# Comet Cookie Extraction — All Known Methods

## Method 1: F12 DevTools (MOST RELIABLE)
User presses F12 → Application tab → Cookies → `premium.unjail.ai` → copy values.
- Works while browser is running
- Gets httpOnly cookies too
- Requires user interaction (10 seconds)

## Method 2: Close Comet, read SQLite
1. User closes Comet completely (`taskkill /f /im comet.exe`)
2. Read cookies from disk:
```python
import sqlite3
db = r"C:\Users\User\AppData\Local\Comet\User\Default\Network\Cookies"
conn = sqlite3.connect(f"file:{db}?mode=ro", uri=True)
cur = conn.execute("SELECT host_key, name, value FROM cookies WHERE host_key LIKE '%unjail%' OR host_key LIKE '%supabase%'")
for row in cur.fetchall():
    print(f"{row[1]}={row[2]}")
conn.close()
```
- Gets ALL cookies including httpOnly
- Disruptive (browser must close)

## Method 3: document.cookie via JS injection (PARTIAL)
```python
# Via Win32 SendKeys into address bar
shell.SendKeys("javascript:void{(}{(}document.body.innerText=document.cookie{)}{)}")
```
- Only gets non-httpOnly cookies
- Supabase auth-token cookies are httpOnly=false → WORKS
- `th_chunk_gate` is httpOnly=true → INVISIBLE

## Method 4: Comet CDP (DOES NOT WORK)
Comet (Perplexity build) does NOT support `--remote-debugging-port`.
- 0 TCP listening ports confirmed via `netstat -ano`
- Playwright MCP → ECONNREFUSED
- DO NOT waste time trying CDP with Comet

## Database locations
- `C:\Users\User\AppData\Local\Comet\User\Default\Network\Cookies` — main profile
- `C:\Users\User\AppData\Local\Comet\UserData\Default\Network\Cookies` — alternate (same data)
- Both locked while Comet runs (15 Perplexity cookies only on disk)
- No WAL file — journal is 0 bytes

## unjail.ai specific cookies needed
```
sb-bdpfsrtntrzlkefukxrx-auth-token.0  — Supabase JWT part 1 (httpOnly: false)
sb-bdpfsrtntrzlkefukxrx-auth-token.1  — Supabase JWT part 2 (httpOnly: false)
th_chunk_gate                          — ThinkHub session gate (httpOnly: true)
```

## Token structure
- Supabase project: `bdpfsrtntrzlkefukxrx`
- Auth: Discord OAuth → Supabase ES256 JWT
- Token split across 2 cookies (~4000 + ~480 bytes) due to 4096-byte browser limit
- Cookie values are raw base64 (NOT base64url) with `base64-` prefix on cookie 0
- JWT payload contains: access_token, refresh_token, user metadata, Discord identity
- Expiry: 3600 seconds from issue