Import portable browser profile data - #229
Conversation
Import bookmarks, recent history, local storage, and selected Web Store extensions alongside cookies. Keep values local until final approval, enforce the API payload bounds in the CLI, and apply extension entitlements before upload.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 60febc7. Configure here.
| return `on «event GURLGURL» incomingURL | ||
| set kernelExecutable to "` + appleScriptString(executable) + `" | ||
| set commandText to quoted form of kernelExecutable & " connector open " & quoted form of incomingURL | ||
| set commandText to "for variable in KERNEL_BASE_URL KERNEL_API_KEY KERNEL_AUTH_BASE_URL; do value=$(/bin/launchctl getenv \"$variable\"); if [[ -n \"$value\" ]]; then export \"$variable=$value\"; fi; done; exec " & quoted form of kernelExecutable & " connector open " & quoted form of incomingURL |
There was a problem hiding this comment.
Strict shell aborts env prelude
Medium Severity
The new commandText prelude assigns value=$(/bin/launchctl getenv "$variable") for KERNEL_BASE_URL, KERNEL_API_KEY, and KERNEL_AUTH_BASE_URL before execing the CLI. Those vars are often unset, and launchctl getenv then exits non-zero. That assignment runs in the main body of zsh -lic after startup files load, so a user setopt ERR_EXIT / set -e aborts the script before kernel connector open, and the dashboard import never starts.
Reviewed by Cursor Bugbot for commit 60febc7. Configure here.
1 participant
What
Extend
kernel profiles import-localbeyond cookies to import approved portable browser data from Chrome and Helium on macOS:--dayswindow, selected by defaultPasswords and supported TOTP seeds remain a separate Managed Auth step. IndexedDB, cache, arbitrary preferences, and extension state are intentionally excluded.
Why
A useful imported profile needs more than cookies. This keeps the moment-to-magic flow simple while preserving a portable, bounded contract and making sensitive categories visible before upload. History uses actual visits in the chosen time window instead of lifetime URL counters.
How
cookies_importedJSON field while adding per-category resultsDepends on kernel/kernel PR #3244 for server-side extension persistence and entitlement enforcement.
Verification
go test ./internal/browserimport ./cmd -count=1go vet ./internal/browserimport ./cmdgo mod tidy -diffgit diff --checkmake buildNote
Medium Risk
Touches sensitive browser data export/upload and new LevelDB/SQLite snapshot paths; server extension support is an external dependency, but changes are bounded with local limit enforcement and approval before value decryption.
Overview
profiles import-localnow imports bookmarks, browsing history (via--history, default on), localStorage, and Chrome Web Store extensions—not only cookies—from Chrome/Helium on macOS.The flow adds interactive category selection, a pre-upload confirmation (before decrypting cookie/storage values), and plan-aware extension caps from org limits (
max_stored_extensions). Local storage over 64 MiB requires interactive origin picking; non-interactive runs fail when over limit or when too many extensions are selected.internal/browserimportgains Chromium readers (SQLite history, LevelDB localStorage snapshots, bookmark/extension export),BuildProfileBundlewith portable size limits, andgoleveldbas a dependency. Upload inventory/selection and JSON output add per-category counts (browser_data_imported) while keepingcookies_imported.The macOS connector deep-link launcher now pulls
KERNEL_*env vars vialaunchctl getenvbefore invoking the CLI.Reviewed by Cursor Bugbot for commit 60febc7. Bugbot is set up for automated code reviews on this repo. Configure here.