secubox-deb/common
CyberMind-FR dca7006ad0 feat(secubox-toolbox): DPI classifier 57→147 patterns + fix R3 metrics aggregation (ref #496)
User : 'dpi icons emoji des application et services web' + 'metrics realtime
toolbox dashboard and splash shows only cookies, no more connexions and others'.

## Two fixes

### 1. DPI classifier extended : 57 → 147 patterns (+ 27 categories)

Mirror in both source locations :
  packages/secubox-toolbox/secubox_toolbox/dpi_class.py   (canonical, 147 patterns)
  common/secubox_core/classifiers/host_app.py             (new file, imports
    from secubox_toolbox.dpi_class so toolbox edits propagate automatically)

New categories with emoji :
  news       📰 — Le Monde, BBC, NYT, Guardian, Reuters, AFP, France Médias, Mediapart
  knowledge  📚 — Wikipedia, Wiktionary, Wikidata, Internet Archive
  ai         🤖 — OpenAI/ChatGPT, Anthropic/Claude, Mistral, Gemini, Copilot,
                  Hugging Face, Perplexity, Ollama, Midjourney, Stable Diffusion
  ecommerce  📦 — Amazon, eBay, Etsy, AliExpress, Shopify, Vinted, Leboncoin
                  Cdiscount, Fnac, Darty
  travel     🚆 — Booking, Airbnb, BlaBlaCar, SNCF, RATP
  gov-fr     🇫🇷 — Service Public, Impôts, ANTS, Ameli, CAF, France Travail
  productivity 📝 — Notion, Slack, Discord, MS Teams, Zoom, Jitsi, BBB,
                    Trello, Asana, Atlassian, Figma, Canva
  maps       🗺 — Google Maps, OpenStreetMap, Mapbox, Waze, Citymapper
  gaming     🎮 — Steam, Epic, PlayStation, Xbox, Nintendo, Battle.net,
                  Minecraft, Roblox, Riot
  crypto     ₿  — Binance, Kraken, Coinbase, Crypto.com, OKX, Blockchain,
                  MetaMask 🦊
  ads        🎯 — Google Ads, ComScore, Hotjar/Mixpanel/Amplitude, Criteo,
                  Adnxs, Rubicon, Taboola, Outbrain
  monitor    📊 — NewRelic, Datadog, Sentry

Plus expanded existing CDN category with OVH, Hetzner, Scaleway, DigitalOcean.

Smoke test verified :
  lemonde.fr → 📰 Le Monde news
  chatgpt.com → 🤖 OpenAI / ChatGPT ai
  vinted.fr → 👕 Vinted ecommerce
  ameli.fr → 🏥 Assurance Maladie gov-fr
  discord.com → 🎮 Discord productivity

### 2. R3 metrics aggregation : merge BOTH mitm units

_aggregate_session() journalctl call read only secubox-toolbox-mitm
(captive R2). R3 clients (which generate logs in secubox-toolbox-mitm-wg)
saw connections/successful/tls_pinned = 0.

Fix : -u secubox-toolbox-mitm -u secubox-toolbox-mitm-wg.

Cookies counts came from SQLite events (correct mac_hash) and worked
already, hence 'only cookies showing'.

### 3. inject_banner classifier import chain

Previously banner imported secubox_core.classifiers.host_app with NO fallback.
That module existed on board (debian package) with only 57 patterns and
shadowed dpi_class. Now :
  try secubox_core.classifiers.host_app
  fallback to secubox_toolbox.dpi_class (147 patterns)

Plus the new common/secubox_core/classifiers/host_app.py source FILE
re-exports from dpi_class so the source-of-truth stays in toolbox.

## Live verification

  patterns count : 147 (was 57)
  categories     : 27 (was 14)
  R3 client report : metric widgets populated (was empty for connexions/
                     hôtes/successful/tls_pinned)
2026-06-06 06:55:10 +02:00
..
apparmor Add secubox-repo and secubox-hardening modules, CI/CD workflows 2026-03-22 22:15:01 +01:00
audit Add secubox-repo and secubox-hardening modules, CI/CD workflows 2026-03-22 22:15:01 +01:00
nginx fix(metrics): Make sibling imports work under uvicorn (post-#98 hotfix) (#100) 2026-05-12 16:50:43 +02:00
secubox_core feat(secubox-toolbox): DPI classifier 57→147 patterns + fix R3 metrics aggregation (ref #496) 2026-06-06 06:55:10 +02:00