# feat\(desktop\): import cookies from Safari · PR \#7262 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/pull/7262)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

State: merged

Source repository: pingdotgg/t3code

Source branch: browser-import-safari

Target branch: main

Head commit: c6cb164bc007a02da724bb446fa2d1efceb1b8b5

[Discussion and reviews](https://git.cafe/pingdotgg/t3code/pull/7262)

[Commits](https://git.cafe/pingdotgg/t3code/pull/7262/commits?format=markdown)

[Files changed](https://git.cafe/pingdotgg/t3code/pull/7262/diffs?format=markdown)

## Description

---

Adds Safari as a browser import source on macOS.

Safari keeps its cookies unencrypted in `Cookies.binarycookies`; the protection is Full Disk Access (TCC), not a key. The reader parses the binary format with every declared structure bounds-checked and refuses a jar the page table does not describe rather than importing part of it. Timestamps are rebased from the 2001 epoch, and host-only vs domain cookies go through the same `cookieScope` rule as the Chromium and Firefox readers.

TCC denies the read with `EPERM` while still allowing `stat`, so listing probes the jar by opening it and reports `needsFullDiskAccess` up front. The wizard gains a Full Disk Access step: **Open System Settings** deep-links to the Privacy & Security → Full Disk Access pane through a dedicated `openSystemSettings` IPC method keyed by pane id (the generic `openExternal` allowlist is unchanged), and after granting the wizard rechecks or retries the selected import. Only Safari's primary profile jar is read; additional Safari profiles are out of scope.

Validation: binary parser fixtures and malformed-record boundaries, an `EPERM`-vs-`EACCES` distinction test, the fixed System Settings destination, and wizard state transitions. The parser was also run against reference `binarycookies` fixtures and structurally checked against a live Safari 27 jar.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents via Codex, and Claude Fable 5 via Claude Code.

<!-- Macroscope's pull request summary starts here -->
<!-- Macroscope will only edit the content between these invisible markers, and the markers themselves will not be visible in the GitHub rendered markdown. -->
<!-- If you delete either of the start / end markers from your PR's description, Macroscope will append its summary at the bottom of the description. -->
> [!NOTE]
> ### Add Safari cookie import with Full Disk Access permission flow
> - Adds Safari as a Darwin-only browser import source that reads Safari's binary `cook` cookie jar instead of SQLite databases used by Chromium and Firefox
> - Implements `parseBinaryCookies` in [SafariCookies.ts](apps/desktop/src/preview/BrowserImport/SafariCookies.ts) to decode the big-endian page table, little-endian records, Safari epoch timestamps, URL/domain/path scope, and secure/HTTP-only flags; structurally invalid jars fail with `SafariCookieReadError`
> - Discovers named Safari profiles from `SafariTabs` metadata with fallback to scanning UUID-named WebKit data stores when metadata is unreadable
> - Adds a `needsFullDiskAccess` unavailability reason and a wizard step that lets users open the macOS Full Disk Access System Settings pane, recheck permission, and resume the import
> - Safari source listing returns `needsFullDiskAccess` when the cookie jar exists but opening it yields `EPERM`; `EACCES` and other errors remain generic read failures
>
> <!-- Macroscope's review summary starts here -->
>
> <sup><a href="https://app.macroscope.com">Macroscope</a> summarized c6cb164.</sup>
> <!-- Macroscope's review summary ends here -->
>
<!-- Macroscope's pull request summary ends here -->

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Touches macOS TCC-sensitive cookie reads and new IPC that opens fixed System Settings URLs; parser mistakes could drop or mis-import cookies, but URLs are allowlisted and malformed jars fail closed.
> 
> **Overview**
> Adds **Safari** as a macOS browser-import source, reading `Cookies.binarycookies` with a bounds-checked parser that maps records into preview cookies (epoch rebase, host-only/`cookieScope`, secure/httpOnly flags) and surfaces **TCC denials** as `needsFullDiskAccess` (EPERM) rather than generic read failures.
> 
> **Availability and import** probe Safari by opening the jar (since `stat` can succeed without Full Disk Access), wire the Safari engine through `BrowserImport`, and extend source discovery to list the default jar plus **named profiles** from `SafariTabs.db` / WebKit data stores, resolving `Cookies.binarycookies` per selected profile. Safari is treated as safe to import while running (no lock probe).
> 
> **Desktop shell / UX**: new `openSystemSettings("full-disk-access")` IPC (pane id, not renderer URLs) deep-links to Privacy & Security → Full Disk Access; the import wizard gains a **Full Disk Access** step with recheck/retry, and Integrations calls the local API to open settings. Contracts add the `safari` source id and `needsFullDiskAccess` copy; user docs note the FDA flow.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit c6cb164bc007a02da724bb446fa2d1efceb1b8b5. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->