feat(web): guide the user through Full Disk Access to import from Safari

Reading Safari's cookies needs Full Disk Access, which no one has granted
before their first import — so this is an expected step, not a failure. Instead
of an error toast, the import opens a dialog that says what it's for, links
straight to the right System Settings pane, and — once access is on — runs the
import itself from a "I've turned it on" button, so the user never returns to
the menu to start over.

Every other failure keeps its toast. `importFailureReason` is exported and
tested, since the whole path depends on the reason token surviving IPC.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: juliusmarminge

apps/web/src/components/settings/IntegrationsSettings.logic.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, it } from "vite-plus/test";
+
+import { importFailureReason } from "./IntegrationsSettings";
+
+// Mirrors `BrowserImportFailedError.message`, which IPC flattens to a string
+// before the renderer sees it.
+const failure = (reason: string) => ({
+  message: `Importing cookies from safari failed: ${reason}.`,
+});
+
+describe("importFailureReason", () => {
+  it("recovers the reason token from the flattened message", () => {
+    // The whole import error path — including the Full Disk Access dialog —
+    // depends on this token surviving the trip through IPC.
+    expect(importFailureReason(failure("needsFullDiskAccess"))).toBe("needsFullDiskAccess");
+    expect(importFailureReason(failure("browserRunning"))).toBe("browserRunning");
+    expect(importFailureReason(failure("readFailed"))).toBe("readFailed");
+  });
+
+  it("falls back to readFailed for anything it cannot classify", () => {
+    expect(importFailureReason(new Error("something else entirely"))).toBe("readFailed");
+    expect(importFailureReason(undefined)).toBe("readFailed");
+  });
+});

apps/web/src/components/settings/IntegrationsSettings.tsx

@@ -54,6 +54,8 @@ import {
   MenuSubTrigger,
   MenuTrigger,
 } from "../ui/menu";
+import { readLocalApi } from "~/localApi";
+
 import { toastManager } from "../ui/toast";
 import {
   AlertDialog,
@@ -117,7 +119,7 @@ const zoomLabel = (zoomFactor: number) => `${Math.round(zoomFactor * 100)}%`;
  * it. Anything unrecognised reads as a plain read failure rather than leaking
  * the raw message into a toast.
  */
-const importFailureReason = (cause: unknown): BrowserImportFailureReason => {
+export const importFailureReason = (cause: unknown): BrowserImportFailureReason => {
   const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
   return (
     BrowserImportFailureReason.literals.find((reason) => message.includes(`failed: ${reason}.`)) ??
@@ -520,13 +522,32 @@ function DesktopOnlyBrowserDefaults({ children }: { readonly children: ReactNode
  * files, and the answer changes while the app is running (quitting the browser
  * clears `browserRunning`), so a value cached at mount would go stale.
  */
+/**
+ * Opens System Settings → Privacy & Security → Full Disk Access. The scheme is
+ * unchanged from the old System Preferences and still resolves on Ventura and
+ * later.
+ */
+const FULL_DISK_ACCESS_SETTINGS_URL =
+  "x-apple.systempreferences:com.apple.preference.security?Privacy_AllFilesAccess";
+
 function BrowserProfilesSetting({ disabled }: { readonly disabled: boolean }) {
   const userProfiles = useClientSettings((settings) => settings.browserProfiles);
   const defaultProfileId = useClientSettings((settings) => settings.browserDefaultProfileId);
   const updateSettings = useUpdatePrimarySettings();
   const environmentId = usePrimaryEnvironment()?.environmentId;
   const [sources, setSources] = useState<ReadonlyArray<BrowserImportSource> | null>(null);
   const [busy, setBusy] = useState(false);
+  // Reading Safari's cookies needs Full Disk Access, which the user won't have
+  // granted before their first import — so this is an expected step, not an
+  // error. The whole request is held so the dialog's confirm button can run
+  // the import itself once access is on, instead of sending the user back to
+  // the menu.
+  const [pendingFullDiskAccessImport, setPendingFullDiskAccessImport] = useState<{
+    readonly source: BrowserImportSource;
+    readonly sourceProfileDirectory: string;
+    readonly targetProfileId: string;
+    readonly targetName: string;
+  } | null>(null);
   const [profilePendingRemoval, setProfilePendingRemoval] = useState<BrowserProfile | null>(null);
 
   const profiles = resolveBrowserProfiles(userProfiles);
@@ -653,10 +674,20 @@ function BrowserProfilesSetting({ disabled }: { readonly disabled: boolean }) {
         });
       })
       .catch((cause: unknown) => {
+        const reason = importFailureReason(cause);
+        if (reason === "needsFullDiskAccess") {
+          setPendingFullDiskAccessImport({
+            source,
+            sourceProfileDirectory,
+            targetProfileId,
+            targetName,
+          });
+          return;
+        }
         toastManager.add({
           type: "error",
           title: `Could not import from ${source.name}`,
-          description: BROWSER_IMPORT_FAILURE_COPY[importFailureReason(cause)],
+          description: BROWSER_IMPORT_FAILURE_COPY[reason],
         });
       })
       .finally(() => setBusy(false));
@@ -882,6 +913,50 @@ function BrowserProfilesSetting({ disabled }: { readonly disabled: boolean }) {
           </AlertDialogFooter>
         </AlertDialogPopup>
       </AlertDialog>
+      <AlertDialog
+        open={pendingFullDiskAccessImport !== null}
+        onOpenChange={(open) => {
+          if (!open) setPendingFullDiskAccessImport(null);
+        }}
+      >
+        <AlertDialogPopup>
+          <AlertDialogHeader>
+            <AlertDialogTitle>Let T3 Code read Safari's cookies</AlertDialogTitle>
+            <AlertDialogDescription>
+              Safari keeps your cookies somewhere only apps with Full Disk Access can reach. Turn
+              that on for T3 Code in System Settings, then come back and finish the import.
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <Button
+              variant="outline"
+              onClick={() =>
+                void readLocalApi()
+                  ?.shell.openExternal(FULL_DISK_ACCESS_SETTINGS_URL)
+                  .catch(() => undefined)
+              }
+            >
+              Open System Settings
+            </Button>
+            <Button
+              onClick={() => {
+                const pending = pendingFullDiskAccessImport;
+                setPendingFullDiskAccessImport(null);
+                if (pending) {
+                  runImport(
+                    pending.source,
+                    pending.sourceProfileDirectory,
+                    pending.targetProfileId,
+                    pending.targetName,
+                  );
+                }
+              }}
+            >
+              I've turned it on
+            </Button>
+          </AlertDialogFooter>
+        </AlertDialogPopup>
+      </AlertDialog>
     </SettingsRow>
   );
 }