feat(desktop): import browser cookies into a profile

[juliusmarminge]

Stacked on #7272 (shared-sqlite-client).

Imports cookies from Helium on macOS into a T3 Code browser profile. Saved passwords and browsing history remain out of scope.

The app requests the browser key through the in-process Keychain API, so consent belongs to T3 Code. Denial stops the import; there is no permission bypass. Source databases are opened read-only and snapshotted consistently with SQLite before extraction.

The wizard chooses a source and destination, prevents profile edits during an import, and reports imported/skipped counts and affected sites. Plaintext and encrypted cookie records are handled separately; domain-bound records are validated. Partitioned cookies are skipped when their partition semantics cannot be preserved by Electron.

Validation includes synthetic decryption records, plaintext and legacy records, domain-binding failures, partitioned-cookie rejection, WAL snapshot consistency, interrupted writes, and wizard state transitions, plus scoped typechecks/lint. Earlier Helium imports were verified in the desktop app; this audit did not request another live Keychain read.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add browser cookie import into profiles via BrowserImport service

• Adds BrowserImport service, contracts, and IPC methods to list browser sources and import cookies into a target partition.
• Implements macOS-only Chromium cookie extraction via keychain lookup, SQLite database snapshots, and AES-128-CBC decryption.
• Introduces BrowserImportWizard and redesigns browser profile settings to support profile management and cookie imports.
• Fixes client-settings persistence by adding a serialized queue in useSettings to prevent race conditions and ensure correct publish order.
• Risk: persistClientSettingsUpdate in useSettings.ts now rejects on persistence failure and recomputes concurrent writes, changing publish timing.

^{Macroscope summarized c5dbc20.}

---

Note

Medium Risk
Touches macOS Keychain reads and cross-browser cookie data with new IPC surface area, plus a behavior change to how client settings are persisted and published.

Overview
Adds cookie import from installed Chromium-family browsers (initially Helium on macOS) into T3 Code preview browser profiles, wired end-to-end from contracts through desktop main, preload, and Integrations settings.

The desktop app introduces a BrowserImport Effect service that lists sources, blocks imports while the source browser holds SingletonLock, validates profile directories against listed profiles (path traversal hardening), snapshots the SQLite cookie DB via VACUUM INTO, reads the encryption key through @napi-rs/keyring (in-process Keychain, no CLI bypass), decrypts Chromium cookies, and writes them into the same Electron partition as the target profile via new IPC channels listBrowserImportSources / importBrowserCookies.

Integrations → Browser profiles is reworked: an Add profile menu offers blank profiles or Import from detected browsers, a BrowserImportWizard handles quit-browser / configure / success / blocked flows, per-profile actions include Set as default, Clear cookies and cache, and remove; the standalone default-profile row is folded into the list. New profiles are persisted only after a successful import (with partition cleanup on save failures or profile cap).

persistClientSettingsUpdate plus a serialized persistence queue ensures awaited settings writes (e.g. registering an imported profile) don’t race optimistic patches. Desktop artifact builds stage keyring native binaries like other nested native deps.

^{Reviewed by Cursor Bugbot for commit c5dbc20. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: daf12449-bccc-4c49-a6df-572e284b0f18

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Reviewed the new BrowserImport service, its Chromium cookie helper, and the IPC/layer wiring against the Effect service conventions.

Service shape, module layout (Context.Service tag + inline interface, make, layer), namespace imports, and layer composition in main.ts all look correct. The findings below are about the error model: the new failure type is unstructured (reason: Schema.String) and every construction discards the underlying cause, including one that erases a structured BrowserSession error.

^{Posted via Macroscope — Effect Service Conventions}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.7 KiB	+172 B (+1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.0 KiB	−10 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.7 KiB	+182 B (+2.7%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.0 KiB	58.5 KiB	+1.5 KiB (+2.6%)	66.4 KiB	✅
Codex	Live turn messages	9	10	+1 (+11.1%)	21	✅
Claude	Total thread wire	13.6 KiB	13.6 KiB	+10 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.0 KiB	7.0 KiB	−8 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.6 KiB	+18 B (+0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.9 KiB	57.9 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: e01c153 · PR result: c5dbc20 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

UI Consistency

One finding in the changed browser-profiles UI (apps/web/src/components/settings/IntegrationsSettings.tsx).

The menu/primitive usage itself looks consistent with the shared system: Menu/MenuPopup/MenuItem/MenuSub from components/ui/menu, MenuTrigger render={<Button …/>} matching the existing pattern in PreviewMoreMenu/ProjectScriptsControl, existing size="icon-sm" / variant="ghost-muted" Button variants, min-w-* on popups honouring MenuPopup's width-defaulting contract, and the bordered list container matching the convention already used in ConnectionsSettings. aria-labels are preserved on both the rename input and the new row trigger.

The issue is a state-display regression introduced by removing the default-profile Select while filtering Incognito out of the new list: a stored default of incognito (which the removed Select allowed a user to pick) now leaves the section with no "Default" badge on any row.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a substantial desktop capability for reading encrypted browser cookie stores and importing session cookies through new IPC, native keyring, persistence, and packaging paths. The sensitive data flow, production artifact changes, and added static-analysis suppressions warrant focused human review.

Not approved because:

• Per-PR cost limit exceeded (workspace setting). Approvability relies on correctness review in order to determine eligibility

No code changes detected at c5dbc20. Prior analysis still applies.

^{Review your spending limits in Billing settings, or comment @macroscope-app review this PR to bypass the limit and review now. You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Reviewed the new BrowserImport service, its Sources/ChromiumCookies helpers, the IPC method, and the layer wiring against the Effect service conventions. The service module follows the canonical shape (errors → Context.Service with inline interface → make → layer), dependencies are acquired from the environment, and the failure translations now keep a real cause. One remaining gap on error context.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

UI Consistency — 1 finding

The two issues flagged on earlier commits are addressed: loadSources now clears sources before each refresh, and resolvedDefaultId resolves against the rendered rows.

One consistency gap remains: with BrowserDefaultProfileSetting removed and Incognito no longer rendered as a row, the section can badge Default on a profile that is not the effective default (see inline comment).

Minor (not blocking): lines 507–529 now carry three consecutive doc comments for a single component — the "Create, rename, and remove browser profiles" and "Per-profile cookie import" blocks are leftovers from the removed/renamed pieces and could be folded into one.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Two findings in the reworked browser-profiles section. Both are about the settings UI now disagreeing with the runtime behaviour it configures, rather than styling.

^{Posted via Macroscope — UI Consistency}