Skip to content

Add macOS coverage: Safari, launchd items, hosts file, download sources - #22

Closed
s3ba-b wants to merge 5 commits into
interplains:mainfrom
s3ba-b:feature/macos-coverage
Closed

s3ba-b wants to merge 5 commits into
interplains:mainfrom
s3ba-b:feature/macos-coverage

Conversation

@s3ba-b

@s3ba-b s3ba-b commented Nov 1, 2026

Copy link
Copy Markdown

A suggestion, built and tested quickly on macOS with Claude, to close the most
pressing macOS gaps as soon as possible. Please review it with that in mind.

Changes

  • Search Safari's history, cookies and caches. Cookie values are never read.
  • Check launchd items, the hosts file and the record of download sources on macOS.
  • Report a refused browser folder with its real reason, not as "browser was running".
  • Fix a release-fixture failure on Xcode's Python, and show progress during Safari
    cache searches.

Testing

  • Unit suite and tools/release_check.py pass on macOS with Python 3.9 (9 unit
    tests skipped; optional YARA-X and website checks not run).
  • Real scans ran on one Mac. Reading Safari requires Full Disk Access for Terminal;
    without it, Safari is reported as a gap.
  • Not tested on Windows, Linux or Python 3.8.

Each commit can be reviewed on its own, and I can split this up if you prefer.

🤖 Generated with Claude Code

s3ba-b and others added 5 commits November 1, 2026 21:58
Any PermissionError was described as the browser running, including macOS
privacy refusals of a closed browser's folder. Close-the-browser advice then
left the browser unchecked with no way forward. Only real lock reports now use
that wording; other refusals state the reason, with a macOS hint for EPERM.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Safari is the default macOS browser and was not scanned, so a clean result said
nothing about it. History is graded like other browsers. Cookies.binarycookies
has no SQL to narrow, so a dedicated parser takes hosts, names and dates and never
follows the value offset. Refused folders are reported as gaps. Existing tests pin
SAFARI_LIBRARY so the suite never reads a tester's real Safari.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every host check was reported as unsupported on macOS, so nothing outside the
browser and a few folders was searched. launchd items and the hosts file now run
the same indicator match, with an unfamiliar job not being a finding. The download
record outlives browser caches and adds a dated window; only matching rows reach
the report. Checks without a macOS equivalent stay reported as gaps.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Python that ships with Xcode keeps its cache under ~/Library/Caches, so
importing a standard-library module tripped the guard before the scan began and
one regression test failed on that interpreter regardless of the scanner.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Tens of thousands of cache files took over five minutes on a real Mac with no
output, which looked like a hang. The time itself is in line with the scanner's
other large searches, so the search is unchanged and only announces itself.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@interplains

Copy link
Copy Markdown
Owner

Thanks for this. This repository is the old one, though: work moved to https://github.com/interplains/Zero-Breach-Toolkit and the code there has changed a lot (the package is now zbtriage). It already reads Safari history, launch items and the hosts file on macOS, so most of this won't apply as it stands.

If you run version 2 on your Mac and something here is still missing, such as the refused-folder wording or download sources, an issue or a small PR there would be very welcome. Results from a real Mac are especially useful to us.

@s3ba-b

s3ba-b commented Nov 1, 2026

Copy link
Copy Markdown
Author

Thanks for letting me know, and sorry about that. I was in a hurry and didn't notice that the repository had moved.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants