# feat\(desktop\): resolve Chromium cookie keys on Linux · PR \#7261 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/pull/7261)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

State: merged

Source repository: pingdotgg/t3code

Source branch: browser-import-linux-windows

Target branch: browser-import-more-sources

Head commit: 0da299e5c45c76f1cb4fae974050aeeea5110cdd

[Discussion and reviews](https://git.cafe/pingdotgg/t3code/pull/7261)

[Commits](https://git.cafe/pingdotgg/t3code/pull/7261/commits?format=markdown)

[Files changed](https://git.cafe/pingdotgg/t3code/pull/7261/diffs?format=markdown)

## Description

---

Stacked on #7260 (`browser-import-more-sources`). Despite the retained branch name, this PR adds Linux support only; Windows Chromium is intentionally unsupported.

Chromium cookie key handling moves into a platform-specific module:

| Platform | Scheme | Key source |
|---|---|---|
| macOS | v10 AES-128-CBC | Login Keychain, with consent |
| Linux | v10 AES-128-CBC | Chromium’s basic-storage `peanuts` passphrase |
| Linux | v11 AES-128-CBC | Secret Service via `secret-tool`, using the browser’s `application` attribute |

Linux requires `secret-tool` and a compatible Secret Service backend to import v11 records. Missing keys/tools/backend can yield a partial v10 import; skipped records are reported. Explicit permission denial or cancellation stops the import. Secret bytes are preserved apart from the tool’s output line ending.

There is no DPAPI, PowerShell, App-Bound Encryption bypass, or direct KWallet implementation. macOS keeps the existing in-process consent path.

Validation: synthetic v10/v11 decryption fixtures, mocked Secret Service subprocess results, denied/missing backend behavior, and trailing-whitespace preservation. No live Linux keyring lookup was performed during this audit.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

<!-- Macroscope's pull request summary starts here -->
<!-- Macroscope will only edit the content between these invisible markers, and the markers themselves will not be visible in the GitHub rendered markdown. -->
<!-- If you delete either of the start / end markers from your PR's description, Macroscope will append its summary at the bottom of the description. -->
> [!NOTE]
> ### Add Chromium cookie key resolution for Linux and Windows imports
> - Adds the `ChromiumKeys` module to resolve macOS, Linux, and Windows encryption keys, replacing hardcoded macOS-only keychain logic.
> - Introduces a native C helper bundled with the Linux desktop build to read Chromium secrets from libsecret.
> - Updates the `ChromiumCookies` value decoder to handle v10/v11 CBC, Windows v10 GCM, and legacy cleartext, preserving partial imports when some keys are missing.
> - Adds Windows support for the Helium browser source and cookie-database running-state detection.
> - Risk: The `ChromiumCookieReadReason` schema in [ChromiumCookies.ts](https://github.com/pingdotgg/t3code/pull/7261/files#diff-4ea21ed7d242c3fb73bfe549eb993ac58973d050bd255ad421c1709ec940881c) replaces macOS-specific failure literals with shared `ChromiumKeyFailure` reasons and removes `unsupportedPlatform`.
>
> <!-- Macroscope's review summary starts here -->
>
> <sup><a href="https://app.macroscope.com">Macroscope</a> summarized 0da299e.</sup>
> <!-- Macroscope's review summary ends here -->
>
<!-- Macroscope's pull request summary ends here -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **High Risk**
> Changes how cookie encryption keys are obtained (keychain, libsecret subprocess, DPAPI) and ships a native helper that reads browser secrets—security- and privacy-sensitive paths with partial-import edge cases.
> 
> **Overview**
> **Enables Chromium-family browser cookie import on Linux** by resolving encryption keys per platform instead of treating non-macOS Chromium as unsupported.
> 
> Key handling moves into **`ChromiumKeys`**: macOS still uses the login keychain; Linux derives **`v10`** keys from Chromium’s keyring-free passphrase, **`v11`** from Secret Service via a **bundled `t3-browser-secret` helper** (native `libsecret`, exit codes for missing/denied/unavailable), plus an **empty-passphrase retry** for mis-encrypted records. **`ChromiumCookies`** decrypts mixed **`v10`/`v11` CBC** schemes, allows **partial imports** when only some keys exist, and aligns **legacy unprefixed values** with Chromium on Linux.
> 
> The helper is **compiled at dev/build** (`build-browser-secret.mjs`), wired through **`LinuxBrowserSecret`**, shipped under **`resources/browser-secret`** on Linux artifacts, and **CI/release** install **`libsecret-1-dev`** / **`pkg-config`**. Browser source definitions gain **`linuxSecretApplication`**; **Helium** is listed on Linux (and Windows profile paths / running detection via held cookie DBs). Contracts and the import wizard add **`keychainUnavailable`** as a **retryable** failure.
> 
> The diff also includes **Windows DPAPI key reading** and **Helium-on-Windows** plumbing in the same modules; other Chromium forks on Windows remain excluded in source metadata.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 0da299e5c45c76f1cb4fae974050aeeea5110cdd. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->