# feat\(desktop\): import from Chrome, Edge, Brave, Vivaldi, Opera, Arc and Firefox · PR \#7260 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/pull/7260)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

State: merged

Source repository: pingdotgg/t3code

Source branch: browser-import-more-sources

Target branch: browser-profile-import

Head commit: eea4224c0a10d6492f837f606ccadc1a25d36088

[Discussion and reviews](https://git.cafe/pingdotgg/t3code/pull/7260)

[Commits](https://git.cafe/pingdotgg/t3code/pull/7260/commits?format=markdown)

[Files changed](https://git.cafe/pingdotgg/t3code/pull/7260/diffs?format=markdown)

## Description

---

Stacked on #7255 (`browser-profile-import`).

Expands cookie import to a source registry with Chromium and Firefox readers.

| Source | macOS | Windows | Linux in this layer |
|---|---|---|---|
| Chrome, Edge, Brave, Vivaldi, Opera | Supported | Unsupported | Detected; key support in #7261 |
| Arc, Helium | Supported | Unsupported | Unsupported |
| Firefox | Supported | Supported | Supported |

Firefox imports its default container; other containers are excluded so their sessions are not mixed. Discovery respects `profiles.ini`, validates relative paths, supports explicitly configured absolute profile directories, and ignores fallback entries without a cookie database. Counts use the same default-container filter as the reader.

Both engines share a consistent read-only SQLite snapshot path. Windows Chromium remains intentionally unsupported, preserving the Windows-tested contribution #7323.

Validation: focused source-discovery, path-validation, Firefox cookie/count, and SQLite snapshot fixtures. Cross-platform path tests run on macOS; they are not a substitute for another live Windows/Linux test.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

<!-- Macroscope's pull request summary starts here -->
<!-- Macroscope will only edit the content between these invisible markers, and the markers themselves will not be visible in the GitHub rendered markdown. -->
<!-- If you delete either of the start / end markers from your PR's description, Macroscope will append its summary at the bottom of the description. -->
> [!NOTE]
> ### Add browser cookie import for Chrome, Edge, Brave, Vivaldi, Opera, Arc, and Firefox
> - Expands `BROWSER_IMPORT_SOURCE_IDS` to include seven Chromium-based browsers and Firefox, with per-browser platform paths, keychain coordinates, and engine type (`chromium` vs `firefox`)
> - Adds Firefox cookie reading in `readFirefoxCookies` that snapshots `cookies.sqlite` read-only, decodes schema-version-aware `moz_cookies` rows (expiry unit changes at schema 16, `rawSameSite` migration for schemas ≤14), and filters to the default container
> - Adds Firefox profile discovery via `parseFirefoxProfiles` (profiles.ini parsing with path validation) plus cross-platform fallback directory scanning, including Linux Snap root deduplication
> - Adds Firefox running-state detection with platform-specific lock probes: `firefoxSymlinkLockIsHeld` + `posixLockIsHeld` (fcntl via child interpreter) on POSIX, `windowsLockIsHeld` (sharing violation on `parent.lock`) on Windows
> - Extracts shared `ImportedCookie`, `CookieReadResult`, `cookieScope`, `bareHost`, and `snapshotCookieDatabase` into [CookieDatabase.ts](https://github.com/pingdotgg/t3code/pull/7260/files#diff-7c056e301689a8f0e400c9ba518e429034d57a6f3d4d01cdb76e7d231d835d4d) for reuse by both engines
> - Risk: `ChromiumCookies.sameSiteFromColumn` now maps column value 1 and unknown values to `unspecified` instead of `lax`; Chromium import is blocked on non-macOS platforms via `unsupportedPlatform` in [BrowserImport.ts](https://github.com/pingdotgg/t3code/pull/7260/files#diff-a37de7a3e91fa89fcad8ed40e4c8a8ef18836a423e7b422d314beb06ce1f5807)
>
> <!-- Macroscope's review summary starts here -->
>
> <sup><a href="https://app.macroscope.com">Macroscope</a> summarized 4916613.</sup>
> <!-- Macroscope's review summary ends here -->
>
<!-- Macroscope's pull request summary ends here -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Touches cookie import, keychain access, and path validation across many browsers; Chromium SameSite mapping changed and Firefox lock probing can mis-detect running state if probes fail.
> 
> **Overview**
> Expands desktop **browser cookie import** from a single Helium source to a registry of **Chrome, Edge, Brave, Vivaldi, Opera, Arc, Helium**, and **Firefox**, wired through contracts and user docs for Settings → Integrations.
> 
> **Discovery and safety** move to a shared `BrowserImportPathContext` (platform, home, Windows `%APPDATA%`). Chromium sources get per-fork paths and keychain IDs; **Windows Chromium stays unsupported** (App-Bound Encryption). Non-macOS Chromium is rejected at list/import time until other key stores exist. Firefox adds `profiles.ini` parsing with path hardening, directory fallback scanning, **Linux Snap** alongside native installs, symlink-following for cookie DB detection, and **per-profile running checks** (symlink `lock`, fcntl on `.parentlock`, Windows `parent.lock`).
> 
> **Reading cookies** is split by engine: shared `CookieDatabase` (WAL-safe snapshot, `ImportedCookie` / `cookieScope`) feeds **Chromium** (macOS keychain, refactored SameSite → `unspecified` where appropriate) and new **Firefox** (`readFirefoxCookies` — schema-aware expiry, `rawSameSite`, default-container-only). `BrowserImport` branches readers, skips false keychain audit logs for Firefox, and maps tagged read errors. `HostProcessAddresses` supports Firefox lock PID matching on local IPs.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit eea4224c0a10d6492f837f606ccadc1a25d36088. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->