feat(desktop): import from Chrome, Edge, Brave, Vivaldi, Opera, Arc, Firefox

Generalises the importer from one hardcoded browser to a source registry with
two engines.

Chromium forks are table entries: Chrome, Edge, Brave, Vivaldi, Opera, Arc and
Helium all share the existing extractor and differ only in their paths and
keychain coordinates. Those coordinates are pinned per fork rather than
derived, because the forks disagree — Helium uses "Helium Storage Key" /
"Helium" where the others use "<Name> Safe Storage" / "<Name>".

Firefox is a second engine. It stores cookies unencrypted in `cookies.sqlite`,
so there is no key to fetch and no consent prompt — that is Mozilla's design
choice, not a control being circumvented, and it is why Firefox works
identically on all three platforms while Chromium still needs a per-platform
credential store.

Paths resolve for macOS, Windows and Linux from an injected context rather
than from `process`, so a platform's layout can be checked without running on
it. Chromium off macOS still reports `unsupportedPlatform` until those key
stores land; Firefox does not.

The snapshot-before-read step moves to a shared module, since both engines
keep the database open with WAL and must never have the browser's own file
opened for writing.

Firefox has tests against a real `moz_cookies` fixture, including that the
source file is left untouched, and `profiles.ini` parsing covers the
`Install*` sections that name a default profile without describing one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: juliusmarminge

apps/desktop/src/preview/BrowserImport/BrowserImport.test.ts

@@ -11,7 +11,7 @@ import * as Layer from "effect/Layer";
 
 import * as BrowserSession from "../BrowserSession.ts";
 import * as BrowserImport from "./BrowserImport.ts";
-import { BROWSER_IMPORT_SOURCES, sourcePaths } from "./Sources.ts";
+import { BROWSER_IMPORT_SOURCES, sourcePathContext } from "./Sources.ts";
 
 const helium = BROWSER_IMPORT_SOURCES.find((source) => source.id === "helium")!;
 
@@ -34,12 +34,13 @@ const withImporter = Effect.fnUntraced(function* () {
   const fileSystem = yield* FileSystem.FileSystem;
   const home = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3code-import-" });
   const environment = Layer.succeed(HostProcessEnvironment, { HOME: home });
-  const paths = yield* sourcePaths.pipe(
+  const context = yield* sourcePathContext.pipe(
     Effect.provideService(HostProcessEnvironment, { HOME: home }),
+    Effect.provideService(HostProcessPlatform, "darwin"),
   );
-  yield* fileSystem.makeDirectory(`${helium.userDataDirectory(paths)}/Default`, {
-    recursive: true,
-  });
+  const root = helium.userDataDirectory(context);
+  if (root === undefined) throw new Error("Helium has no macOS user-data directory");
+  yield* fileSystem.makeDirectory(`${root}/Default`, { recursive: true });
 
   const importer = yield* BrowserImport.BrowserImport.pipe(
     Effect.provide(
@@ -52,7 +53,7 @@ const withImporter = Effect.fnUntraced(function* () {
       ),
     ),
   );
-  return { importer, home, paths };
+  return { importer, home, root };
 });
 
 describe("BrowserImport.importCookies", () => {
@@ -86,12 +87,12 @@ describe("BrowserImport.importCookies", () => {
   it.effect("refuses to import while the source browser holds its profile", () =>
     Effect.gen(function* () {
       const fileSystem = yield* FileSystem.FileSystem;
-      const { importer, paths } = yield* withImporter();
+      const { importer, root } = yield* withImporter();
       // The lock Chromium leaves while it is running, dangling target and
       // all. This must stop the import before it ever asks the keychain.
       yield* fileSystem.symlink(
         "host-that-does-not-exist-1234",
-        `${helium.userDataDirectory(paths)}/SingletonLock`,
+        `${root}/SingletonLock`,
       );
 
       const error = yield* importer

apps/desktop/src/preview/BrowserImport/BrowserImport.ts

@@ -17,20 +17,23 @@ import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Path from "effect/Path";
 import * as Schema from "effect/Schema";
+import * as Scope from "effect/Scope";
 
 import { HostProcessExecutablePath, HostProcessPlatform } from "@t3tools/shared/hostProcess";
 
 import * as BrowserSession from "../BrowserSession.ts";
 import { readChromiumCookies } from "./ChromiumCookies.ts";
+import type { ImportedCookie } from "./CookieDatabase.ts";
+import { readFirefoxCookies } from "./FirefoxCookies.ts";
 import {
   BROWSER_IMPORT_SOURCES,
   cookieDatabasePath,
   isSourceInstalled,
   isSourceRunning,
   listSourceProfiles,
-  sourcePaths,
+  sourcePathContext,
+  type BrowserImportPathContext,
   type BrowserImportSourceDefinition,
-  type SourcePaths,
 } from "./Sources.ts";
 
 export class BrowserImportFailedError extends Schema.TaggedErrorClass<BrowserImportFailedError>()(
@@ -64,12 +67,16 @@ export class BrowserImport extends Context.Service<
 
 const unavailableReason = Effect.fn("BrowserImport.unavailableReason")(function* (
   definition: BrowserImportSourceDefinition,
-  platform: NodeJS.Platform,
-  paths: SourcePaths,
+  context: BrowserImportPathContext,
 ): Effect.fn.Return<BrowserImportUnavailableReason | undefined, never, FileSystem.FileSystem> {
-  if (!definition.platforms.includes(platform)) return "unsupportedPlatform";
-  if (!(yield* isSourceInstalled(definition, paths))) return "notInstalled";
-  if (yield* isSourceRunning(definition, paths)) return "browserRunning";
+  if (!definition.platforms.includes(context.platform)) return "unsupportedPlatform";
+  // Chromium's key lives in an OS credential store, and only the macOS one is
+  // implemented; Firefox needs no key at all, so it works everywhere.
+  if (definition.engine === "chromium" && context.platform !== "darwin") {
+    return "unsupportedPlatform";
+  }
+  if (!(yield* isSourceInstalled(definition, context))) return "notInstalled";
+  if (yield* isSourceRunning(definition, context)) return "browserRunning";
   return undefined;
 });
 
@@ -80,18 +87,18 @@ export const make = Effect.gen(function* BrowserImportMake() {
   // Captured here so the service's methods stay free of a requirements
   // channel: the layer is built where NodeServices is already in scope.
   const platformServices = yield* Effect.context<FileSystem.FileSystem | Path.Path>();
-  const paths = yield* sourcePaths;
+  const pathContext = yield* sourcePathContext;
 
   const listSources: Effect.Effect<ReadonlyArray<BrowserImportSource>> = Effect.forEach(
     BROWSER_IMPORT_SOURCES,
     Effect.fnUntraced(function* (definition) {
-      const unavailable = yield* unavailableReason(definition, platform, paths);
+      const unavailable = yield* unavailableReason(definition, pathContext);
       return {
         id: definition.id,
         name: definition.name,
         // Listing profiles touches the source's own files, so skip it when the
         // source is unusable anyway.
-        profiles: unavailable === undefined ? yield* listSourceProfiles(definition, paths) : [],
+        profiles: unavailable === undefined ? yield* listSourceProfiles(definition, pathContext) : [],
         ...(unavailable === undefined ? {} : { unavailable }),
       } satisfies BrowserImportSource;
     }),
@@ -112,7 +119,7 @@ export const make = Effect.gen(function* BrowserImportMake() {
       });
     }
 
-    const blocked = yield* unavailableReason(definition, platform, paths).pipe(
+    const blocked = yield* unavailableReason(definition, pathContext).pipe(
       Effect.provide(platformServices),
     );
     if (blocked !== undefined) {
@@ -131,7 +138,7 @@ export const make = Effect.gen(function* BrowserImportMake() {
     // source itself reported it. Forwarding it unchecked would let `..`
     // segments walk out of the browser's user-data directory and read any
     // cookie database reachable on disk.
-    const sourceProfiles = yield* listSourceProfiles(definition, paths).pipe(
+    const sourceProfiles = yield* listSourceProfiles(definition, pathContext).pipe(
       Effect.provide(platformServices),
     );
     const requestedProfile = sourceProfiles.find(
@@ -144,12 +151,33 @@ export const make = Effect.gen(function* BrowserImportMake() {
       });
     }
 
-    const cookies = yield* readChromiumCookies({
-      cookieDatabasePath: cookieDatabasePath(definition, paths, requestedProfile.directory),
-      keychainService: definition.keychainService,
-      keychainAccount: definition.keychainAccount,
-      platform,
-    }).pipe(
+    const databasePath = cookieDatabasePath(definition, pathContext, requestedProfile.directory);
+    if (databasePath === undefined) {
+      return yield* new BrowserImportFailedError({
+        sourceId: definition.id,
+        reason: "unsupportedPlatform",
+      });
+    }
+
+    const read: Effect.Effect<
+      ReadonlyArray<ImportedCookie>,
+      { readonly reason: BrowserImportFailureReason },
+      FileSystem.FileSystem | Path.Path | Scope.Scope
+    > =
+      definition.engine === "firefox"
+        ? readFirefoxCookies(databasePath).pipe(
+            Effect.mapError((cause) => ({ reason: "readFailed" as const, cause })),
+          )
+        : readChromiumCookies({
+            cookieDatabasePath: databasePath,
+            // Only reached on macOS: `unavailableReason` rejects Chromium
+            // elsewhere until those key stores are implemented.
+            keychainService: definition.keychainService ?? "",
+            keychainAccount: definition.keychainAccount ?? "",
+            platform,
+          });
+
+    const cookies = yield* read.pipe(
       Effect.scoped,
       Effect.provide(platformServices),
       Effect.mapError(

apps/desktop/src/preview/BrowserImport/ChromiumCookies.ts

@@ -19,11 +19,11 @@ import * as NodeCrypto from "node:crypto";
 
 import * as NodeSqliteClient from "@t3tools/shared/nodeSqliteClient";
 import * as Effect from "effect/Effect";
-import * as FileSystem from "effect/FileSystem";
-import * as Path from "effect/Path";
 import * as Schema from "effect/Schema";
 import * as SqlClient from "effect/unstable/sql/SqlClient";
 
+import { snapshotCookieDatabase, type ImportedCookie } from "./CookieDatabase.ts";
+
 /** macOS OSCrypt parameters. Chromium has used these since the feature landed. */
 const MAC_KEY_ITERATIONS = 1003;
 const MAC_KEY_SALT = "saltysalt";
@@ -32,18 +32,7 @@ const MAC_KEY_LENGTH = 16;
 const AES_IV = Buffer.alloc(16, 0x20);
 const V10_PREFIX = "v10";
 
-export interface ChromiumCookie {
-  readonly url: string;
-  readonly name: string;
-  readonly value: string;
-  readonly domain: string;
-  readonly path: string;
-  readonly secure: boolean;
-  readonly httpOnly: boolean;
-  /** Seconds since the UNIX epoch, or undefined for a session cookie. */
-  readonly expirationDate: number | undefined;
-  readonly sameSite: "no_restriction" | "lax" | "strict";
-}
+export type ChromiumCookie = ImportedCookie;
 
 export const ChromiumCookieReadReason = Schema.Literals([
   "needsKeychainApproval",
@@ -144,30 +133,6 @@ const readMacKeychainPassword = Effect.fn("ChromiumCookies.readMacKeychainPasswo
   return password;
 });
 
-/**
- * Chromium keeps the cookie DB open with WAL, and reading it in place can
- * observe a torn state. Copying first — including the sidecars — gives a
- * consistent snapshot without touching the browser's own files.
- *
- * Scoped: the temp directory is removed when the caller's scope closes.
- */
-const snapshotCookieDatabase = Effect.fn("ChromiumCookies.snapshotCookieDatabase")(function* (
-  cookiePath: string,
-) {
-  const fileSystem = yield* FileSystem.FileSystem;
-  const path = yield* Path.Path;
-
-  const directory = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3code-cookie-import-" });
-  const target = path.join(directory, "Cookies");
-  yield* fileSystem.copyFile(cookiePath, target);
-  // The sidecars only exist while the browser holds the database open, so a
-  // missing one is normal rather than a failure.
-  yield* Effect.forEach(["-wal", "-shm"], (suffix) =>
-    fileSystem.copyFile(`${cookiePath}${suffix}`, `${target}${suffix}`).pipe(Effect.ignore),
-  );
-  return target;
-});
-
 const decryptValue = (encrypted: Uint8Array, key: Buffer, domain: string): string | null => {
   const buffer = Buffer.from(encrypted);
   if (buffer.length === 0) return "";

apps/desktop/src/preview/BrowserImport/CookieDatabase.ts

@@ -0,0 +1,52 @@
+/**
+ * Shared pieces of cookie extraction: the shape both engines produce, and the
+ * snapshot every reader takes before touching a live database.
+ *
+ * @module CookieDatabase
+ */
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+
+/** A cookie in the shape Electron's `session.cookies.set` accepts. */
+export interface ImportedCookie {
+  readonly url: string;
+  readonly name: string;
+  readonly value: string;
+  readonly domain: string;
+  readonly path: string;
+  readonly secure: boolean;
+  readonly httpOnly: boolean;
+  /** Seconds since the UNIX epoch, or undefined for a session cookie. */
+  readonly expirationDate: number | undefined;
+  readonly sameSite: "no_restriction" | "lax" | "strict";
+}
+
+/**
+ * Copies a cookie database, and its write-ahead sidecars, to a temporary
+ * directory before reading, and returns the copy's path.
+ *
+ * Both engines keep the file open with WAL while the browser runs, so reading
+ * in place can observe a torn write. Copying also guarantees we never open the
+ * browser's own file for writing.
+ *
+ * Scoped: the temporary directory goes away when the caller's scope closes.
+ */
+export const snapshotCookieDatabase = Effect.fn("CookieDatabase.snapshotCookieDatabase")(
+  function* (cookiePath: string) {
+    const fileSystem = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+
+    const directory = yield* fileSystem.makeTempDirectoryScoped({
+      prefix: "t3code-cookie-import-",
+    });
+    const target = path.join(directory, path.basename(cookiePath));
+    yield* fileSystem.copyFile(cookiePath, target);
+    // The sidecars only exist while the browser holds the database open, so a
+    // missing one is normal rather than a failure.
+    yield* Effect.forEach(["-wal", "-shm"], (suffix) =>
+      fileSystem.copyFile(`${cookiePath}${suffix}`, `${target}${suffix}`).pipe(Effect.ignore),
+    );
+    return target;
+  },
+);