How chris0jeky/navsentinel works
Heedline is a local-first Chrome extension that evaluates risky browser interactions and explains or intervenes on them. The main workflow runs from a page action through content-side detection and shared policy decisions, then to a prompt, block, or recorded outcome visible to the operator. Separate defenses cover navigation, credentials, double-click attacks, and clipboard traps; operator surfaces manage settings and review local history. The README also describes a Gym and an Observatory evidence workflow. Some wiring is documented rather than shown in the sampled excerpts, so uncertain links are omitted.
Main entry points: scoring.ts Risk scoring · sw.ts Service worker · capture_isolated.ts Action capture · storage_impl.ts Local state
Components 20
Page defenses
- Action capture
extension/src/content/capture_isolated.ts - Navigation guards
extension/src/content/main_guard.ts - Credential checks
extension/src/content/content_analyzer.ts - Click correlation
extension/src/content/shadow_guard_correlation.ts - Clipboard traps
extension/src/content/clipboard_bridge.ts
Decision and state
- Risk scoring
extension/src/shared/scoring.ts - Domain policy
extension/src/shared/domain_profile.ts - Service worker
extension/src/sw/sw.ts - Pending decisions
extension/src/sw/pending_decision_handlers.ts - Local state
extension/src/shared/storage_impl.ts
Operator surfaces
- Decision prompt
extension/src/content/smart_prompt_gate.ts - Popup
extension/src/popup/popup.ts - Settings
extension/src/options/options.ts - Evidence records
extension/src/evidence/evidence.ts
Evidence workflow
- Attack scenarios
gym - Scene recording
experiments/evidence-observatory - Campaign reporting
experiments/evidence-observatory/reporter.mjs
Other components
- Browser user
- Web page
- Chrome browser
Connections 25
- Browser user → Web page: acts on
- Web page → Action capture: action context
- Action capture → Navigation guards: checks navigation
- Action capture → Credential checks: checks submission
- Action capture → Click correlation: correlates clicks
- Action capture → Clipboard traps: checks clipboard
- Navigation guards → Risk scoring: evaluates risk
- Credential checks → Risk scoring: evaluates risk
- Click correlation → Risk scoring: signals attack
- Clipboard traps → Risk scoring: signals attack
- Risk scoring → Domain policy: applies policy
- Service worker → Risk scoring: coordinates decisions
- Service worker → Pending decisions: manages prompts
- Pending decisions → Local state: stores decisions
- Service worker → Local state: records outcomes
- Service worker → Chrome browser: updates badge
- Pending decisions → Decision prompt: delivers decision
- Browser user → Popup: reviews status
- Popup → Local state: reads local state
- Browser user → Settings: sets preferences
- Settings → Local state: saves settings
- Service worker → Evidence records: records outcomes
- Attack scenarios → Web page: serves fixtures
- Scene recording → Chrome browser: captures scenes
- Scene recording → Campaign reporting: produces receipts