feat(desktop): resolve Chromium cookie keys on Linux

[juliusmarminge]

Stacked on #7260 (browser-import-more-sources). Despite the retained branch name, this PR adds Linux support only; Windows Chromium is intentionally unsupported.

Chromium cookie key handling moves into a platform-specific module:

Platform	Scheme	Key source
macOS	v10 AES-128-CBC	Login Keychain, with consent
Linux	v10 AES-128-CBC	Chromium’s basic-storage peanuts passphrase
Linux	v11 AES-128-CBC	Secret Service via secret-tool, using the browser’s application attribute

Linux requires secret-tool and a compatible Secret Service backend to import v11 records. Missing keys/tools/backend can yield a partial v10 import; skipped records are reported. Explicit permission denial or cancellation stops the import. Secret bytes are preserved apart from the tool’s output line ending.

There is no DPAPI, PowerShell, App-Bound Encryption bypass, or direct KWallet implementation. macOS keeps the existing in-process consent path.

Validation: synthetic v10/v11 decryption fixtures, mocked Secret Service subprocess results, denied/missing backend behavior, and trailing-whitespace preservation. No live Linux keyring lookup was performed during this audit.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add Chromium cookie key resolution for Linux and Windows imports

• Adds the ChromiumKeys module to resolve macOS, Linux, and Windows encryption keys, replacing hardcoded macOS-only keychain logic.
• Introduces a native C helper bundled with the Linux desktop build to read Chromium secrets from libsecret.
• Updates the ChromiumCookies value decoder to handle v10/v11 CBC, Windows v10 GCM, and legacy cleartext, preserving partial imports when some keys are missing.
• Adds Windows support for the Helium browser source and cookie-database running-state detection.
• Risk: The ChromiumCookieReadReason schema in ChromiumCookies.ts replaces macOS-specific failure literals with shared ChromiumKeyFailure reasons and removes unsupportedPlatform.

^{Macroscope summarized 0da299e.}

---

Note

High Risk
Changes how cookie encryption keys are obtained (keychain, libsecret subprocess, DPAPI) and ships a native helper that reads browser secrets—security- and privacy-sensitive paths with partial-import edge cases.

Overview
Enables Chromium-family browser cookie import on Linux by resolving encryption keys per platform instead of treating non-macOS Chromium as unsupported.

Key handling moves into ChromiumKeys: macOS still uses the login keychain; Linux derives v10 keys from Chromium’s keyring-free passphrase, v11 from Secret Service via a bundled t3-browser-secret helper (native libsecret, exit codes for missing/denied/unavailable), plus an empty-passphrase retry for mis-encrypted records. ChromiumCookies decrypts mixed v10/v11 CBC schemes, allows partial imports when only some keys exist, and aligns legacy unprefixed values with Chromium on Linux.

The helper is compiled at dev/build (build-browser-secret.mjs), wired through LinuxBrowserSecret, shipped under resources/browser-secret on Linux artifacts, and CI/release install libsecret-1-dev / pkg-config. Browser source definitions gain linuxSecretApplication; Helium is listed on Linux (and Windows profile paths / running detection via held cookie DBs). Contracts and the import wizard add keychainUnavailable as a retryable failure.

The diff also includes Windows DPAPI key reading and Helium-on-Windows plumbing in the same modules; other Chromium forks on Windows remain excluded in source metadata.

^{Reviewed by Cursor Bugbot for commit 0da299e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2a0d1595-8e5e-4594-b3da-057657d6ef1a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	13.4 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	7.0 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	6.4 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	56.2 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	8	—	21	✅
Claude	Total thread wire	—	13.5 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	7.0 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	6.5 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	57.8 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	8	—	21	✅

Baseline: unavailable · PR result: 0da299e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Reviewed the new ChromiumKeys module and its call sites against the Effect service conventions. Imports, Effect.fn.Return requirement typing, and dependency acquisition (yield* FileSystem.FileSystem, ChildProcessSpawner surfaced in the requirement channel and threaded through BrowserImport's captured context) all look right. Two error-modelling issues in ChromiumKeys.ts: an underlying failure is discarded instead of being preserved as cause, and the Windows DPAPI path can turn a real failure into a silently empty key reported under a misleading reason.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a substantial cross-platform browser credential and cookie-import capability, including native keyring access and sensitive-data handling, rather than a small isolated change. An unresolved runtime concern about the bundled helper path, plus a universal-architecture build issue and newly added static-analysis suppressions, requires human review.

Not approved because:

• 1 blocking correctness issue found at or above your repo's Minimum Blocking Severity

No code changes detected at 4bc257e. Prior analysis still applies.

^{Adjust the Minimum Blocking Severity for this repo — including turning it Off — in Settings. You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

One finding: a typed ChromiumKeyError is re-wrapped at a translation boundary in ChromiumKeys.ts, losing its reason and nesting the error inside itself.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Reviewed the new ChromiumKeys module and its call sites in ChromiumCookies/BrowserImport against the Effect service conventions. Two findings on error modelling in ChromiumKeys.ts; the layer/import/dependency-acquisition side looks fine (resolveChromiumKeys takes FileSystem/ChildProcessSpawner from the environment and scopes the child process locally).

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

One finding, on the new test file's diagnostic suppression. The rest of the change — the ChromiumKeys module layout, ChromiumKeyError structure with preserved cause, ChildProcessSpawner/HostProcessEnvironment acquired from the environment, requirements surfaced through Effect.fn.Return, and the now-uniform ChromiumKeyMaterial key shape with focused mixed v10/v11 coverage — matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit a771eb6. Configure here.}