Self-heal expired Google cookies natively + alert on dead platforms

[MaxGhenis]

Problem

Max's Google Messages (SMS/RCS) sync has repeatedly died silently. The session cookies Google issues rotate ~30 min; when the backend is offline long enough (sleep, travel), they expire and every token refresh returns HTTP 401. Today that parks the session as needs_repair and waits for a manual cookie-surgery re-pair — which is exactly the ordeal documented in docs/agent-runbook.md. In the latest incident the session was stale for 15 days with no notification.

The reconnect watchdog already had a self-heal path (OPENMESSAGE_COOKIE_REFRESH_SCRIPT), but it was never wired on the macOS app, and the only implementation was Linux/KWallet-specific.

Changes

1. Native in-process cookie refresh — internal/googlecookies

No external script, no Python, no re-pair. When cookies expire, the watchdog rewrites auth_data.cookies from the signed-in Chrome profile and reconnects.

• Chrome Safe Storage key from the login keychain (macOS); AES-128-CBC / PBKDF2-HMAC-SHA1 decrypt; handles the Chrome 130+ SHA256(host) plaintext prefix; highest-priority host wins per cookie name.
• Snapshots the cookie DB +WAL before reading, so freshly rotated cookies are visible while Chrome holds the live file.
• refreshGoogleSessionCookies falls back to the native path when no script is set; canRefreshGoogleCookies() gates planGoogleReconnect so a recoverable session refreshes instead of parking.
• darwin-only for now (Linux keeps the script path via build tags).

Verified end-to-end against the real Chrome profile: 52 cookies written, all 6 required session cookies present, phone_id/tachyon_token preserved, stale cookies dropped.

2. Health notifications — NotificationManager.swift

Alerts once, on the rising edge, when Google Messages flips to needs_repair or WhatsApp logs out; re-arms after recovery. Checked on both the status SSE event and the post-reconnect catch-up, so a flag flip isn't missed while the stream is down. This is the piece that would have surfaced the 15-day outage on day one.

3. scripts/refresh-google-session-cookies-macos.py

macOS reference implementation / OPENMESSAGE_COOKIE_REFRESH_SCRIPT override, mirroring the existing Linux script (keychain instead of KWallet, openssl for AES so it ships dependency-free).

Testing

• internal/googlecookies unit tests: decrypt round-trip (incl. host-hash prefix), non-v10 passthrough, session-field preservation, required-cookie enforcement, host-priority dedup.
• serve_test.go updated for the new signature; native path made deterministic via OPENMESSAGE_CHROME_PROFILE.
• go build / go vet / go test ./... green; swift build green.

Notes

• Non-sandboxed hardened-runtime app (confirmed in entitlements), so the Go backend can read the Chrome DB and keychain. First keychain read may show a one-time "access Chrome Safe Storage" prompt — Always Allow persists it.
• Complements Bump gmessages fork to upstream v26.06 (auth-refresh retry fix) #73 (gmessages upstream bump adds refresh-retry-on-network-error): Bump gmessages fork to upstream v26.06 (auth-refresh retry fix) #73 prevents transient failures from killing the session; this PR recovers the ones that still expire.

🤖 Generated with Claude Code