feat(chromium): extract passwords from the account-synced store

[slimwang]

Summary

Extract Chromium credentials from both the profile-local Login Data database
and the account-synced Login Data For Account database.

Chromium can legitimately keep the same credential in both databases. This
change preserves both records and adds a store field so consumers retain
their source provenance instead of losing information through deduplication.

What changed

• Resolve Login Data For Account as a fallback when no local database exists.
• When both databases exist, acquire, extract, count, and archive both.
• Merge both result sets in stable descending CreatedAt order.
• Keep identical credentials from both stores as separate records.
• Add local and account values to types.LoginEntry.Store.
• Populate local for Firefox, Safari, and Yandex password extractors.
• Cover local plus account, identical records, account-only profiles, and
  archive source enumeration.

Output compatibility

This intentionally changes the password output schema:

• JSON rows gain a required store property.
• password.csv gains a seventh store column.
• The exported Go types.LoginEntry struct gains a Store string field.

store identifies the backend/source from which HackBrowserData read the
credential. It does not indicate whether a Firefox or Safari credential has
ever participated in browser or platform sync.

{
  "url": "https://example.com",
  "username": "alice",
  "password": "secret",
  "created_at": "2026-01-15T10:30:00Z",
  "store": "account"
}

Validation

• go test ./... with Go 1.26.2 on macOS arm64
• go test ./... with Go 1.20.14 on macOS arm64
• go vet ./...
• golangci-lint v2.10.0: 0 issues
• typos v1.49.0
• default, Linux amd64, and Windows amd64 builds
• Windows test packages compiled with Go 1.26.2 and Go 1.20.14

Windows test binaries were cross-compiled but not executed during this review.

Checklist

• Pull request targets the main branch
• All CI checks pass
• Tests cover the new behavior
• Output compatibility is documented above
• go.mod remains at Go 1.20

[Copilot]

🟢 Approval recommended

The implementation consistently preserves store provenance and covers extraction, counting, ordering, output, and archival behavior.

Pull request overview

Adds extraction and provenance tracking for Chromium’s account-synced password store.

Changes:

• Extracts, counts, merges, and archives local and account password databases.
• Adds the required store field across password extractors and output formats.
• Adds coverage for dual-store, account-only, duplicate, and archive scenarios.

File summaries

File	Description
types/models.go	Defines password stores and adds provenance to login entries.
output/reflect_test.go	Updates reflected CSV/JSON schema tests.
output/output_test.go	Updates output fixtures and CSV expectations.
browser/safari/extract_password.go	Marks Safari credentials as local.
browser/firefox/extract_password.go	Marks Firefox credentials as local.
browser/chromium/source.go	Adds the account database fallback source.
browser/chromium/profile.go	Acquires, extracts, merges, and counts both stores.
browser/chromium/profile_test.go	Tests dual-store, duplicate, and account-only profiles.
browser/chromium/extract_password.go	Labels credentials and performs stable merged sorting.
browser/chromium/extract_password_test.go	Tests store labels and undecryptable credentials.
browser/chromium/archive.go	Includes account password databases in archives.
browser/chromium/archive_test.go	Verifies both databases are enumerated for archiving.

Review details

• Files reviewed: 12/12 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.