feat(browser_profiles): browser & embedded-Chromium container catalog#12
Merged
Conversation
…atalog Add the failing test suite for a new pure-data browser/embedded-Chromium knowledge module: Chromium & Firefox profile-signature markers (file vs dir), Chromium artifact filenames + session-file prefixes, and an app attribution catalog (ContainerApp / AppKind / attribute_container) spanning browsers, Electron, WebView2 (EBWebView) and CEF hosts. Types + empty tables + stub attribute_container compile; 12 tests fail. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…talog Fill the pure-data browser/container knowledge module: - Chromium & Firefox profile-signature markers (file vs dir, incl. nested Local Storage/leveldb and Network/Cookies), Chromium artifact filenames, session-file prefixes, and Firefox mozLz4 suffixes. - CONTAINER_APPS: 31-entry attribution catalog across Browser / Electron / WebView2 (EBWebView) / CEF hosts — Chrome, Edge, Brave, Vivaldi, Opera, Arc, Yandex, Chromium, Firefox; OneDrive, new Outlook (Olk), Widgets, Copilot, new Teams; Slack, Discord, classic Teams, Signal, WhatsApp, VS Code, OpenAI Codex, Notion, 1Password, Obsidian, GitHub Desktop, Postman, Figma, Element, Skype; Steam (CEF), Spotify (CEF). Tokens seeded from Browser-Reviewer and expanded from each app's documented user-data location (Electron app.getPath, WebView2 UDF, Chromium user_data_dir). - attribute_container(): zero-alloc, no_std-safe, case- & separator- insensitive substring match with folder-boundary anchoring so /code/ does not swallow openai.codex_. Serde derives gated behind the optional feature, matching siblings. All 14 tests pass; MSRV 1.75 clean; zero third-party deps preserved. Ships in 1.5.0 (1.4.0 already published to crates.io). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…rust 1.96) Pre-existing CI red on this branch's base (unrelated to browser_profiles): - rustfmt --all collapses a wrapped import in a generated descriptor file. - clippy 1.96 doc_lazy_continuation flags a NEW_CHANNEL_EVENTS doc line that is a new paragraph, not a list continuation — separate it with a blank doc line. Both fixes are mechanical; browser_profiles was already fmt/clippy clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
src/browser_profiles.rs— a pure-data knowledge module (sibling totemporal_formats.rs) describing the on-disk shape that marks a Chromium/Firefox profile, and an attribution catalog naming the desktop apps that ship an embedded Chromium profile. This is the knowledge half of a knowledge/engine split; the browser-forensic discovery engine consumes it to run a structural signature sweep (not an app allow-list), so an unknown-named Chromium-shaped directory is still discovered — just generically labelled.What's in it
CHROMIUM_PROFILE_MARKERS/FIREFOX_PROFILE_MARKERSas&'static [ProfileMarker](each withMarkerKind::File|Dir, incl. nestedLocal Storage/leveldb,Network/Cookies), plusCHROMIUM_ARTIFACT_FILES,CHROMIUM_SESSION_FILE_PREFIXES(Session_/Tabs_),FIREFOX_PROFILE_MARKER_SUFFIXES(.jsonlz4/.baklz4), andchromium_profile_markers()/firefox_profile_markers()accessors.ContainerApp { name, vendor, kind: AppKind, path_tokens, macos/linux/windows_bases }and a 31-entryCONTAINER_APPStable spanningBrowser/Electron/WebView2/Cef.attribute_container(path) -> Option<&'static ContainerApp>does a zero-alloc,no_std-safe, case- & separator-insensitive substring match with folder-boundary anchoring (so/code/does not swallowopenai.codex_).Tokens were seeded from Browser-Reviewer's discovery sweep and expanded via web research against each app's documented user-data location, cited in the module doc comment:
app.getPath('userData')— https://www.electronjs.org/docs/latest/api/appuser_data_dir.md— https://chromium.googlesource.com/chromium/src/+/main/docs/user_data_dir.mdHonest caveats noted inline: Telegram Desktop is Qt/
tdata(not Chromium) → deliberately absent; newest Windows WhatsApp is WebView2/Store, not the older Electron app; classic Teams (Electron) vs new Teams (WebView2) both catalogued.Versioning
1.4.0is already published to crates.io, so this additive module ships as 1.5.0 (package version + workspace pin bumped). Under release-plz thefeat:commit yields the 1.5.0 release PR.Gate
cargo test -p forensicnomicon— 1667 pass (14 new)cargo +1.75 testgreencargo tree --edges no-devshows only internal workspace crates--check,cargo deny check(advisories/bans/licenses/sources ok)serdefeature, matching siblingsTDD: RED (
7a676c8, failing tests) → GREEN (97f35bf).🤖 Generated with Claude Code