feat(desktop): import from Chrome, Edge, Brave, Vivaldi, Opera, Arc and Firefox

[juliusmarminge]

Stacked on #7255 — review that first; this PR's base is browser-profile-import.

Generalises the importer from one hardcoded browser to a source registry with two engines, taking it from 1 source to 8.

Source	Engine	macOS	Windows	Linux
Chrome, Edge, Brave, Vivaldi, Opera	chromium	✅	paths only¹	paths only¹
Arc, Helium	chromium	✅	—	—
Firefox	firefox	✅	✅	✅

¹ Chromium off macOS reports unsupportedPlatform until its key stores land — that's the next PR.

Notes for review

Chromium forks are table entries. They share the existing extractor and differ only in paths and keychain coordinates. Those are pinned per fork rather than derived, because the forks disagree — Helium uses Helium Storage Key / Helium where the others use <Name> Safe Storage / <Name>.

Firefox is a second engine with no crypto at all. It stores cookies in plaintext cookies.sqlite, so there's no key and no consent prompt. That's Mozilla's design choice, not a control being circumvented, and it's why Firefox works identically on all three platforms while Chromium needs a per-platform credential store.

Paths resolve from an injected context, not process, so Windows and Linux layouts can be checked without running on them.

The snapshot-before-read step moved to a shared module. Both engines keep the database open with WAL, and neither may have the browser's own file opened for writing.

Testing

Verified against the machine this was written on — all seven Chromium sources detected, Chrome reporting its real profile name:

chrome  installed=true  profiles=Your Chrome
helium  installed=true  profiles=You
…

Firefox isn't installed here, so it's covered by tests against a real moz_cookies fixture rather than a claim — including one asserting the source file's mtime and size are unchanged after a read.

profiles.ini parsing has its own tests because of a genuine trap: Install* sections name a default profile without describing one, so counting them invents a directory that doesn't exist.

Note

Add Chrome, Edge, Brave, Vivaldi, Opera, Arc, and Firefox as browser import sources

• Expands BROWSER_IMPORT_SOURCES in Sources.ts from Helium-only to all major browsers, with correct per-platform user-data paths for macOS, Windows, and Linux.
• Adds Firefox cookie import via a new readFirefoxCookies reader in FirefoxCookies.ts that reads cookies.sqlite directly (no keychain), filtering to default-container cookies only.
• Introduces BrowserImportPathContext to unify platform, home, and appData resolution, replacing separate platform and path arguments across isSourceInstalled, isSourceRunning, listSourceProfiles, and cookieDatabasePath.
• Moves shared snapshotting and the ImportedCookie type into CookieDatabase.ts so both Chromium and Firefox readers share them.
• Behavioral Change: Chromium imports are now restricted to macOS (unsupportedPlatform error on other platforms); Firefox imports are cross-platform.

^{Macroscope summarized 7487b3c.}

---

Note

Medium Risk
Touches local filesystem reads, keychain-backed decryption, and session cookie writes with path traversal guards; Chromium is deliberately gated off macOS, but wrong paths or lock detection could still read live DBs or mis-report availability.

Overview
Expands browser cookie import from a single Helium entry to eight sources (Chrome, Edge, Brave, Vivaldi, Opera, Arc, Helium, Firefox) via a registry with chromium and firefox engines, pinned per-fork paths/keychain coordinates, and a chromiumSource helper for macOS/Windows/Linux layouts (including Opera under roaming AppData).

Replaces SourcePaths / sourcePaths with BrowserImportPathContext / sourcePathContext (platform, home, %APPDATA% / %LOCALAPPDATA%) so listing, install detection, running checks, and DB paths are testable off-host. Chromium imports stay macOS-only until non-mac key stores exist; Firefox is cross-platform with no keychain.

Adds Firefox: profiles.ini parsing, per-profile lock detection (not root SingletonLock), cookies.sqlite via readFirefoxCookies (default-container cookies only via originAttributes = ''). Moves WAL snapshot + ImportedCookie into CookieDatabase.ts; Chromium uses the shared type and snapshot.

BrowserImport.importCookies branches on engine, maps FirefoxCookieReadError to readFailed, and treats missing cookie DB paths as unsupportedPlatform. Contracts extend BROWSER_IMPORT_SOURCE_IDS to all eight browsers.

^{Reviewed by Cursor Bugbot for commit 7487b3c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 61d7b5ea-6156-4c2c-9d62-8f971cc7e83e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	12.6 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	6.3 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	6.3 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	51.8 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	16	—	21	✅
Claude	Total thread wire	—	12.6 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	6.3 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	6.3 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	52.7 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	16	—	21	✅

Baseline: unavailable · PR result: 7487b3c · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

One convention finding: the new Firefox cookie read path models its failure as an anonymous object literal instead of a Schema.TaggedErrorClass. Details inline.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. New feature adding browser import support for 7 browsers with substantial new logic, cross-platform path handling, and a new Firefox cookie extraction engine. New capabilities of this scope warrant human review. An unresolved High severity finding regarding Firefox cookie domain handling also requires attention.

No code changes detected at 7487b3c. Prior analysis still applies.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

🟠 High BrowserImport/FirefoxCookies.ts:75

Host-only Firefox cookies are imported with domain: row.host, so Electron normalizes example.com to a domain cookie and exposes it to every subdomain. Omit domain when row.host has no leading dot (and update the cookie type if needed) to preserve the original scope.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @apps/desktop/src/preview/BrowserImport/FirefoxCookies.ts around line 75:

Host-only Firefox cookies are imported with `domain: row.host`, so Electron normalizes `example.com` to a domain cookie and exposes it to every subdomain. Omit `domain` when `row.host` has no leading dot (and update the cookie type if needed) to preserve the original scope.

[macroscopeapp]

Effect service conventions: one finding on the new FirefoxCookieReadError. The tagged-error union fix from the previous round looks good; what remains is the structural context the error captures.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit 27037c9. Configure here.}

[macroscopeapp]

One retained finding in the Firefox error model; the rest of the Effect service conventions look satisfied (namespace subpath imports, tagged errors at the failure boundary, Context.Service/make/layer order preserved, no new runtimes or injected service instances).

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

One finding: the mapped error union is discriminated by hand instead of with Effect.catchTags.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Both failures are statically known tagged errors, so the branch belongs in Effect.catchTags rather than a hand-rolled cause._tag ternary inside mapError. That also keeps each handler's reason next to the tag it applies to.

The comment above read ("Both branches fail with a tagged error carrying a reason") is now stale too — FirefoxCookieReadError deliberately has no reason.

     const cookies = yield* read.pipe(
       Effect.scoped,
       Effect.provide(platformServices),
-      Effect.mapError(
-        (cause) =>
-          new BrowserImportFailedError({
-            sourceId: definition.id,
-            reason: cause._tag === "FirefoxCookieReadError" ? "readFailed" : cause.reason,
-            cause,
-          }),
-      ),
+      Effect.catchTags({
+        // Firefox has one failure mode — its plaintext database would not
+        // open — so the user-facing reason is supplied here.
+        FirefoxCookieReadError: (cause) =>
+          new BrowserImportFailedError({ sourceId: definition.id, reason: "readFailed", cause }),
+        ChromiumCookieReadError: (cause) =>
+          new BrowserImportFailedError({ sourceId: definition.id, reason: cause.reason, cause }),
+      }),
     );

^{Posted via Macroscope — Effect Service Conventions}