`secret-tool lookup` is non-interactive — on a locked keyring it returns
nothing and shows no dialog — and a busctl Unlock+Prompt pair cannot work
either, because Secret Service prompt objects die with the D-Bus
connection that created them. secretstorage keeps one connection:
get_default_collection().unlock() pops the gcr dialog and blocks until it
is answered. Verified on the real profile: 5 v11 rows -> v10, then with
the keyring re-locked Helium (through the wrapper, so the flags file and
LeechBlock apply) lists all 5 logins and keeps every row.
`pgrep -f /opt/helium-browser-bin` also matched the invoking shell when
its argv mentioned the path, so the guard refused on an idle machine;
now anchored to `^/opt/helium-browser-bin/`.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M8YGXVZdNUG79q5DGsdMm3
Chromium 151 removed the last Manifest V2 code paths and the Web Store
purged uBlock Origin on 2026-08-31, so ungoogled-chromium 153 cannot load
the full blocker any more. Helium (GPL-3, ungoogled-chromium base) bundles
uBO 1.75.0 as a component extension and keeps MV2 alive.
- installers/install_helium.sh: pacman deps, AUR via yay or makepkg
(+validpgpkeys import), /usr/local/bin/helium-browser ->
browser-preexec-wrapper so LeechBlock NG and the hosts refresh still
apply, --clone-profile with a downgrade check and running-browser
refusal, then the verifier. Passed in vmbox from scratch, then host.
- installers/verify_helium.py: Xvfb + DevTools exit-code gate — uBO
background_page + manifest_version 2, every /etc/chromium/policies key
on chrome://policy (Helium reads that dir natively), adblock-tester >= 95.
- installers/migrate_helium_passwords_to_basic.py: lightdm autologin
leaves gnome-keyring locked, so the 5 v11 logins make Helium prompt on
every launch; this re-encrypts them as v10 and only then enables
--password-store=basic.
- register helium-browser in aur_packages.txt and the periodic browser
wrapper/service lists; pylint hook gets websockets + cryptography;
codespell learns the vendor name; anthropic 1.6.0 -> 1.7.0 (gate red);
oldest evidence artifact pruned to stay under the 60-file cap.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M8YGXVZdNUG79q5DGsdMm3
