Add dashboard connector for local browser imports - #227
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
🔧 CI Fix Available I've pushed a fix for the CI failure.
The request is now retried a few times, and both download tests in that file skip instead of fail when github.com cannot be reached. A non-200 response or a genuine extraction bug still fails the test, and the per-attempt timeouts stay well inside Go's default 10 minute package timeout so a stalled download ends in a skip rather than a panic. |
| } | ||
|
|
||
| return results, nil | ||
| } |
There was a problem hiding this comment.
Parallel Bitwarden queries race
High Severity
Candidates now runs up to four bw list processes at once via errgroup. Bitwarden’s CLI serializes access to its local state file and commonly fails concurrent invocations with lock errors, so multi-site Managed Auth discovery can fail even when each site would succeed alone.
Reviewed by Cursor Bugbot for commit c590d01. Configure here.
c590d01 to
3bc8e01
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
There are 2 total unresolved issues (including 1 from previous review).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 3bc8e01. Configure here.
| return project, nil | ||
| } | ||
| } | ||
| return kernel.Project{}, fmt.Errorf("%w: %q", errRequestedProjectUnavailable, requested) |
There was a problem hiding this comment.
Project names no longer select imports
Medium Severity
import-local now looks up a requested project only by ID. The global --project flag and KERNEL_PROJECT still accept a name, so a name that previously scoped the import is treated as missing and the run fails.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 3bc8e01. Configure here.
1 participant
What
Add the macOS bridge that lets the Kernel dashboard open the existing local browser-import wizard with a
kernel://browser-import?project_id=...link.kernel connector installto register a user-levelKernel Connector.appkernel connector opendeep-link entrypointprofiles import-local; no second importer or downloaded helper is introducedWhy
The previous dashboard handoff asked users to copy several terminal commands and manually carry a project ID. The connector turns that into one dashboard button while keeping sensitive browser and password-manager access inside the local CLI and its explicit terminal confirmations.
How
The dashboard supplies only a non-secret project ID. The CLI remains responsible for authentication, authorization, browser discovery, cookie selection, password-manager approval, profile import, and Managed Auth provisioning.
The installed app is a tiny AppleScript URL handler that delegates to the stable Kernel CLI path through a login shell. Installation is user-scoped, verifies exact bundle ownership before replacement, signs the completed app, preserves the previous app if rollback fails, and registers it with Launch Services. No server-side intent or new API is required.
This is intentionally macOS-only for the MVP. Windows and Linux return an explicit unsupported-platform error until their protocol-handler packaging is implemented.
Safety
kernel://browser-importroute with one validated project IDVerification
go test ./internal/connector ./internal/browserimport ./internal/passwordmanager ./internal/agentskills ./pkg/auth ./pkg/interactive ./cmdgo vet ./internal/connector ./internal/browserimport ./internal/passwordmanager ./internal/agentskills ./pkg/auth ./pkg/interactive ./cmd/usr/bin/osacompile/usr/bin/codesign --verify --strictpassedStack
Depends on #224, which depends on #223.
Note
High Risk
Touches protocol-handler installation, OAuth/login recovery, cookie export, and Managed Auth quota/provisioning. A bug could leak cookies, register a malicious URL handler, or create auth connections beyond plan limits.
Overview
Adds a macOS Kernel Connector so the dashboard can launch local browser import with a
kernel://browser-import?project_id=...link.kernel connector installbuilds a user-scoped URL-handler app that delegates to the CLI; Homebrewpost_installtries this on macOS. Hiddenconnector openparses a strict deep link, logs in on demand, recovers wrong-account/API-key cases, then reusesprofiles import-local.Import UX no longer caps ~10 recent sites. Users can import all cookies or pick sites; cookie discovery ranks every domain with cookies. Managed Auth is a separate flow: capacity from org limits, skip/refresh existing connections without consuming quota, per-site login choice, and 1Password vault-aware identity. Bitwarden candidate lookup is parallelized (max 4). Cookie SQL filtering uses a CTE so large site lists stay valid.
Auth distinguishes missing credentials vs storage/refresh failures so the connector can prompt login without hiding real errors. Login cancel is a distinct error; connector login requires tokens to persist.
Reviewed by Cursor Bugbot for commit 3bc8e01. Bugbot is set up for automated code reviews on this repo. Configure here.