Siri app conversations

macOS 27, aka Golden Gate featured a new Siri app, which allows a user to store their conversations with Siri unlike the default Siri invocations where they disppear after use. The new Siri app keeps a persistent history of your conversations, allows you to pin important chats, and organises them in either a grid or list as per preference.

Siri can also be interacted with from the new Unified Search bar, which is triggered via ⌘ + Space. 

Figure 1 - Unified Search bar (previously Spotlight search)

Figure 2 - Siri app conversations

Siri has now been embedded into almost all contextual (right-click) menus throughout the OS and is seen in most 3rd party App menus as well. 

Figure 3 - "Ask Siri" in the right-click menu in an email in Microsoft Outlook

Figure 4 - Reply from "Ask Siri" saved in Siri conversations

Most Siri interaction (without explicitly using the app) also results in information being stored in the Siri App. The default retention setting (at least what I had on mine) was "Forever". The other options are 30 days and 1 Year. 

This means there is now an opportunity to pull data from this database for forensic purposes. The database can be found here:

~/Library/Daemon Containers/<UUID>/Data/AgentSessionKit/AgentSessionStore.sqlite

where UUID would be a different one on every host.

Every event is stored in the ZAGENTSESSIONEVENTENTITY table and sessions are tracked in ZAGENTSESSIONEVENTENTITY.

Getting data out

A query like the one below can be used to pull out useful data:

SELECT 

(SELECT  ZBUNDLEID FROM ZAGENTPROVENANCEENTITY WHERE Z_PK=ee.ZAGENTPROVENANCE) as agent,

ee.ZSESSION as session, re.ZISPINNED as is_pinned, 

datetime(re.ZCREATIONDATE + 978307200, 'unixepoch') as session_created, 

datetime(ee.ZCREATEDAT + 978307200, 'unixepoch') as event_created, 

re.ZSUMMARY as session_summary, re.ZTITLE as title, ee.ZROLERAWVALUE as role, 

ee.ZTEXTCONTENT as text_content, 

datetime(re.ZSELECTEDAGENTPROVENANCESETAT + 978307200, 'unixepoch') as selected_agent_provenance_set_at,

re.ZSESSIONID as sessionid, re.ZSOURCEBUNDLEID as source_bundleid,

datetime(re.ZLASTMODIFIEDDATE + 978307200, 'unixepoch') as record_last_mod

FROM ZAGENTSESSIONRECORDENTITY re

LEFT JOIN ZAGENTSESSIONEVENTENTITY ee on ee.ZSESSION=re.Z_PK

ORDER BY ee.ZSESSION ASC, ee.Z_PK ASC  

Figure 5 - Query output

Siri can be asked to work with file attachments and process them in various ways. The above query will not pull out attachment related information. The files aren't usually stored in the database. They are instead referenced in the ZARTIFACTENTITY table stored usually as a JSON string which contains nested/embedded bookmark objects and plists where you can sometimes find bookmarks to files on disk.

Interesting find

There is a field ZPERSISTABLESTATERAW in the database table ZAGENTSESSIONRECORDENTITY which indicates if an entry can be removed. If this is zero, then that entry does not show up in the conversations, and can be removed at a later time.

Figure 6 - ZAGENTSESSIONRECORDENTITY table

As seen above, sessions 15 and 17 have this set to zero. There are no events retained for session 15 currently in the database, while session 17 has this data (below).

Figure 7 - Data corresponding to session 17

Automation

A plugin to read Siri App data has been added to mac_apt. It can read standalone databases too (via mac_apt_artifact_only).