fix(desktop): report Safari's TCC denial as needing Full Disk Access

A Safari import with no Full Disk Access failed with the generic "cookie
database could not be read" instead of telling the user to grant access — and
no prompt appears, because macOS never prompts for Full Disk Access; the app is
added by hand.

The denial arrives as EPERM, which Effect tags `Unknown`, not
`PermissionDenied` (that is EACCES), so checking the tag alone never matched.
The underlying errno is checked too. Verified against the real jar: the reason
is now `needsFullDiskAccess`, which the renderer maps to the System Settings
instruction.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: juliusmarminge

apps/desktop/src/preview/BrowserImport/SafariCookies.test.ts

@@ -4,8 +4,14 @@ import * as NodeServices from "@effect/platform-node/NodeServices";
 import { assert, describe, expect, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
+import * as PlatformError from "effect/PlatformError";
 
-import { parseBinaryCookies, readSafariCookies, SafariCookieReadError } from "./SafariCookies.ts";
+import {
+  isPermissionDenied,
+  parseBinaryCookies,
+  readSafariCookies,
+  SafariCookieReadError,
+} from "./SafariCookies.ts";
 
 const APPLE_EPOCH_OFFSET_SECONDS = 978_307_200;
 
@@ -221,3 +227,25 @@ describe("readSafariCookies", () => {
     }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
   );
 });
+
+describe("isPermissionDenied", () => {
+  // Shapes taken from a real `FileSystem.readFile` failure on macOS — verified
+  // against Safari's TCC-protected jar, whose denial is EPERM, tagged
+  // `Unknown` rather than `PermissionDenied`.
+  const platformError = (reasonTag: string, code: string): PlatformError.PlatformError =>
+    ({ _tag: "PlatformError", reason: { _tag: reasonTag, cause: { code } } }) as never;
+
+  it("treats a TCC EPERM denial as permission denied", () => {
+    // The regression: EPERM is tagged `Unknown`, so checking the tag alone
+    // reported Safari's Full Disk Access refusal as a generic read failure.
+    expect(isPermissionDenied(platformError("Unknown", "EPERM"))).toBe(true);
+  });
+
+  it("treats an EACCES denial as permission denied", () => {
+    expect(isPermissionDenied(platformError("PermissionDenied", "EACCES"))).toBe(true);
+  });
+
+  it("does not treat an unrelated failure as permission denied", () => {
+    expect(isPermissionDenied(platformError("Unknown", "EIO"))).toBe(false);
+  });
+});

apps/desktop/src/preview/BrowserImport/SafariCookies.ts

@@ -21,6 +21,7 @@
  */
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
+import * as PlatformError from "effect/PlatformError";
 import * as Schema from "effect/Schema";
 
 import type { ImportedCookie } from "./CookieDatabase.ts";
@@ -159,17 +160,33 @@ export function parseBinaryCookies(buffer: Buffer): ReadonlyArray<ImportedCookie
   return cookies;
 }
 
+/**
+ * Whether a filesystem error is the OS refusing access.
+ *
+ * A TCC denial arrives as EPERM, which Effect tags `Unknown` rather than
+ * `PermissionDenied` (reserved for EACCES), so the underlying errno is checked
+ * too — otherwise a Full Disk Access refusal is reported as a generic read
+ * failure and the user is never told what to grant.
+ */
+export const isPermissionDenied = (error: PlatformError.PlatformError): boolean => {
+  if (error.reason._tag === "PermissionDenied") return true;
+  const code = (error.reason as { cause?: { code?: unknown } }).cause?.code;
+  return code === "EPERM" || code === "EACCES";
+};
+
 export const readSafariCookies = Effect.fn("SafariCookies.readSafariCookies")(function* (
   cookiePath: string,
 ) {
   const fileSystem = yield* FileSystem.FileSystem;
   const contents = yield* fileSystem.readFile(cookiePath).pipe(
     Effect.mapError((cause) => {
-      // TCC denies the read even though the file exists, which is a permission
-      // the user can grant rather than a missing browser.
-      const denied = cause.reason._tag === "PermissionDenied";
+      // TCC denies the read even though the file exists — a permission the user
+      // grants in System Settings rather than a missing browser. macOS never
+      // prompts for Full Disk Access, so there is no dialog to wait on; the
+      // read just fails, and it fails with EPERM, which Effect surfaces as an
+      // `Unknown` system error rather than `PermissionDenied` (that is EACCES).
       return new SafariCookieReadError({
-        reason: denied ? "needsFullDiskAccess" : "readFailed",
+        reason: isPermissionDenied(cause) ? "needsFullDiskAccess" : "readFailed",
         cookieDatabasePath: cookiePath,
         cause,
       });