# feat\(desktop\): import cookies from an installed browser into a profile · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/commit/6141890c18ddcd1440cb71bbad9ae7c99412275a)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

Requested revision: 6141890c18ddcd1440cb71bbad9ae7c99412275a

Requested commit: 6141890c18ddcd1440cb71bbad9ae7c99412275a

Commit: 6141890c18ddcd1440cb71bbad9ae7c99412275a

Tree: 7ed115bbd32b3367989f879cbd6a974fc2c0813d

Author: Julius Marminge

Committer: Julius Marminge

## Message

```
feat(desktop): import cookies from an installed browser into a profile

Adds per-profile cookie import, with Helium on macOS as the first source.
Cookies carry the logged-in sessions, which is what makes an imported profile
useful; saved passwords are out of scope because Electron exposes no password
store to put them in.

The key is read through the in-process Keychain API rather than by shelling
out to `/usr/bin/security`, because macOS attributes both the consent prompt
and the resulting ACL grant to the binary that asks. Via the CLI the prompt
said "security" and "Always Allow" granted trust to a tool every process on
the machine can invoke; in-process it names this app and the grant belongs to
it. There is deliberately no fallback when consent is denied — the techniques
that work around it exist to defeat exactly this.

The read is untimed: macOS answers it with a modal, and a timeout racing the
user means the prompt can be approved after nothing is left listening, which
reads as "approving did nothing".

Sources pin their own coordinates rather than deriving them, because Chromium
forks disagree: Helium uses the keychain service "Helium Storage Key" /
account "Helium" where Chrome and its closer relatives use "<Name> Safe
Storage" / "<Name>".

`expires_utc` counts microseconds since 1601 and exceeds JavaScript's safe
integer range, which `node:sqlite` refuses to narrow, so the division happens
in SQL and only seconds cross the boundary. The cookie database is snapshotted
before reading, since Chromium keeps it open with WAL.

Unavailable sources are reported with a reason rather than as one generic
failure — a missing keychain item is not something approving a prompt can fix.
`unsupportedPlatform` is the one that is not a permission at all: it covers
cases like Chrome on Windows, whose App-Bound Encryption is designed to stop
this and which we will not work around.

The platform binary is staged beside the loader during packaging, mirroring
the Clerk passkey handling: pnpm nests the arch package, electron-builder only
retains top-level dependencies, and the generated loader checks for a sibling
`.node` first.

Verified end to end against a real Helium profile: 5,002 cookies imported.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

```

## Parents

- [e01c153c18a94a2aa33df7115c6cfee1eb09880f](https://git.cafe/pingdotgg/t3code/commit/e01c153c18a94a2aa33df7115c6cfee1eb09880f?format=markdown)

[Source at this commit](https://git.cafe/pingdotgg/t3code/tree/6141890c18ddcd1440cb71bbad9ae7c99412275a?format=markdown)