fix(desktop): stop listing browsers that are not installed

Detection keyed off the browser's user-data directory, which is not evidence
the browser exists. Installers for native messaging hosts create an empty one
for every Chromium fork they know about, so a machine with only Chrome and
Helium listed Edge, Brave, Vivaldi, Opera and Arc as importable sources — each
holding nothing but a `NativeMessagingHosts` folder.

It now keys off the cookie database, which is the thing an import actually
needs. Existence is checked without opening the file, which matters for Safari:
TCC permits `stat` on the jar inside its container but refuses a read, so
Safari is still found and the user gets the Full Disk Access prompt instead of
Safari vanishing from the list.

A source that is not on the machine is now left out of the menu rather than
shown as a dead row. Every other unavailable reason stays visible, because each
names something the user can do — quit the browser, grant access.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: juliusmarminge

apps/desktop/src/preview/BrowserImport/BrowserImport.test.ts

@@ -40,6 +40,9 @@ const withImporter = Effect.fnUntraced(function* () {
   yield* fileSystem.makeDirectory(`${helium.userDataDirectory(paths)}/Default`, {
     recursive: true,
   });
+  // The cookie database is what marks a source as installed, so a fixture
+  // without one is reported as absent before any other check runs.
+  yield* fileSystem.writeFileString(`${helium.userDataDirectory(paths)}/Default/Cookies`, "db");
 
   const importer = yield* BrowserImport.BrowserImport.pipe(
     Effect.provide(

apps/desktop/src/preview/BrowserImport/Sources.test.ts

@@ -54,14 +54,24 @@ describe("isSourceRunning", () => {
 });
 
 describe("isSourceInstalled", () => {
-  it.effect("follows the presence of the user-data directory", () =>
+  it.effect("ignores a user-data directory that holds no cookie database", () =>
     run(
       Effect.gen(function* () {
         const fileSystem = yield* FileSystem.FileSystem;
         const paths = yield* withSourceHome();
+        const root = helium.userDataDirectory(paths);
+
+        // Installers for native messaging hosts create an empty user-data
+        // directory for every Chromium fork they know about, so treating the
+        // directory as evidence lists browsers the user does not have.
+        yield* fileSystem.makeDirectory(`${root}/NativeMessagingHosts`, { recursive: true });
+        assert.isFalse(yield* isSourceInstalled(helium, paths));
+
+        yield* fileSystem.makeDirectory(`${root}/Default`, { recursive: true });
+        yield* fileSystem.writeFileString(`${root}/Default/Cookies`, "db");
         assert.isTrue(yield* isSourceInstalled(helium, paths));
 
-        yield* fileSystem.remove(helium.userDataDirectory(paths), { recursive: true });
+        yield* fileSystem.remove(root, { recursive: true });
         assert.isFalse(yield* isSourceInstalled(helium, paths));
       }),
     ),

apps/desktop/src/preview/BrowserImport/Sources.ts

@@ -101,12 +101,26 @@ export const listSourceProfiles = Effect.fn("BrowserImportSources.listSourceProf
   return profiles.length === 0 ? DEFAULT_PROFILES : profiles;
 });
 
+/**
+ * Whether a directory entry exists, without following it or opening it.
+ *
+ * `stat` resolves symlinks and the locks below deliberately dangle, so
+ * `readLink` is the probe that answers for the entry itself.
+ */
+const entryExists = Effect.fnUntraced(function* (path: string) {
+  const fileSystem = yield* FileSystem.FileSystem;
+  return yield* fileSystem.stat(path).pipe(
+    Effect.catchCause(() => fileSystem.readLink(path)),
+    Effect.as(true),
+    Effect.orElseSucceed(() => false),
+  );
+});
+
 /** Whether the browser is running, which leaves its cookie DB mid-write. */
 export const isSourceRunning = Effect.fn("BrowserImportSources.isSourceRunning")(function* (
   definition: BrowserImportSourceDefinition,
   paths: SourcePaths,
 ) {
-  const fileSystem = yield* FileSystem.FileSystem;
   const lock = paths.path.join(definition.userDataDirectory(paths), "SingletonLock");
   // Chromium writes a `SingletonLock` symlink for as long as an instance holds
   // the profile. Its presence is a far cheaper and more targeted signal than
@@ -116,19 +130,31 @@ export const isSourceRunning = Effect.fn("BrowserImportSources.isSourceRunning")
   // `stat` and `exists` follow links — so they report every running browser as
   // closed, which would let an import read a live, mid-write database.
   // `readLink` is the one probe that answers for the entry itself.
-  return yield* fileSystem.stat(lock).pipe(
-    Effect.catchCause(() => fileSystem.readLink(lock)),
-    Effect.as(true),
-    Effect.orElseSucceed(() => false),
-  );
+  return yield* entryExists(lock);
 });
 
+/**
+ * Whether the source has cookies to import.
+ *
+ * Keyed off the cookie database rather than the user-data directory, because
+ * that directory is not evidence the browser exists: installers for native
+ * messaging hosts create an empty one for every Chromium fork they know about,
+ * so a machine with only Chrome reports Edge, Brave, Vivaldi, Opera and Arc as
+ * present. The database is the thing an import actually needs, so its absence
+ * is the honest answer either way.
+ *
+ * Existence is checked without opening the file, which matters for Safari: TCC
+ * permits `stat` on the jar inside its container but refuses a read, so this
+ * still sees it and the user gets the Full Disk Access prompt rather than
+ * having Safari disappear.
+ */
 export const isSourceInstalled = Effect.fn("BrowserImportSources.isSourceInstalled")(function* (
   definition: BrowserImportSourceDefinition,
   paths: SourcePaths,
 ) {
-  const fileSystem = yield* FileSystem.FileSystem;
-  return yield* fileSystem
-    .exists(definition.userDataDirectory(paths))
-    .pipe(Effect.orElseSucceed(() => false));
+  const profiles = yield* listSourceProfiles(definition, paths);
+  const found = yield* Effect.forEach(profiles, (profile) =>
+    entryExists(cookieDatabasePath(definition, paths, profile.directory)),
+  );
+  return found.some(Boolean);
 });

apps/web/src/components/settings/IntegrationsSettings.tsx

@@ -595,6 +595,14 @@ function BrowserProfilesSetting({ disabled }: { readonly disabled: boolean }) {
     });
   };
 
+  // A browser that is not on this machine is left out rather than listed as a
+  // dead row: there is nothing to act on, and the menu is a list of things you
+  // can import from. Every other unavailable reason stays, since each names a
+  // step the user can take.
+  const importableSources = (sources ?? []).filter(
+    (source) => source.unavailable !== "notInstalled",
+  );
+
   const loadSources = () => {
     if (!previewBridge) return;
     // Cleared first: availability changes while the app runs (quitting a
@@ -678,15 +686,15 @@ function BrowserProfilesSetting({ disabled }: { readonly disabled: boolean }) {
               <MenuGroupLabel>Import from</MenuGroupLabel>
               {sources === null ? (
                 <MenuItem disabled>Looking for browsers…</MenuItem>
-              ) : sources.length === 0 ? (
+              ) : importableSources.length === 0 ? (
                 <MenuItem disabled>No supported browsers found</MenuItem>
               ) : (
-                sources.flatMap((source) =>
+                importableSources.flatMap((source) =>
                   source.unavailable
                     ? [
-                        // Kept visible with its reason rather than hidden:
-                        // "Helium is running, quit it" beats "Helium isn't
-                        // listed".
+                        // Kept visible with its reason, because each remaining
+                        // reason is something the user can act on: "Helium is
+                        // running, quit it" beats "Helium isn't listed".
                         <MenuItem key={source.id} disabled>
                           <span className="flex flex-col items-start">
                             <span>{source.name}</span>