autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/windows-browser-automation/references/comet-cookie-extraction.md

@@ -0,0 +1,58 @@
+# Comet Cookie Extraction — All Known Methods
+
+## Method 1: F12 DevTools (MOST RELIABLE)
+User presses F12 → Application tab → Cookies → `premium.unjail.ai` → copy values.
+- Works while browser is running
+- Gets httpOnly cookies too
+- Requires user interaction (10 seconds)
+
+## Method 2: Close Comet, read SQLite
+1. User closes Comet completely (`taskkill /f /im comet.exe`)
+2. Read cookies from disk:
+```python
+import sqlite3
+db = r"C:\Users\User\AppData\Local\Comet\User\Default\Network\Cookies"
+conn = sqlite3.connect(f"file:{db}?mode=ro", uri=True)
+cur = conn.execute("SELECT host_key, name, value FROM cookies WHERE host_key LIKE '%unjail%' OR host_key LIKE '%supabase%'")
+for row in cur.fetchall():
+    print(f"{row[1]}={row[2]}")
+conn.close()
+```
+- Gets ALL cookies including httpOnly
+- Disruptive (browser must close)
+
+## Method 3: document.cookie via JS injection (PARTIAL)
+```python
+# Via Win32 SendKeys into address bar
+shell.SendKeys("javascript:void{(}{(}document.body.innerText=document.cookie{)}{)}")
+```
+- Only gets non-httpOnly cookies
+- Supabase auth-token cookies are httpOnly=false → WORKS
+- `th_chunk_gate` is httpOnly=true → INVISIBLE
+
+## Method 4: Comet CDP (DOES NOT WORK)
+Comet (Perplexity build) does NOT support `--remote-debugging-port`.
+- 0 TCP listening ports confirmed via `netstat -ano`
+- Playwright MCP → ECONNREFUSED
+- DO NOT waste time trying CDP with Comet
+
+## Database locations
+- `C:\Users\User\AppData\Local\Comet\User\Default\Network\Cookies` — main profile
+- `C:\Users\User\AppData\Local\Comet\UserData\Default\Network\Cookies` — alternate (same data)
+- Both locked while Comet runs (15 Perplexity cookies only on disk)
+- No WAL file — journal is 0 bytes
+
+## unjail.ai specific cookies needed
+```
+sb-bdpfsrtntrzlkefukxrx-auth-token.0  — Supabase JWT part 1 (httpOnly: false)
+sb-bdpfsrtntrzlkefukxrx-auth-token.1  — Supabase JWT part 2 (httpOnly: false)
+th_chunk_gate                          — ThinkHub session gate (httpOnly: true)
+```
+
+## Token structure
+- Supabase project: `bdpfsrtntrzlkefukxrx`
+- Auth: Discord OAuth → Supabase ES256 JWT
+- Token split across 2 cookies (~4000 + ~480 bytes) due to 4096-byte browser limit
+- Cookie values are raw base64 (NOT base64url) with `base64-` prefix on cookie 0
+- JWT payload contains: access_token, refresh_token, user metadata, Discord identity
+- Expiry: 3600 seconds from issue