xtrm-tools 0.7.3 → 0.7.4

package/.xtrm/skills/default/last30days/scripts/lib/chrome_cookies.py

@@ -0,0 +1,265 @@
+"""Chrome cookie extraction for macOS.
+
+Extracts cookies from Chrome's encrypted SQLite database using only stdlib
+modules and the system openssl CLI (ships with macOS). Zero pip dependencies.
+
+Chrome on macOS uses v10 encryption (AES-128-CBC with Keychain-stored key).
+This is NOT affected by Windows App-Bound Encryption (v20).
+"""
+
+import hashlib
+import logging
+import shutil
+import sqlite3
+import subprocess
+import tempfile
+from pathlib import Path
+from typing import Optional
+
+logger = logging.getLogger(__name__)
+
+# Chrome cookie DB location on macOS
+CHROME_COOKIES_DB = Path.home() / "Library" / "Application Support" / "Google" / "Chrome" / "Default" / "Cookies"
+
+# Chrome v10 encryption constants
+CHROME_SALT = b"saltysalt"
+CHROME_PBKDF2_ITERATIONS = 1003
+CHROME_KEY_LENGTH = 16
+# IV is 16 space characters (0x20)
+CHROME_IV_HEX = "20" * 16
+
+
+def _get_chrome_encryption_key() -> Optional[bytes]:
+    """Retrieve Chrome's encryption passphrase from macOS Keychain.
+
+    Calls `security find-generic-password` which may trigger a system dialog
+    on first access.
+
+    Returns the raw passphrase bytes, or None on failure.
+    """
+    try:
+        result = subprocess.run(
+            ["security", "find-generic-password", "-w", "-s", "Chrome Safe Storage"],
+            capture_output=True,
+            text=True,
+            timeout=10,
+        )
+        if result.returncode != 0:
+            logger.info("Chrome Keychain access denied or Chrome not installed: %s", result.stderr.strip())
+            return None
+        passphrase = result.stdout.strip()
+        if not passphrase:
+            logger.info("Chrome Keychain returned empty passphrase")
+            return None
+        return passphrase.encode("utf-8")
+    except FileNotFoundError:
+        logger.info("'security' command not found — not on macOS?")
+        return None
+    except subprocess.TimeoutExpired:
+        logger.info("Chrome Keychain access timed out")
+        return None
+    except Exception as e:
+        logger.info("Failed to get Chrome encryption key: %s", e)
+        return None
+
+
+def _derive_aes_key(passphrase: bytes) -> bytes:
+    """Derive 16-byte AES key from Chrome's Keychain passphrase via PBKDF2."""
+    return hashlib.pbkdf2_hmac(
+        "sha1",
+        passphrase,
+        CHROME_SALT,
+        CHROME_PBKDF2_ITERATIONS,
+        dklen=CHROME_KEY_LENGTH,
+    )
+
+
+def _decrypt_v10_value(encrypted_value: bytes, aes_key: bytes, db_version: int) -> Optional[str]:
+    """Decrypt a Chrome v10-encrypted cookie value.
+
+    Uses system openssl CLI for AES-128-CBC decryption (zero pip deps).
+    For Chrome 130+ (db_version >= 24), strips 32-byte SHA-256 prefix after decryption.
+
+    Returns decrypted string or None on failure.
+    """
+    # Strip the 'v10' prefix
+    ciphertext = encrypted_value[3:]
+    if not ciphertext:
+        return None
+
+    hex_key = aes_key.hex()
+
+    try:
+        result = subprocess.run(
+            [
+                "openssl", "enc", "-aes-128-cbc", "-d",
+                "-K", hex_key,
+                "-iv", CHROME_IV_HEX,
+                "-nopad",
+            ],
+            input=ciphertext,
+            capture_output=True,
+            timeout=5,
+        )
+        if result.returncode != 0:
+            logger.debug("openssl decryption failed: %s", result.stderr.decode(errors="replace").strip())
+            return None
+
+        decrypted = result.stdout
+        if not decrypted:
+            return None
+
+        # Remove PKCS7 padding
+        decrypted = _remove_pkcs7_padding(decrypted)
+        if decrypted is None:
+            return None
+
+        # Chrome 130+ (db version >= 24): strip 32-byte SHA-256 prefix
+        if db_version >= 24 and len(decrypted) > 32:
+            decrypted = decrypted[32:]
+
+        return decrypted.decode("utf-8", errors="replace")
+
+    except FileNotFoundError:
+        logger.info("openssl not found — cannot decrypt Chrome cookies")
+        return None
+    except subprocess.TimeoutExpired:
+        logger.info("openssl decryption timed out")
+        return None
+    except Exception as e:
+        logger.debug("Chrome cookie decryption error: %s", e)
+        return None
+
+
+def _remove_pkcs7_padding(data: bytes) -> Optional[bytes]:
+    """Remove PKCS7 padding from decrypted data.
+
+    The last byte indicates the number of padding bytes added.
+    All padding bytes must have the same value.
+
+    Returns unpadded data or None if padding is invalid.
+    """
+    if not data:
+        return None
+    pad_len = data[-1]
+    if pad_len < 1 or pad_len > 16:
+        return None
+    # Verify all padding bytes match
+    if data[-pad_len:] != bytes([pad_len]) * pad_len:
+        return None
+    return data[:-pad_len]
+
+
+def _get_db_version(cursor: sqlite3.Cursor) -> int:
+    """Get Chrome cookie database version from the meta table.
+
+    Returns 0 if meta table doesn't exist or version can't be read.
+    """
+    try:
+        cursor.execute("SELECT value FROM meta WHERE key = 'version'")
+        row = cursor.fetchone()
+        if row:
+            return int(row[0])
+    except Exception:
+        pass
+    return 0
+
+
+def extract_chrome_cookies_macos(domain: str, cookie_names: list[str]) -> Optional[dict[str, str]]:
+    """Extract cookies from Chrome on macOS.
+
+    Copies the locked Cookies database to a temp file, reads specified cookies,
+    and decrypts v10-encrypted values using the Keychain-stored key.
+
+    Args:
+        domain: Cookie domain to match (e.g., ".twitter.com", ".x.com")
+        cookie_names: List of cookie names to extract
+
+    Returns:
+        Dict mapping cookie name to decrypted value, or None on failure.
+        Only includes cookies that were successfully found and decrypted.
+    """
+    if not CHROME_COOKIES_DB.exists():
+        logger.info("Chrome cookies database not found at %s", CHROME_COOKIES_DB)
+        return None
+
+    # Get encryption key from Keychain
+    passphrase = _get_chrome_encryption_key()
+    aes_key = _derive_aes_key(passphrase) if passphrase else None
+
+    # Copy DB to temp file (Chrome locks the original)
+    tmp_fd = None
+    tmp_path = None
+    try:
+        tmp_fd, tmp_path = tempfile.mkstemp(suffix=".sqlite")
+        shutil.copy2(str(CHROME_COOKIES_DB), tmp_path)
+    except Exception as e:
+        logger.info("Failed to copy Chrome cookies database: %s", e)
+        if tmp_path:
+            try:
+                Path(tmp_path).unlink(missing_ok=True)
+            except Exception:
+                pass
+        return None
+    finally:
+        if tmp_fd is not None:
+            import os
+            os.close(tmp_fd)
+
+    try:
+        conn = sqlite3.connect(tmp_path)
+        cursor = conn.cursor()
+
+        db_version = _get_db_version(cursor)
+        logger.debug("Chrome cookie DB version: %d", db_version)
+
+        # Build query with placeholders for cookie names
+        placeholders = ",".join("?" for _ in cookie_names)
+        query = (
+            f"SELECT name, value, encrypted_value FROM cookies "
+            f"WHERE host_key LIKE ? AND name IN ({placeholders})"
+        )
+        # Use LIKE for domain matching (e.g., %.twitter.com matches .twitter.com)
+        params = [f"%{domain}"] + list(cookie_names)
+        cursor.execute(query, params)
+
+        results: dict[str, str] = {}
+        for name, value, encrypted_value in cursor.fetchall():
+            # Prefer unencrypted value if present
+            if value:
+                results[name] = value
+                continue
+
+            # Handle encrypted value
+            if encrypted_value and encrypted_value[:3] == b"v10":
+                if aes_key is None:
+                    logger.debug("Skipping encrypted cookie %s — no Keychain access", name)
+                    continue
+                decrypted = _decrypt_v10_value(encrypted_value, aes_key, db_version)
+                if decrypted:
+                    results[name] = decrypted
+                else:
+                    logger.debug("Failed to decrypt cookie %s", name)
+            elif encrypted_value:
+                # Unknown encryption version
+                logger.debug("Unknown encryption for cookie %s (prefix: %r)", name, encrypted_value[:3])
+
+        conn.close()
+
+        if not results:
+            logger.info("No matching cookies found in Chrome for domain %s", domain)
+            return None
+
+        return results
+
+    except sqlite3.Error as e:
+        logger.info("Failed to read Chrome cookies database: %s", e)
+        return None
+    except Exception as e:
+        logger.info("Unexpected error reading Chrome cookies: %s", e)
+        return None
+    finally:
+        try:
+            Path(tmp_path).unlink(missing_ok=True)
+        except Exception:
+            pass

package/.xtrm/skills/default/last30days/scripts/lib/cookie_extract.py

@@ -0,0 +1,295 @@
+"""Browser cookie extraction for last30days.
+
+Extracts cookies from local browser databases (Firefox, Chrome, Safari)
+to enable zero-config authentication for services like X/Twitter.
+
+Only uses Python stdlib — no external dependencies.
+"""
+
+import configparser
+import logging
+import platform
+import shutil
+import sqlite3
+import tempfile
+from pathlib import Path
+from typing import Dict, List, Optional
+
+logger = logging.getLogger(__name__)
+
+
+def _get_firefox_profiles_dir() -> Optional[Path]:
+    """Return the Firefox profiles directory for the current platform, or None."""
+    system = platform.system()
+    if system == "Darwin":
+        path = Path.home() / "Library" / "Application Support" / "Firefox"
+    elif system == "Linux":
+        path = Path.home() / ".mozilla" / "firefox"
+    else:
+        # Windows: %APPDATA%\Mozilla\Firefox — best-effort
+        appdata = Path.home() / "AppData" / "Roaming" / "Mozilla" / "Firefox"
+        path = appdata
+    return path if path.is_dir() else None
+
+
+def _find_default_profile(profiles_dir: Path) -> Optional[Path]:
+    """Parse profiles.ini to find the default profile directory.
+
+    Looks for a section with Default=1. Falls back to the first profile
+    directory found on disk if profiles.ini is missing or malformed.
+    """
+    ini_path = profiles_dir / "profiles.ini"
+
+    if ini_path.is_file():
+        try:
+            config = configparser.ConfigParser()
+            config.read(str(ini_path), encoding="utf-8")
+
+            # First pass: look for Default=1
+            for section in config.sections():
+                if config.has_option(section, "Default") and config.get(section, "Default") == "1":
+                    return _resolve_profile_path(profiles_dir, config, section)
+
+            # Second pass: first Install* section with Default key (Firefox >= 67 format)
+            for section in config.sections():
+                if section.startswith("Install") and config.has_option(section, "Default"):
+                    raw = config.get(section, "Default")
+                    candidate = profiles_dir / raw
+                    if candidate.is_dir():
+                        return candidate
+
+            # Third pass: first Profile section that exists on disk
+            for section in config.sections():
+                if section.startswith("Profile"):
+                    resolved = _resolve_profile_path(profiles_dir, config, section)
+                    if resolved and resolved.is_dir():
+                        return resolved
+        except (configparser.Error, OSError) as exc:
+            logger.debug("Failed to parse profiles.ini: %s", exc)
+
+    # Fallback: scan directory for anything that looks like a profile
+    return _fallback_find_profile(profiles_dir)
+
+
+def _resolve_profile_path(
+    profiles_dir: Path, config: configparser.ConfigParser, section: str
+) -> Optional[Path]:
+    """Resolve a profile path from a ConfigParser section."""
+    if not config.has_option(section, "Path"):
+        return None
+    raw_path = config.get(section, "Path")
+    is_relative = config.has_option(section, "IsRelative") and config.get(section, "IsRelative") == "1"
+    if is_relative:
+        candidate = profiles_dir / raw_path
+    else:
+        candidate = Path(raw_path)
+    return candidate if candidate.is_dir() else None
+
+
+def _fallback_find_profile(profiles_dir: Path) -> Optional[Path]:
+    """Find the first directory that contains cookies.sqlite."""
+    try:
+        for child in sorted(profiles_dir.iterdir()):
+            if child.is_dir() and (child / "cookies.sqlite").is_file():
+                return child
+    except OSError:
+        pass
+    return None
+
+
+def _query_cookies_db(
+    db_path: Path, domain: str, cookie_names: List[str]
+) -> Optional[Dict[str, str]]:
+    """Copy the cookies database to a temp file and query it.
+
+    Firefox locks cookies.sqlite while running, so we copy first.
+    Returns {name: value} dict or None if no matching cookies found.
+    """
+    if not db_path.is_file():
+        return None
+
+    tmp_fd = None
+    tmp_path = None
+    try:
+        tmp_fd, tmp_path = tempfile.mkstemp(suffix=".sqlite")
+        shutil.copy2(str(db_path), tmp_path)
+
+        conn = sqlite3.connect(tmp_path)
+        try:
+            # Build parameterized query — SQLite doesn't support array params,
+            # so we build the IN clause with individual placeholders.
+            placeholders = ",".join("?" for _ in cookie_names)
+            query = (
+                f"SELECT name, value FROM moz_cookies "
+                f"WHERE host LIKE ? AND name IN ({placeholders})"
+            )
+            # domain pattern: match .x.com, x.com, etc.
+            domain_pattern = f"%{domain}"
+            params = [domain_pattern] + list(cookie_names)
+
+            cursor = conn.execute(query, params)
+            rows = cursor.fetchall()
+        finally:
+            conn.close()
+
+        if not rows:
+            return None
+        return {name: value for name, value in rows}
+
+    except (sqlite3.Error, OSError) as exc:
+        logger.debug("Failed to query cookies database %s: %s", db_path, exc)
+        return None
+    finally:
+        if tmp_path:
+            try:
+                Path(tmp_path).unlink(missing_ok=True)
+            except OSError:
+                pass
+        if tmp_fd is not None:
+            try:
+                import os
+                os.close(tmp_fd)
+            except OSError:
+                pass
+
+
+def extract_firefox_cookies(
+    domain: str, cookie_names: List[str]
+) -> Optional[Dict[str, str]]:
+    """Extract cookies from Firefox for the given domain and cookie names.
+
+    Finds the default Firefox profile, copies cookies.sqlite to a temp file
+    (to avoid lock conflicts), and queries for the requested cookies.
+
+    Args:
+        domain: The cookie domain to match (e.g. ".x.com"). Matched with LIKE %domain.
+        cookie_names: List of cookie names to extract (e.g. ["auth_token", "ct0"]).
+
+    Returns:
+        Dict of {cookie_name: cookie_value} or None if extraction fails.
+    """
+    profiles_dir = _get_firefox_profiles_dir()
+    if profiles_dir is None:
+        logger.debug("Firefox profiles directory not found")
+        return None
+
+    profile_path = _find_default_profile(profiles_dir)
+    if profile_path is None:
+        logger.debug("No Firefox profile found in %s", profiles_dir)
+        return None
+
+    db_path = profile_path / "cookies.sqlite"
+    return _query_cookies_db(db_path, domain, cookie_names)
+
+
+def extract_chrome_cookies(
+    domain: str, cookie_names: List[str]
+) -> Optional[Dict[str, str]]:
+    """Extract cookies from Chrome for the given domain and cookie names.
+
+    macOS only — uses Keychain + system openssl for AES-128-CBC decryption.
+    Linux/Windows not supported (Chrome uses platform-specific encryption).
+
+    Returns:
+        Dict of {cookie_name: cookie_value} or None if extraction fails.
+    """
+    if platform.system() != "Darwin":
+        logger.debug("Chrome cookie extraction only supported on macOS")
+        return None
+    try:
+        from .chrome_cookies import extract_chrome_cookies_macos
+        return extract_chrome_cookies_macos(domain, cookie_names)
+    except Exception as exc:
+        logger.debug("Chrome cookie extraction failed: %s", exc)
+        return None
+
+
+def extract_safari_cookies(
+    domain: str, cookie_names: List[str]
+) -> Optional[Dict[str, str]]:
+    """Extract cookies from Safari for the given domain and cookie names.
+
+    macOS only — parses the unencrypted binary cookie file.
+
+    Returns:
+        Dict of {cookie_name: cookie_value} or None if extraction fails.
+    """
+    if platform.system() != "Darwin":
+        logger.debug("Safari cookie extraction only supported on macOS")
+        return None
+    try:
+        from .safari_cookies import extract_safari_cookies_macos
+        return extract_safari_cookies_macos(domain, cookie_names)
+    except Exception as exc:
+        logger.debug("Safari cookie extraction failed: %s", exc)
+        return None
+
+
+def extract_cookies(
+    browser: str, domain: str, cookie_names: list[str]
+) -> Optional[dict[str, str]]:
+    """Extract cookies from the specified browser.
+
+    Args:
+        browser: One of 'firefox', 'chrome', 'safari', or 'auto'.
+            'auto' tries browsers in platform-appropriate order:
+            - macOS: Chrome -> Firefox -> Safari
+            - Linux: Firefox only
+        domain: The cookie domain to match (e.g. ".x.com").
+        cookie_names: List of cookie names to extract.
+
+    Returns:
+        Dict of {cookie_name: cookie_value} or None if extraction fails.
+    """
+    result = extract_cookies_with_source(browser, domain, cookie_names)
+    if result is None:
+        return None
+    cookies, _browser_name = result
+    return cookies
+
+
+def extract_cookies_with_source(
+    browser: str, domain: str, cookie_names: list[str]
+) -> Optional[tuple[dict[str, str], str]]:
+    """Extract cookies and report which browser they came from.
+
+    Same as extract_cookies() but returns a (cookies, browser_name) tuple
+    so callers can track the source.
+
+    Args:
+        browser: One of 'firefox', 'chrome', 'safari', or 'auto'.
+        domain: The cookie domain to match (e.g. ".x.com").
+        cookie_names: List of cookie names to extract.
+
+    Returns:
+        Tuple of ({cookie_name: cookie_value}, browser_name) or None.
+    """
+    extractors = {
+        "firefox": extract_firefox_cookies,
+        "chrome": extract_chrome_cookies,
+        "safari": extract_safari_cookies,
+    }
+
+    if browser != "auto":
+        extractor = extractors.get(browser)
+        if extractor is None:
+            logger.warning("Unknown browser: %s", browser)
+            return None
+        result = extractor(domain, cookie_names)
+        return (result, browser) if result is not None else None
+
+    # Auto mode: try browsers in platform-appropriate order
+    system = platform.system()
+    if system == "Darwin":
+        order = ["chrome", "firefox", "safari"]
+    elif system == "Linux":
+        order = ["firefox"]
+    else:
+        order = ["firefox"]
+
+    for name in order:
+        result = extractors[name](domain, cookie_names)
+        if result is not None:
+            return (result, name)
+
+    return None

package/.xtrm/skills/default/last30days/scripts/lib/dates.py

@@ -0,0 +1,124 @@
+"""Date utilities for last30days skill."""
+
+from datetime import datetime, timedelta, timezone
+from typing import Optional, Tuple
+
+
+def get_date_range(days: int = 30) -> Tuple[str, str]:
+    """Get the date range for the last N days.
+
+    Returns:
+        Tuple of (from_date, to_date) as YYYY-MM-DD strings
+    """
+    today = datetime.now(timezone.utc).date()
+    from_date = today - timedelta(days=days)
+    return from_date.isoformat(), today.isoformat()
+
+
+def parse_date(date_str: Optional[str]) -> Optional[datetime]:
+    """Parse a date string in various formats.
+
+    Supports: YYYY-MM-DD, ISO 8601, Unix timestamp
+    """
+    if not date_str:
+        return None
+
+    # Try Unix timestamp (from Reddit)
+    try:
+        ts = float(date_str)
+        return datetime.fromtimestamp(ts, tz=timezone.utc)
+    except (ValueError, TypeError):
+        pass
+
+    # Try ISO formats
+    formats = [
+        "%Y-%m-%d",
+        "%Y-%m-%dT%H:%M:%S",
+        "%Y-%m-%dT%H:%M:%SZ",
+        "%Y-%m-%dT%H:%M:%S%z",
+        "%Y-%m-%dT%H:%M:%S.%f%z",
+    ]
+
+    for fmt in formats:
+        try:
+            return datetime.strptime(date_str, fmt).replace(tzinfo=timezone.utc)
+        except ValueError:
+            continue
+
+    return None
+
+
+def timestamp_to_date(ts: Optional[float]) -> Optional[str]:
+    """Convert Unix timestamp to YYYY-MM-DD string."""
+    if ts is None:
+        return None
+    try:
+        dt = datetime.fromtimestamp(ts, tz=timezone.utc)
+        return dt.date().isoformat()
+    except (ValueError, TypeError, OSError):
+        return None
+
+
+def get_date_confidence(date_str: Optional[str], from_date: str, to_date: str) -> str:
+    """Determine confidence level for a date.
+
+    Args:
+        date_str: The date to check (YYYY-MM-DD or None)
+        from_date: Start of valid range (YYYY-MM-DD)
+        to_date: End of valid range (YYYY-MM-DD)
+
+    Returns:
+        'high', 'med', or 'low'
+    """
+    if not date_str:
+        return 'low'
+
+    try:
+        dt = datetime.strptime(date_str, "%Y-%m-%d").date()
+        start = datetime.strptime(from_date, "%Y-%m-%d").date()
+        end = datetime.strptime(to_date, "%Y-%m-%d").date()
+
+        if start <= dt <= end:
+            return 'high'
+        elif dt < start:
+            # Older than range
+            return 'low'
+        else:
+            # Future date (suspicious)
+            return 'low'
+    except ValueError:
+        return 'low'
+
+
+def days_ago(date_str: Optional[str]) -> Optional[int]:
+    """Calculate how many days ago a date is.
+
+    Returns None if date is invalid or missing.
+    """
+    if not date_str:
+        return None
+
+    try:
+        dt = datetime.strptime(date_str, "%Y-%m-%d").date()
+        today = datetime.now(timezone.utc).date()
+        delta = today - dt
+        return delta.days
+    except ValueError:
+        return None
+
+
+def recency_score(date_str: Optional[str], max_days: int = 30) -> int:
+    """Calculate recency score (0-100).
+
+    0 days ago = 100, max_days ago = 0, clamped.
+    """
+    age = days_ago(date_str)
+    if age is None:
+        return 0  # Unknown date gets worst score
+
+    if age < 0:
+        return 100  # Future date (treat as today)
+    if age >= max_days:
+        return 0
+
+    return int(100 * (1 - age / max_days))