Add local Chrome profile import to the Kernel CLI - #223
Conversation
IlyaasK
changed the title
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 41073c6. Configure here.
| } | ||
| const chromeEpochMicros = int64(11_644_473_600_000_000) | ||
| cutoff := since.UnixMicro() + chromeEpochMicros | ||
| query := fmt.Sprintf(`SELECT u.url, COUNT(*) AS visits, MAX(v.visit_time) AS last_visit FROM visits v JOIN urls u ON u.id = v.url WHERE v.visit_time >= %d AND (u.url LIKE 'http://%%' OR u.url LIKE 'https://%%') GROUP BY u.url ORDER BY visits DESC, last_visit DESC LIMIT 10000`, cutoff) |
There was a problem hiding this comment.
Site ranking misses heavy domains
Medium Severity
RecentSites applies LIMIT 10000 to per-URL visit rows before aggregating by registrable domain. Domains whose traffic is spread across many lower-traffic URLs can be undercounted or dropped, so the default “most-used” site list can omit sites the user actually uses most.
Reviewed by Cursor Bugbot for commit 41073c6. Configure here.
Move the macOS Chrome and Helium happy path into the existing Kernel CLI. Rank websites from the last 30 days, let users choose five to ten domains, decrypt only their cookies, and upload a minimal bundle through the durable browser-import API. Reuse CLI authentication and keep the command non-interactive when explicit flags are supplied.
41073c6 to
59b7587
Compare
1 participant
why
The browser-import backend stack currently assumes a separate local helper and dashboard handoff. Kernel already ships a cross-platform CLI with authentication, project selection, upgrades, prompts, and release distribution. Putting the local import entry point there removes a second installer and makes the happy path one command.
This PR intentionally supports only the current main path: Google Chrome and Helium on macOS, importing cookies for five to ten recently used websites into one Kernel profile.
what
kernel profiles import-localhow
The command reads Chrome's local History and Cookies SQLite databases through the system sqlite3 client. It groups history by registrable domain, filters cookies locally, and encodes only selected cookie records into the server's existing tar.zst bundle contract.
The released Go SDK does not yet expose the browser-import endpoints, so this PR includes a narrow authenticated HTTP client for those four endpoints. Managed Auth and credential creation remain on the existing generated SDK and are intentionally deferred to the next stacked PR.
scope
Included:
Not included:
verification
Before: the Kernel CLI had no local browser import command. Browser import required the dashboard and standalone helper path.
After:
make buildpassesmake testpasses, includinggo vet ./...andgo test ./...This is the first PR in the CLI browser-import stack. The next PR adds selected Bitwarden/1Password credentials, Managed Auth activation, and optional agent-skill installation.
Note
High Risk
Decrypts and uploads live session cookies from local Chromium stores using Keychain access, plus a new authenticated HTTP client for import endpoints. Credential handling and API-host validation are security-sensitive.
Overview
Adds
kernel profiles import-localso macOS users can pull cookies from a local Google Chrome or Helium profile into a Kernel browser profile, without a separate helper app.The command discovers local profiles, ranks recent sites from History, lets the user pick up to 10 domains (or
--yes/--sites), decrypts only those cookies via Keychain, and uploads a tar.zst cookie bundle through the existing browser-import workflow.kernel profiles import-statuspolls that job. Non-interactive use is supported; partitioned cookies are skipped.Auth is shared via a new
BearerTokenhelper so the custom import HTTP client (SDK does not expose these endpoints yet) uses the same API key or refreshed OAuth token. The client only talks to official Kernel HTTPS hosts or localhost and does not follow redirects.Reviewed by Cursor Bugbot for commit 59b7587. Bugbot is set up for automated code reviews on this repo. Configure here.