feat(desktop): import from Chrome, Edge, Brave, Vivaldi, Opera, Arc and Firefox

[juliusmarminge]

Stacked on #7255 (browser-profile-import).

Expands cookie import to a source registry with Chromium and Firefox readers.

Source	macOS	Windows	Linux in this layer
Chrome, Edge, Brave, Vivaldi, Opera	Supported	Unsupported	Detected; key support in #7261
Arc, Helium	Supported	Unsupported	Unsupported
Firefox	Supported	Supported	Supported

Firefox imports its default container; other containers are excluded so their sessions are not mixed. Discovery respects profiles.ini, validates relative paths, supports explicitly configured absolute profile directories, and ignores fallback entries without a cookie database. Counts use the same default-container filter as the reader.

Both engines share a consistent read-only SQLite snapshot path. Windows Chromium remains intentionally unsupported, preserving the Windows-tested contribution #7323.

Validation: focused source-discovery, path-validation, Firefox cookie/count, and SQLite snapshot fixtures. Cross-platform path tests run on macOS; they are not a substitute for another live Windows/Linux test.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add Chrome, Edge, Brave, Vivaldi, Opera, Arc, and Firefox import to desktop

• Expands the BROWSER_IMPORT_SOURCES registry to include Chrome, Edge, Brave, Vivaldi, Opera, Arc, and Firefox, using a platform-aware BrowserImportPathContext to resolve user-data directories.
• Adds a Firefox cookie reader that parses profiles.ini, handles schema-specific expiry and SameSite conversions, filters to default-container cookies, and uses Windows or POSIX lock probes to detect if the browser is running.
• Extracts shared cookie contracts and SQLite snapshot logic into CookieDatabase.ts for use by both Chromium and Firefox engines.
• Adds a profileLimitReached failure reason and ProfileLimitReachedError when profile creation or import persistence exceeds the configured maximum.
• Risk: Chromium sources are now blocked on non-macOS platforms in BrowserImport.unavailableReason; out-of-tree consumers will receive unsupportedPlatform instead of attempting unsupported keychain reads.

^{Macroscope summarized ff29cce.}

---

Note

Medium Risk
Touches cookie/session import, filesystem path validation, and keychain reads on macOS; Firefox lock probing spawns Python and may allow import while Firefox is running if the probe is unavailable.

Overview
Adds a multi-browser import registry (Chrome, Edge, Brave, Vivaldi, Opera, Arc, Helium, Firefox) with an engine split and BrowserImportPathContext (platform, home, Windows %APPDATA%) replacing the old sourcePaths helper.

Firefox gets a plaintext cookies.sqlite reader, profiles.ini discovery with path hardening, default-container-only imports, schema-aware expiry/SameSite handling, and per-profile running detection (Linux lock symlinks, macOS .parentlock fcntl via a short Python probe, Windows parent.lock). HostProcessAddresses resolves local IPs for lock ownership checks.

Chromium sources share a chromiumSource factory (macOS + Linux paths; non-macOS Chromium import is gated as unsupportedPlatform until other key stores exist). Shared CookieDatabase holds ImportedCookie, WAL-safe snapshotCookieDatabase, and cookieScope. BrowserImport.importCookies branches on engine, skips keychain audit logs for Firefox, and maps Chromium unspecified SameSite to Electron unspecified instead of forcing Lax.

Contracts expand BROWSER_IMPORT_SOURCE_IDS; tests cover Firefox/Chromium readers, snapshots, locks, and discovery edge cases.

^{Reviewed by Cursor Bugbot for commit ff29cce. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f3c31f7b-c598-4238-adee-9242d001ce25

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	13.4 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	6.9 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	57.0 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	10	—	21	✅
Claude	Total thread wire	—	13.5 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	6.9 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	57.8 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	10	—	21	✅

Baseline: unavailable · PR result: ff29cce · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

One convention finding: the new Firefox cookie read path models its failure as an anonymous object literal instead of a Schema.TaggedErrorClass. Details inline.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a multi-browser cookie-import capability with new cross-platform discovery, database extraction, lock handling, Keychain interaction, and session-cookie writes. It also introduces a static-analysis diagnostic suppression in a new test, so the scope and sensitive-data handling warrant human review.

No code changes detected at ff29cce. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Effect service conventions: one finding on the new FirefoxCookieReadError. The tagged-error union fix from the previous round looks good; what remains is the structural context the error captures.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit 8360b0f. Configure here.}

[juliusmarminge]

Stacked on #7255 (browser-profile-import).

Expands cookie import to a source registry with Chromium and Firefox readers.

Source	macOS	Windows	Linux in this layer
Chrome, Edge, Brave, Vivaldi, Opera	Supported	Unsupported	Detected; key support in #7261
Arc, Helium	Supported	Unsupported	Unsupported
Firefox	Supported	Supported	Supported

Firefox imports its default container; other containers are excluded so their sessions are not mixed. Discovery respects profiles.ini, validates relative paths, supports explicitly configured absolute profile directories, and ignores fallback entries without a cookie database. Counts use the same default-container filter as the reader.

Both engines share a consistent read-only SQLite snapshot path. Windows Chromium remains intentionally unsupported, preserving the Windows-tested contribution #7323.

Validation: focused source-discovery, path-validation, Firefox cookie/count, and SQLite snapshot fixtures. Cross-platform path tests run on macOS; they are not a substitute for another live Windows/Linux test.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add Chrome, Edge, Brave, Vivaldi, Opera, Arc, and Firefox import to desktop

• Expands the BROWSER_IMPORT_SOURCES registry to include Chrome, Edge, Brave, Vivaldi, Opera, Arc, and Firefox, using a platform-aware BrowserImportPathContext to resolve user-data directories.
• Adds a Firefox cookie reader that parses profiles.ini, handles schema-specific expiry and SameSite conversions, filters to default-container cookies, and uses Windows or POSIX lock probes to detect if the browser is running.
• Extracts shared cookie contracts and SQLite snapshot logic into CookieDatabase.ts for use by both Chromium and Firefox engines.
• Adds a profileLimitReached failure reason and ProfileLimitReachedError when profile creation or import persistence exceeds the configured maximum.
• Risk: Chromium sources are now blocked on non-macOS platforms in BrowserImport.unavailableReason; out-of-tree consumers will receive unsupportedPlatform instead of attempting unsupported keychain reads.

^{Macroscope summarized ff29cce.}

---

Note

Medium Risk
Touches cookie/session import, filesystem path validation, and keychain reads on macOS; Firefox lock probing spawns Python and may allow import while Firefox is running if the probe is unavailable.

Overview
Adds a multi-browser import registry (Chrome, Edge, Brave, Vivaldi, Opera, Arc, Helium, Firefox) with an engine split and BrowserImportPathContext (platform, home, Windows %APPDATA%) replacing the old sourcePaths helper.

Firefox gets a plaintext cookies.sqlite reader, profiles.ini discovery with path hardening, default-container-only imports, schema-aware expiry/SameSite handling, and per-profile running detection (Linux lock symlinks, macOS .parentlock fcntl via a short Python probe, Windows parent.lock). HostProcessAddresses resolves local IPs for lock ownership checks.

Chromium sources share a chromiumSource factory (macOS + Linux paths; non-macOS Chromium import is gated as unsupportedPlatform until other key stores exist). Shared CookieDatabase holds ImportedCookie, WAL-safe snapshotCookieDatabase, and cookieScope. BrowserImport.importCookies branches on engine, skips keychain audit logs for Firefox, and maps Chromium unspecified SameSite to Electron unspecified instead of forcing Lax.

Contracts expand BROWSER_IMPORT_SOURCE_IDS; tests cover Firefox/Chromium readers, snapshots, locks, and discovery edge cases.

^{Reviewed by Cursor Bugbot for commit ff29cce. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f3c31f7b-c598-4238-adee-9242d001ce25

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	13.4 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	6.9 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	57.0 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	10	—	21	✅
Claude	Total thread wire	—	13.5 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	6.9 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	57.8 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	10	—	21	✅

Baseline: unavailable · PR result: ff29cce · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

One convention finding: the new Firefox cookie read path models its failure as an anonymous object literal instead of a Schema.TaggedErrorClass. Details inline.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a multi-browser cookie-import capability with new cross-platform discovery, database extraction, lock handling, Keychain interaction, and session-cookie writes. It also introduces a static-analysis diagnostic suppression in a new test, so the scope and sensitive-data handling warrant human review.

No code changes detected at ff29cce. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Effect service conventions: one finding on the new FirefoxCookieReadError. The tagged-error union fix from the previous round looks good; what remains is the structural context the error captures.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit 8360b0f. Configure here.}

[juliusmarminge]

Stacked on #7255 (browser-profile-import).

Expands cookie import to a source registry with Chromium and Firefox readers.

Source	macOS	Windows	Linux in this layer
Chrome, Edge, Brave, Vivaldi, Opera	Supported	Unsupported	Detected; key support in #7261
Arc, Helium	Supported	Unsupported	Unsupported
Firefox	Supported	Supported	Supported

Firefox imports its default container; other containers are excluded so their sessions are not mixed. Discovery respects profiles.ini, validates relative paths, supports explicitly configured absolute profile directories, and ignores fallback entries without a cookie database. Counts use the same default-container filter as the reader.

Both engines share a consistent read-only SQLite snapshot path. Windows Chromium remains intentionally unsupported, preserving the Windows-tested contribution #7323.

Validation: focused source-discovery, path-validation, Firefox cookie/count, and SQLite snapshot fixtures. Cross-platform path tests run on macOS; they are not a substitute for another live Windows/Linux test.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add Chrome, Edge, Brave, Vivaldi, Opera, Arc, and Firefox import to desktop

• Expands the BROWSER_IMPORT_SOURCES registry to include Chrome, Edge, Brave, Vivaldi, Opera, Arc, and Firefox, using a platform-aware BrowserImportPathContext to resolve user-data directories.
• Adds a Firefox cookie reader that parses profiles.ini, handles schema-specific expiry and SameSite conversions, filters to default-container cookies, and uses Windows or POSIX lock probes to detect if the browser is running.
• Extracts shared cookie contracts and SQLite snapshot logic into CookieDatabase.ts for use by both Chromium and Firefox engines.
• Adds a profileLimitReached failure reason and ProfileLimitReachedError when profile creation or import persistence exceeds the configured maximum.
• Risk: Chromium sources are now blocked on non-macOS platforms in BrowserImport.unavailableReason; out-of-tree consumers will receive unsupportedPlatform instead of attempting unsupported keychain reads.

^{Macroscope summarized ff29cce.}

---

Note

Medium Risk
Touches cookie/session import, filesystem path validation, and keychain reads on macOS; Firefox lock probing spawns Python and may allow import while Firefox is running if the probe is unavailable.

Overview
Adds a multi-browser import registry (Chrome, Edge, Brave, Vivaldi, Opera, Arc, Helium, Firefox) with an engine split and BrowserImportPathContext (platform, home, Windows %APPDATA%) replacing the old sourcePaths helper.

Firefox gets a plaintext cookies.sqlite reader, profiles.ini discovery with path hardening, default-container-only imports, schema-aware expiry/SameSite handling, and per-profile running detection (Linux lock symlinks, macOS .parentlock fcntl via a short Python probe, Windows parent.lock). HostProcessAddresses resolves local IPs for lock ownership checks.

Chromium sources share a chromiumSource factory (macOS + Linux paths; non-macOS Chromium import is gated as unsupportedPlatform until other key stores exist). Shared CookieDatabase holds ImportedCookie, WAL-safe snapshotCookieDatabase, and cookieScope. BrowserImport.importCookies branches on engine, skips keychain audit logs for Firefox, and maps Chromium unspecified SameSite to Electron unspecified instead of forcing Lax.

Contracts expand BROWSER_IMPORT_SOURCE_IDS; tests cover Firefox/Chromium readers, snapshots, locks, and discovery edge cases.

^{Reviewed by Cursor Bugbot for commit ff29cce. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f3c31f7b-c598-4238-adee-9242d001ce25

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	13.4 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	6.9 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	57.0 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	10	—	21	✅
Claude	Total thread wire	—	13.5 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	6.9 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	57.8 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	10	—	21	✅

Baseline: unavailable · PR result: ff29cce · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

One convention finding: the new Firefox cookie read path models its failure as an anonymous object literal instead of a Schema.TaggedErrorClass. Details inline.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a multi-browser cookie-import capability with new cross-platform discovery, database extraction, lock handling, Keychain interaction, and session-cookie writes. It also introduces a static-analysis diagnostic suppression in a new test, so the scope and sensitive-data handling warrant human review.

No code changes detected at ff29cce. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Effect service conventions: one finding on the new FirefoxCookieReadError. The tagged-error union fix from the previous round looks good; what remains is the structural context the error captures.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit 8360b0f. Configure here.}

[juliusmarminge]

Stacked on #7255 (browser-profile-import).

Expands cookie import to a source registry with Chromium and Firefox readers.

Source	macOS	Windows	Linux in this layer
Chrome, Edge, Brave, Vivaldi, Opera	Supported	Unsupported	Detected; key support in #7261
Arc, Helium	Supported	Unsupported	Unsupported
Firefox	Supported	Supported	Supported

Firefox imports its default container; other containers are excluded so their sessions are not mixed. Discovery respects profiles.ini, validates relative paths, supports explicitly configured absolute profile directories, and ignores fallback entries without a cookie database. Counts use the same default-container filter as the reader.

Both engines share a consistent read-only SQLite snapshot path. Windows Chromium remains intentionally unsupported, preserving the Windows-tested contribution #7323.

Validation: focused source-discovery, path-validation, Firefox cookie/count, and SQLite snapshot fixtures. Cross-platform path tests run on macOS; they are not a substitute for another live Windows/Linux test.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add Chrome, Edge, Brave, Vivaldi, Opera, Arc, and Firefox import to desktop

• Expands the BROWSER_IMPORT_SOURCES registry to include Chrome, Edge, Brave, Vivaldi, Opera, Arc, and Firefox, using a platform-aware BrowserImportPathContext to resolve user-data directories.
• Adds a Firefox cookie reader that parses profiles.ini, handles schema-specific expiry and SameSite conversions, filters to default-container cookies, and uses Windows or POSIX lock probes to detect if the browser is running.
• Extracts shared cookie contracts and SQLite snapshot logic into CookieDatabase.ts for use by both Chromium and Firefox engines.
• Adds a profileLimitReached failure reason and ProfileLimitReachedError when profile creation or import persistence exceeds the configured maximum.
• Risk: Chromium sources are now blocked on non-macOS platforms in BrowserImport.unavailableReason; out-of-tree consumers will receive unsupportedPlatform instead of attempting unsupported keychain reads.

^{Macroscope summarized ff29cce.}

---

Note

Medium Risk
Touches cookie/session import, filesystem path validation, and keychain reads on macOS; Firefox lock probing spawns Python and may allow import while Firefox is running if the probe is unavailable.

Overview
Adds a multi-browser import registry (Chrome, Edge, Brave, Vivaldi, Opera, Arc, Helium, Firefox) with an engine split and BrowserImportPathContext (platform, home, Windows %APPDATA%) replacing the old sourcePaths helper.

Firefox gets a plaintext cookies.sqlite reader, profiles.ini discovery with path hardening, default-container-only imports, schema-aware expiry/SameSite handling, and per-profile running detection (Linux lock symlinks, macOS .parentlock fcntl via a short Python probe, Windows parent.lock). HostProcessAddresses resolves local IPs for lock ownership checks.

Chromium sources share a chromiumSource factory (macOS + Linux paths; non-macOS Chromium import is gated as unsupportedPlatform until other key stores exist). Shared CookieDatabase holds ImportedCookie, WAL-safe snapshotCookieDatabase, and cookieScope. BrowserImport.importCookies branches on engine, skips keychain audit logs for Firefox, and maps Chromium unspecified SameSite to Electron unspecified instead of forcing Lax.

Contracts expand BROWSER_IMPORT_SOURCE_IDS; tests cover Firefox/Chromium readers, snapshots, locks, and discovery edge cases.

^{Reviewed by Cursor Bugbot for commit ff29cce. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f3c31f7b-c598-4238-adee-9242d001ce25

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	13.4 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	6.9 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	57.0 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	10	—	21	✅
Claude	Total thread wire	—	13.5 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	6.9 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	57.8 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	10	—	21	✅

Baseline: unavailable · PR result: ff29cce · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

One convention finding: the new Firefox cookie read path models its failure as an anonymous object literal instead of a Schema.TaggedErrorClass. Details inline.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a multi-browser cookie-import capability with new cross-platform discovery, database extraction, lock handling, Keychain interaction, and session-cookie writes. It also introduces a static-analysis diagnostic suppression in a new test, so the scope and sensitive-data handling warrant human review.

No code changes detected at ff29cce. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Effect service conventions: one finding on the new FirefoxCookieReadError. The tagged-error union fix from the previous round looks good; what remains is the structural context the error captures.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit 8360b0f. Configure here.}

[juliusmarminge]

Stacked on #7255 (browser-profile-import).

Expands cookie import to a source registry with Chromium and Firefox readers.

Source	macOS	Windows	Linux in this layer
Chrome, Edge, Brave, Vivaldi, Opera	Supported	Unsupported	Detected; key support in #7261
Arc, Helium	Supported	Unsupported	Unsupported
Firefox	Supported	Supported	Supported

Firefox imports its default container; other containers are excluded so their sessions are not mixed. Discovery respects profiles.ini, validates relative paths, supports explicitly configured absolute profile directories, and ignores fallback entries without a cookie database. Counts use the same default-container filter as the reader.

Both engines share a consistent read-only SQLite snapshot path. Windows Chromium remains intentionally unsupported, preserving the Windows-tested contribution #7323.

Validation: focused source-discovery, path-validation, Firefox cookie/count, and SQLite snapshot fixtures. Cross-platform path tests run on macOS; they are not a substitute for another live Windows/Linux test.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add Chrome, Edge, Brave, Vivaldi, Opera, Arc, and Firefox import to desktop

• Expands the BROWSER_IMPORT_SOURCES registry to include Chrome, Edge, Brave, Vivaldi, Opera, Arc, and Firefox, using a platform-aware BrowserImportPathContext to resolve user-data directories.
• Adds a Firefox cookie reader that parses profiles.ini, handles schema-specific expiry and SameSite conversions, filters to default-container cookies, and uses Windows or POSIX lock probes to detect if the browser is running.
• Extracts shared cookie contracts and SQLite snapshot logic into CookieDatabase.ts for use by both Chromium and Firefox engines.
• Adds a profileLimitReached failure reason and ProfileLimitReachedError when profile creation or import persistence exceeds the configured maximum.
• Risk: Chromium sources are now blocked on non-macOS platforms in BrowserImport.unavailableReason; out-of-tree consumers will receive unsupportedPlatform instead of attempting unsupported keychain reads.

^{Macroscope summarized ff29cce.}

---

Note

Medium Risk
Touches cookie/session import, filesystem path validation, and keychain reads on macOS; Firefox lock probing spawns Python and may allow import while Firefox is running if the probe is unavailable.

Overview
Adds a multi-browser import registry (Chrome, Edge, Brave, Vivaldi, Opera, Arc, Helium, Firefox) with an engine split and BrowserImportPathContext (platform, home, Windows %APPDATA%) replacing the old sourcePaths helper.

Firefox gets a plaintext cookies.sqlite reader, profiles.ini discovery with path hardening, default-container-only imports, schema-aware expiry/SameSite handling, and per-profile running detection (Linux lock symlinks, macOS .parentlock fcntl via a short Python probe, Windows parent.lock). HostProcessAddresses resolves local IPs for lock ownership checks.

Chromium sources share a chromiumSource factory (macOS + Linux paths; non-macOS Chromium import is gated as unsupportedPlatform until other key stores exist). Shared CookieDatabase holds ImportedCookie, WAL-safe snapshotCookieDatabase, and cookieScope. BrowserImport.importCookies branches on engine, skips keychain audit logs for Firefox, and maps Chromium unspecified SameSite to Electron unspecified instead of forcing Lax.

Contracts expand BROWSER_IMPORT_SOURCE_IDS; tests cover Firefox/Chromium readers, snapshots, locks, and discovery edge cases.

^{Reviewed by Cursor Bugbot for commit ff29cce. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f3c31f7b-c598-4238-adee-9242d001ce25

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	13.4 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	6.9 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	57.0 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	10	—	21	✅
Claude	Total thread wire	—	13.5 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	6.9 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	57.8 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	10	—	21	✅

Baseline: unavailable · PR result: ff29cce · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

One convention finding: the new Firefox cookie read path models its failure as an anonymous object literal instead of a Schema.TaggedErrorClass. Details inline.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a multi-browser cookie-import capability with new cross-platform discovery, database extraction, lock handling, Keychain interaction, and session-cookie writes. It also introduces a static-analysis diagnostic suppression in a new test, so the scope and sensitive-data handling warrant human review.

No code changes detected at ff29cce. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Effect service conventions: one finding on the new FirefoxCookieReadError. The tagged-error union fix from the previous round looks good; what remains is the structural context the error captures.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit 8360b0f. Configure here.}

[juliusmarminge]

Stacked on #7255 (browser-profile-import).

Expands cookie import to a source registry with Chromium and Firefox readers.

Source	macOS	Windows	Linux in this layer
Chrome, Edge, Brave, Vivaldi, Opera	Supported	Unsupported	Detected; key support in #7261
Arc, Helium	Supported	Unsupported	Unsupported
Firefox	Supported	Supported	Supported

Firefox imports its default container; other containers are excluded so their sessions are not mixed. Discovery respects profiles.ini, validates relative paths, supports explicitly configured absolute profile directories, and ignores fallback entries without a cookie database. Counts use the same default-container filter as the reader.

Both engines share a consistent read-only SQLite snapshot path. Windows Chromium remains intentionally unsupported, preserving the Windows-tested contribution #7323.

Validation: focused source-discovery, path-validation, Firefox cookie/count, and SQLite snapshot fixtures. Cross-platform path tests run on macOS; they are not a substitute for another live Windows/Linux test.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add Chrome, Edge, Brave, Vivaldi, Opera, Arc, and Firefox import to desktop

• Expands the BROWSER_IMPORT_SOURCES registry to include Chrome, Edge, Brave, Vivaldi, Opera, Arc, and Firefox, using a platform-aware BrowserImportPathContext to resolve user-data directories.
• Adds a Firefox cookie reader that parses profiles.ini, handles schema-specific expiry and SameSite conversions, filters to default-container cookies, and uses Windows or POSIX lock probes to detect if the browser is running.
• Extracts shared cookie contracts and SQLite snapshot logic into CookieDatabase.ts for use by both Chromium and Firefox engines.
• Adds a profileLimitReached failure reason and ProfileLimitReachedError when profile creation or import persistence exceeds the configured maximum.
• Risk: Chromium sources are now blocked on non-macOS platforms in BrowserImport.unavailableReason; out-of-tree consumers will receive unsupportedPlatform instead of attempting unsupported keychain reads.

^{Macroscope summarized ff29cce.}

---

Note

Medium Risk
Touches cookie/session import, filesystem path validation, and keychain reads on macOS; Firefox lock probing spawns Python and may allow import while Firefox is running if the probe is unavailable.

Overview
Adds a multi-browser import registry (Chrome, Edge, Brave, Vivaldi, Opera, Arc, Helium, Firefox) with an engine split and BrowserImportPathContext (platform, home, Windows %APPDATA%) replacing the old sourcePaths helper.

Firefox gets a plaintext cookies.sqlite reader, profiles.ini discovery with path hardening, default-container-only imports, schema-aware expiry/SameSite handling, and per-profile running detection (Linux lock symlinks, macOS .parentlock fcntl via a short Python probe, Windows parent.lock). HostProcessAddresses resolves local IPs for lock ownership checks.

Chromium sources share a chromiumSource factory (macOS + Linux paths; non-macOS Chromium import is gated as unsupportedPlatform until other key stores exist). Shared CookieDatabase holds ImportedCookie, WAL-safe snapshotCookieDatabase, and cookieScope. BrowserImport.importCookies branches on engine, skips keychain audit logs for Firefox, and maps Chromium unspecified SameSite to Electron unspecified instead of forcing Lax.

Contracts expand BROWSER_IMPORT_SOURCE_IDS; tests cover Firefox/Chromium readers, snapshots, locks, and discovery edge cases.

^{Reviewed by Cursor Bugbot for commit ff29cce. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f3c31f7b-c598-4238-adee-9242d001ce25

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	13.4 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	6.9 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	57.0 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	10	—	21	✅
Claude	Total thread wire	—	13.5 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	6.9 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	57.8 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	10	—	21	✅

Baseline: unavailable · PR result: ff29cce · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

One convention finding: the new Firefox cookie read path models its failure as an anonymous object literal instead of a Schema.TaggedErrorClass. Details inline.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a multi-browser cookie-import capability with new cross-platform discovery, database extraction, lock handling, Keychain interaction, and session-cookie writes. It also introduces a static-analysis diagnostic suppression in a new test, so the scope and sensitive-data handling warrant human review.

No code changes detected at ff29cce. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Effect service conventions: one finding on the new FirefoxCookieReadError. The tagged-error union fix from the previous round looks good; what remains is the structural context the error captures.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit 8360b0f. Configure here.}

[juliusmarminge]

Stacked on #7255 (browser-profile-import).

Expands cookie import to a source registry with Chromium and Firefox readers.

Source	macOS	Windows	Linux in this layer
Chrome, Edge, Brave, Vivaldi, Opera	Supported	Unsupported	Detected; key support in #7261
Arc, Helium	Supported	Unsupported	Unsupported
Firefox	Supported	Supported	Supported

Firefox imports its default container; other containers are excluded so their sessions are not mixed. Discovery respects profiles.ini, validates relative paths, supports explicitly configured absolute profile directories, and ignores fallback entries without a cookie database. Counts use the same default-container filter as the reader.

Both engines share a consistent read-only SQLite snapshot path. Windows Chromium remains intentionally unsupported, preserving the Windows-tested contribution #7323.

Validation: focused source-discovery, path-validation, Firefox cookie/count, and SQLite snapshot fixtures. Cross-platform path tests run on macOS; they are not a substitute for another live Windows/Linux test.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add Chrome, Edge, Brave, Vivaldi, Opera, Arc, and Firefox import to desktop

• Expands the BROWSER_IMPORT_SOURCES registry to include Chrome, Edge, Brave, Vivaldi, Opera, Arc, and Firefox, using a platform-aware BrowserImportPathContext to resolve user-data directories.
• Adds a Firefox cookie reader that parses profiles.ini, handles schema-specific expiry and SameSite conversions, filters to default-container cookies, and uses Windows or POSIX lock probes to detect if the browser is running.
• Extracts shared cookie contracts and SQLite snapshot logic into CookieDatabase.ts for use by both Chromium and Firefox engines.
• Adds a profileLimitReached failure reason and ProfileLimitReachedError when profile creation or import persistence exceeds the configured maximum.
• Risk: Chromium sources are now blocked on non-macOS platforms in BrowserImport.unavailableReason; out-of-tree consumers will receive unsupportedPlatform instead of attempting unsupported keychain reads.

^{Macroscope summarized ff29cce.}

---

Note

Medium Risk
Touches cookie/session import, filesystem path validation, and keychain reads on macOS; Firefox lock probing spawns Python and may allow import while Firefox is running if the probe is unavailable.

Overview
Adds a multi-browser import registry (Chrome, Edge, Brave, Vivaldi, Opera, Arc, Helium, Firefox) with an engine split and BrowserImportPathContext (platform, home, Windows %APPDATA%) replacing the old sourcePaths helper.

Firefox gets a plaintext cookies.sqlite reader, profiles.ini discovery with path hardening, default-container-only imports, schema-aware expiry/SameSite handling, and per-profile running detection (Linux lock symlinks, macOS .parentlock fcntl via a short Python probe, Windows parent.lock). HostProcessAddresses resolves local IPs for lock ownership checks.

Chromium sources share a chromiumSource factory (macOS + Linux paths; non-macOS Chromium import is gated as unsupportedPlatform until other key stores exist). Shared CookieDatabase holds ImportedCookie, WAL-safe snapshotCookieDatabase, and cookieScope. BrowserImport.importCookies branches on engine, skips keychain audit logs for Firefox, and maps Chromium unspecified SameSite to Electron unspecified instead of forcing Lax.

Contracts expand BROWSER_IMPORT_SOURCE_IDS; tests cover Firefox/Chromium readers, snapshots, locks, and discovery edge cases.

^{Reviewed by Cursor Bugbot for commit ff29cce. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f3c31f7b-c598-4238-adee-9242d001ce25

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	13.4 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	6.9 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	57.0 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	10	—	21	✅
Claude	Total thread wire	—	13.5 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	6.9 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	57.8 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	10	—	21	✅

Baseline: unavailable · PR result: ff29cce · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

One convention finding: the new Firefox cookie read path models its failure as an anonymous object literal instead of a Schema.TaggedErrorClass. Details inline.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a multi-browser cookie-import capability with new cross-platform discovery, database extraction, lock handling, Keychain interaction, and session-cookie writes. It also introduces a static-analysis diagnostic suppression in a new test, so the scope and sensitive-data handling warrant human review.

No code changes detected at ff29cce. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Effect service conventions: one finding on the new FirefoxCookieReadError. The tagged-error union fix from the previous round looks good; what remains is the structural context the error captures.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit 8360b0f. Configure here.}

[juliusmarminge]

Stacked on #7255 (browser-profile-import).

Expands cookie import to a source registry with Chromium and Firefox readers.

Source	macOS	Windows	Linux in this layer
Chrome, Edge, Brave, Vivaldi, Opera	Supported	Unsupported	Detected; key support in #7261
Arc, Helium	Supported	Unsupported	Unsupported
Firefox	Supported	Supported	Supported

Firefox imports its default container; other containers are excluded so their sessions are not mixed. Discovery respects profiles.ini, validates relative paths, supports explicitly configured absolute profile directories, and ignores fallback entries without a cookie database. Counts use the same default-container filter as the reader.

Both engines share a consistent read-only SQLite snapshot path. Windows Chromium remains intentionally unsupported, preserving the Windows-tested contribution #7323.

Validation: focused source-discovery, path-validation, Firefox cookie/count, and SQLite snapshot fixtures. Cross-platform path tests run on macOS; they are not a substitute for another live Windows/Linux test.

Original implementation: Claude Code. Review fixes: GPT-5.6 Sol agents, coordinated through Codex.

Note

Add Chrome, Edge, Brave, Vivaldi, Opera, Arc, and Firefox import to desktop

• Expands the BROWSER_IMPORT_SOURCES registry to include Chrome, Edge, Brave, Vivaldi, Opera, Arc, and Firefox, using a platform-aware BrowserImportPathContext to resolve user-data directories.
• Adds a Firefox cookie reader that parses profiles.ini, handles schema-specific expiry and SameSite conversions, filters to default-container cookies, and uses Windows or POSIX lock probes to detect if the browser is running.
• Extracts shared cookie contracts and SQLite snapshot logic into CookieDatabase.ts for use by both Chromium and Firefox engines.
• Adds a profileLimitReached failure reason and ProfileLimitReachedError when profile creation or import persistence exceeds the configured maximum.
• Risk: Chromium sources are now blocked on non-macOS platforms in BrowserImport.unavailableReason; out-of-tree consumers will receive unsupportedPlatform instead of attempting unsupported keychain reads.

^{Macroscope summarized ff29cce.}

---

Note

Medium Risk
Touches cookie/session import, filesystem path validation, and keychain reads on macOS; Firefox lock probing spawns Python and may allow import while Firefox is running if the probe is unavailable.

Overview
Adds a multi-browser import registry (Chrome, Edge, Brave, Vivaldi, Opera, Arc, Helium, Firefox) with an engine split and BrowserImportPathContext (platform, home, Windows %APPDATA%) replacing the old sourcePaths helper.

Firefox gets a plaintext cookies.sqlite reader, profiles.ini discovery with path hardening, default-container-only imports, schema-aware expiry/SameSite handling, and per-profile running detection (Linux lock symlinks, macOS .parentlock fcntl via a short Python probe, Windows parent.lock). HostProcessAddresses resolves local IPs for lock ownership checks.

Chromium sources share a chromiumSource factory (macOS + Linux paths; non-macOS Chromium import is gated as unsupportedPlatform until other key stores exist). Shared CookieDatabase holds ImportedCookie, WAL-safe snapshotCookieDatabase, and cookieScope. BrowserImport.importCookies branches on engine, skips keychain audit logs for Firefox, and maps Chromium unspecified SameSite to Electron unspecified instead of forcing Lax.

Contracts expand BROWSER_IMPORT_SOURCE_IDS; tests cover Firefox/Chromium readers, snapshots, locks, and discovery edge cases.

^{Reviewed by Cursor Bugbot for commit ff29cce. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f3c31f7b-c598-4238-adee-9242d001ce25

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	13.4 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	6.9 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	57.0 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	10	—	21	✅
Claude	Total thread wire	—	13.5 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	6.9 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	6.6 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	57.8 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	10	—	21	✅

Baseline: unavailable · PR result: ff29cce · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

One convention finding: the new Firefox cookie read path models its failure as an anonymous object literal instead of a Schema.TaggedErrorClass. Details inline.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a multi-browser cookie-import capability with new cross-platform discovery, database extraction, lock handling, Keychain interaction, and session-cookie writes. It also introduces a static-analysis diagnostic suppression in a new test, so the scope and sensitive-data handling warrant human review.

No code changes detected at ff29cce. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Effect service conventions: one finding on the new FirefoxCookieReadError. The tagged-error union fix from the previous round looks good; what remains is the structural context the error captures.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit 8360b0f. Configure here.}