browser-cookie-bridge 1.0.0 → 1.2.0

package/README.md

@@ -4,15 +4,16 @@
 
 <h1>Browser Cookie Bridge</h1>
 
-<strong>Move cookies and signed-in sessions between browsers—locally on your Mac.</strong>
+<strong>Move signed-in sessions locally—or explicitly upload one to Browserless Cloud.</strong>
 
-<p>Brave, Chrome, Edge, Arc, Vivaldi, Opera, and Comet · browser-to-browser transfer · import into ChatGPT Codex.</p>
+<p>Brave, Chrome, Edge, Arc, Vivaldi, Opera, and Comet · ChatGPT Codex import · optional Browserless authenticated profiles.</p>
 
 <p>
-  <img src="https://img.shields.io/badge/macOS-13%2B-111111?logo=apple&logoColor=white" alt="macOS 13+" />
+  <img src="https://img.shields.io/badge/macOS-13.5%2B-111111?logo=apple&logoColor=white" alt="macOS 13.5+" />
   <img src="https://img.shields.io/badge/Swift-6-8E2735?logo=swift&logoColor=white" alt="Swift 6" />
-  <img src="https://img.shields.io/badge/Node.js-22.5%2B-3C873A?logo=nodedotjs&logoColor=white" alt="Node.js 22.5+" />
-  <img src="https://img.shields.io/badge/local--first-no%20cloud-C68B3C" alt="Local-first, no cloud" />
+  <img src="https://img.shields.io/badge/Node.js-24%2B-3C873A?logo=nodedotjs&logoColor=white" alt="Node.js 24+" />
+  <a href="https://www.npmjs.com/package/browser-cookie-bridge"><img src="https://img.shields.io/npm/v/browser-cookie-bridge?logo=npm&color=CB3837" alt="browser-cookie-bridge on npm" /></a>
+  <img src="https://img.shields.io/badge/local--first-cloud%20optional-C68B3C" alt="Local-first, cloud optional" />
   <img src="https://img.shields.io/github/stars/apoorvdarshan/browser-cookie-bridge?logo=github&color=C68B3C" alt="GitHub stars" />
   <a href="https://www.producthunt.com/products/browser-cookie-bridge"><img src="https://img.shields.io/badge/Product%20Hunt-View%20launch-DA552F?logo=producthunt&logoColor=white" alt="Browser Cookie Bridge on Product Hunt" /></a>
   <img src="https://img.shields.io/badge/license-MIT-3DA639" alt="MIT License" />
@@ -20,6 +21,8 @@
 
 <p>
   <a href="#installation"><b>Install</b></a> ·
+  <a href="https://github.com/apoorvdarshan/browser-cookie-bridge/releases/latest">DMG</a> ·
+  <a href="https://www.npmjs.com/package/browser-cookie-bridge">npm</a> ·
   <a href="#how-it-works">How it works</a> ·
   <a href="#security--privacy">Security</a> ·
   <a href="CONTRIBUTING.md">Contribute</a> ·
@@ -28,7 +31,10 @@
   <a href="#support">Support</a>
 </p>
 
-<p><code>npm run build:app</code></p>
+<p>
+  <a href="https://github.com/apoorvdarshan/browser-cookie-bridge/releases/latest/download/Browser-Cookie-Bridge-arm64.dmg"><b>Download for Apple silicon</b></a>
+  · <a href="https://github.com/apoorvdarshan/browser-cookie-bridge/releases/latest/download/Browser-Cookie-Bridge-x64.dmg">Download for Intel</a>
+</p>
 
 <br />
 
@@ -38,24 +44,25 @@
 
 ---
 
-> **Status — local beta.** The native app and transfer engine work locally; the first public npm release has not been published yet. Importing into ChatGPT Codex is an intentionally unsupported direct integration and requires Codex to be completely closed.
+> **Version 1.2.0 adds an optional Browserless Cloud destination.** It is destination-only, manual-only, and visually separated from local transfers. Importing into ChatGPT Codex remains an intentionally unsupported direct integration and requires Codex to be completely closed.
 
 ## Why Browser Cookie Bridge
 
 Signing into the same sites across several browsers is repetitive. Export files are awkward, password managers do not move active sessions, and ChatGPT Codex does not currently offer a Brave import button.
 
-Browser Cookie Bridge gives those local browser profiles a small, native control panel. Pick where data comes from, pick where it goes, choose cookies or history, and sync. Transfers stay on the Mac you are using.
+Browser Cookie Bridge gives those browser profiles a small, native control panel. Local browser and Codex transfers stay on the Mac. If you explicitly select Browserless Cloud and click Upload, the app can instead send authenticated profile state to your own Browserless account.
 
 ## Features
 
 - 🍪 **Cookie and session transfer** — cookies are enabled by default, including supported domain, path, expiry, security, `SameSite`, and partition attributes.
 - 🌐 **Seven Chromium browsers** — Brave, Chrome, Edge, Arc, Vivaldi, Opera, and Perplexity Comet can be sources or destinations.
 - ✨ **ChatGPT Codex import** — merge selected local browser data into Codex's built-in browser; Codex is destination-only.
+- ☁️ **Optional Browserless upload** — create or refresh a Browserless authenticated profile with cookies, local storage, and IndexedDB; Browserless is destination-only and manual-only.
 - 🕘 **Background automation** — sync when you sign in, at a fixed daily time, or whenever you choose.
 - ◉ **Native menu-bar app** — closing the window removes the Dock icon while the helper continues running.
 - 🧯 **Backup and rollback** — Codex's database is backed up, modified on a separate copy, integrity-checked, and restored if replacement fails.
-- ⬆️ **Built-in updates** — automatically checks npm release metadata and can install an update and relaunch the app.
-- 🔒 **Local-first** — no account, analytics, cloud service, cookie logs, or remote relay.
+- ⬆️ **Built-in updates** — checks for GitHub releases, verifies the DMG checksum, installs in place, and relaunches the app.
+- 🔒 **Local-first** — local paths use no account, analytics, cookie logs, or remote relay; the separate Browserless path runs only after explicit selection and confirmation.
 
 ## What it transfers
 
@@ -63,6 +70,7 @@ Browser Cookie Bridge gives those local browser profiles a small, native control
 |---|---:|---|
 | **Cookies and sessions** | ✅ Default | Transfers supported cookie values and attributes |
 | **History URLs** | ◐ Optional | Original visit times and page titles cannot be preserved |
+| **Local storage and IndexedDB** | ◐ Browserless only | Included only in an explicit Browserless authenticated-profile upload |
 | **Passwords** | — Never | Chromium extensions cannot read the browser password store |
 | **Bookmarks, autofill, payments** | — Never | Not requested or accessed |
 | **iCloud Keychain** | — Never | Remains completely separate |
@@ -71,27 +79,23 @@ Some websites bind sessions to a specific device or browser and may ask you to s
 
 ## Requirements
 
-- **macOS 13 (Ventura)+**
-- **Node.js 22.5+**
-- **Xcode Command Line Tools** — install with `xcode-select --install`
+- **macOS 13.5+**
 - A supported Chromium browser, or ChatGPT Codex as the destination
 
+The DMG is self-contained. Node.js 24+ and Xcode Command Line Tools are required only for npm or source installation.
+
 ## Installation
 
-### From source
+### Download a DMG — recommended
 
-```bash
-git clone https://github.com/apoorvdarshan/browser-cookie-bridge.git
-cd browser-cookie-bridge
-npm test
-npm run build:app
-```
+- **[Apple silicon DMG](https://github.com/apoorvdarshan/browser-cookie-bridge/releases/latest/download/Browser-Cookie-Bridge-arm64.dmg)** — M1, M2, M3, M4, and newer
+- **[Intel DMG](https://github.com/apoorvdarshan/browser-cookie-bridge/releases/latest/download/Browser-Cookie-Bridge-x64.dmg)** — Intel-based Macs
 
-The final command compiles the native SwiftUI app, enables **Open at login**, **Sync at login**, and the **menu-bar helper**, then launches it. A first install uses `~/Applications/Browser Cookie Bridge.app` without requesting administrator access. If an existing `/Applications/Browser Cookie Bridge.app` is present, later builds and updates keep using that system Applications copy instead of creating a duplicate. Daily sync stays off until you enable it.
+Open the DMG, drag **Browser Cookie Bridge** onto **Applications**, then open it from Applications. The current public build is checksum-verified and ad-hoc signed but not Apple-notarized, so macOS may require **Control-click → Open** on first launch. It does not require Node.js, Xcode, Terminal, or an administrator password.
 
 ### Via npm
 
-The package will be installable after the first tagged release:
+Run the published package directly:
 
 ```bash
 npx browser-cookie-bridge install-app
@@ -99,6 +103,21 @@ npx browser-cookie-bridge install-app
 
 No administrator password is needed. The app is built from source on your Mac and installed in your user Applications folder unless an existing writable system Applications copy is being updated.
 
+Both installation methods use the same bundle identifier and the same settings under `~/Library/Application Support/BraveCodexCookieSync`. Installing the DMG after npm does not create a separate product identity: the system Applications copy becomes canonical, and a stale matching user Applications copy is moved to the Trash on launch. Future updates replace that same app in place.
+
+**[View `browser-cookie-bridge` on npm →](https://www.npmjs.com/package/browser-cookie-bridge)**
+
+### From source
+
+```bash
+git clone https://github.com/apoorvdarshan/browser-cookie-bridge.git
+cd browser-cookie-bridge
+npm test
+npm run build:app
+```
+
+The final command compiles the native SwiftUI app, enables **Open at login**, **Sync at login**, and the **menu-bar helper**, then launches it. A first install uses `~/Applications/Browser Cookie Bridge.app` without requesting administrator access. If an existing `/Applications/Browser Cookie Bridge.app` is present, later builds and updates keep using that system Applications copy instead of creating a duplicate. Daily sync stays off until you enable it.
+
 ## Setup
 
 ### Browser → ChatGPT Codex
@@ -123,21 +142,34 @@ Browser-to-browser transfers use a small unpacked extension at each selected end
 
 Generated extensions live under `~/Library/Application Support/BraveCodexCookieSync/` and contain a random, user-only local broker token. Do not share those folders.
 
+### Browser → Browserless Cloud (optional)
+
+This path uses the official Browserless CLI and is deliberately separate from local sync.
+
+1. Select **Browserless Cloud** as the destination.
+2. Enter your Browserless API token, cloud profile name, region, and optional domain allowlist. The token is stored in macOS Keychain; it is never written to the app configuration or command arguments.
+3. Quit the selected source browser so its profile can be copied consistently.
+4. Review the cloud warning and click **Upload now**.
+
+The upload creates the named Browserless profile the first time and refreshes it on later runs. It may contain cookies, local storage, and IndexedDB; history and saved passwords are excluded. Browserless uploads never run from Daily sync or Sync at login. Browser Cookie Bridge disables Browserless CLI telemetry for this integration. Comet is not currently supported by the Browserless capture CLI.
+
+The official CLI records the Browserless upload-disclaimer acceptance timestamp in `~/.browserless/config.json`. Browser Cookie Bridge does not store its API token there.
+
 ## Usage
 
 | Control | What it does |
 |---|---|
 | **Export from** | Selects the browser whose data will be read |
-| **Import into** | Selects a different browser or ChatGPT Codex |
+| **Import into** | Selects a different browser, ChatGPT Codex, or optional Browserless Cloud |
 | **Cookies** | Moves cookies and supported session attributes; on by default |
 | **History URLs** | Adds visited URLs without their original timestamps or titles |
 | **Daily sync** | Runs at one fixed local time; off by default |
 | **Sync at login** | Runs once whenever you sign in; on by default |
 | **Open at login** | Starts the background app after macOS login; on by default |
 | **Show in menu bar** | Keeps sync, status, updates, and support actions close at hand |
-| **Check for updates** | Finds a newer npm release and offers install + relaunch |
+| **Check for updates** | Finds a newer GitHub release, verifies its DMG, and offers install + relaunch |
 
-Automation always uses the source, destination, and data choices currently saved in the app. A scheduled Codex sync safely exits without making changes when Codex is open.
+Automation uses the saved source, destination, and data choices for local transfers. A scheduled Codex sync safely exits without making changes when Codex is open. Browserless cloud uploads are always manual and require an explicit upload action.
 
 ## CLI
 
@@ -145,7 +177,7 @@ Automation always uses the source, destination, and data choices currently saved
 browser-cookie-bridge install-app [--no-open]
 browser-cookie-bridge setup [--hour 9] [--minute 0] [--no-schedule]
 browser-cookie-bridge preferences --source brave --target codex --cookies on --history off
-browser-cookie-bridge sync [--timeout 300]
+browser-cookie-bridge sync [--timeout 300] [--allow-cloud-upload]
 browser-cookie-bridge doctor
 browser-cookie-bridge enable-login-sync
 browser-cookie-bridge disable-login-sync
@@ -154,7 +186,7 @@ browser-cookie-bridge disable-app-login
 browser-cookie-bridge remove-schedule
 ```
 
-Supported source IDs are `brave`, `chrome`, `edge`, `arc`, `vivaldi`, `opera`, and `comet`. Target IDs are the same plus `codex`. The same browser cannot be both endpoints.
+Supported source IDs are `brave`, `chrome`, `edge`, `arc`, `vivaldi`, `opera`, and `comet`. Target IDs are the same plus `codex` and `browserless`. The same browser cannot be both endpoints. Browserless requires `BROWSERLESS_TOKEN` and the explicit `--allow-cloud-upload` flag; the native app supplies the token from Keychain without placing it in the OS command line or app configuration.
 
 ## How it works
 
@@ -162,6 +194,7 @@ Supported source IDs are `brave`, `chrome`, `edge`, `arc`, `vivaldi`, `opera`, a
 |---|---|
 | **Browser → browser** | Unpacked extensions connect to a short-lived broker on IPv4 loopback. Selected data stays in memory and is never written to logs. |
 | **Browser → Codex** | The app reads the selected local Chromium profile, creates a consistent Codex SQLite backup, merges into a working copy, validates it, then replaces the destination atomically. |
+| **Browser → Browserless** | The bundled official Browserless CLI copies a closed local profile, captures cookies/local storage/IndexedDB, and uploads it directly to the selected Browserless region. |
 
 The broker validates a random token and extension origin, limits payload size, and normally exits after five minutes. Only the endpoints selected in the app respond to a transfer.
 
@@ -173,6 +206,7 @@ The broker validates a random token and extension origin, limits payload size, a
 - The app refuses unknown Codex database schemas instead of guessing.
 - Imported Codex rows use an empty `encrypted_value` because OpenAI's Safe Storage key is protected by a private macOS Keychain access group. Those imported rows can therefore remain readable to software running as your macOS user until the website refreshes them.
 - Anyone who can use your logged-in macOS account or modify a generated extension may be able to access transferred browser sessions.
+- The optional Browserless destination sends authenticated state to Browserless under their terms and privacy practices. Its API token is stored in macOS Keychain, uploads are manual, and Browserless CLI telemetry is disabled by the app.
 
 Cookies are credentials. Review the source, protect your macOS account, and transfer only between profiles you trust.
 
@@ -180,12 +214,12 @@ Found a vulnerability? Read [SECURITY.md](SECURITY.md) and report it privately.
 
 ## Releases
 
-Pushing a semantic version tag runs tests, validates that package and app versions match, publishes to npm, and creates a GitHub Release with the tarball attached.
+Pushing a semantic version tag runs tests, validates that package and app versions match, builds separate Apple-silicon and Intel DMGs, publishes to npm, and creates a GitHub Release with the tarball, DMGs, and SHA-256 files attached.
 
 ```bash
 npm run release:check
-git tag v1.0.0
-git push origin v1.0.0
+git tag vX.Y.Z
+git push origin vX.Y.Z
 ```
 
 A normal branch push does not publish anything.
@@ -199,6 +233,8 @@ Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for local setu
 If Browser Cookie Bridge is useful to you:
 
 - ⭐ **Star** the repository
+- ⬇️ **[Download the latest DMG](https://github.com/apoorvdarshan/browser-cookie-bridge/releases/latest)**
+- 📦 **[Install from npm](https://www.npmjs.com/package/browser-cookie-bridge)**
 - 🐛 **[Report a bug](https://github.com/apoorvdarshan/browser-cookie-bridge/issues/new?template=bug_report.yml)** — never include cookie values or tokens
 - ☕ **[Support on Ko-fi](https://ko-fi.com/apoorvdarshan)**
 - 𝕏 **Follow [@apoorvdarshan](https://x.com/apoorvdarshan)**
@@ -218,4 +254,4 @@ npm run web
 
 [MIT](LICENSE) © 2026 [Apoorv Darshan](https://github.com/apoorvdarshan)
 
-<sub>Not affiliated with Brave, Google, Microsoft, The Browser Company, Vivaldi, Opera, Perplexity, or OpenAI. Their names and marks belong to their respective owners.</sub>
+<sub>Not affiliated with Brave, Google, Microsoft, The Browser Company, Vivaldi, Opera, Perplexity, OpenAI, or Browserless. Their names and marks belong to their respective owners.</sub>

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,11 @@
+# Third-party notices
+
+Browser Cookie Bridge includes the official Browserless CLI for the optional, user-initiated Browserless Cloud destination.
+
+## @browserless.io/cli
+
+- Version: 0.3.0
+- License: MIT
+- Source: https://github.com/browserless/browserless-cli
+
+The Browserless CLI's license and the licenses shipped with its npm dependencies remain included inside `node_modules` in self-contained app builds. Browser Cookie Bridge disables Browserless CLI telemetry for uploads started through this app.

package/extension-template/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Browser Cookie Bridge",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "Transfers selected browser data locally between supported browsers and into ChatGPT Codex.",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5o6lDkXzU/23Jm2QRk4mfuxNnr3VlEIjRHcZr93Gdo7PI7asHJQhigaMGT6UOz0lkaTn1F+TGIPlsJo9GNBSsxbCfxWoBSXcFQFrPolY5LEfKaMtZQQ6eb4UAnp+bbUwb1den4On0piWU47Yzl6i0Jcdg4EG5H1kCSF/6nJsbKgF7OTaR/3drULu40yRvflzSXRhly3UDO7c5mgHJsaMwVV+VILsxbcPOoRINjuo3zDC737HFs67dpf38xF3tjSVL0HURAWKKobMvfABiDfVEm5O0Lvf+57d1Ib12QLT2qtVXNDy3iYwX+w2S0wH2vIMsfvoFPlRdmeqft70kZOqXwIDAQAB",
   "permissions": ["alarms", "cookies", "history"],

package/macos-app/Info.plist

@@ -10,9 +10,9 @@
   <key>CFBundleInfoDictionaryVersion</key><string>6.0</string>
   <key>CFBundleName</key><string>Browser Cookie Bridge</string>
   <key>CFBundlePackageType</key><string>APPL</string>
-  <key>CFBundleShortVersionString</key><string>1.0.0</string>
-  <key>CFBundleVersion</key><string>24</string>
-  <key>LSMinimumSystemVersion</key><string>13.0</string>
+  <key>CFBundleShortVersionString</key><string>1.2.0</string>
+  <key>CFBundleVersion</key><string>26</string>
+  <key>LSMinimumSystemVersion</key><string>13.5</string>
   <key>NSHighResolutionCapable</key><true/>
 </dict>
 </plist>

package/macos-app/Resources/BrowserIcons/browserless.svg

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="256px" height="256px" viewBox="0 0 256 256">
+  <style>.s0{fill:black}@media (prefers-color-scheme:dark){.s0{fill:white}}</style>
+  <path class="s0" d="M 60.96875 0 C 61.0625 0.03125 67.5625 3.75 89.75 16.625 L 89.75 119.5625 C 89.75 217.46875 89.78125 222.5 90.1875 222.375 C 90.4375 222.3125 107.625 213.875 166.21875 185.125 L 166.25 169.6875 C 166.25 157.4375 166.1875 154.28125 165.9375 154.34375 C 165.78125 154.40625 155.03125 159.34375 142.0625 165.34375 C 129.09375 171.34375 118.4375 176.21875 118.375 176.1875 C 118.3125 176.15625 118.3125 144.09375 118.375 33.78125 L 147.25 50.78125 L 147.53125 114.875 L 195.375 142.71875 L 195.5 203.625 L 142.21875 229.75 C 112.9375 244.125 88.75 255.90625 88.53125 255.9375 C 88.3125 256 81.90625 251.875 60.46875 237.625 L 60.5 163.5 C 60.5 122.71875 60.5625 69.28125 60.6875 44.6875 C 60.75 20.09375 60.90625 0 60.96875 0 Z" />
+</svg>
+