComponent(proxy.username);
+    password = decodeURIComponent(proxy.password);
+  } catch {
+    fail("Sandbox HTTP proxy credentials are invalid.");
+  }
+  const authorization =
+    username || password
+      ? `Proxy-Authorization: Basic ${Buffer.from(`${username}:${password}`).toString("base64")}\r\n`
+      : "";
+
+  const socket = connect({ host: proxy.hostname, port: proxyPort });
+  const connectTimeout = setTimeout(() => {
+    socket.destroy(new Error("Sandbox proxy connection timed out."));
+  }, CONNECT_TIMEOUT_MS);
+  let response = Buffer.alloc(0);
+  let tunnelEstablished = false;
+  let connectionFailed = false;
+
+  socket.once("connect", () => {
+    clearTimeout(connectTimeout);
+    socket.write(
+      `CONNECT ${authority} HTTP/1.1\r\nHost: ${authority}\r\n${authorization}Proxy-Connection: Keep-Alive\r\n\r\n`,
+    );
+  });
+
+  const failConnection = (error) => {
+    if (connectionFailed) return;
+    connectionFailed = true;
+    clearTimeout(connectTimeout);
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+    socket.destroy();
+  };
+
+  const handleResponse = (chunk) => {
+    response = Buffer.concat([response, chunk]);
+    if (response.length > MAX_RESPONSE_HEADER_BYTES) {
+      failConnection(new Error("Sandbox proxy returned oversized headers."));
+      return;
+    }
+
+    const headerEnd = response.indexOf("\r\n\r\n");
+    if (headerEnd === -1) return;
+
+    const header = response.subarray(0, headerEnd).toString("latin1");
+    const status = header.match(/^HTTP\/\d(?:\.\d)?\s+(\d{3})/u)?.[1];
+    if (status !== "200") {
+      failConnection(new Error(`Sandbox proxy CONNECT failed${status ? ` (${status})` : ""}.`));
+      return;
+    }
+
+    tunnelEstablished = true;
+    socket.off("data", handleResponse);
+    const remainder = response.subarray(headerEnd + 4);
+    if (remainder.length > 0) process.stdout.write(remainder);
+    process.stdin.pipe(socket);
+    socket.pipe(process.stdout);
+  };
+
+  socket.on("data", handleResponse);
+  socket.once("error", failConnection);
+  socket.once("close", () => {
+    clearTimeout(connectTimeout);
+    process.stdin.unpipe(socket);
+    process.stdin.pause();
+    if (!tunnelEstablished && !connectionFailed) {
+      failConnection(new Error("Sandbox proxy closed before establishing the SSH tunnel."));
+    }
+  });
+  process.stdin.on("error", failConnection);
+  process.stdout.on("error", (error) => {
+    if (error?.code === "EPIPE") {
+      socket.destroy();
+      return;
+    }
+    failConnection(error);
+  });
+}
+
+function getSandboxProxyUrl() {
+  const value = process.env.HTTPS_PROXY ?? process.env.HTTP_PROXY;
+  if (!value) throw new Error("Sandbox HTTP proxy is unavailable.");
+
+  try {
+    return new URL(value);
+  } catch {
+    throw new Error("Sandbox HTTP proxy URL is invalid.");
+  }
+}
+
+function escapeSshPercent(value) {
+  return value.replaceAll("%", "%%");
+}
+
+function shellQuote(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+
+function fail(error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+}

package/extensions/{interlude.ts → stash.ts}

@@ -1,16 +1,19 @@
 import fs from "node:fs";
-import os from "node:os";
 import path from "node:path";
-import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import {
+  getAgentDir,
+  type ExtensionAPI,
+  type ExtensionContext,
+} from "@earendil-works/pi-coding-agent";
 
 const DEFAULT_SHORTCUTS = ["alt+x"] as const;
-const STATUS_KEY = "interlude";
-const KEYBINDINGS_PATH = path.join(os.homedir(), ".pi", "agent", "keybindings.json");
+const STATUS_KEY = "stash";
+const KEYBINDINGS_PATH = path.join(getAgentDir(), "keybindings.json");
 
 type ShortcutConfig = string | string[] | undefined;
 
 type KeybindingsConfig = {
-  interlude?: ShortcutConfig;
+  stash?: ShortcutConfig;
   [key: string]: unknown;
 };
 
@@ -37,9 +40,9 @@ function normalizeShortcuts(value: ShortcutConfig): string[] {
   return normalized.length > 0 ? [...new Set(normalized)] : [...DEFAULT_SHORTCUTS];
 }
 
-export default function interludeExtension(pi: ExtensionAPI): void {
+export default function stashExtension(pi: ExtensionAPI): void {
   const keybindings = readKeybindings(KEYBINDINGS_PATH);
-  const shortcuts = normalizeShortcuts(keybindings.interlude);
+  const shortcuts = normalizeShortcuts(keybindings.stash);
 
   let stashedDraft: string | null = null;
   let armed = false;
@@ -52,7 +55,7 @@ export default function interludeExtension(pi: ExtensionAPI): void {
     if (!ctx.hasUI) return;
 
     if (armed && stashedDraft !== null) {
-      ctx.ui.setStatus(STATUS_KEY, `interlude (${shortcutLabel()})`);
+      ctx.ui.setStatus(STATUS_KEY, `stash (${shortcutLabel()})`);
       return;
     }
 
@@ -80,7 +83,7 @@ export default function interludeExtension(pi: ExtensionAPI): void {
 
     if (armed && stashedDraft !== null) {
       restoreDraft(ctx);
-      ctx.ui.notify("Interlude draft restored", "info");
+      ctx.ui.notify("Stashed draft restored", "info");
       return;
     }
 
@@ -101,8 +104,7 @@ export default function interludeExtension(pi: ExtensionAPI): void {
 
   for (const shortcut of shortcuts) {
     pi.registerShortcut(shortcut as never, {
-      description:
-        "Stash the current message draft, send one interlude message, then restore the draft",
+      description: "Stash the current message draft, send one message, then restore it",
       handler: async (ctx) => {
         stashOrRestore(ctx);
       },

package/extensions/tool-display-mode.ts

@@ -1,7 +1,7 @@
 import { mkdir, readFile, writeFile } from "node:fs/promises";
-import os from "node:os";
 import path from "node:path";
 import {
+  getAgentDir,
   type AppKeybinding,
   CustomEditor,
   createBashToolDefinition,
@@ -77,8 +77,7 @@ function emptyConfig(): ToolDisplayModeConfig {
 }
 
 function getConfigPath(): string {
-  const agentDir = process.env.PI_CODING_AGENT_DIR ?? path.join(os.homedir(), ".pi", "agent");
-  return path.join(agentDir, CONFIG_FILE);
+  return path.join(getAgentDir(), CONFIG_FILE);
 }
 
 function isObject(value: unknown): value is JsonObject {

package/extensions/usage/anthropic.ts

@@ -1,4 +1,4 @@
-import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { readStoredCredential, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import {
   clampPercent,
   formatCurrency,
@@ -111,7 +111,7 @@ async function fetchUsage(ctx: ExtensionContext, signal?: AbortSignal): Promise<
   const token = await ctx.modelRegistry.getApiKeyForProvider(PROVIDER_ID);
   if (!token) throw new LiveUsageUnavailableError("no auth configured");
 
-  const credential = ctx.modelRegistry.authStorage.get(PROVIDER_ID);
+  const credential = readStoredCredential(PROVIDER_ID);
   if (credential?.type === "api_key") {
     throw new LiveUsageUnavailableError("API-key auth does not expose Claude subscription quota");
   }
@@ -170,12 +170,11 @@ async function fetchUsage(ctx: ExtensionContext, signal?: AbortSignal): Promise<
   };
 }
 
-async function getLiveUsageAvailability(ctx: ExtensionContext) {
-  if (!ctx.modelRegistry.authStorage.hasAuth(PROVIDER_ID)) {
+async function getLiveUsageAvailability(_ctx: ExtensionContext) {
+  const credential = readStoredCredential(PROVIDER_ID);
+  if (!credential) {
     return { available: false as const, reason: "no auth configured" };
   }
-
-  const credential = ctx.modelRegistry.authStorage.get(PROVIDER_ID);
   if (credential?.type === "oauth") {
     return { available: true as const };
   }

package/extensions/usage/github-copilot.ts

@@ -1,4 +1,5 @@
-import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { OAuthCredential } from "@earendil-works/pi-ai";
+import { readStoredCredential, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import {
   clampPercent,
   formatCount,
@@ -8,7 +9,12 @@ import {
   readNumber,
   readString,
 } from "./shared.js";
-import type { LiveUsageItem, LiveUsageSnapshot, UsageProviderDefinition } from "./types.js";
+import type {
+  LiveUsageAvailability,
+  LiveUsageItem,
+  LiveUsageSnapshot,
+  UsageProviderDefinition,
+} from "./types.js";
 
 const PROVIDER_ID = "github-copilot";
 
@@ -136,13 +142,18 @@ function buildUsageUrl(enterpriseUrl?: string): string {
   return `https://${host}/copilot_internal/user`;
 }
 
-async function fetchUsage(ctx: ExtensionContext, signal?: AbortSignal): Promise<LiveUsageSnapshot> {
-  const credential = ctx.modelRegistry.authStorage.get(PROVIDER_ID);
-  if (
-    credential?.type !== "oauth" ||
-    typeof credential.refresh !== "string" ||
-    !credential.refresh.trim()
-  ) {
+async function getLiveUsageAvailability(_ctx: ExtensionContext): Promise<LiveUsageAvailability> {
+  return getStoredCopilotCredential()
+    ? { available: true }
+    : { available: false, reason: "not logged in" };
+}
+
+async function fetchUsage(
+  _ctx: ExtensionContext,
+  signal?: AbortSignal,
+): Promise<LiveUsageSnapshot> {
+  const credential = getStoredCopilotCredential();
+  if (!credential) {
     throw new Error("Not logged in to GitHub Copilot.");
   }
 
@@ -193,11 +204,21 @@ async function fetchUsage(ctx: ExtensionContext, signal?: AbortSignal): Promise<
   };
 }
 
+function getStoredCopilotCredential(): OAuthCredential | undefined {
+  const credential = readStoredCredential(PROVIDER_ID);
+  return credential?.type === "oauth" &&
+    typeof credential.refresh === "string" &&
+    credential.refresh.trim()
+    ? credential
+    : undefined;
+}
+
 const githubCopilotProvider: UsageProviderDefinition = {
   id: PROVIDER_ID,
   label: "GitHub Copilot",
   shortLabel: "copilot",
   color: { r: 168, g: 85, b: 247 },
+  getLiveUsageAvailability,
   fetchLiveUsage: fetchUsage,
 };
 

package/extensions/usage/index.ts

@@ -1,5 +1,9 @@
-import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { BorderedLoader } from "@earendil-works/pi-coding-agent";
+import {
+  BorderedLoader,
+  getAgentDir,
+  type ExtensionAPI,
+  type ExtensionContext,
+} from "@earendil-works/pi-coding-agent";
 import {
   Key,
   matchesKey,
@@ -31,7 +35,7 @@ import type {
 } from "./types.js";
 
 const ALL_TAB_ID = "all";
-const SESSION_ROOT = path.join(os.homedir(), ".pi", "agent", "sessions");
+const SESSION_ROOT = path.join(getAgentDir(), "sessions");
 const RANGE_DAYS = [7, 30, 90] as const;
 const FILE_PARSE_CONCURRENCY = 16;
 
@@ -1429,7 +1433,7 @@ async function getLiveUsageAvailability(
     return provider.getLiveUsageAvailability(ctx);
   }
 
-  return ctx.modelRegistry.authStorage.hasAuth(provider.id)
+  return ctx.modelRegistry.getProviderAuthStatus(provider.id).configured
     ? { available: true }
     : { available: false, reason: "no auth configured" };
 }
@@ -2205,7 +2209,7 @@ export default function usageBreakdownExtension(pi: ExtensionAPI) {
     handler: async (_args, ctx: ExtensionContext) => {
       const liveUsageAvailability = await getLiveUsageAvailabilityMap(ctx);
 
-      if (!ctx.hasUI) {
+      if (ctx.mode !== "tui") {
         const [data, liveUsage] = await Promise.all([
           computeBreakdown(liveUsageAvailability, undefined),
           fetchLiveUsage(SUPPORTED_PROVIDERS, liveUsageAvailability, ctx, undefined),

package/extensions/usage/openai-codex.ts

@@ -1,4 +1,4 @@
-import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { readStoredCredential, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import {
   clampPercent,
   formatCurrency,
@@ -112,7 +112,7 @@ async function fetchUsage(ctx: ExtensionContext, signal?: AbortSignal): Promise<
   const apiKey = await ctx.modelRegistry.getApiKeyForProvider(PROVIDER_ID);
   if (!apiKey) throw new Error("Not logged in to OpenAI Codex.");
 
-  const credential = ctx.modelRegistry.authStorage.get(PROVIDER_ID);
+  const credential = readStoredCredential(PROVIDER_ID);
   const accountId =
     credential?.type === "oauth" && typeof credential.accountId === "string"
       ? credential.accountId

package/extensions/websearch/README.md

@@ -16,7 +16,7 @@ Current routes:
 
 Optional config file:
 
-- `~/.pi/websearch.json`
+- `~/.pi/agent/websearch.json`
 
 Example:
 

package/extensions/websearch/browser/chromium.ts

@@ -1,11 +1,13 @@
-import { execFileSync } from "node:child_process";
-import { createDecipheriv, createHash, pbkdf2Sync } from "node:crypto";
-import { existsSync, readdirSync } from "node:fs";
+import { execFile } from "node:child_process";
+import { createDecipheriv, createHash, pbkdf2 } from "node:crypto";
+import { readdir } from "node:fs/promises";
 import { DatabaseSync } from "node:sqlite";
 import os from "node:os";
 import path from "node:path";
+import { promisify } from "node:util";
 
 import type { BrowserCookie, BrowserProfile } from "../types.js";
+import { pathExists } from "./fs.js";
 import { withSqliteSnapshot } from "./sqlite.js";
 
 const MACOS_BROWSER_CONFIGS: ChromiumBrowserConfig[] = [
@@ -72,6 +74,8 @@ interface ChromiumBrowserConfig {
   secretToolApp?: string;
 }
 
+const execFileAsync = promisify(execFile);
+const pbkdf2Async = promisify(pbkdf2);
 const passwordCache = new Map<string, string | null>();
 
 function browserConfigs(): ChromiumBrowserConfig[] {
@@ -80,13 +84,15 @@ function browserConfigs(): ChromiumBrowserConfig[] {
   return [];
 }
 
-export function discoverChromiumProfiles(preferredProfileName?: string): BrowserProfile[] {
+export async function discoverChromiumProfiles(
+  preferredProfileName?: string,
+): Promise<BrowserProfile[]> {
   const profiles: BrowserProfile[] = [];
 
   for (const config of browserConfigs()) {
-    if (!existsSync(config.baseDir)) continue;
+    if (!(await pathExists(config.baseDir))) continue;
 
-    const candidates = ["Default", ...discoverProfileDirectories(config.baseDir)];
+    const candidates = ["Default", ...(await discoverProfileDirectories(config.baseDir))];
     const seen = new Set<string>();
     for (const directoryName of candidates) {
       if (!directoryName || seen.has(directoryName)) continue;
@@ -94,7 +100,7 @@ export function discoverChromiumProfiles(preferredProfileName?: string): Browser
 
       const profilePath = path.join(config.baseDir, directoryName);
       const cookiesPath = path.join(profilePath, "Cookies");
-      if (!existsSync(cookiesPath)) continue;
+      if (!(await pathExists(cookiesPath))) continue;
 
       profiles.push({
         family: "chromium",
@@ -136,9 +142,9 @@ function isPreferredChromiumProfile(
   return profile.profileName === preferredProfileName;
 }
 
-function discoverProfileDirectories(baseDir: string): string[] {
+async function discoverProfileDirectories(baseDir: string): Promise<string[]> {
   try {
-    return readdirSync(baseDir, { withFileTypes: true })
+    return (await readdir(baseDir, { withFileTypes: true }))
       .filter((entry) => entry.isDirectory())
       .map((entry) => entry.name)
       .filter((name) => name === "Default" || /^Profile\s+\d+$/.test(name));
@@ -147,27 +153,28 @@ function discoverProfileDirectories(baseDir: string): string[] {
   }
 }
 
-export function loadChromiumCookies(profile: BrowserProfile): BrowserCookie[] {
+export async function loadChromiumCookies(profile: BrowserProfile): Promise<BrowserCookie[]> {
   const browserConfig = browserConfigs().find((config) =>
     profile.profilePath.startsWith(config.baseDir),
   );
   if (!browserConfig) return [];
 
-  const password = readBrowserPassword(browserConfig);
+  const cookiesPath = path.join(profile.profilePath, "Cookies");
+  if (!(await pathExists(cookiesPath))) return [];
+
+  const password = await readBrowserPassword(browserConfig);
   if (!password) return [];
 
-  const keyMaterial = pbkdf2Sync(
+  const keyMaterial = await pbkdf2Async(
     password,
     "saltysalt",
     process.platform === "darwin" ? 1003 : 1,
     16,
     "sha1",
   );
-  const cookiesPath = path.join(profile.profilePath, "Cookies");
-  if (!existsSync(cookiesPath)) return [];
 
   try {
-    return withSqliteSnapshot(cookiesPath, "websearch-chromium", (tempDbPath) => {
+    return await withSqliteSnapshot(cookiesPath, "websearch-chromium", (tempDbPath) => {
       const db = new DatabaseSync(tempDbPath, { readOnly: true });
       try {
         const rows = db
@@ -277,7 +284,7 @@ function stripHostKeyDigest(buffer: Buffer, hostKey: string | null): Buffer {
   return buffer.subarray(0, 32).equals(digest) ? buffer.subarray(32) : buffer;
 }
 
-function readBrowserPassword(config: ChromiumBrowserConfig): string | null {
+async function readBrowserPassword(config: ChromiumBrowserConfig): Promise<string | null> {
   const cacheKey = `${config.name}:${config.baseDir}`;
   if (passwordCache.has(cacheKey)) {
     return passwordCache.get(cacheKey) ?? null;
@@ -286,9 +293,13 @@ function readBrowserPassword(config: ChromiumBrowserConfig): string | null {
   let password: string | null = null;
   if (process.platform === "darwin") {
     if (!config.keychainAccount || !config.keychainService) return null;
-    password = readMacKeychainPassword(config.name, config.keychainAccount, config.keychainService);
+    password = await readMacKeychainPassword(
+      config.name,
+      config.keychainAccount,
+      config.keychainService,
+    );
   } else if (process.platform === "linux") {
-    password = readLinuxPassword(config.secretToolApp);
+    password = await readLinuxPassword(config.secretToolApp);
   }
 
   if (password) {
@@ -297,33 +308,33 @@ function readBrowserPassword(config: ChromiumBrowserConfig): string | null {
   return password;
 }
 
-function readMacKeychainPassword(
+async function readMacKeychainPassword(
   browserName: string,
   account: string,
   service: string,
-): string | null {
+): Promise<string | null> {
   try {
-    return (
-      execFileSync("security", ["find-generic-password", "-w", "-a", account, "-s", service], {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-      }).trim() || null
+    const { stdout } = await execFileAsync(
+      "security",
+      ["find-generic-password", "-w", "-a", account, "-s", service],
+      { encoding: "utf8" },
     );
+    return stdout.trim() || null;
   } catch {
     throw new Error(`Could not read ${browserName} cookie decryption password from Keychain.`);
   }
 }
 
-function readLinuxPassword(secretToolApp?: string): string | null {
+async function readLinuxPassword(secretToolApp?: string): Promise<string | null> {
   if (!secretToolApp) return "peanuts";
 
   try {
-    return (
-      execFileSync("secret-tool", ["lookup", "application", secretToolApp], {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-      }).trim() || "peanuts"
+    const { stdout } = await execFileAsync(
+      "secret-tool",
+      ["lookup", "application", secretToolApp],
+      { encoding: "utf8" },
     );
+    return stdout.trim() || "peanuts";
   } catch {
     return "peanuts";
   }

package/extensions/websearch/browser/discovery.ts

@@ -11,32 +11,34 @@ import type {
 const COOKIE_CACHE_TTL_MS = 30_000;
 const cookieCache = new Map<string, { cookies: BrowserCookie[]; expiresAt: number }>();
 
-export function discoverProfiles(
+export async function discoverProfiles(
   browserFamilies: WebsearchBrowserFamily[],
   preferredProfiles: WebsearchConfig["profiles"],
-): BrowserProfile[] {
+): Promise<BrowserProfile[]> {
   const profiles: BrowserProfile[] = [];
 
   for (const family of browserFamilies) {
     if (family === "firefox") {
-      profiles.push(...discoverFirefoxProfiles(preferredProfiles.firefox));
+      profiles.push(...(await discoverFirefoxProfiles(preferredProfiles.firefox)));
       continue;
     }
 
-    profiles.push(...discoverChromiumProfiles(preferredProfiles.chromium));
+    profiles.push(...(await discoverChromiumProfiles(preferredProfiles.chromium)));
   }
 
   return profiles;
 }
 
-export function loadCookies(profile: BrowserProfile): BrowserCookie[] {
+export async function loadCookies(profile: BrowserProfile): Promise<BrowserCookie[]> {
   const cacheKey = `${profile.family}:${profile.profilePath}`;
   const cached = cookieCache.get(cacheKey);
   if (cached && cached.expiresAt > Date.now()) return cached.cookies;
   if (cached) cookieCache.delete(cacheKey);
 
   const cookies =
-    profile.family === "firefox" ? loadFirefoxCookies(profile) : loadChromiumCookies(profile);
+    profile.family === "firefox"
+      ? await loadFirefoxCookies(profile)
+      : await loadChromiumCookies(profile);
 
   if (cookies.length > 0) {
     cookieCache.set(cacheKey, {
@@ -48,11 +50,11 @@ export function loadCookies(profile: BrowserProfile): BrowserCookie[] {
   return cookies;
 }
 
-export function createBrowserSession(
+export async function createBrowserSession(
   profile: BrowserProfile,
   domains: string[],
-): BrowserSession | null {
-  const cookies = loadCookies(profile).filter((cookie) => {
+): Promise<BrowserSession | null> {
+  const cookies = (await loadCookies(profile)).filter((cookie) => {
     return domains.some((domain) => matchesBrowserDomain(domain, cookie.domain));
   });
   if (cookies.length === 0) return null;