feat(desktop): resolve Chromium cookie keys on Linux#7261

@@ -78,18 +79,29 @@ const chromiumSource = (input: {
   readonly keychainAccount: string;
   readonly macSegments: ReadonlyArray<string>;
   readonly linuxSegments?: ReadonlyArray<string>;
+  readonly linuxSecretApplication?: string;
+  readonly windowsSegments?: ReadonlyArray<string>;
 }): BrowserImportSourceDefinition => ({
   id: input.id,
   name: input.name,
   engine: "chromium",
   platforms: [
     "darwin" as NodeJS.Platform,
     ...(input.linuxSegments ? ["linux" as NodeJS.Platform] : []),
+    ...(input.windowsSegments ? ["win32" as NodeJS.Platform] : []),

@@ -0,0 +1,263 @@
+// @effect-diagnostics nodeBuiltinImport:off - `node:crypto` implements the
+// OSCrypt key derivation Chromium uses; Effect has no equivalent.
+/**
+ * Chromium cookie-encryption keys, per platform.
+ *
+ * Chromium calls this OSCrypt, and it works differently on each OS:
+ *
+ * - **macOS** keeps one key in the login keychain. Reading it prompts the
+ *   user, which is the consent this feature is built around.
+ * - **Linux** may keep a key in libsecret/kwallet (`v11` records), or use a
+ *   hardcoded `peanuts` passphrase when no keyring is available (`v10`).
+ *   Both can appear in the same database, so both are derived up front and
+ *   chosen per record.
+ * - **Windows** wraps an AES-256-GCM key in DPAPI inside `Local State`. Since
+ *   Chrome 127 it *also* keeps an app-bound key that only the browser binary
+ *   can unwrap, and cookies written under it carry a `v20` prefix. Those are
+ *   not readable by anything else, by design, and this module does not try.
+ *
+ * @module ChromiumKeys
+ */
+import * as Keyring from "@napi-rs/keyring";
+import * as NodeCrypto from "node:crypto";
+
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+
+const KEY_SALT = "saltysalt";
+const KEY_LENGTH = 16;
+/** macOS stretches the keychain secret; Linux uses a single iteration. */
+const MAC_KEY_ITERATIONS = 1003;
+const LINUX_KEY_ITERATIONS = 1;
+/** Chromium's documented fallback passphrase when no Linux keyring is present. */
+const LINUX_FALLBACK_PASSPHRASE = "peanuts";
+
+export const ChromiumKeyFailure = Schema.Literals([
+  "needsKeychainApproval",
+  "keychainItemMissing",
+  "appBoundEncryption",
+  "unsupportedPlatform",
+  /** The key store itself could not be read, as opposed to holding no key. */
+  "readFailed",
+]);
+export type ChromiumKeyFailure = typeof ChromiumKeyFailure.Type;
+
+export class ChromiumKeyError extends Schema.TaggedErrorClass<ChromiumKeyError>()(
+  "ChromiumKeyError",
+  {
+    reason: ChromiumKeyFailure,
+    /** Kept for the log; never surfaced to the user. */
+    cause: Schema.optional(Schema.Defect()),
+  },
+) {
+  override get message(): string {
+    return `Could not obtain the Chromium cookie key: ${this.reason}.`;
+  }
+}
+
+/**
+ * Keys to try, indexed by the record prefix they decrypt. A database can hold
+ * records written under more than one scheme, so a missing entry means those
+ * records are skipped rather than the whole import failing.
+ */
+export interface ChromiumKeyMaterial {
+  /** AES-128-CBC on macOS and Linux. */
+  readonly cbcV10?: Buffer;
+  /** AES-128-CBC, Linux keyring-derived. */
+  readonly cbcV11?: Buffer;
+  /** AES-256-GCM on Windows. */
+  readonly gcmV10?: Buffer;
+}
+
+const derive = (passphrase: string, iterations: number) =>
+  NodeCrypto.pbkdf2Sync(passphrase, KEY_SALT, iterations, KEY_LENGTH, "sha1");
+
+/**
+ * Reads the OSCrypt key from the macOS login keychain.
+ *
+ * Uses the in-process Keychain API rather than shelling out to
+ * `/usr/bin/security`, because macOS attributes both the consent prompt and
+ * the resulting ACL entry to the binary that asks. Via the CLI the prompt says
+ * "security" and "Always Allow" grants trust to a tool every process on the
+ * machine can invoke; in-process it names this app and the grant belongs to
+ * it. (In an unsigned dev build the name is the dev binary, not the shipped
+ * app identity.)
+ *
+ * Deliberately untimed: macOS answers this with a modal, and a timeout racing
+ * the user means the prompt can be approved while nothing is left listening,
+ * which reads as "approving did nothing".
+ */
+const readKeychainSecret = Effect.fn("ChromiumKeys.readKeychainSecret")(function* (
+  service: string,
+  account: string,
+) {
+  const secret = yield* Effect.try({
+    try: () => new Keyring.Entry(service, account).getPassword(),
+    catch: (cause) => {
+      const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
+      // Distinguish the causes rather than reporting "approve the prompt" for
+      // a failure approving cannot fix.
+      const missing = /no (matching )?entry|not found/i.test(message);
+      return new ChromiumKeyError({
+        reason: missing ? "keychainItemMissing" : "needsKeychainApproval",
+        cause,
+      });
+    },
+  });
+  if (secret === null || secret === "") {
+    return yield* new ChromiumKeyError({ reason: "keychainItemMissing" });
+  }
+  return secret;
+});
+
+/**
+ * Unwraps the Windows DPAPI-protected key via PowerShell.
+ *
+ * Shelling out is fine here in a way it is not on macOS: DPAPI is transparent
+ * to any process running as the user, so there is no consent prompt to
+ * misattribute and no ACL entry to write against the wrong binary.
+ */
+const unprotectWithDpapi = Effect.fn("ChromiumKeys.unprotectWithDpapi")(function* (
+  protectedKey: Buffer,
+) {
+  const script = [
+    "Add-Type -AssemblyName System.Security;",
+    `$b=[Convert]::FromBase64String('${protectedKey.toString("base64")}');`,
+    "$u=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,",
+    "[System.Security.Cryptography.DataProtectionScope]::CurrentUser);",
+    "[Convert]::ToBase64String($u)",
+  ].join("");
+
+  const process = yield* ChildProcess.make("powershell.exe", [
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    script,
+  ]);
+  const stdout = yield* process.stdout.pipe(Stream.decodeText(), Stream.mkString);
+  const exitCode = yield* process.exitCode;
+
+  // A failed `Unprotect` still exits, printing nothing. Without these checks
+  // the empty stdout decodes to a zero-length Buffer, which is truthy, so
+  // `gcmV10` would be populated with an unusable key: every record then fails
+  // to decrypt and the import reports success having written nothing.
+  if (exitCode !== 0) {
+    return yield* new ChromiumKeyError({
+      reason: "keychainItemMissing",
+      cause: new Error(`powershell.exe exited with ${exitCode}`),
+    });
+  }
+  const unwrapped = Buffer.from(stdout.trim(), "base64");
+  if (unwrapped.length === 0) {
+    return yield* new ChromiumKeyError({
+      reason: "keychainItemMissing",
+      cause: new Error("powershell.exe returned no key material"),
+    });
+  }
+  return unwrapped;
+});
+
+/** The slice of `Local State` that carries the wrapped keys. */
+const LocalState = Schema.Struct({
+  os_crypt: Schema.optional(
+    Schema.Struct({
+      encrypted_key: Schema.optional(Schema.String),
+      app_bound_encrypted_key: Schema.optional(Schema.String),
+    }),
+  ),
+});
+const decodeLocalState = Schema.decodeUnknownEffect(Schema.fromJsonString(LocalState));
+
+/**
+ * Reads the metadata file that carries the wrapped Windows keys.
+ *
+ * Failures are reported rather than flattened into an empty document: a
+ * missing, unreadable or corrupt `Local State` is a different problem from a
+ * browser that has no key yet, and telling the user the latter sends them
+ * looking in the wrong place.
+ */
+const readLocalState = Effect.fn("ChromiumKeys.readLocalState")(function* (localStatePath: string) {
+  const fileSystem = yield* FileSystem.FileSystem;
+  return yield* fileSystem.readFileString(localStatePath).pipe(
+    Effect.flatMap(decodeLocalState),
+    Effect.mapError((cause) => new ChromiumKeyError({ reason: "readFailed", cause })),
+  );
+});
+
+/**
+ * Windows stores the key base64-encoded with a literal `DPAPI` marker in
+ * front, which has to come off before unwrapping.
+ */
+const DPAPI_MARKER = "DPAPI";
+
+export function stripDpapiMarker(encodedKey: string): Buffer {
+  const raw = Buffer.from(encodedKey, "base64");
+  return raw.subarray(0, DPAPI_MARKER.length).toString("latin1") === DPAPI_MARKER
+    ? raw.subarray(DPAPI_MARKER.length)
+    : raw;
+}
+
+export interface ChromiumKeyRequest {
+  readonly platform: NodeJS.Platform;
+  readonly keychainService: string | undefined;
+  readonly keychainAccount: string | undefined;
+  readonly localStatePath: string;
+}
+
+export const resolveChromiumKeys = Effect.fn("ChromiumKeys.resolveChromiumKeys")(function* (
+  request: ChromiumKeyRequest,
+): Effect.fn.Return<
+  ChromiumKeyMaterial,
+  ChromiumKeyError,
+  FileSystem.FileSystem | ChildProcessSpawner.ChildProcessSpawner
+> {
+  if (request.platform === "darwin") {
+    if (!request.keychainService || !request.keychainAccount) {
+      return yield* new ChromiumKeyError({ reason: "unsupportedPlatform" });
+    }
+    const secret = yield* readKeychainSecret(request.keychainService, request.keychainAccount);
+    return { cbcV10: derive(secret, MAC_KEY_ITERATIONS) };
+  }
+
+  if (request.platform === "linux") {
+    // The fallback passphrase always applies to `v10` records; a keyring
+    // secret, when one is reachable, additionally unlocks `v11`. Failing to
+    // reach the keyring is not fatal — it just leaves those records skipped.
+    const keyringSecret =
+      request.keychainService && request.keychainAccount
+        ? yield* readKeychainSecret(request.keychainService, request.keychainAccount).pipe(

@@ -116,136 +118,106 @@ const toUnixSeconds = (webkitSeconds: number): number | undefined => {
 };
 
 /**
- * Reads the OSCrypt key from the login keychain.
- *
- * Uses the in-process Keychain API rather than shelling out to
- * `/usr/bin/security`, because the keychain attributes both the consent prompt
- * and the resulting ACL entry to the binary that asks. Via the CLI the prompt
- * says "security" and "Always Allow" grants trust to a tool every process on
- * the machine can invoke; in-process it names this app and the grant belongs
- * to it. (In an unsigned dev build the name is the dev Electron binary rather
- * than the shipped app identity.)
- *
- * Deliberately untimed: macOS answers this with a modal, and a timeout racing
- * the user means the prompt can be approved while nothing is left listening —
- * which reads as "approving did nothing".
+ * Chromium >= 127 prefixes the plaintext with SHA-256 of the host key, binding
+ * a cookie to its domain. Strip it when present.
  */
-const readMacKeychainPassword = Effect.fn("ChromiumCookies.readMacKeychainPassword")(function* (
-  service: string,
-  account: string,
-  cookieDatabasePath: string,
-) {
-  const password = yield* Effect.try({
-    try: () => new Keyring.Entry(service, account).getPassword(),
-    catch: (cause) => {
-      const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
-      // Distinguish the causes rather than telling the user to approve a
-      // prompt when approving cannot fix the failure.
-      const missing = /no (matching )?entry|not found/i.test(message);
-      return new ChromiumCookieReadError({
-        reason: missing ? "keychainItemMissing" : "needsKeychainApproval",
-        cookieDatabasePath,
-        cause,
-      });
-    },
-  });
-  if (password === null || password === "") {
-    return yield* new ChromiumCookieReadError({
-      reason: "keychainItemMissing",
-      cookieDatabasePath,
-    });
-  }
-  return password;
-});
+const stripDomainBinding = (
+  plaintext: Buffer,
+  domain: string,
+  schemaVersion: number,
+): Buffer | null => {
+  if (schemaVersion < 24) return plaintext;
+  const domainHash = NodeCrypto.createHash("sha256").update(domain).digest();
+  return plaintext.length >= 32 && plaintext.subarray(0, 32).equals(domainHash)
+    ? plaintext.subarray(32)
+    : null;
+};
 
-const decryptValue = (
-  encrypted: Uint8Array,
+const decryptCbc = (
+  payload: Buffer,
   key: Buffer,
   domain: string,
   schemaVersion: number,
-  platform: NodeJS.Platform,
 ): string | null => {
-  const buffer = Buffer.from(encrypted);
-  const version = buffer.subarray(0, 3).toString("latin1");
-
   try {
-    let plaintext: Buffer;
-    if (version === V10_PREFIX) {
-      const decipher = NodeCrypto.createDecipheriv("aes-128-cbc", key, AES_IV);
-      decipher.setAutoPadding(true);
-      plaintext = Buffer.concat([decipher.update(buffer.subarray(3)), decipher.final()]);
-    } else if (platform === "darwin") {
-      // macOS OSCrypt explicitly treats an unversioned encrypted_value as
-      // legacy cleartext. This is platform-specific: Linux uses other version
-      // prefixes, which must not be widened into plaintext cookies.
-      plaintext = buffer;
-    } else {
-      return null;
-    }
-    // Cookie schema 24 requires SHA-256(host_key) at the front of every
-    // encrypted value. Treat a missing or mismatched binding as undecryptable;
-    // older schemas stored arbitrary plaintext here, including long values
-    // whose first 32 bytes must not be interpreted as a hash.
-    if (schemaVersion >= 24) {
-      const domainHash = NodeCrypto.createHash("sha256").update(domain).digest();
-      if (plaintext.length < domainHash.length || !plaintext.subarray(0, 32).equals(domainHash)) {
-        return null;
-      }
-      plaintext = plaintext.subarray(32);
-    }
-    return plaintext.toString("utf8");
+    const decipher = NodeCrypto.createDecipheriv("aes-128-cbc", key, AES_CBC_IV);
+    decipher.setAutoPadding(true);
+    const plaintext = Buffer.concat([decipher.update(payload), decipher.final()]);
+    return stripDomainBinding(plaintext, domain, schemaVersion)?.toString("utf8") ?? null;
   } catch {
     return null;
   }
 };
 
+/**
+ * Decrypts one stored value, choosing the scheme from its prefix. Returns null
+ * when no key covers that scheme — including Windows' app-bound `v20`, which
+ * this build has no key for at all.
+ */
+export function decryptChromiumValue(
+  encrypted: Uint8Array,
+  keys: ChromiumKeyMaterial,
+  domain: string,
+  schemaVersion = 23,
+  platform: NodeJS.Platform = "linux",
+): string | null {
+  const buffer = Buffer.from(encrypted);
+  if (buffer.length === 0) return "";
+  const prefix = buffer.subarray(0, 3).toString("latin1");
+  const payload = buffer.subarray(3);
+
+  if (prefix === "v10") {
+    return keys.cbcV10 ? decryptCbc(payload, keys.cbcV10, domain, schemaVersion) : null;
+  }
+  if (prefix === "v11") {
+    return keys.cbcV11 ? decryptCbc(payload, keys.cbcV11, domain, schemaVersion) : null;
+  }
+  if (platform === "darwin") {
+    return stripDomainBinding(buffer, domain, schemaVersion)?.toString("utf8") ?? null;
+  }
+  return null;
+}
+
 /** Reads and decodes one snapshotted Chromium cookie database. */
 export const readChromiumCookieDatabase = Effect.fn("ChromiumCookies.readChromiumCookieDatabase")(
-  function* (snapshotPath: string, key: Buffer, platform: NodeJS.Platform) {
-    const rows = yield* Effect.gen(function* () {
+  function* (snapshotPath: string, keys: ChromiumKeyMaterial | Buffer, platform: NodeJS.Platform) {
+    const keyMaterial = Buffer.isBuffer(keys) ? { cbcV10: keys } : keys;

@@ -0,0 +1,234 @@
+// @effect-diagnostics nodeBuiltinImport:off - `node:crypto` implements the
+// OSCrypt key derivation Chromium uses; Effect has no equivalent.
+/**
+ * Chromium cookie-encryption keys, per platform.
+ *
+ * Chromium calls this OSCrypt, and it works differently on each OS:
+ *
+ * - **macOS** keeps one key in the login keychain. Reading it prompts the
+ *   user, which is the consent this feature is built around.
+ * - **Linux** may keep a key in libsecret/kwallet (`v11` records), or use a
+ *   hardcoded `peanuts` passphrase when no keyring is available (`v10`).
+ *   Both can appear in the same database, so both are derived up front and
+ *   chosen per record.
+ * - **Windows** wraps an AES-256-GCM key in DPAPI inside `Local State`. Since
+ *   Chrome 127 it *also* keeps an app-bound key that only the browser binary
+ *   can unwrap, and cookies written under it carry a `v20` prefix. Those are
+ *   not readable by anything else, by design, and this module does not try.
+ *
+ * @module ChromiumKeys
+ */
+import * as Keyring from "@napi-rs/keyring";
+import * as NodeCrypto from "node:crypto";
+
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+
+const KEY_SALT = "saltysalt";
+const KEY_LENGTH = 16;
+/** macOS stretches the keychain secret; Linux uses a single iteration. */
+const MAC_KEY_ITERATIONS = 1003;
+const LINUX_KEY_ITERATIONS = 1;
+/** Chromium's documented fallback passphrase when no Linux keyring is present. */
+const LINUX_FALLBACK_PASSPHRASE = "peanuts";
+
+export const ChromiumKeyFailure = Schema.Literals([
+  "needsKeychainApproval",
+  "keychainItemMissing",
+  "appBoundEncryption",
+  "unsupportedPlatform",
+]);
+export type ChromiumKeyFailure = typeof ChromiumKeyFailure.Type;
+
+export class ChromiumKeyError extends Schema.TaggedErrorClass<ChromiumKeyError>()(
+  "ChromiumKeyError",
+  {
+    reason: ChromiumKeyFailure,
+    /** Kept for the log; never surfaced to the user. */
+    cause: Schema.optional(Schema.Defect()),
+  },
+) {
+  override get message(): string {
+    return `Could not obtain the Chromium cookie key: ${this.reason}.`;
+  }
+}
+
+/**
+ * Keys to try, indexed by the record prefix they decrypt. A database can hold
+ * records written under more than one scheme, so a missing entry means those
+ * records are skipped rather than the whole import failing.
+ */
+export interface ChromiumKeyMaterial {
+  /** AES-128-CBC on macOS and Linux. */
+  readonly cbcV10?: Buffer;
+  /** AES-128-CBC, Linux keyring-derived. */
+  readonly cbcV11?: Buffer;
+  /** AES-256-GCM on Windows. */
+  readonly gcmV10?: Buffer;
+}
+
+const derive = (passphrase: string, iterations: number) =>
+  NodeCrypto.pbkdf2Sync(passphrase, KEY_SALT, iterations, KEY_LENGTH, "sha1");
+
+/**
+ * Reads the OSCrypt key from the macOS login keychain.
+ *
+ * Uses the in-process Keychain API rather than shelling out to
+ * `/usr/bin/security`, because macOS attributes both the consent prompt and
+ * the resulting ACL entry to the binary that asks. Via the CLI the prompt says
+ * "security" and "Always Allow" grants trust to a tool every process on the
+ * machine can invoke; in-process it names this app and the grant belongs to
+ * it. (In an unsigned dev build the name is the dev binary, not the shipped
+ * app identity.)
+ *
+ * Deliberately untimed: macOS answers this with a modal, and a timeout racing
+ * the user means the prompt can be approved while nothing is left listening,
+ * which reads as "approving did nothing".
+ */
+const readKeychainSecret = Effect.fn("ChromiumKeys.readKeychainSecret")(function* (
+  service: string,
+  account: string,
+) {
+  const secret = yield* Effect.try({
+    try: () => new Keyring.Entry(service, account).getPassword(),
+    catch: (cause) => {
+      const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
+      // Distinguish the causes rather than reporting "approve the prompt" for
+      // a failure approving cannot fix.
+      const missing = /no (matching )?entry|not found/i.test(message);
+      return new ChromiumKeyError({
+        reason: missing ? "keychainItemMissing" : "needsKeychainApproval",
+        cause,
+      });
+    },
+  });
+  if (secret === null || secret === "") {
+    return yield* new ChromiumKeyError({ reason: "keychainItemMissing" });
+  }
+  return secret;
+});
+
+/**
+ * Unwraps the Windows DPAPI-protected key via PowerShell.
+ *
+ * Shelling out is fine here in a way it is not on macOS: DPAPI is transparent
+ * to any process running as the user, so there is no consent prompt to
+ * misattribute and no ACL entry to write against the wrong binary.
+ */
+const unprotectWithDpapi = Effect.fn("ChromiumKeys.unprotectWithDpapi")(function* (
+  protectedKey: Buffer,
+) {
+  const script = [
+    "Add-Type -AssemblyName System.Security;",
+    `$b=[Convert]::FromBase64String('${protectedKey.toString("base64")}');`,
+    "$u=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,",
+    "[System.Security.Cryptography.DataProtectionScope]::CurrentUser);",
+    "[Convert]::ToBase64String($u)",
+  ].join("");
+
+  const process = yield* ChildProcess.make("powershell.exe", [
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    script,
+  ]);
+  const stdout = yield* process.stdout.pipe(Stream.decodeText(), Stream.mkString);
+  return Buffer.from(stdout.trim(), "base64");

@@ -0,0 +1,278 @@
+// @effect-diagnostics nodeBuiltinImport:off - `node:crypto` implements the
+// OSCrypt key derivation Chromium uses; Effect has no equivalent.
+/**
+ * Chromium cookie-encryption keys, per platform.
+ *
+ * Chromium calls this OSCrypt, and it works differently on each OS:
+ *
+ * - **macOS** keeps one key in the login keychain. Reading it prompts the
+ *   user, which is the consent this feature is built around.
+ * - **Linux** may keep a key in libsecret/kwallet (`v11` records), or use a
+ *   hardcoded `peanuts` passphrase when no keyring is available (`v10`).
+ *   Both can appear in the same database, so both are derived up front and
+ *   chosen per record.
+ * - **Windows** wraps an AES-256-GCM key in DPAPI inside `Local State`. Since
+ *   Chrome 127 it *also* keeps an app-bound key that only the browser binary
+ *   can unwrap, and cookies written under it carry a `v20` prefix. Those are
+ *   not readable by anything else, by design, and this module does not try.
+ *
+ * @module ChromiumKeys
+ */
+import * as Keyring from "@napi-rs/keyring";
+import * as NodeCrypto from "node:crypto";
+
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+
+const KEY_SALT = "saltysalt";
+const KEY_LENGTH = 16;
+/** macOS stretches the keychain secret; Linux uses a single iteration. */
+const MAC_KEY_ITERATIONS = 1003;
+const LINUX_KEY_ITERATIONS = 1;
+/** Chromium's documented fallback passphrase when no Linux keyring is present. */
+const LINUX_FALLBACK_PASSPHRASE = "peanuts";
+
+export const ChromiumKeyFailure = Schema.Literals([
+  "needsKeychainApproval",
+  "keychainItemMissing",
+  "appBoundEncryption",
+  "unsupportedPlatform",
+  /** The key store itself could not be read, as opposed to holding no key. */
+  "readFailed",
+]);
+export type ChromiumKeyFailure = typeof ChromiumKeyFailure.Type;
+
+export class ChromiumKeyError extends Schema.TaggedErrorClass<ChromiumKeyError>()(
+  "ChromiumKeyError",
+  {
+    reason: ChromiumKeyFailure,
+    /**
+     * The metadata file the failure is about, when it is about one. Without it
+     * an unreadable `Local State` is reported against the cookie database the
+     * caller names instead.
+     */
+    localStatePath: Schema.optional(Schema.String),
+    /** Exit status of the helper that was asked to unwrap the key. */
+    exitCode: Schema.optional(Schema.Number),
+    /** Kept for the log; never surfaced to the user. */
+    cause: Schema.optional(Schema.Defect()),
+  },
+) {
+  override get message(): string {
+    const where = this.localStatePath === undefined ? "" : ` at ${this.localStatePath}`;
+    const status = this.exitCode === undefined ? "" : ` (helper exited with ${this.exitCode})`;
+    return `Could not obtain the Chromium cookie key${where}: ${this.reason}${status}.`;
+  }
+}
+
+/**
+ * Keys to try, indexed by the record prefix they decrypt. A database can hold
+ * records written under more than one scheme, so a missing entry means those
+ * records are skipped rather than the whole import failing.
+ */
+export interface ChromiumKeyMaterial {
+  /** AES-128-CBC on macOS and Linux. */
+  readonly cbcV10?: Buffer;
+  /** AES-128-CBC, Linux keyring-derived. */
+  readonly cbcV11?: Buffer;
+  /** AES-256-GCM on Windows. */
+  readonly gcmV10?: Buffer;
+}
+
+const isChromiumKeyError = Schema.is(ChromiumKeyError);
+
+const derive = (passphrase: string, iterations: number) =>
+  NodeCrypto.pbkdf2Sync(passphrase, KEY_SALT, iterations, KEY_LENGTH, "sha1");
+
+/**
+ * Reads the OSCrypt key from the macOS login keychain.
+ *
+ * Uses the in-process Keychain API rather than shelling out to
+ * `/usr/bin/security`, because macOS attributes both the consent prompt and
+ * the resulting ACL entry to the binary that asks. Via the CLI the prompt says
+ * "security" and "Always Allow" grants trust to a tool every process on the
+ * machine can invoke; in-process it names this app and the grant belongs to
+ * it. (In an unsigned dev build the name is the dev binary, not the shipped
+ * app identity.)
+ *
+ * Deliberately untimed: macOS answers this with a modal, and a timeout racing
+ * the user means the prompt can be approved while nothing is left listening,
+ * which reads as "approving did nothing".
+ */
+const readKeychainSecret = Effect.fn("ChromiumKeys.readKeychainSecret")(function* (
+  service: string,
+  account: string,
+) {
+  const secret = yield* Effect.try({
+    try: () => new Keyring.Entry(service, account).getPassword(),
+    catch: (cause) => {
+      const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
+      // Distinguish the causes rather than reporting "approve the prompt" for
+      // a failure approving cannot fix.
+      const missing = /no (matching )?entry|not found/i.test(message);
+      return new ChromiumKeyError({
+        reason: missing ? "keychainItemMissing" : "needsKeychainApproval",
+        cause,
+      });
+    },
+  });
+  if (secret === null || secret === "") {
+    return yield* new ChromiumKeyError({ reason: "keychainItemMissing" });
+  }
+  return secret;
+});
+
+/**
+ * Unwraps the Windows DPAPI-protected key via PowerShell.
+ *
+ * Shelling out is fine here in a way it is not on macOS: DPAPI is transparent
+ * to any process running as the user, so there is no consent prompt to
+ * misattribute and no ACL entry to write against the wrong binary.
+ */
+const unprotectWithDpapi = Effect.fn("ChromiumKeys.unprotectWithDpapi")(function* (
+  protectedKey: Buffer,
+) {
+  const script = [
+    "Add-Type -AssemblyName System.Security;",
+    `$b=[Convert]::FromBase64String('${protectedKey.toString("base64")}');`,
+    "$u=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,",
+    "[System.Security.Cryptography.DataProtectionScope]::CurrentUser);",
+    "[Convert]::ToBase64String($u)",
+  ].join("");
+
+  const process = yield* ChildProcess.make("powershell.exe", [
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    script,
+  ]);
+  const stdout = yield* process.stdout.pipe(Stream.decodeText(), Stream.mkString);
+  const exitCode = yield* process.exitCode;
+
+  // A failed `Unprotect` still exits, printing nothing. Without these checks
+  // the empty stdout decodes to a zero-length Buffer, which is truthy, so
+  // `gcmV10` would be populated with an unusable key: every record then fails
+  // to decrypt and the import reports success having written nothing.
+  if (exitCode !== 0) {
+    return yield* new ChromiumKeyError({ reason: "readFailed", exitCode });
+  }
+  const unwrapped = Buffer.from(stdout.trim(), "base64");
+  if (unwrapped.length === 0) {
+    return yield* new ChromiumKeyError({ reason: "readFailed", exitCode });
+  }
+  return unwrapped;
+});
+
+/** The slice of `Local State` that carries the wrapped keys. */
+const LocalState = Schema.Struct({
+  os_crypt: Schema.optional(
+    Schema.Struct({
+      encrypted_key: Schema.optional(Schema.String),
+      app_bound_encrypted_key: Schema.optional(Schema.String),
+    }),
+  ),
+});
+const decodeLocalState = Schema.decodeUnknownEffect(Schema.fromJsonString(LocalState));
+
+/**
+ * Reads the metadata file that carries the wrapped Windows keys.
+ *
+ * Failures are reported rather than flattened into an empty document: a
+ * missing, unreadable or corrupt `Local State` is a different problem from a
+ * browser that has no key yet, and telling the user the latter sends them
+ * looking in the wrong place.
+ */
+const readLocalState = Effect.fn("ChromiumKeys.readLocalState")(function* (localStatePath: string) {
+  const fileSystem = yield* FileSystem.FileSystem;
+  return yield* fileSystem.readFileString(localStatePath).pipe(
+    Effect.flatMap(decodeLocalState),
+    Effect.mapError(
+      (cause) => new ChromiumKeyError({ reason: "readFailed", localStatePath, cause }),
+    ),
+  );
+});
+
+/**
+ * Windows stores the key base64-encoded with a literal `DPAPI` marker in
+ * front, which has to come off before unwrapping.
+ */
+const DPAPI_MARKER = "DPAPI";
+
+export function stripDpapiMarker(encodedKey: string): Buffer {
+  const raw = Buffer.from(encodedKey, "base64");
+  return raw.subarray(0, DPAPI_MARKER.length).toString("latin1") === DPAPI_MARKER
+    ? raw.subarray(DPAPI_MARKER.length)
+    : raw;
+}
+
+export interface ChromiumKeyRequest {
+  readonly platform: NodeJS.Platform;
+  readonly keychainService: string | undefined;
+  readonly keychainAccount: string | undefined;
+  readonly localStatePath: string;
+}
+
+export const resolveChromiumKeys = Effect.fn("ChromiumKeys.resolveChromiumKeys")(function* (
+  request: ChromiumKeyRequest,
+): Effect.fn.Return<
+  ChromiumKeyMaterial,
+  ChromiumKeyError,
+  FileSystem.FileSystem | ChildProcessSpawner.ChildProcessSpawner
+> {
+  if (request.platform === "darwin") {
+    if (!request.keychainService || !request.keychainAccount) {
+      return yield* new ChromiumKeyError({ reason: "unsupportedPlatform" });
+    }
+    const secret = yield* readKeychainSecret(request.keychainService, request.keychainAccount);
+    return { cbcV10: derive(secret, MAC_KEY_ITERATIONS) };
+  }
+
+  if (request.platform === "linux") {
+    // The fallback passphrase always applies to `v10` records; a keyring
+    // secret, when one is reachable, additionally unlocks `v11`. Failing to
+    // reach the keyring is not fatal — it just leaves those records skipped.
+    const keyringSecret =
+      request.keychainService && request.keychainAccount
+        ? yield* readKeychainSecret(request.keychainService, request.keychainAccount).pipe(
+            // No Secret Service, locked keyring, or a differently-keyed entry.
+            Effect.orElseSucceed(() => undefined),
+          )
+        : undefined;
+    return {
+      cbcV10: derive(LINUX_FALLBACK_PASSPHRASE, LINUX_KEY_ITERATIONS),
+      ...(keyringSecret ? { cbcV11: derive(keyringSecret, LINUX_KEY_ITERATIONS) } : {}),
+    };
+  }
+
+  if (request.platform === "win32") {
+    const localState = yield* readLocalState(request.localStatePath);
+    const encodedKey = localState.os_crypt?.encrypted_key;
+    if (!encodedKey) {
+      // An app-bound key with no legacy key means every record is `v20`.
+      return yield* new ChromiumKeyError({
+        reason: localState.os_crypt?.app_bound_encrypted_key
+          ? "appBoundEncryption"
+          : "keychainItemMissing",
+      });
+    }
+    const unwrapped = yield* unprotectWithDpapi(stripDpapiMarker(encodedKey)).pipe(
+      // Scoped here so the PowerShell process is reaped before we return.
+      Effect.scoped,
+      // A `ChromiumKeyError` already says what went wrong and passes through.
+      // Only a spawn failure — no `powershell.exe`, or one that cannot be
+      // launched — arrives as something else, and that is a read failure, not
+      // a browser that has no key.
+      Effect.catchIf(
+        (error) => !isChromiumKeyError(error),
+        (cause) => new ChromiumKeyError({ reason: "readFailed", cause }),
+      ),

@@ -85,11 +86,6 @@ const unavailableReason = Effect.fn("BrowserImport.unavailableReason")(function*
   context: BrowserImportPathContext,
 ): Effect.fn.Return<BrowserImportUnavailableReason | undefined, never, FileSystem.FileSystem> {
   if (!definition.platforms.includes(context.platform)) return "unsupportedPlatform";

@@ -116,136 +118,105 @@ const toUnixSeconds = (webkitSeconds: number): number | undefined => {
 };
 
 /**
- * Reads the OSCrypt key from the login keychain.
- *
- * Uses the in-process Keychain API rather than shelling out to
- * `/usr/bin/security`, because the keychain attributes both the consent prompt
- * and the resulting ACL entry to the binary that asks. Via the CLI the prompt
- * says "security" and "Always Allow" grants trust to a tool every process on
- * the machine can invoke; in-process it names this app and the grant belongs
- * to it. (In an unsigned dev build the name is the dev Electron binary rather
- * than the shipped app identity.)
- *
- * Deliberately untimed: macOS answers this with a modal, and a timeout racing
- * the user means the prompt can be approved while nothing is left listening —
- * which reads as "approving did nothing".
+ * Chromium >= 127 prefixes the plaintext with SHA-256 of the host key, binding
+ * a cookie to its domain. Strip it when present.
  */
-const readMacKeychainPassword = Effect.fn("ChromiumCookies.readMacKeychainPassword")(function* (
-  service: string,
-  account: string,
-  cookieDatabasePath: string,
-) {
-  const password = yield* Effect.try({
-    try: () => new Keyring.Entry(service, account).getPassword(),
-    catch: (cause) => {
-      const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
-      // Distinguish the causes rather than telling the user to approve a
-      // prompt when approving cannot fix the failure.
-      const missing = /no (matching )?entry|not found/i.test(message);
-      return new ChromiumCookieReadError({
-        reason: missing ? "keychainItemMissing" : "needsKeychainApproval",
-        cookieDatabasePath,
-        cause,
-      });
-    },
-  });
-  if (password === null || password === "") {
-    return yield* new ChromiumCookieReadError({
-      reason: "keychainItemMissing",
-      cookieDatabasePath,
-    });
-  }
-  return password;
-});
+const stripDomainBinding = (
+  plaintext: Buffer,
+  domain: string,
+  schemaVersion: number,
+): Buffer | null => {
+  if (schemaVersion < 24) return plaintext;
+  const domainHash = NodeCrypto.createHash("sha256").update(domain).digest();
+  return plaintext.length >= 32 && plaintext.subarray(0, 32).equals(domainHash)
+    ? plaintext.subarray(32)
+    : null;
+};
 
-const decryptValue = (
-  encrypted: Uint8Array,
+const decryptCbc = (
+  payload: Buffer,
   key: Buffer,
   domain: string,
   schemaVersion: number,
-  platform: NodeJS.Platform,
 ): string | null => {
-  const buffer = Buffer.from(encrypted);
-  const version = buffer.subarray(0, 3).toString("latin1");
-
   try {
-    let plaintext: Buffer;
-    if (version === V10_PREFIX) {
-      const decipher = NodeCrypto.createDecipheriv("aes-128-cbc", key, AES_IV);
-      decipher.setAutoPadding(true);
-      plaintext = Buffer.concat([decipher.update(buffer.subarray(3)), decipher.final()]);
-    } else if (platform === "darwin") {
-      // macOS OSCrypt explicitly treats an unversioned encrypted_value as
-      // legacy cleartext. This is platform-specific: Linux uses other version
-      // prefixes, which must not be widened into plaintext cookies.
-      plaintext = buffer;
-    } else {
-      return null;
-    }
-    // Cookie schema 24 requires SHA-256(host_key) at the front of every
-    // encrypted value. Treat a missing or mismatched binding as undecryptable;
-    // older schemas stored arbitrary plaintext here, including long values
-    // whose first 32 bytes must not be interpreted as a hash.
-    if (schemaVersion >= 24) {
-      const domainHash = NodeCrypto.createHash("sha256").update(domain).digest();
-      if (plaintext.length < domainHash.length || !plaintext.subarray(0, 32).equals(domainHash)) {
-        return null;
-      }
-      plaintext = plaintext.subarray(32);
-    }
-    return plaintext.toString("utf8");
+    const decipher = NodeCrypto.createDecipheriv("aes-128-cbc", key, AES_CBC_IV);
+    decipher.setAutoPadding(true);
+    const plaintext = Buffer.concat([decipher.update(payload), decipher.final()]);
+    return stripDomainBinding(plaintext, domain, schemaVersion)?.toString("utf8") ?? null;
   } catch {
     return null;
   }
 };
 
+/**
+ * Decrypts one stored value, choosing the scheme from its prefix. Returns null
+ * when no key covers that scheme — including Windows' app-bound `v20`, which
+ * this build has no key for at all.
+ */
+export function decryptChromiumValue(
+  encrypted: Uint8Array,
+  keys: ChromiumKeyMaterial,
+  domain: string,
+  schemaVersion = 23,
+  platform: NodeJS.Platform = "linux",
+): string | null {
+  const buffer = Buffer.from(encrypted);
+  if (buffer.length === 0) return "";
+  const prefix = buffer.subarray(0, 3).toString("latin1");
+  const payload = buffer.subarray(3);
+
+  if (prefix === "v10") {
+    return keys.cbcV10 ? decryptCbc(payload, keys.cbcV10, domain, schemaVersion) : null;

@@ -0,0 +1,263 @@
+// @effect-diagnostics nodeBuiltinImport:off - `node:crypto` implements the
+// OSCrypt key derivation Chromium uses; Effect has no equivalent.
+/**
+ * Chromium cookie-encryption keys, per platform.
+ *
+ * Chromium calls this OSCrypt, and it works differently on each OS:
+ *
+ * - **macOS** keeps one key in the login keychain. Reading it prompts the
+ *   user, which is the consent this feature is built around.
+ * - **Linux** may keep a key in libsecret/kwallet (`v11` records), or use a
+ *   hardcoded `peanuts` passphrase when no keyring is available (`v10`).
+ *   Both can appear in the same database, so both are derived up front and
+ *   chosen per record.
+ * - **Windows** wraps an AES-256-GCM key in DPAPI inside `Local State`. Since
+ *   Chrome 127 it *also* keeps an app-bound key that only the browser binary
+ *   can unwrap, and cookies written under it carry a `v20` prefix. Those are
+ *   not readable by anything else, by design, and this module does not try.
+ *
+ * @module ChromiumKeys
+ */
+import * as Keyring from "@napi-rs/keyring";
+import * as NodeCrypto from "node:crypto";
+
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+
+const KEY_SALT = "saltysalt";
+const KEY_LENGTH = 16;
+/** macOS stretches the keychain secret; Linux uses a single iteration. */
+const MAC_KEY_ITERATIONS = 1003;
+const LINUX_KEY_ITERATIONS = 1;
+/** Chromium's documented fallback passphrase when no Linux keyring is present. */
+const LINUX_FALLBACK_PASSPHRASE = "peanuts";
+
+export const ChromiumKeyFailure = Schema.Literals([
+  "needsKeychainApproval",
+  "keychainItemMissing",
+  "appBoundEncryption",
+  "unsupportedPlatform",
+  /** The key store itself could not be read, as opposed to holding no key. */
+  "readFailed",
+]);
+export type ChromiumKeyFailure = typeof ChromiumKeyFailure.Type;
+
+export class ChromiumKeyError extends Schema.TaggedErrorClass<ChromiumKeyError>()(
+  "ChromiumKeyError",
+  {
+    reason: ChromiumKeyFailure,
+    /** Kept for the log; never surfaced to the user. */
+    cause: Schema.optional(Schema.Defect()),
+  },
+) {
+  override get message(): string {
+    return `Could not obtain the Chromium cookie key: ${this.reason}.`;
+  }
+}
+
+/**
+ * Keys to try, indexed by the record prefix they decrypt. A database can hold
+ * records written under more than one scheme, so a missing entry means those
+ * records are skipped rather than the whole import failing.
+ */
+export interface ChromiumKeyMaterial {
+  /** AES-128-CBC on macOS and Linux. */
+  readonly cbcV10?: Buffer;
+  /** AES-128-CBC, Linux keyring-derived. */
+  readonly cbcV11?: Buffer;
+  /** AES-256-GCM on Windows. */
+  readonly gcmV10?: Buffer;
+}
+
+const derive = (passphrase: string, iterations: number) =>
+  NodeCrypto.pbkdf2Sync(passphrase, KEY_SALT, iterations, KEY_LENGTH, "sha1");
+
+/**
+ * Reads the OSCrypt key from the macOS login keychain.
+ *
+ * Uses the in-process Keychain API rather than shelling out to
+ * `/usr/bin/security`, because macOS attributes both the consent prompt and
+ * the resulting ACL entry to the binary that asks. Via the CLI the prompt says
+ * "security" and "Always Allow" grants trust to a tool every process on the
+ * machine can invoke; in-process it names this app and the grant belongs to
+ * it. (In an unsigned dev build the name is the dev binary, not the shipped
+ * app identity.)
+ *
+ * Deliberately untimed: macOS answers this with a modal, and a timeout racing
+ * the user means the prompt can be approved while nothing is left listening,
+ * which reads as "approving did nothing".
+ */
+const readKeychainSecret = Effect.fn("ChromiumKeys.readKeychainSecret")(function* (
+  service: string,
+  account: string,
+) {
+  const secret = yield* Effect.try({
+    try: () => new Keyring.Entry(service, account).getPassword(),
+    catch: (cause) => {
+      const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
+      // Distinguish the causes rather than reporting "approve the prompt" for
+      // a failure approving cannot fix.
+      const missing = /no (matching )?entry|not found/i.test(message);
+      return new ChromiumKeyError({
+        reason: missing ? "keychainItemMissing" : "needsKeychainApproval",
+        cause,
+      });
+    },
+  });
+  if (secret === null || secret === "") {
+    return yield* new ChromiumKeyError({ reason: "keychainItemMissing" });
+  }
+  return secret;
+});
+
+/**
+ * Unwraps the Windows DPAPI-protected key via PowerShell.
+ *
+ * Shelling out is fine here in a way it is not on macOS: DPAPI is transparent
+ * to any process running as the user, so there is no consent prompt to
+ * misattribute and no ACL entry to write against the wrong binary.
+ */
+const unprotectWithDpapi = Effect.fn("ChromiumKeys.unprotectWithDpapi")(function* (
+  protectedKey: Buffer,
+) {
+  const script = [
+    "Add-Type -AssemblyName System.Security;",
+    `$b=[Convert]::FromBase64String('${protectedKey.toString("base64")}');`,
+    "$u=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,",
+    "[System.Security.Cryptography.DataProtectionScope]::CurrentUser);",
+    "[Convert]::ToBase64String($u)",
+  ].join("");
+
+  const process = yield* ChildProcess.make("powershell.exe", [
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    script,
+  ]);
+  const stdout = yield* process.stdout.pipe(Stream.decodeText(), Stream.mkString);
+  const exitCode = yield* process.exitCode;
+
+  // A failed `Unprotect` still exits, printing nothing. Without these checks
+  // the empty stdout decodes to a zero-length Buffer, which is truthy, so
+  // `gcmV10` would be populated with an unusable key: every record then fails
+  // to decrypt and the import reports success having written nothing.
+  if (exitCode !== 0) {
+    return yield* new ChromiumKeyError({
+      reason: "keychainItemMissing",
+      cause: new Error(`powershell.exe exited with ${exitCode}`),
+    });
+  }

@@ -0,0 +1,263 @@
+// @effect-diagnostics nodeBuiltinImport:off - `node:crypto` implements the
+// OSCrypt key derivation Chromium uses; Effect has no equivalent.
+/**
+ * Chromium cookie-encryption keys, per platform.
+ *
+ * Chromium calls this OSCrypt, and it works differently on each OS:
+ *
+ * - **macOS** keeps one key in the login keychain. Reading it prompts the
+ *   user, which is the consent this feature is built around.
+ * - **Linux** may keep a key in libsecret/kwallet (`v11` records), or use a
+ *   hardcoded `peanuts` passphrase when no keyring is available (`v10`).
+ *   Both can appear in the same database, so both are derived up front and
+ *   chosen per record.
+ * - **Windows** wraps an AES-256-GCM key in DPAPI inside `Local State`. Since
+ *   Chrome 127 it *also* keeps an app-bound key that only the browser binary
+ *   can unwrap, and cookies written under it carry a `v20` prefix. Those are
+ *   not readable by anything else, by design, and this module does not try.
+ *
+ * @module ChromiumKeys
+ */
+import * as Keyring from "@napi-rs/keyring";
+import * as NodeCrypto from "node:crypto";
+
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+
+const KEY_SALT = "saltysalt";
+const KEY_LENGTH = 16;
+/** macOS stretches the keychain secret; Linux uses a single iteration. */
+const MAC_KEY_ITERATIONS = 1003;
+const LINUX_KEY_ITERATIONS = 1;
+/** Chromium's documented fallback passphrase when no Linux keyring is present. */
+const LINUX_FALLBACK_PASSPHRASE = "peanuts";
+
+export const ChromiumKeyFailure = Schema.Literals([
+  "needsKeychainApproval",
+  "keychainItemMissing",
+  "appBoundEncryption",
+  "unsupportedPlatform",
+  /** The key store itself could not be read, as opposed to holding no key. */
+  "readFailed",
+]);
+export type ChromiumKeyFailure = typeof ChromiumKeyFailure.Type;
+
+export class ChromiumKeyError extends Schema.TaggedErrorClass<ChromiumKeyError>()(
+  "ChromiumKeyError",
+  {
+    reason: ChromiumKeyFailure,
+    /** Kept for the log; never surfaced to the user. */
+    cause: Schema.optional(Schema.Defect()),
+  },
+) {
+  override get message(): string {
+    return `Could not obtain the Chromium cookie key: ${this.reason}.`;
+  }
+}
+
+/**
+ * Keys to try, indexed by the record prefix they decrypt. A database can hold
+ * records written under more than one scheme, so a missing entry means those
+ * records are skipped rather than the whole import failing.
+ */
+export interface ChromiumKeyMaterial {
+  /** AES-128-CBC on macOS and Linux. */
+  readonly cbcV10?: Buffer;
+  /** AES-128-CBC, Linux keyring-derived. */
+  readonly cbcV11?: Buffer;
+  /** AES-256-GCM on Windows. */
+  readonly gcmV10?: Buffer;
+}
+
+const derive = (passphrase: string, iterations: number) =>
+  NodeCrypto.pbkdf2Sync(passphrase, KEY_SALT, iterations, KEY_LENGTH, "sha1");
+
+/**
+ * Reads the OSCrypt key from the macOS login keychain.
+ *
+ * Uses the in-process Keychain API rather than shelling out to
+ * `/usr/bin/security`, because macOS attributes both the consent prompt and
+ * the resulting ACL entry to the binary that asks. Via the CLI the prompt says
+ * "security" and "Always Allow" grants trust to a tool every process on the
+ * machine can invoke; in-process it names this app and the grant belongs to
+ * it. (In an unsigned dev build the name is the dev binary, not the shipped
+ * app identity.)
+ *
+ * Deliberately untimed: macOS answers this with a modal, and a timeout racing
+ * the user means the prompt can be approved while nothing is left listening,
+ * which reads as "approving did nothing".
+ */
+const readKeychainSecret = Effect.fn("ChromiumKeys.readKeychainSecret")(function* (
+  service: string,
+  account: string,
+) {
+  const secret = yield* Effect.try({
+    try: () => new Keyring.Entry(service, account).getPassword(),
+    catch: (cause) => {
+      const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
+      // Distinguish the causes rather than reporting "approve the prompt" for
+      // a failure approving cannot fix.
+      const missing = /no (matching )?entry|not found/i.test(message);
+      return new ChromiumKeyError({
+        reason: missing ? "keychainItemMissing" : "needsKeychainApproval",
+        cause,
+      });
+    },
+  });
+  if (secret === null || secret === "") {
+    return yield* new ChromiumKeyError({ reason: "keychainItemMissing" });
+  }
+  return secret;
+});
+
+/**
+ * Unwraps the Windows DPAPI-protected key via PowerShell.
+ *
+ * Shelling out is fine here in a way it is not on macOS: DPAPI is transparent
+ * to any process running as the user, so there is no consent prompt to
+ * misattribute and no ACL entry to write against the wrong binary.
+ */
+const unprotectWithDpapi = Effect.fn("ChromiumKeys.unprotectWithDpapi")(function* (
+  protectedKey: Buffer,
+) {
+  const script = [
+    "Add-Type -AssemblyName System.Security;",
+    `$b=[Convert]::FromBase64String('${protectedKey.toString("base64")}');`,
+    "$u=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,",
+    "[System.Security.Cryptography.DataProtectionScope]::CurrentUser);",
+    "[Convert]::ToBase64String($u)",
+  ].join("");
+
+  const process = yield* ChildProcess.make("powershell.exe", [
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    script,
+  ]);
+  const stdout = yield* process.stdout.pipe(Stream.decodeText(), Stream.mkString);
+  const exitCode = yield* process.exitCode;
+
+  // A failed `Unprotect` still exits, printing nothing. Without these checks
+  // the empty stdout decodes to a zero-length Buffer, which is truthy, so
+  // `gcmV10` would be populated with an unusable key: every record then fails
+  // to decrypt and the import reports success having written nothing.
+  if (exitCode !== 0) {
+    return yield* new ChromiumKeyError({
+      reason: "keychainItemMissing",
+      cause: new Error(`powershell.exe exited with ${exitCode}`),
+    });
+  }
+  const unwrapped = Buffer.from(stdout.trim(), "base64");
+  if (unwrapped.length === 0) {
+    return yield* new ChromiumKeyError({
+      reason: "keychainItemMissing",
+      cause: new Error("powershell.exe returned no key material"),
+    });
+  }
+  return unwrapped;
+});
+
+/** The slice of `Local State` that carries the wrapped keys. */
+const LocalState = Schema.Struct({
+  os_crypt: Schema.optional(
+    Schema.Struct({
+      encrypted_key: Schema.optional(Schema.String),
+      app_bound_encrypted_key: Schema.optional(Schema.String),
+    }),
+  ),
+});
+const decodeLocalState = Schema.decodeUnknownEffect(Schema.fromJsonString(LocalState));
+
+/**
+ * Reads the metadata file that carries the wrapped Windows keys.
+ *
+ * Failures are reported rather than flattened into an empty document: a
+ * missing, unreadable or corrupt `Local State` is a different problem from a
+ * browser that has no key yet, and telling the user the latter sends them
+ * looking in the wrong place.
+ */
+const readLocalState = Effect.fn("ChromiumKeys.readLocalState")(function* (localStatePath: string) {
+  const fileSystem = yield* FileSystem.FileSystem;
+  return yield* fileSystem.readFileString(localStatePath).pipe(
+    Effect.flatMap(decodeLocalState),
+    Effect.mapError((cause) => new ChromiumKeyError({ reason: "readFailed", cause })),
+  );
+});
+
+/**
+ * Windows stores the key base64-encoded with a literal `DPAPI` marker in
+ * front, which has to come off before unwrapping.
+ */
+const DPAPI_MARKER = "DPAPI";
+
+export function stripDpapiMarker(encodedKey: string): Buffer {
+  const raw = Buffer.from(encodedKey, "base64");
+  return raw.subarray(0, DPAPI_MARKER.length).toString("latin1") === DPAPI_MARKER
+    ? raw.subarray(DPAPI_MARKER.length)
+    : raw;
+}
+
+export interface ChromiumKeyRequest {
+  readonly platform: NodeJS.Platform;
+  readonly keychainService: string | undefined;
+  readonly keychainAccount: string | undefined;
+  readonly localStatePath: string;
+}
+
+export const resolveChromiumKeys = Effect.fn("ChromiumKeys.resolveChromiumKeys")(function* (
+  request: ChromiumKeyRequest,
+): Effect.fn.Return<
+  ChromiumKeyMaterial,
+  ChromiumKeyError,
+  FileSystem.FileSystem | ChildProcessSpawner.ChildProcessSpawner
+> {
+  if (request.platform === "darwin") {
+    if (!request.keychainService || !request.keychainAccount) {
+      return yield* new ChromiumKeyError({ reason: "unsupportedPlatform" });
+    }
+    const secret = yield* readKeychainSecret(request.keychainService, request.keychainAccount);
+    return { cbcV10: derive(secret, MAC_KEY_ITERATIONS) };
+  }
+
+  if (request.platform === "linux") {
+    // The fallback passphrase always applies to `v10` records; a keyring
+    // secret, when one is reachable, additionally unlocks `v11`. Failing to
+    // reach the keyring is not fatal — it just leaves those records skipped.
+    const keyringSecret =
+      request.keychainService && request.keychainAccount
+        ? yield* readKeychainSecret(request.keychainService, request.keychainAccount).pipe(
+            // No Secret Service, locked keyring, or a differently-keyed entry.
+            Effect.orElseSucceed(() => undefined),
+          )
+        : undefined;
+    return {
+      cbcV10: derive(LINUX_FALLBACK_PASSPHRASE, LINUX_KEY_ITERATIONS),
+      ...(keyringSecret ? { cbcV11: derive(keyringSecret, LINUX_KEY_ITERATIONS) } : {}),
+    };
+  }
+
+  if (request.platform === "win32") {
+    const localState = yield* readLocalState(request.localStatePath);
+    const encodedKey = localState.os_crypt?.encrypted_key;
+    if (!encodedKey) {
+      // An app-bound key with no legacy key means every record is `v20`.
+      return yield* new ChromiumKeyError({
+        reason: localState.os_crypt?.app_bound_encrypted_key
+          ? "appBoundEncryption"
+          : "keychainItemMissing",
+      });

@@ -0,0 +1,145 @@
+// @effect-diagnostics nodeBuiltinImport:off - `node:crypto` implements the
+// OSCrypt key derivation Chromium uses; Effect has no equivalent.
+/**
+ * Chromium cookie-encryption keys, per platform.
+ *
+ * Chromium calls this OSCrypt, and it works differently on each OS:
+ *
+ * - **macOS** keeps one key in the login keychain. Reading it prompts the
+ *   user, which is the consent this feature is built around.
+ * - **Linux** may keep a key in libsecret/kwallet (`v11` records), or use a
+ *   hardcoded `peanuts` passphrase when no keyring is available (`v10`). Both
+ *   can appear in the same database, so both are derived up front and chosen
+ *   per record.
+ *
+ * Windows is not supported: since Chrome 127 its cookies are encrypted to the
+ * browser's own identity (App-Bound Encryption), unreadable by any other app.
+ *
+ * @module ChromiumKeys
+ */
+import * as Keyring from "@napi-rs/keyring";
+import * as NodeCrypto from "node:crypto";
+
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+
+const KEY_SALT = "saltysalt";
+const KEY_LENGTH = 16;
+/** macOS stretches the keychain secret; Linux uses a single iteration. */
+const MAC_KEY_ITERATIONS = 1003;
+const LINUX_KEY_ITERATIONS = 1;
+/** Chromium's documented fallback passphrase when no Linux keyring is present. */
+const LINUX_FALLBACK_PASSPHRASE = "peanuts";
+
+export const ChromiumKeyFailure = Schema.Literals([
+  "needsKeychainApproval",
+  "keychainItemMissing",
+  "unsupportedPlatform",
+  /** The key store itself could not be read, as opposed to holding no key. */
+  "readFailed",

@@ -232,7 +234,7 @@ export const readChromiumCookies = Effect.fn("ChromiumCookies.readChromiumCookie
 
   const cookies: ChromiumCookie[] = [];
   for (const row of rows) {
-    const value = decryptValue(row.encrypted_value, key, row.host_key);
+    const value = decryptChromiumValue(row.encrypted_value, keys, row.host_key);

@@ -0,0 +1,234 @@
+// @effect-diagnostics nodeBuiltinImport:off - `node:crypto` implements the
+// OSCrypt key derivation Chromium uses; Effect has no equivalent.
+/**
+ * Chromium cookie-encryption keys, per platform.
+ *
+ * Chromium calls this OSCrypt, and it works differently on each OS:
+ *
+ * - **macOS** keeps one key in the login keychain. Reading it prompts the
+ *   user, which is the consent this feature is built around.
+ * - **Linux** may keep a key in libsecret/kwallet (`v11` records), or use a
+ *   hardcoded `peanuts` passphrase when no keyring is available (`v10`).
+ *   Both can appear in the same database, so both are derived up front and
+ *   chosen per record.
+ * - **Windows** wraps an AES-256-GCM key in DPAPI inside `Local State`. Since
+ *   Chrome 127 it *also* keeps an app-bound key that only the browser binary
+ *   can unwrap, and cookies written under it carry a `v20` prefix. Those are
+ *   not readable by anything else, by design, and this module does not try.
+ *
+ * @module ChromiumKeys
+ */
+import * as Keyring from "@napi-rs/keyring";
+import * as NodeCrypto from "node:crypto";
+
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+
+const KEY_SALT = "saltysalt";
+const KEY_LENGTH = 16;
+/** macOS stretches the keychain secret; Linux uses a single iteration. */
+const MAC_KEY_ITERATIONS = 1003;
+const LINUX_KEY_ITERATIONS = 1;
+/** Chromium's documented fallback passphrase when no Linux keyring is present. */
+const LINUX_FALLBACK_PASSPHRASE = "peanuts";
+
+export const ChromiumKeyFailure = Schema.Literals([
+  "needsKeychainApproval",
+  "keychainItemMissing",
+  "appBoundEncryption",
+  "unsupportedPlatform",
+]);
+export type ChromiumKeyFailure = typeof ChromiumKeyFailure.Type;
+
+export class ChromiumKeyError extends Schema.TaggedErrorClass<ChromiumKeyError>()(
+  "ChromiumKeyError",
+  {
+    reason: ChromiumKeyFailure,
+    /** Kept for the log; never surfaced to the user. */
+    cause: Schema.optional(Schema.Defect()),
+  },
+) {
+  override get message(): string {
+    return `Could not obtain the Chromium cookie key: ${this.reason}.`;
+  }
+}
+
+/**
+ * Keys to try, indexed by the record prefix they decrypt. A database can hold
+ * records written under more than one scheme, so a missing entry means those
+ * records are skipped rather than the whole import failing.
+ */
+export interface ChromiumKeyMaterial {
+  /** AES-128-CBC on macOS and Linux. */
+  readonly cbcV10?: Buffer;
+  /** AES-128-CBC, Linux keyring-derived. */
+  readonly cbcV11?: Buffer;
+  /** AES-256-GCM on Windows. */
+  readonly gcmV10?: Buffer;
+}
+
+const derive = (passphrase: string, iterations: number) =>
+  NodeCrypto.pbkdf2Sync(passphrase, KEY_SALT, iterations, KEY_LENGTH, "sha1");
+
+/**
+ * Reads the OSCrypt key from the macOS login keychain.
+ *
+ * Uses the in-process Keychain API rather than shelling out to
+ * `/usr/bin/security`, because macOS attributes both the consent prompt and
+ * the resulting ACL entry to the binary that asks. Via the CLI the prompt says
+ * "security" and "Always Allow" grants trust to a tool every process on the
+ * machine can invoke; in-process it names this app and the grant belongs to
+ * it. (In an unsigned dev build the name is the dev binary, not the shipped
+ * app identity.)
+ *
+ * Deliberately untimed: macOS answers this with a modal, and a timeout racing
+ * the user means the prompt can be approved while nothing is left listening,
+ * which reads as "approving did nothing".
+ */
+const readKeychainSecret = Effect.fn("ChromiumKeys.readKeychainSecret")(function* (
+  service: string,
+  account: string,
+) {
+  const secret = yield* Effect.try({
+    try: () => new Keyring.Entry(service, account).getPassword(),
+    catch: (cause) => {
+      const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
+      // Distinguish the causes rather than reporting "approve the prompt" for
+      // a failure approving cannot fix.
+      const missing = /no (matching )?entry|not found/i.test(message);
+      return new ChromiumKeyError({
+        reason: missing ? "keychainItemMissing" : "needsKeychainApproval",
+        cause,
+      });
+    },
+  });
+  if (secret === null || secret === "") {
+    return yield* new ChromiumKeyError({ reason: "keychainItemMissing" });
+  }
+  return secret;
+});
+
+/**
+ * Unwraps the Windows DPAPI-protected key via PowerShell.
+ *
+ * Shelling out is fine here in a way it is not on macOS: DPAPI is transparent
+ * to any process running as the user, so there is no consent prompt to
+ * misattribute and no ACL entry to write against the wrong binary.
+ */
+const unprotectWithDpapi = Effect.fn("ChromiumKeys.unprotectWithDpapi")(function* (
+  protectedKey: Buffer,
+) {
+  const script = [
+    "Add-Type -AssemblyName System.Security;",
+    `$b=[Convert]::FromBase64String('${protectedKey.toString("base64")}');`,
+    "$u=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,",
+    "[System.Security.Cryptography.DataProtectionScope]::CurrentUser);",
+    "[Convert]::ToBase64String($u)",
+  ].join("");
+
+  const process = yield* ChildProcess.make("powershell.exe", [
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    script,
+  ]);
+  const stdout = yield* process.stdout.pipe(Stream.decodeText(), Stream.mkString);
+  return Buffer.from(stdout.trim(), "base64");
+});
+
+/** The slice of `Local State` that carries the wrapped keys. */
+const LocalState = Schema.Struct({
+  os_crypt: Schema.optional(
+    Schema.Struct({
+      encrypted_key: Schema.optional(Schema.String),
+      app_bound_encrypted_key: Schema.optional(Schema.String),
+    }),
+  ),
+});
+const decodeLocalState = Schema.decodeUnknownEffect(Schema.fromJsonString(LocalState));
+
+const readLocalState = Effect.fn("ChromiumKeys.readLocalState")(function* (localStatePath: string) {
+  const fileSystem = yield* FileSystem.FileSystem;
+  return yield* fileSystem.readFileString(localStatePath).pipe(
+    Effect.flatMap(decodeLocalState),
+    Effect.orElseSucceed(() => ({}) as typeof LocalState.Type),
+  );

@@ -0,0 +1,263 @@
+// @effect-diagnostics nodeBuiltinImport:off - `node:crypto` implements the
+// OSCrypt key derivation Chromium uses; Effect has no equivalent.
+/**
+ * Chromium cookie-encryption keys, per platform.
+ *
+ * Chromium calls this OSCrypt, and it works differently on each OS:
+ *
+ * - **macOS** keeps one key in the login keychain. Reading it prompts the
+ *   user, which is the consent this feature is built around.
+ * - **Linux** may keep a key in libsecret/kwallet (`v11` records), or use a
+ *   hardcoded `peanuts` passphrase when no keyring is available (`v10`).
+ *   Both can appear in the same database, so both are derived up front and
+ *   chosen per record.
+ * - **Windows** wraps an AES-256-GCM key in DPAPI inside `Local State`. Since
+ *   Chrome 127 it *also* keeps an app-bound key that only the browser binary
+ *   can unwrap, and cookies written under it carry a `v20` prefix. Those are
+ *   not readable by anything else, by design, and this module does not try.
+ *
+ * @module ChromiumKeys
+ */
+import * as Keyring from "@napi-rs/keyring";
+import * as NodeCrypto from "node:crypto";
+
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+
+const KEY_SALT = "saltysalt";
+const KEY_LENGTH = 16;
+/** macOS stretches the keychain secret; Linux uses a single iteration. */
+const MAC_KEY_ITERATIONS = 1003;
+const LINUX_KEY_ITERATIONS = 1;
+/** Chromium's documented fallback passphrase when no Linux keyring is present. */
+const LINUX_FALLBACK_PASSPHRASE = "peanuts";
+
+export const ChromiumKeyFailure = Schema.Literals([
+  "needsKeychainApproval",
+  "keychainItemMissing",
+  "appBoundEncryption",
+  "unsupportedPlatform",
+  /** The key store itself could not be read, as opposed to holding no key. */
+  "readFailed",
+]);
+export type ChromiumKeyFailure = typeof ChromiumKeyFailure.Type;
+
+export class ChromiumKeyError extends Schema.TaggedErrorClass<ChromiumKeyError>()(
+  "ChromiumKeyError",
+  {
+    reason: ChromiumKeyFailure,
+    /** Kept for the log; never surfaced to the user. */
+    cause: Schema.optional(Schema.Defect()),
+  },
+) {
+  override get message(): string {
+    return `Could not obtain the Chromium cookie key: ${this.reason}.`;
+  }
+}
+
+/**
+ * Keys to try, indexed by the record prefix they decrypt. A database can hold
+ * records written under more than one scheme, so a missing entry means those
+ * records are skipped rather than the whole import failing.
+ */
+export interface ChromiumKeyMaterial {
+  /** AES-128-CBC on macOS and Linux. */
+  readonly cbcV10?: Buffer;
+  /** AES-128-CBC, Linux keyring-derived. */
+  readonly cbcV11?: Buffer;
+  /** AES-256-GCM on Windows. */
+  readonly gcmV10?: Buffer;
+}
+
+const derive = (passphrase: string, iterations: number) =>
+  NodeCrypto.pbkdf2Sync(passphrase, KEY_SALT, iterations, KEY_LENGTH, "sha1");
+
+/**
+ * Reads the OSCrypt key from the macOS login keychain.
+ *
+ * Uses the in-process Keychain API rather than shelling out to
+ * `/usr/bin/security`, because macOS attributes both the consent prompt and
+ * the resulting ACL entry to the binary that asks. Via the CLI the prompt says
+ * "security" and "Always Allow" grants trust to a tool every process on the
+ * machine can invoke; in-process it names this app and the grant belongs to
+ * it. (In an unsigned dev build the name is the dev binary, not the shipped
+ * app identity.)
+ *
+ * Deliberately untimed: macOS answers this with a modal, and a timeout racing
+ * the user means the prompt can be approved while nothing is left listening,
+ * which reads as "approving did nothing".
+ */
+const readKeychainSecret = Effect.fn("ChromiumKeys.readKeychainSecret")(function* (
+  service: string,
+  account: string,
+) {
+  const secret = yield* Effect.try({
+    try: () => new Keyring.Entry(service, account).getPassword(),
+    catch: (cause) => {
+      const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
+      // Distinguish the causes rather than reporting "approve the prompt" for
+      // a failure approving cannot fix.
+      const missing = /no (matching )?entry|not found/i.test(message);
+      return new ChromiumKeyError({
+        reason: missing ? "keychainItemMissing" : "needsKeychainApproval",
+        cause,
+      });
+    },
+  });
+  if (secret === null || secret === "") {
+    return yield* new ChromiumKeyError({ reason: "keychainItemMissing" });
+  }
+  return secret;
+});
+
+/**
+ * Unwraps the Windows DPAPI-protected key via PowerShell.
+ *
+ * Shelling out is fine here in a way it is not on macOS: DPAPI is transparent
+ * to any process running as the user, so there is no consent prompt to
+ * misattribute and no ACL entry to write against the wrong binary.
+ */
+const unprotectWithDpapi = Effect.fn("ChromiumKeys.unprotectWithDpapi")(function* (
+  protectedKey: Buffer,
+) {
+  const script = [
+    "Add-Type -AssemblyName System.Security;",
+    `$b=[Convert]::FromBase64String('${protectedKey.toString("base64")}');`,
+    "$u=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,",
+    "[System.Security.Cryptography.DataProtectionScope]::CurrentUser);",
+    "[Convert]::ToBase64String($u)",
+  ].join("");
+
+  const process = yield* ChildProcess.make("powershell.exe", [
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    script,
+  ]);
+  const stdout = yield* process.stdout.pipe(Stream.decodeText(), Stream.mkString);
+  const exitCode = yield* process.exitCode;
+
+  // A failed `Unprotect` still exits, printing nothing. Without these checks
+  // the empty stdout decodes to a zero-length Buffer, which is truthy, so
+  // `gcmV10` would be populated with an unusable key: every record then fails
+  // to decrypt and the import reports success having written nothing.
+  if (exitCode !== 0) {
+    return yield* new ChromiumKeyError({
+      reason: "keychainItemMissing",
+      cause: new Error(`powershell.exe exited with ${exitCode}`),
+    });
+  }
+  const unwrapped = Buffer.from(stdout.trim(), "base64");
+  if (unwrapped.length === 0) {
+    return yield* new ChromiumKeyError({
+      reason: "keychainItemMissing",
+      cause: new Error("powershell.exe returned no key material"),
+    });

@@ -232,7 +234,7 @@ export const readChromiumCookies = Effect.fn("ChromiumCookies.readChromiumCookie
 
   const cookies: ChromiumCookie[] = [];
   for (const row of rows) {
-    const value = decryptValue(row.encrypted_value, key, row.host_key);
+    const value = decryptChromiumValue(row.encrypted_value, keys, row.host_key);
     if (value === null) continue;

@@ -0,0 +1,234 @@
+// @effect-diagnostics nodeBuiltinImport:off - `node:crypto` implements the
+// OSCrypt key derivation Chromium uses; Effect has no equivalent.
+/**
+ * Chromium cookie-encryption keys, per platform.
+ *
+ * Chromium calls this OSCrypt, and it works differently on each OS:
+ *
+ * - **macOS** keeps one key in the login keychain. Reading it prompts the
+ *   user, which is the consent this feature is built around.
+ * - **Linux** may keep a key in libsecret/kwallet (`v11` records), or use a
+ *   hardcoded `peanuts` passphrase when no keyring is available (`v10`).
+ *   Both can appear in the same database, so both are derived up front and
+ *   chosen per record.
+ * - **Windows** wraps an AES-256-GCM key in DPAPI inside `Local State`. Since
+ *   Chrome 127 it *also* keeps an app-bound key that only the browser binary
+ *   can unwrap, and cookies written under it carry a `v20` prefix. Those are
+ *   not readable by anything else, by design, and this module does not try.
+ *
+ * @module ChromiumKeys
+ */
+import * as Keyring from "@napi-rs/keyring";
+import * as NodeCrypto from "node:crypto";
+
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+
+const KEY_SALT = "saltysalt";
+const KEY_LENGTH = 16;
+/** macOS stretches the keychain secret; Linux uses a single iteration. */
+const MAC_KEY_ITERATIONS = 1003;
+const LINUX_KEY_ITERATIONS = 1;
+/** Chromium's documented fallback passphrase when no Linux keyring is present. */
+const LINUX_FALLBACK_PASSPHRASE = "peanuts";
+
+export const ChromiumKeyFailure = Schema.Literals([
+  "needsKeychainApproval",
+  "keychainItemMissing",
+  "appBoundEncryption",
+  "unsupportedPlatform",
+]);
+export type ChromiumKeyFailure = typeof ChromiumKeyFailure.Type;
+
+export class ChromiumKeyError extends Schema.TaggedErrorClass<ChromiumKeyError>()(
+  "ChromiumKeyError",
+  {
+    reason: ChromiumKeyFailure,
+    /** Kept for the log; never surfaced to the user. */
+    cause: Schema.optional(Schema.Defect()),
+  },
+) {
+  override get message(): string {
+    return `Could not obtain the Chromium cookie key: ${this.reason}.`;
+  }
+}
+
+/**
+ * Keys to try, indexed by the record prefix they decrypt. A database can hold
+ * records written under more than one scheme, so a missing entry means those
+ * records are skipped rather than the whole import failing.
+ */
+export interface ChromiumKeyMaterial {
+  /** AES-128-CBC on macOS and Linux. */
+  readonly cbcV10?: Buffer;
+  /** AES-128-CBC, Linux keyring-derived. */
+  readonly cbcV11?: Buffer;
+  /** AES-256-GCM on Windows. */
+  readonly gcmV10?: Buffer;
+}
+
+const derive = (passphrase: string, iterations: number) =>
+  NodeCrypto.pbkdf2Sync(passphrase, KEY_SALT, iterations, KEY_LENGTH, "sha1");
+
+/**
+ * Reads the OSCrypt key from the macOS login keychain.
+ *
+ * Uses the in-process Keychain API rather than shelling out to
+ * `/usr/bin/security`, because macOS attributes both the consent prompt and
+ * the resulting ACL entry to the binary that asks. Via the CLI the prompt says
+ * "security" and "Always Allow" grants trust to a tool every process on the
+ * machine can invoke; in-process it names this app and the grant belongs to
+ * it. (In an unsigned dev build the name is the dev binary, not the shipped
+ * app identity.)
+ *
+ * Deliberately untimed: macOS answers this with a modal, and a timeout racing
+ * the user means the prompt can be approved while nothing is left listening,
+ * which reads as "approving did nothing".
+ */
+const readKeychainSecret = Effect.fn("ChromiumKeys.readKeychainSecret")(function* (
+  service: string,
+  account: string,
+) {
+  const secret = yield* Effect.try({
+    try: () => new Keyring.Entry(service, account).getPassword(),
+    catch: (cause) => {
+      const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
+      // Distinguish the causes rather than reporting "approve the prompt" for
+      // a failure approving cannot fix.
+      const missing = /no (matching )?entry|not found/i.test(message);
+      return new ChromiumKeyError({
+        reason: missing ? "keychainItemMissing" : "needsKeychainApproval",
+        cause,
+      });
+    },
+  });
+  if (secret === null || secret === "") {
+    return yield* new ChromiumKeyError({ reason: "keychainItemMissing" });
+  }
+  return secret;
+});
+
+/**
+ * Unwraps the Windows DPAPI-protected key via PowerShell.
+ *
+ * Shelling out is fine here in a way it is not on macOS: DPAPI is transparent
+ * to any process running as the user, so there is no consent prompt to
+ * misattribute and no ACL entry to write against the wrong binary.
+ */
+const unprotectWithDpapi = Effect.fn("ChromiumKeys.unprotectWithDpapi")(function* (
+  protectedKey: Buffer,
+) {
+  const script = [
+    "Add-Type -AssemblyName System.Security;",
+    `$b=[Convert]::FromBase64String('${protectedKey.toString("base64")}');`,
+    "$u=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,",
+    "[System.Security.Cryptography.DataProtectionScope]::CurrentUser);",
+    "[Convert]::ToBase64String($u)",
+  ].join("");
+
+  const process = yield* ChildProcess.make("powershell.exe", [
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    script,
+  ]);
+  const stdout = yield* process.stdout.pipe(Stream.decodeText(), Stream.mkString);
+  return Buffer.from(stdout.trim(), "base64");
+});
+
+/** The slice of `Local State` that carries the wrapped keys. */
+const LocalState = Schema.Struct({
+  os_crypt: Schema.optional(
+    Schema.Struct({
+      encrypted_key: Schema.optional(Schema.String),
+      app_bound_encrypted_key: Schema.optional(Schema.String),
+    }),
+  ),
+});
+const decodeLocalState = Schema.decodeUnknownEffect(Schema.fromJsonString(LocalState));
+
+const readLocalState = Effect.fn("ChromiumKeys.readLocalState")(function* (localStatePath: string) {
+  const fileSystem = yield* FileSystem.FileSystem;
+  return yield* fileSystem.readFileString(localStatePath).pipe(
+    Effect.flatMap(decodeLocalState),
+    Effect.orElseSucceed(() => ({}) as typeof LocalState.Type),
+  );
+});
+
+/**
+ * Windows stores the key base64-encoded with a literal `DPAPI` marker in
+ * front, which has to come off before unwrapping.
+ */
+const DPAPI_MARKER = "DPAPI";
+
+export function stripDpapiMarker(encodedKey: string): Buffer {
+  const raw = Buffer.from(encodedKey, "base64");
+  return raw.subarray(0, DPAPI_MARKER.length).toString("latin1") === DPAPI_MARKER
+    ? raw.subarray(DPAPI_MARKER.length)
+    : raw;
+}
+
+export interface ChromiumKeyRequest {
+  readonly platform: NodeJS.Platform;
+  readonly keychainService: string | undefined;
+  readonly keychainAccount: string | undefined;
+  readonly localStatePath: string;
+}
+
+export const resolveChromiumKeys = Effect.fn("ChromiumKeys.resolveChromiumKeys")(function* (
+  request: ChromiumKeyRequest,
+): Effect.fn.Return<
+  ChromiumKeyMaterial,
+  ChromiumKeyError,
+  FileSystem.FileSystem | ChildProcessSpawner.ChildProcessSpawner
+> {
+  if (request.platform === "darwin") {
+    if (!request.keychainService || !request.keychainAccount) {
+      return yield* new ChromiumKeyError({ reason: "unsupportedPlatform" });
+    }
+    const secret = yield* readKeychainSecret(request.keychainService, request.keychainAccount);
+    return { cbcV10: derive(secret, MAC_KEY_ITERATIONS) };
+  }
+
+  if (request.platform === "linux") {
+    // The fallback passphrase always applies to `v10` records; a keyring
+    // secret, when one is reachable, additionally unlocks `v11`. Failing to
+    // reach the keyring is not fatal — it just leaves those records skipped.
+    const keyringSecret =
+      request.keychainService && request.keychainAccount
+        ? yield* readKeychainSecret(request.keychainService, request.keychainAccount).pipe(
+            // No Secret Service, locked keyring, or a differently-keyed entry.
+            Effect.orElseSucceed(() => undefined),
+          )

@@ -0,0 +1,263 @@
+// @effect-diagnostics nodeBuiltinImport:off - `node:crypto` implements the
+// OSCrypt key derivation Chromium uses; Effect has no equivalent.
+/**
+ * Chromium cookie-encryption keys, per platform.
+ *
+ * Chromium calls this OSCrypt, and it works differently on each OS:
+ *
+ * - **macOS** keeps one key in the login keychain. Reading it prompts the
+ *   user, which is the consent this feature is built around.
+ * - **Linux** may keep a key in libsecret/kwallet (`v11` records), or use a
+ *   hardcoded `peanuts` passphrase when no keyring is available (`v10`).
+ *   Both can appear in the same database, so both are derived up front and
+ *   chosen per record.
+ * - **Windows** wraps an AES-256-GCM key in DPAPI inside `Local State`. Since
+ *   Chrome 127 it *also* keeps an app-bound key that only the browser binary
+ *   can unwrap, and cookies written under it carry a `v20` prefix. Those are
+ *   not readable by anything else, by design, and this module does not try.
+ *
+ * @module ChromiumKeys
+ */
+import * as Keyring from "@napi-rs/keyring";
+import * as NodeCrypto from "node:crypto";
+
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+
+const KEY_SALT = "saltysalt";
+const KEY_LENGTH = 16;
+/** macOS stretches the keychain secret; Linux uses a single iteration. */
+const MAC_KEY_ITERATIONS = 1003;
+const LINUX_KEY_ITERATIONS = 1;
+/** Chromium's documented fallback passphrase when no Linux keyring is present. */
+const LINUX_FALLBACK_PASSPHRASE = "peanuts";
+
+export const ChromiumKeyFailure = Schema.Literals([
+  "needsKeychainApproval",
+  "keychainItemMissing",
+  "appBoundEncryption",
+  "unsupportedPlatform",
+  /** The key store itself could not be read, as opposed to holding no key. */
+  "readFailed",
+]);
+export type ChromiumKeyFailure = typeof ChromiumKeyFailure.Type;
+
+export class ChromiumKeyError extends Schema.TaggedErrorClass<ChromiumKeyError>()(
+  "ChromiumKeyError",
+  {
+    reason: ChromiumKeyFailure,
+    /** Kept for the log; never surfaced to the user. */
+    cause: Schema.optional(Schema.Defect()),
+  },
+) {
+  override get message(): string {
+    return `Could not obtain the Chromium cookie key: ${this.reason}.`;
+  }
+}
+
+/**
+ * Keys to try, indexed by the record prefix they decrypt. A database can hold
+ * records written under more than one scheme, so a missing entry means those
+ * records are skipped rather than the whole import failing.
+ */
+export interface ChromiumKeyMaterial {
+  /** AES-128-CBC on macOS and Linux. */
+  readonly cbcV10?: Buffer;
+  /** AES-128-CBC, Linux keyring-derived. */
+  readonly cbcV11?: Buffer;
+  /** AES-256-GCM on Windows. */
+  readonly gcmV10?: Buffer;
+}
+
+const derive = (passphrase: string, iterations: number) =>
+  NodeCrypto.pbkdf2Sync(passphrase, KEY_SALT, iterations, KEY_LENGTH, "sha1");
+
+/**
+ * Reads the OSCrypt key from the macOS login keychain.
+ *
+ * Uses the in-process Keychain API rather than shelling out to
+ * `/usr/bin/security`, because macOS attributes both the consent prompt and
+ * the resulting ACL entry to the binary that asks. Via the CLI the prompt says
+ * "security" and "Always Allow" grants trust to a tool every process on the
+ * machine can invoke; in-process it names this app and the grant belongs to
+ * it. (In an unsigned dev build the name is the dev binary, not the shipped
+ * app identity.)
+ *
+ * Deliberately untimed: macOS answers this with a modal, and a timeout racing
+ * the user means the prompt can be approved while nothing is left listening,
+ * which reads as "approving did nothing".
+ */
+const readKeychainSecret = Effect.fn("ChromiumKeys.readKeychainSecret")(function* (
+  service: string,
+  account: string,
+) {
+  const secret = yield* Effect.try({
+    try: () => new Keyring.Entry(service, account).getPassword(),
+    catch: (cause) => {
+      const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
+      // Distinguish the causes rather than reporting "approve the prompt" for
+      // a failure approving cannot fix.
+      const missing = /no (matching )?entry|not found/i.test(message);
+      return new ChromiumKeyError({
+        reason: missing ? "keychainItemMissing" : "needsKeychainApproval",
+        cause,
+      });
+    },
+  });
+  if (secret === null || secret === "") {
+    return yield* new ChromiumKeyError({ reason: "keychainItemMissing" });
+  }
+  return secret;
+});
+
+/**
+ * Unwraps the Windows DPAPI-protected key via PowerShell.
+ *
+ * Shelling out is fine here in a way it is not on macOS: DPAPI is transparent
+ * to any process running as the user, so there is no consent prompt to
+ * misattribute and no ACL entry to write against the wrong binary.
+ */
+const unprotectWithDpapi = Effect.fn("ChromiumKeys.unprotectWithDpapi")(function* (
+  protectedKey: Buffer,
+) {
+  const script = [
+    "Add-Type -AssemblyName System.Security;",
+    `$b=[Convert]::FromBase64String('${protectedKey.toString("base64")}');`,
+    "$u=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,",
+    "[System.Security.Cryptography.DataProtectionScope]::CurrentUser);",
+    "[Convert]::ToBase64String($u)",
+  ].join("");
+
+  const process = yield* ChildProcess.make("powershell.exe", [
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    script,
+  ]);
+  const stdout = yield* process.stdout.pipe(Stream.decodeText(), Stream.mkString);
+  const exitCode = yield* process.exitCode;
+
+  // A failed `Unprotect` still exits, printing nothing. Without these checks
+  // the empty stdout decodes to a zero-length Buffer, which is truthy, so
+  // `gcmV10` would be populated with an unusable key: every record then fails
+  // to decrypt and the import reports success having written nothing.
+  if (exitCode !== 0) {
+    return yield* new ChromiumKeyError({
+      reason: "keychainItemMissing",
+      cause: new Error(`powershell.exe exited with ${exitCode}`),
+    });
+  }
+  const unwrapped = Buffer.from(stdout.trim(), "base64");
+  if (unwrapped.length === 0) {
+    return yield* new ChromiumKeyError({
+      reason: "keychainItemMissing",
+      cause: new Error("powershell.exe returned no key material"),
+    });
+  }
+  return unwrapped;
+});
+
+/** The slice of `Local State` that carries the wrapped keys. */
+const LocalState = Schema.Struct({
+  os_crypt: Schema.optional(
+    Schema.Struct({
+      encrypted_key: Schema.optional(Schema.String),
+      app_bound_encrypted_key: Schema.optional(Schema.String),
+    }),
+  ),
+});
+const decodeLocalState = Schema.decodeUnknownEffect(Schema.fromJsonString(LocalState));
+
+/**
+ * Reads the metadata file that carries the wrapped Windows keys.
+ *
+ * Failures are reported rather than flattened into an empty document: a
+ * missing, unreadable or corrupt `Local State` is a different problem from a
+ * browser that has no key yet, and telling the user the latter sends them
+ * looking in the wrong place.
+ */
+const readLocalState = Effect.fn("ChromiumKeys.readLocalState")(function* (localStatePath: string) {
+  const fileSystem = yield* FileSystem.FileSystem;
+  return yield* fileSystem.readFileString(localStatePath).pipe(
+    Effect.flatMap(decodeLocalState),
+    Effect.mapError((cause) => new ChromiumKeyError({ reason: "readFailed", cause })),

@@ -2196,6 +2212,31 @@ export const stageResourceMonitor = Effect.fn("stageResourceMonitor")(function*
   }
 });
 
+export const stageBrowserSecret = Effect.fn("stageBrowserSecret")(function* (input: {
+  readonly repoRoot: string;
+  readonly stageResourcesDir: string;
+  readonly platform: typeof BuildPlatform.Type;
+  readonly arch: typeof BuildArch.Type;
+  readonly verbose: boolean;
+}) {
+  if (input.platform !== "linux") return;
+  const path = yield* Path.Path;
+  yield* runCommand(
+    ChildProcess.make(
+      "node",
+      [
+        path.join(input.repoRoot, "apps/desktop/scripts/build-browser-secret.mjs"),
+        "--arch",
+        input.arch,

@@ -0,0 +1,234 @@
+// @effect-diagnostics nodeBuiltinImport:off - `node:crypto` implements the
+// OSCrypt key derivation Chromium uses; Effect has no equivalent.
+/**
+ * Chromium cookie-encryption keys, per platform.
+ *
+ * Chromium calls this OSCrypt, and it works differently on each OS:
+ *
+ * - **macOS** keeps one key in the login keychain. Reading it prompts the
+ *   user, which is the consent this feature is built around.
+ * - **Linux** may keep a key in libsecret/kwallet (`v11` records), or use a
+ *   hardcoded `peanuts` passphrase when no keyring is available (`v10`).
+ *   Both can appear in the same database, so both are derived up front and
+ *   chosen per record.
+ * - **Windows** wraps an AES-256-GCM key in DPAPI inside `Local State`. Since
+ *   Chrome 127 it *also* keeps an app-bound key that only the browser binary
+ *   can unwrap, and cookies written under it carry a `v20` prefix. Those are
+ *   not readable by anything else, by design, and this module does not try.
+ *
+ * @module ChromiumKeys
+ */
+import * as Keyring from "@napi-rs/keyring";
+import * as NodeCrypto from "node:crypto";
+
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+
+const KEY_SALT = "saltysalt";
+const KEY_LENGTH = 16;
+/** macOS stretches the keychain secret; Linux uses a single iteration. */
+const MAC_KEY_ITERATIONS = 1003;
+const LINUX_KEY_ITERATIONS = 1;
+/** Chromium's documented fallback passphrase when no Linux keyring is present. */
+const LINUX_FALLBACK_PASSPHRASE = "peanuts";
+
+export const ChromiumKeyFailure = Schema.Literals([
+  "needsKeychainApproval",
+  "keychainItemMissing",
+  "appBoundEncryption",
+  "unsupportedPlatform",
+]);
+export type ChromiumKeyFailure = typeof ChromiumKeyFailure.Type;
+
+export class ChromiumKeyError extends Schema.TaggedErrorClass<ChromiumKeyError>()(
+  "ChromiumKeyError",
+  {
+    reason: ChromiumKeyFailure,
+    /** Kept for the log; never surfaced to the user. */
+    cause: Schema.optional(Schema.Defect()),
+  },
+) {
+  override get message(): string {
+    return `Could not obtain the Chromium cookie key: ${this.reason}.`;
+  }
+}
+
+/**
+ * Keys to try, indexed by the record prefix they decrypt. A database can hold
+ * records written under more than one scheme, so a missing entry means those
+ * records are skipped rather than the whole import failing.
+ */
+export interface ChromiumKeyMaterial {
+  /** AES-128-CBC on macOS and Linux. */
+  readonly cbcV10?: Buffer;
+  /** AES-128-CBC, Linux keyring-derived. */
+  readonly cbcV11?: Buffer;
+  /** AES-256-GCM on Windows. */
+  readonly gcmV10?: Buffer;
+}
+
+const derive = (passphrase: string, iterations: number) =>
+  NodeCrypto.pbkdf2Sync(passphrase, KEY_SALT, iterations, KEY_LENGTH, "sha1");
+
+/**
+ * Reads the OSCrypt key from the macOS login keychain.
+ *
+ * Uses the in-process Keychain API rather than shelling out to
+ * `/usr/bin/security`, because macOS attributes both the consent prompt and
+ * the resulting ACL entry to the binary that asks. Via the CLI the prompt says
+ * "security" and "Always Allow" grants trust to a tool every process on the
+ * machine can invoke; in-process it names this app and the grant belongs to
+ * it. (In an unsigned dev build the name is the dev binary, not the shipped
+ * app identity.)
+ *
+ * Deliberately untimed: macOS answers this with a modal, and a timeout racing
+ * the user means the prompt can be approved while nothing is left listening,
+ * which reads as "approving did nothing".
+ */
+const readKeychainSecret = Effect.fn("ChromiumKeys.readKeychainSecret")(function* (
+  service: string,
+  account: string,
+) {
+  const secret = yield* Effect.try({
+    try: () => new Keyring.Entry(service, account).getPassword(),
+    catch: (cause) => {
+      const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
+      // Distinguish the causes rather than reporting "approve the prompt" for
+      // a failure approving cannot fix.
+      const missing = /no (matching )?entry|not found/i.test(message);
+      return new ChromiumKeyError({
+        reason: missing ? "keychainItemMissing" : "needsKeychainApproval",
+        cause,
+      });
+    },
+  });
+  if (secret === null || secret === "") {
+    return yield* new ChromiumKeyError({ reason: "keychainItemMissing" });
+  }
+  return secret;
+});
+
+/**
+ * Unwraps the Windows DPAPI-protected key via PowerShell.
+ *
+ * Shelling out is fine here in a way it is not on macOS: DPAPI is transparent
+ * to any process running as the user, so there is no consent prompt to
+ * misattribute and no ACL entry to write against the wrong binary.
+ */
+const unprotectWithDpapi = Effect.fn("ChromiumKeys.unprotectWithDpapi")(function* (
+  protectedKey: Buffer,
+) {
+  const script = [
+    "Add-Type -AssemblyName System.Security;",
+    `$b=[Convert]::FromBase64String('${protectedKey.toString("base64")}');`,
+    "$u=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,",
+    "[System.Security.Cryptography.DataProtectionScope]::CurrentUser);",
+    "[Convert]::ToBase64String($u)",
+  ].join("");
+
+  const process = yield* ChildProcess.make("powershell.exe", [
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    script,
+  ]);
+  const stdout = yield* process.stdout.pipe(Stream.decodeText(), Stream.mkString);
+  return Buffer.from(stdout.trim(), "base64");
+});
+
+/** The slice of `Local State` that carries the wrapped keys. */
+const LocalState = Schema.Struct({
+  os_crypt: Schema.optional(
+    Schema.Struct({
+      encrypted_key: Schema.optional(Schema.String),
+      app_bound_encrypted_key: Schema.optional(Schema.String),
+    }),
+  ),
+});
+const decodeLocalState = Schema.decodeUnknownEffect(Schema.fromJsonString(LocalState));
+
+const readLocalState = Effect.fn("ChromiumKeys.readLocalState")(function* (localStatePath: string) {
+  const fileSystem = yield* FileSystem.FileSystem;
+  return yield* fileSystem.readFileString(localStatePath).pipe(
+    Effect.flatMap(decodeLocalState),
+    Effect.orElseSucceed(() => ({}) as typeof LocalState.Type),
+  );

@@ -152,7 +153,7 @@ const desktopServerExposureLayer = DesktopServerExposure.layer.pipe(
 const desktopPreviewLayer = PreviewManager.layer.pipe(
   // Merged rather than provided so the IPC handlers can reach the import
   // service alongside the manager; both sit on the same BrowserSession.
-  Layer.provideMerge(BrowserImport.layer),
+  Layer.provideMerge(BrowserImport.layer.pipe(Layer.provide(LinuxBrowserSecret.layer))),

@@ -0,0 +1,222 @@
+// @effect-diagnostics nodeBuiltinImport:off - `node:crypto` implements the
+// OSCrypt key derivation Chromium uses; Effect has no equivalent.
+/**
+ * Chromium cookie-encryption keys, per platform.
+ *
+ * Chromium calls this OSCrypt, and it works differently on each OS:
+ *
+ * - **macOS** keeps one key in the login keychain. Reading it prompts the
+ *   user, which is the consent this feature is built around.
+ * - **Linux** may keep a key in libsecret/kwallet (`v11` records), or use a
+ *   hardcoded `peanuts` passphrase when no keyring is available (`v10`). Both
+ *   can appear in the same database, so both are derived up front and chosen
+ *   per record.
+ *
+ * Windows is not supported: since Chrome 127 its cookies are encrypted to the
+ * browser's own identity (App-Bound Encryption), unreadable by any other app.
+ *
+ * @module ChromiumKeys
+ */
+import * as Keyring from "@napi-rs/keyring";
+import * as NodeCrypto from "node:crypto";
+
+import { HostProcessEnvironment } from "@t3tools/shared/hostProcess";
+
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
+
+const KEY_SALT = "saltysalt";
+const KEY_LENGTH = 16;
+/** macOS stretches the keychain secret; Linux uses a single iteration. */
+const MAC_KEY_ITERATIONS = 1003;
+const LINUX_KEY_ITERATIONS = 1;
+/** Chromium's documented fallback passphrase when no Linux keyring is present. */
+const LINUX_FALLBACK_PASSPHRASE = "peanuts";
+
+export const ChromiumKeyFailure = Schema.Literals([
+  "needsKeychainApproval",
+  "keychainItemMissing",
+  "unsupportedPlatform",
+  /** The key store itself could not be read, as opposed to holding no key. */
+  "readFailed",
+]);
+export type ChromiumKeyFailure = typeof ChromiumKeyFailure.Type;
+
+export class ChromiumKeyError extends Schema.TaggedErrorClass<ChromiumKeyError>()(
+  "ChromiumKeyError",
+  {
+    reason: ChromiumKeyFailure,
+    /** Kept for the log; never surfaced to the user. */
+    cause: Schema.optional(Schema.Defect()),
+  },
+) {
+  override get message(): string {
+    return `Could not obtain the Chromium cookie key: ${this.reason}.`;
+  }
+}
+
+/**
+ * Keys to try, indexed by the record prefix they decrypt. A database can hold
+ * records written under more than one scheme, so a missing entry means those
+ * records are skipped rather than the whole import failing.
+ */
+export interface ChromiumKeyMaterial {
+  /** AES-128-CBC on macOS, and the keyring-free Linux fallback. */
+  readonly cbcV10?: Buffer;
+  /** AES-128-CBC, Linux keyring-derived. */
+  readonly cbcV11?: Buffer;
+  /**
+   * AES-128-CBC from an empty passphrase. Some Linux clients wrote records
+   * with it (crbug.com/1195256), so Chromium — and this import — retry with it
+   * after a record's own key fails.
+   */
+  readonly cbcEmpty?: Buffer;
+}
+
+const derive = (passphrase: string, iterations: number) =>
+  NodeCrypto.pbkdf2Sync(passphrase, KEY_SALT, iterations, KEY_LENGTH, "sha1");
+
+/**
+ * Reads the macOS OSCrypt secret from the login keychain.
+ *
+ * Uses the in-process Keychain API rather than shelling out to
+ * `/usr/bin/security`, because macOS attributes both the consent prompt and the
+ * resulting ACL entry to the binary that asks. Via the CLI the prompt says
+ * "security" and "Always Allow" grants trust to a tool every process on the
+ * machine can invoke; in-process it names this app and the grant belongs to it.
+ * (In an unsigned dev build the name is the dev binary, not the shipped app
+ * identity.)
+ *
+ * Deliberately untimed: macOS answers this with a modal, and a timeout racing
+ * the user means the prompt can be approved while nothing is left listening,
+ * which reads as "approving did nothing".
+ */
+const readKeychainSecret = Effect.fn("ChromiumKeys.readKeychainSecret")(function* (
+  service: string,
+  account: string,
+) {
+  const secret = yield* Effect.try({
+    try: () => new Keyring.Entry(service, account).getPassword(),
+    catch: (cause) => {
+      const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
+      // Distinguish the causes rather than reporting "approve the prompt" for
+      // a failure approving cannot fix.
+      const missing = /no (matching )?entry|not found/i.test(message);
+      return new ChromiumKeyError({
+        reason: missing ? "keychainItemMissing" : "needsKeychainApproval",
+        cause,
+      });
+    },
+  });
+  if (secret === null || secret === "") {
+    return yield* new ChromiumKeyError({ reason: "keychainItemMissing" });
+  }
+  return secret;
+});
+
+const secretToolFailure = (stderr: string): ChromiumKeyFailure => {
+  if (stderr.trim() === "" || /no such secret|not found/i.test(stderr)) {
+    return "keychainItemMissing";
+  }
+  if (/denied|locked|cancel|dismiss|permission/i.test(stderr)) {
+    return "needsKeychainApproval";
+  }
+  return "readFailed";
+};
+
+/**
+ * Chromium's Linux backend uses a custom libsecret schema keyed by its
+ * `application` attribute. `secret-tool lookup` performs that same attribute
+ * search through Secret Service and keeps its normal unlock/consent prompt.
+ */
+export const readLinuxSecret = Effect.fn("ChromiumKeys.readLinuxSecret")(function* (
+  application: string,
+) {
+  return yield* Effect.scoped(
+    Effect.gen(function* () {
+      const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+      const environment = yield* HostProcessEnvironment;
+      const handle = yield* spawner
+        .spawn(
+          ChildProcess.make("secret-tool", ["lookup", "application", application], {

@@ -71,86 +70,91 @@ const toUnixSeconds = (webkitSeconds: number): number | undefined => {
 };
 
 /**
- * Reads the OSCrypt key from the login keychain.
- *
- * Uses the in-process Keychain API rather than shelling out to
- * `/usr/bin/security`, because the keychain attributes both the consent prompt
- * and the resulting ACL entry to the binary that asks. Via the CLI the prompt
- * says "security" and "Always Allow" grants trust to a tool every process on
- * the machine can invoke; in-process it names this app and the grant belongs
- * to it. (In an unsigned dev build the name is the dev Electron binary rather
- * than the shipped app identity.)
- *
- * Deliberately untimed: macOS answers this with a modal, and a timeout racing
- * the user means the prompt can be approved while nothing is left listening —
- * which reads as "approving did nothing".
+ * Chromium >= 127 prefixes the plaintext with SHA-256 of the host key, binding
+ * a cookie to its domain. Strip it when present.
  */
-async function readMacKeychainPassword(service: string, account: string): Promise<string> {
-  let password: string | null;
+const stripDomainBinding = (plaintext: Buffer, domain: string): Buffer => {
+  const domainHash = NodeCrypto.createHash("sha256").update(domain).digest();
+  return plaintext.length >= 32 && plaintext.subarray(0, 32).equals(domainHash)
+    ? plaintext.subarray(32)
+    : plaintext;
+};
+
+const decryptCbc = (payload: Buffer, key: Buffer, domain: string): string | null => {
   try {
-    password = new Keyring.Entry(service, account).getPassword();
-  } catch (cause) {
-    const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
-    // Distinguish the causes rather than reporting "approve the prompt" for a
-    // failure approving cannot fix.
-    if (/no (matching )?entry|not found/i.test(message)) {
-      throw new ChromiumCookieReadError({ reason: "keychainItemMissing" });
-    }
-    throw new ChromiumCookieReadError({ reason: "needsKeychainApproval" });
-  }
-  if (password === null || password === "") {
-    throw new ChromiumCookieReadError({ reason: "keychainItemMissing" });
+    const decipher = NodeCrypto.createDecipheriv("aes-128-cbc", key, AES_CBC_IV);
+    decipher.setAutoPadding(true);
+    const plaintext = Buffer.concat([decipher.update(payload), decipher.final()]);
+    return stripDomainBinding(plaintext, domain).toString("utf8");
+  } catch {
+    return null;
   }
-  return password;
-}
-
-const decryptValue = (encrypted: Uint8Array, key: Buffer, domain: string): string | null => {
-  const buffer = Buffer.from(encrypted);
-  if (buffer.length === 0) return "";
-  if (buffer.subarray(0, 3).toString("latin1") !== V10_PREFIX) return null;
+};
 
+const decryptGcm = (payload: Buffer, key: Buffer, domain: string): string | null => {
   try {
-    const decipher = NodeCrypto.createDecipheriv("aes-128-cbc", key, AES_IV);
-    decipher.setAutoPadding(true);
-    let plaintext = Buffer.concat([decipher.update(buffer.subarray(3)), decipher.final()]);
-    // Chromium >= 127 prefixes the plaintext with SHA-256 of the host key to
-    // bind a cookie to its domain; strip it when present.
-    const domainHash = NodeCrypto.createHash("sha256").update(domain).digest();
-    if (plaintext.length >= 32 && plaintext.subarray(0, 32).equals(domainHash)) {
-      plaintext = plaintext.subarray(32);
-    }
-    return plaintext.toString("utf8");
+    const nonce = payload.subarray(0, GCM_NONCE_LENGTH);
+    const tag = payload.subarray(payload.length - GCM_TAG_LENGTH);
+    const body = payload.subarray(GCM_NONCE_LENGTH, payload.length - GCM_TAG_LENGTH);
+    const decipher = NodeCrypto.createDecipheriv("aes-256-gcm", key, nonce);
+    decipher.setAuthTag(tag);
+    const plaintext = Buffer.concat([decipher.update(body), decipher.final()]);
+    return stripDomainBinding(plaintext, domain).toString("utf8");
   } catch {
     return null;
   }
 };
 
+/**
+ * Decrypts one stored value, choosing the scheme from its prefix. Returns null
+ * when no key covers that scheme — including `v20`, which is app-bound and
+ * deliberately unreadable outside the browser.
+ */
+export function decryptChromiumValue(
+  encrypted: Uint8Array,
+  keys: ChromiumKeyMaterial,
+  domain: string,
+): string | null {
+  const buffer = Buffer.from(encrypted);
+  if (buffer.length === 0) return "";
+  const prefix = buffer.subarray(0, 3).toString("latin1");
+  const payload = buffer.subarray(3);
+
+  if (prefix === "v10") {
+    if (keys.gcmV10) return decryptGcm(payload, keys.gcmV10, domain);
+    return keys.cbcV10 ? decryptCbc(payload, keys.cbcV10, domain) : null;
+  }
+  if (prefix === "v11") {
+    return keys.cbcV11 ? decryptCbc(payload, keys.cbcV11, domain) : null;
+  }
+  return null;
+}
+
 export interface ChromiumCookieSource {
   readonly cookieDatabasePath: string;
-  readonly keychainService: string;
-  readonly keychainAccount: string;
-  /** Supplied by the caller from `HostProcessPlatform` rather than read here. */
+  readonly localStatePath: string;
+  readonly keychainService: string | undefined;
+  readonly keychainAccount: string | undefined;
   readonly platform: NodeJS.Platform;
 }
 
 export async function readChromiumCookies(
   source: ChromiumCookieSource,
 ): Promise<ReadonlyArray<ChromiumCookie>> {
-  if (source.platform !== "darwin") {
-    // Linux (libsecret) and Windows (DPAPI, and App-Bound Encryption on
-    // current Chrome) each need their own key path; only macOS is implemented.
-    throw new ChromiumCookieReadError({ reason: "unsupportedPlatform" });
+  let keys: ChromiumKeyMaterial;
+  try {
+    keys = await resolveChromiumKeys({
+      platform: source.platform,
+      keychainService: source.keychainService,
+      keychainAccount: source.keychainAccount,
+      localStatePath: source.localStatePath,
+    });
+  } catch (cause) {
+    throw new ChromiumCookieReadError({
+      reason: cause instanceof ChromiumKeyError ? cause.reason : "unsupportedPlatform",
+    });

@@ -0,0 +1,276 @@
+// @effect-diagnostics nodeBuiltinImport:off - `node:crypto` implements the
+// OSCrypt key derivation Chromium uses; Effect has no equivalent.
+/**
+ * Chromium cookie-encryption keys, per platform.
+ *
+ * Chromium calls this OSCrypt, and it works differently on each OS:
+ *
+ * - **macOS** keeps one key in the login keychain. Reading it prompts the
+ *   user, which is the consent this feature is built around.
+ * - **Linux** may keep a key in libsecret/kwallet (`v11` records), or use a
+ *   hardcoded `peanuts` passphrase when no keyring is available (`v10`).
+ *   Both can appear in the same database, so both are derived up front and
+ *   chosen per record.
+ * - **Windows** wraps an AES-256-GCM key in DPAPI inside `Local State`. Since
+ *   Chrome 127 it *also* keeps an app-bound key that only the browser binary
+ *   can unwrap, and cookies written under it carry a `v20` prefix. Those are
+ *   not readable by anything else, by design, and this module does not try.
+ *
+ * @module ChromiumKeys
+ */
+import * as Keyring from "@napi-rs/keyring";
+import * as NodeCrypto from "node:crypto";
+
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+
+const KEY_SALT = "saltysalt";
+const KEY_LENGTH = 16;
+/** macOS stretches the keychain secret; Linux uses a single iteration. */
+const MAC_KEY_ITERATIONS = 1003;
+const LINUX_KEY_ITERATIONS = 1;
+/** Chromium's documented fallback passphrase when no Linux keyring is present. */
+const LINUX_FALLBACK_PASSPHRASE = "peanuts";
+
+export const ChromiumKeyFailure = Schema.Literals([
+  "needsKeychainApproval",
+  "keychainItemMissing",
+  "appBoundEncryption",
+  "unsupportedPlatform",
+  /** The key store itself could not be read, as opposed to holding no key. */
+  "readFailed",
+]);
+export type ChromiumKeyFailure = typeof ChromiumKeyFailure.Type;
+
+export class ChromiumKeyError extends Schema.TaggedErrorClass<ChromiumKeyError>()(
+  "ChromiumKeyError",
+  {
+    reason: ChromiumKeyFailure,
+    /**
+     * The metadata file the failure is about, when it is about one. Without it
+     * an unreadable `Local State` is reported against the cookie database the
+     * caller names instead.
+     */
+    localStatePath: Schema.optional(Schema.String),
+    /** Exit status of the helper that was asked to unwrap the key. */
+    exitCode: Schema.optional(Schema.Number),
+    /** Kept for the log; never surfaced to the user. */
+    cause: Schema.optional(Schema.Defect()),
+  },
+) {
+  override get message(): string {
+    const where = this.localStatePath === undefined ? "" : ` at ${this.localStatePath}`;
+    const status = this.exitCode === undefined ? "" : ` (helper exited with ${this.exitCode})`;
+    return `Could not obtain the Chromium cookie key${where}: ${this.reason}${status}.`;
+  }
+}
+
+/**
+ * Keys to try, indexed by the record prefix they decrypt. A database can hold
+ * records written under more than one scheme, so a missing entry means those
+ * records are skipped rather than the whole import failing.
+ */
+export interface ChromiumKeyMaterial {
+  /** AES-128-CBC on macOS and Linux. */
+  readonly cbcV10?: Buffer;
+  /** AES-128-CBC, Linux keyring-derived. */
+  readonly cbcV11?: Buffer;
+  /** AES-256-GCM on Windows. */
+  readonly gcmV10?: Buffer;
+}
+
+const derive = (passphrase: string, iterations: number) =>
+  NodeCrypto.pbkdf2Sync(passphrase, KEY_SALT, iterations, KEY_LENGTH, "sha1");
+
+/**
+ * Reads the OSCrypt key from the macOS login keychain.
+ *
+ * Uses the in-process Keychain API rather than shelling out to
+ * `/usr/bin/security`, because macOS attributes both the consent prompt and
+ * the resulting ACL entry to the binary that asks. Via the CLI the prompt says
+ * "security" and "Always Allow" grants trust to a tool every process on the
+ * machine can invoke; in-process it names this app and the grant belongs to
+ * it. (In an unsigned dev build the name is the dev binary, not the shipped
+ * app identity.)
+ *
+ * Deliberately untimed: macOS answers this with a modal, and a timeout racing
+ * the user means the prompt can be approved while nothing is left listening,
+ * which reads as "approving did nothing".
+ */
+const readKeychainSecret = Effect.fn("ChromiumKeys.readKeychainSecret")(function* (
+  service: string,
+  account: string,
+) {
+  const secret = yield* Effect.try({
+    try: () => new Keyring.Entry(service, account).getPassword(),
+    catch: (cause) => {
+      const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
+      // Distinguish the causes rather than reporting "approve the prompt" for
+      // a failure approving cannot fix.
+      const missing = /no (matching )?entry|not found/i.test(message);
+      return new ChromiumKeyError({
+        reason: missing ? "keychainItemMissing" : "needsKeychainApproval",
+        cause,
+      });
+    },
+  });
+  if (secret === null || secret === "") {
+    return yield* new ChromiumKeyError({ reason: "keychainItemMissing" });
+  }
+  return secret;
+});
+
+/**
+ * Unwraps the Windows DPAPI-protected key via PowerShell.
+ *
+ * Shelling out is fine here in a way it is not on macOS: DPAPI is transparent
+ * to any process running as the user, so there is no consent prompt to
+ * misattribute and no ACL entry to write against the wrong binary.
+ */
+const unprotectWithDpapi = Effect.fn("ChromiumKeys.unprotectWithDpapi")(function* (
+  protectedKey: Buffer,
+) {
+  const script = [
+    "Add-Type -AssemblyName System.Security;",
+    `$b=[Convert]::FromBase64String('${protectedKey.toString("base64")}');`,
+    "$u=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,",
+    "[System.Security.Cryptography.DataProtectionScope]::CurrentUser);",
+    "[Convert]::ToBase64String($u)",
+  ].join("");
+
+  const process = yield* ChildProcess.make("powershell.exe", [
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    script,
+  ]);
+  const stdout = yield* process.stdout.pipe(Stream.decodeText(), Stream.mkString);
+  const exitCode = yield* process.exitCode;

@@ -0,0 +1,234 @@
+// @effect-diagnostics nodeBuiltinImport:off - `node:crypto` implements the
+// OSCrypt key derivation Chromium uses; Effect has no equivalent.
+/**
+ * Chromium cookie-encryption keys, per platform.
+ *
+ * Chromium calls this OSCrypt, and it works differently on each OS:
+ *
+ * - **macOS** keeps one key in the login keychain. Reading it prompts the
+ *   user, which is the consent this feature is built around.
+ * - **Linux** may keep a key in libsecret/kwallet (`v11` records), or use a
+ *   hardcoded `peanuts` passphrase when no keyring is available (`v10`).
+ *   Both can appear in the same database, so both are derived up front and
+ *   chosen per record.
+ * - **Windows** wraps an AES-256-GCM key in DPAPI inside `Local State`. Since
+ *   Chrome 127 it *also* keeps an app-bound key that only the browser binary
+ *   can unwrap, and cookies written under it carry a `v20` prefix. Those are
+ *   not readable by anything else, by design, and this module does not try.
+ *
+ * @module ChromiumKeys
+ */
+import * as Keyring from "@napi-rs/keyring";
+import * as NodeCrypto from "node:crypto";
+
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/unstable/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/unstable/process/ChildProcessSpawner";
+
+const KEY_SALT = "saltysalt";
+const KEY_LENGTH = 16;
+/** macOS stretches the keychain secret; Linux uses a single iteration. */
+const MAC_KEY_ITERATIONS = 1003;
+const LINUX_KEY_ITERATIONS = 1;
+/** Chromium's documented fallback passphrase when no Linux keyring is present. */
+const LINUX_FALLBACK_PASSPHRASE = "peanuts";
+
+export const ChromiumKeyFailure = Schema.Literals([
+  "needsKeychainApproval",
+  "keychainItemMissing",
+  "appBoundEncryption",
+  "unsupportedPlatform",
+]);
+export type ChromiumKeyFailure = typeof ChromiumKeyFailure.Type;
+
+export class ChromiumKeyError extends Schema.TaggedErrorClass<ChromiumKeyError>()(
+  "ChromiumKeyError",
+  {
+    reason: ChromiumKeyFailure,
+    /** Kept for the log; never surfaced to the user. */
+    cause: Schema.optional(Schema.Defect()),
+  },
+) {
+  override get message(): string {
+    return `Could not obtain the Chromium cookie key: ${this.reason}.`;
+  }
+}
+
+/**
+ * Keys to try, indexed by the record prefix they decrypt. A database can hold
+ * records written under more than one scheme, so a missing entry means those
+ * records are skipped rather than the whole import failing.
+ */
+export interface ChromiumKeyMaterial {
+  /** AES-128-CBC on macOS and Linux. */
+  readonly cbcV10?: Buffer;
+  /** AES-128-CBC, Linux keyring-derived. */
+  readonly cbcV11?: Buffer;
+  /** AES-256-GCM on Windows. */
+  readonly gcmV10?: Buffer;
+}
+
+const derive = (passphrase: string, iterations: number) =>
+  NodeCrypto.pbkdf2Sync(passphrase, KEY_SALT, iterations, KEY_LENGTH, "sha1");
+
+/**
+ * Reads the OSCrypt key from the macOS login keychain.
+ *
+ * Uses the in-process Keychain API rather than shelling out to
+ * `/usr/bin/security`, because macOS attributes both the consent prompt and
+ * the resulting ACL entry to the binary that asks. Via the CLI the prompt says
+ * "security" and "Always Allow" grants trust to a tool every process on the
+ * machine can invoke; in-process it names this app and the grant belongs to
+ * it. (In an unsigned dev build the name is the dev binary, not the shipped
+ * app identity.)
+ *
+ * Deliberately untimed: macOS answers this with a modal, and a timeout racing
+ * the user means the prompt can be approved while nothing is left listening,
+ * which reads as "approving did nothing".
+ */
+const readKeychainSecret = Effect.fn("ChromiumKeys.readKeychainSecret")(function* (
+  service: string,
+  account: string,
+) {
+  const secret = yield* Effect.try({
+    try: () => new Keyring.Entry(service, account).getPassword(),
+    catch: (cause) => {
+      const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
+      // Distinguish the causes rather than reporting "approve the prompt" for
+      // a failure approving cannot fix.
+      const missing = /no (matching )?entry|not found/i.test(message);
+      return new ChromiumKeyError({
+        reason: missing ? "keychainItemMissing" : "needsKeychainApproval",
+        cause,
+      });
+    },
+  });
+  if (secret === null || secret === "") {
+    return yield* new ChromiumKeyError({ reason: "keychainItemMissing" });
+  }
+  return secret;
+});
+
+/**
+ * Unwraps the Windows DPAPI-protected key via PowerShell.
+ *
+ * Shelling out is fine here in a way it is not on macOS: DPAPI is transparent
+ * to any process running as the user, so there is no consent prompt to
+ * misattribute and no ACL entry to write against the wrong binary.
+ */
+const unprotectWithDpapi = Effect.fn("ChromiumKeys.unprotectWithDpapi")(function* (
+  protectedKey: Buffer,
+) {
+  const script = [
+    "Add-Type -AssemblyName System.Security;",
+    `$b=[Convert]::FromBase64String('${protectedKey.toString("base64")}');`,
+    "$u=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,",
+    "[System.Security.Cryptography.DataProtectionScope]::CurrentUser);",
+    "[Convert]::ToBase64String($u)",
+  ].join("");
+
+  const process = yield* ChildProcess.make("powershell.exe", [
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    script,
+  ]);
+  const stdout = yield* process.stdout.pipe(Stream.decodeText(), Stream.mkString);
+  return Buffer.from(stdout.trim(), "base64");

@@ -0,0 +1,211 @@
+// @effect-diagnostics nodeBuiltinImport:off - `node:crypto` implements the
+// OSCrypt key derivation Chromium uses; Effect has no equivalent.
+/**
+ * Chromium cookie-encryption keys, per platform.
+ *
+ * Chromium calls this OSCrypt, and it works differently on each OS:
+ *
+ * - **macOS** keeps one key in the login keychain. Reading it prompts the
+ *   user, which is the consent this feature is built around.
+ * - **Linux** may keep a key in libsecret/kwallet (`v11` records), or use a
+ *   hardcoded `peanuts` passphrase when no keyring is available (`v10`). Both
+ *   can appear in the same database, so both are derived up front and chosen
+ *   per record.
+ *
+ * Windows is not supported: since Chrome 127 its cookies are encrypted to the
+ * browser's own identity (App-Bound Encryption), unreadable by any other app.
+ *
+ * @module ChromiumKeys
+ */
+import * as Keyring from "@napi-rs/keyring";
+import * as NodeCrypto from "node:crypto";
+
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
+
+const KEY_SALT = "saltysalt";
+const KEY_LENGTH = 16;
+/** macOS stretches the keychain secret; Linux uses a single iteration. */
+const MAC_KEY_ITERATIONS = 1003;
+const LINUX_KEY_ITERATIONS = 1;
+/** Chromium's documented fallback passphrase when no Linux keyring is present. */
+const LINUX_FALLBACK_PASSPHRASE = "peanuts";
+
+export const ChromiumKeyFailure = Schema.Literals([
+  "needsKeychainApproval",
+  "keychainItemMissing",
+  "unsupportedPlatform",
+  /** The key store itself could not be read, as opposed to holding no key. */
+  "readFailed",
+]);
+export type ChromiumKeyFailure = typeof ChromiumKeyFailure.Type;
+
+export class ChromiumKeyError extends Schema.TaggedErrorClass<ChromiumKeyError>()(
+  "ChromiumKeyError",
+  {
+    reason: ChromiumKeyFailure,
+    /** Kept for the log; never surfaced to the user. */
+    cause: Schema.optional(Schema.Defect()),
+  },
+) {
+  override get message(): string {
+    return `Could not obtain the Chromium cookie key: ${this.reason}.`;
+  }
+}
+
+/**
+ * Keys to try, indexed by the record prefix they decrypt. A database can hold
+ * records written under more than one scheme, so a missing entry means those
+ * records are skipped rather than the whole import failing.
+ */
+export interface ChromiumKeyMaterial {
+  /** AES-128-CBC on macOS, and the keyring-free Linux fallback. */
+  readonly cbcV10?: Buffer;
+  /** AES-128-CBC, Linux keyring-derived. */
+  readonly cbcV11?: Buffer;
+}
+
+const derive = (passphrase: string, iterations: number) =>
+  NodeCrypto.pbkdf2Sync(passphrase, KEY_SALT, iterations, KEY_LENGTH, "sha1");
+
+/**
+ * Reads the macOS OSCrypt secret from the login keychain.
+ *
+ * Uses the in-process Keychain API rather than shelling out to
+ * `/usr/bin/security`, because macOS attributes both the consent prompt and the
+ * resulting ACL entry to the binary that asks. Via the CLI the prompt says
+ * "security" and "Always Allow" grants trust to a tool every process on the
+ * machine can invoke; in-process it names this app and the grant belongs to it.
+ * (In an unsigned dev build the name is the dev binary, not the shipped app
+ * identity.)
+ *
+ * Deliberately untimed: macOS answers this with a modal, and a timeout racing
+ * the user means the prompt can be approved while nothing is left listening,
+ * which reads as "approving did nothing".
+ */
+const readKeychainSecret = Effect.fn("ChromiumKeys.readKeychainSecret")(function* (
+  service: string,
+  account: string,
+) {
+  const secret = yield* Effect.try({
+    try: () => new Keyring.Entry(service, account).getPassword(),
+    catch: (cause) => {
+      const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
+      // Distinguish the causes rather than reporting "approve the prompt" for
+      // a failure approving cannot fix.
+      const missing = /no (matching )?entry|not found/i.test(message);
+      return new ChromiumKeyError({
+        reason: missing ? "keychainItemMissing" : "needsKeychainApproval",
+        cause,
+      });
+    },
+  });
+  if (secret === null || secret === "") {
+    return yield* new ChromiumKeyError({ reason: "keychainItemMissing" });
+  }
+  return secret;
+});
+
+const secretToolFailure = (stderr: string): ChromiumKeyFailure => {
+  if (stderr.trim() === "" || /no such secret|not found/i.test(stderr)) {
+    return "keychainItemMissing";
+  }
+  if (/denied|locked|cancel|dismiss|permission/i.test(stderr)) {

@@ -102,100 +108,96 @@ const toUnixSeconds = (webkitSeconds: number): number | undefined => {
 };
 
 /**
- * Reads the OSCrypt key from the login keychain.
- *
- * Uses the in-process Keychain API rather than shelling out to
- * `/usr/bin/security`, because the keychain attributes both the consent prompt
- * and the resulting ACL entry to the binary that asks. Via the CLI the prompt
- * says "security" and "Always Allow" grants trust to a tool every process on
- * the machine can invoke; in-process it names this app and the grant belongs
- * to it. (In an unsigned dev build the name is the dev Electron binary rather
- * than the shipped app identity.)
- *
- * Deliberately untimed: macOS answers this with a modal, and a timeout racing
- * the user means the prompt can be approved while nothing is left listening —
- * which reads as "approving did nothing".
+ * Chromium >= 127 prefixes the plaintext with SHA-256 of the host key, binding
+ * a cookie to its domain. Strip it when present.
  */
-const readMacKeychainPassword = Effect.fn("ChromiumCookies.readMacKeychainPassword")(function* (
-  service: string,
-  account: string,
-  cookieDatabasePath: string,
-) {
-  const password = yield* Effect.try({
-    try: () => new Keyring.Entry(service, account).getPassword(),
-    catch: (cause) => {
-      const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
-      // Distinguish the causes rather than telling the user to approve a
-      // prompt when approving cannot fix the failure.
-      const missing = /no (matching )?entry|not found/i.test(message);
-      return new ChromiumCookieReadError({
-        reason: missing ? "keychainItemMissing" : "needsKeychainApproval",
-        cookieDatabasePath,
-        cause,
-      });
-    },
-  });
-  if (password === null || password === "") {
-    return yield* new ChromiumCookieReadError({
-      reason: "keychainItemMissing",
-      cookieDatabasePath,
-    });
-  }
-  return password;
-});
-
-const decryptValue = (encrypted: Uint8Array, key: Buffer, domain: string): string | null => {
-  const buffer = Buffer.from(encrypted);
-  if (buffer.length === 0) return "";
-  if (buffer.subarray(0, 3).toString("latin1") !== V10_PREFIX) return null;
+const stripDomainBinding = (plaintext: Buffer, domain: string): Buffer => {
+  const domainHash = NodeCrypto.createHash("sha256").update(domain).digest();
+  return plaintext.length >= 32 && plaintext.subarray(0, 32).equals(domainHash)
+    ? plaintext.subarray(32)
+    : plaintext;

@@ -116,136 +118,105 @@ const toUnixSeconds = (webkitSeconds: number): number | undefined => {
 };
 
 /**
- * Reads the OSCrypt key from the login keychain.
- *
- * Uses the in-process Keychain API rather than shelling out to
- * `/usr/bin/security`, because the keychain attributes both the consent prompt
- * and the resulting ACL entry to the binary that asks. Via the CLI the prompt
- * says "security" and "Always Allow" grants trust to a tool every process on
- * the machine can invoke; in-process it names this app and the grant belongs
- * to it. (In an unsigned dev build the name is the dev Electron binary rather
- * than the shipped app identity.)
- *
- * Deliberately untimed: macOS answers this with a modal, and a timeout racing
- * the user means the prompt can be approved while nothing is left listening —
- * which reads as "approving did nothing".
+ * Chromium >= 127 prefixes the plaintext with SHA-256 of the host key, binding
+ * a cookie to its domain. Strip it when present.
  */
-const readMacKeychainPassword = Effect.fn("ChromiumCookies.readMacKeychainPassword")(function* (
-  service: string,
-  account: string,
-  cookieDatabasePath: string,
-) {
-  const password = yield* Effect.try({
-    try: () => new Keyring.Entry(service, account).getPassword(),
-    catch: (cause) => {
-      const message = String((cause as { message?: unknown } | undefined)?.message ?? "");
-      // Distinguish the causes rather than telling the user to approve a
-      // prompt when approving cannot fix the failure.
-      const missing = /no (matching )?entry|not found/i.test(message);
-      return new ChromiumCookieReadError({
-        reason: missing ? "keychainItemMissing" : "needsKeychainApproval",
-        cookieDatabasePath,
-        cause,
-      });
-    },
-  });
-  if (password === null || password === "") {
-    return yield* new ChromiumCookieReadError({
-      reason: "keychainItemMissing",
-      cookieDatabasePath,
-    });
-  }
-  return password;
-});
+const stripDomainBinding = (
+  plaintext: Buffer,
+  domain: string,
+  schemaVersion: number,
+): Buffer | null => {
+  if (schemaVersion < 24) return plaintext;
+  const domainHash = NodeCrypto.createHash("sha256").update(domain).digest();
+  return plaintext.length >= 32 && plaintext.subarray(0, 32).equals(domainHash)
+    ? plaintext.subarray(32)
+    : null;
+};
 
-const decryptValue = (
-  encrypted: Uint8Array,
+const decryptCbc = (
+  payload: Buffer,
   key: Buffer,
   domain: string,
   schemaVersion: number,
-  platform: NodeJS.Platform,
 ): string | null => {
-  const buffer = Buffer.from(encrypted);
-  const version = buffer.subarray(0, 3).toString("latin1");
-
   try {
-    let plaintext: Buffer;
-    if (version === V10_PREFIX) {
-      const decipher = NodeCrypto.createDecipheriv("aes-128-cbc", key, AES_IV);
-      decipher.setAutoPadding(true);
-      plaintext = Buffer.concat([decipher.update(buffer.subarray(3)), decipher.final()]);
-    } else if (platform === "darwin") {
-      // macOS OSCrypt explicitly treats an unversioned encrypted_value as
-      // legacy cleartext. This is platform-specific: Linux uses other version
-      // prefixes, which must not be widened into plaintext cookies.
-      plaintext = buffer;
-    } else {
-      return null;
-    }
-    // Cookie schema 24 requires SHA-256(host_key) at the front of every
-    // encrypted value. Treat a missing or mismatched binding as undecryptable;
-    // older schemas stored arbitrary plaintext here, including long values
-    // whose first 32 bytes must not be interpreted as a hash.
-    if (schemaVersion >= 24) {
-      const domainHash = NodeCrypto.createHash("sha256").update(domain).digest();
-      if (plaintext.length < domainHash.length || !plaintext.subarray(0, 32).equals(domainHash)) {
-        return null;
-      }
-      plaintext = plaintext.subarray(32);
-    }
-    return plaintext.toString("utf8");
+    const decipher = NodeCrypto.createDecipheriv("aes-128-cbc", key, AES_CBC_IV);
+    decipher.setAutoPadding(true);
+    const plaintext = Buffer.concat([decipher.update(payload), decipher.final()]);
+    return stripDomainBinding(plaintext, domain, schemaVersion)?.toString("utf8") ?? null;
   } catch {
     return null;
   }
 };
 
+/**
+ * Decrypts one stored value, choosing the scheme from its prefix. Returns null
+ * when no key covers that scheme — including Windows' app-bound `v20`, which
+ * this build has no key for at all.
+ */
+export function decryptChromiumValue(
+  encrypted: Uint8Array,
+  keys: ChromiumKeyMaterial,
+  domain: string,
+  schemaVersion = 23,
+  platform: NodeJS.Platform = "linux",
+): string | null {
+  const buffer = Buffer.from(encrypted);
+  if (buffer.length === 0) return "";
+  const prefix = buffer.subarray(0, 3).toString("latin1");
+  const payload = buffer.subarray(3);
+
+  if (prefix === "v10") {
+    return keys.cbcV10 ? decryptCbc(payload, keys.cbcV10, domain, schemaVersion) : null;
+  }
+  if (prefix === "v11") {
+    return keys.cbcV11 ? decryptCbc(payload, keys.cbcV11, domain, schemaVersion) : null;
+  }

@@ -0,0 +1,180 @@
+// @effect-diagnostics nodeBuiltinImport:off
+import { describe, expect, it } from "@effect/vitest";

@@ -0,0 +1 @@
+db

@@ -254,12 +234,13 @@ export const readChromiumCookies = Effect.fn("ChromiumCookies.readChromiumCookie
   let undecryptable = 0;
   const undecryptableHosts = new Set<string>();
   for (const row of rows) {
-    const value = decryptValue(row.encrypted_value, key, row.host_key);
+    const value = decryptChromiumValue(row.encrypted_value, keys, row.host_key);