browser-cookie-bridge 1.4.7 → 1.5.0

package/README.md

@@ -6,7 +6,7 @@
 
 <strong>Move signed-in sessions locally—or explicitly upload one to Browserless Cloud.</strong>
 
-<p>Brave, Chrome, Edge, Arc, Vivaldi, Opera, and Comet · ChatGPT Codex import · optional Browserless authenticated profiles.</p>
+<p>Brave, Chrome, Edge, Arc, Vivaldi, Opera, and Comet · ChatGPT Codex and experimental Cursor browser import · encrypted Grok Bot <code>.bcbx</code> export · optional Browserless authenticated profiles.</p>
 
 <p>
   <img src="https://img.shields.io/badge/macOS-13.5%2B-111111?logo=apple&logoColor=white" alt="macOS 13.5+" />
@@ -46,13 +46,13 @@
 
 ---
 
-> **Version 1.4.0 adds an optional one-click Codex restart flow.** When enabled for a manual sync, Browser Cookie Bridge force quits Codex, waits for its database to close, performs the verified local transfer, preserves the imported/skipped/failed counts, and reopens Codex only after success. The option is off by default.
+> **Version 1.5.0 adds experimental Cursor browser import and encrypted Grok Bot `.bcbx` export.** Cursor is destination-only and currently imports cookie sessions into its dedicated browser partition. Grok Bot writes a one-time encrypted transfer file with a bundled importer and a one-time key: attach the `.bcbx` file to any Grok Bot, paste the prompt, and enter the key privately when asked. Cookie values must never be logged or pasted into chat. The optional Codex restart flow from 1.4.0 is unchanged and remains off by default.
 
 ## Why Browser Cookie Bridge
 
-Signing into the same sites across several browsers is repetitive. Export files are awkward, password managers do not move active sessions, and ChatGPT Codex does not currently offer a Brave import button.
+Signing into the same sites across several browsers is repetitive. Export files are awkward, password managers do not move active sessions, and embedded app browsers do not always offer an import button.
 
-Browser Cookie Bridge gives those browser profiles a small, native control panel. Local browser and Codex transfers stay on the Mac. If you explicitly select Browserless Cloud and click Upload, the app can instead send authenticated profile state to your own Browserless account.
+Browser Cookie Bridge gives those browser profiles a small, native control panel. Local browser, Codex, and Cursor transfers stay on the Mac. Grok Bot uses a one-time encrypted transfer file that you attach yourself. If you explicitly select Browserless Cloud and click Upload, the app can instead send authenticated profile state to your own Browserless account.
 
 ## Windows waitlist
 
@@ -63,15 +63,16 @@ Browser Cookie Bridge currently ships for macOS. A separate Windows app is being
 - 🍪 **Cookie and session transfer** — cookies are enabled by default, including supported domain, path, expiry, security, `SameSite`, and partition attributes.
 - 🗃️ **Optional full site data for Codex** — replace Codex's compatible Local Storage, IndexedDB, Session Storage, service-worker, and related origin stores from a closed source profile, with backup and rollback. Off by default.
 - 🌐 **Seven Chromium browsers** — Brave, Chrome, Edge, Arc, Vivaldi, Opera, and Perplexity Comet can be sources or destinations.
-- ✨ **ChatGPT Codex import** — merge selected local browser data into Codex's built-in browser; Codex is destination-only.
+- ✨ **ChatGPT Codex and experimental Cursor import** — merge cookie sessions into either app's built-in browser; Codex also supports optional history and full site data. Both are destination-only. Cursor import is experimental: it writes only to Cursor's dedicated `Partitions/cursor-browser` profile and refuses unknown schemas.
+- 🤖 **Encrypted Grok Bot transfer (`.bcbx`)** — export cookie sessions into a local encrypted bundle with a one-time key and bundled importer. The destination tile uses the official Grok Bot app icon. Attach the file to any Grok Bot; the importer runs on the cloud computer only. Manual only.
 - 🔁 **Optional Codex restart** — manual Sync can force quit a running Codex instance and reopen it only after a successful local transfer; off by default.
 - 🔄 **Optional two-app restart** — Full site data can force quit the selected source browser and Codex, then reopen only the apps that were running after a successful transfer; off by default.
 - ☁️ **Optional Browserless upload** — create or refresh a Browserless authenticated profile with cookies, local storage, and IndexedDB; see a local size preflight, live progress, cancellation, and post-upload verification.
 - 🕘 **Background automation** — sync when you sign in, at a fixed daily time, or whenever you choose.
 - ◉ **Native menu-bar app** — closing the window removes the Dock icon while the helper continues running.
-- 🧯 **Backup and rollback** — Codex's database is backed up, modified on a separate copy, integrity-checked, and restored if replacement fails.
+- 🧯 **Backup and rollback** — the destination app browser's database is backed up, modified on a separate copy, integrity-checked, and restored if replacement fails.
 - ⬆️ **Built-in updates** — checks for GitHub releases, verifies the DMG checksum, installs in place, and relaunches the app.
-- 🔒 **Local-first** — local paths use no account, analytics, cookie logs, or remote relay; the separate Browserless path runs only after explicit selection and confirmation.
+- 🔒 **Local-first** — local paths use no account, analytics, cookie logs, or remote relay; Grok Bot writes an encrypted file you attach yourself; the separate Browserless path runs only after explicit selection and confirmation.
 
 ## What it transfers
 
@@ -79,7 +80,8 @@ Browser Cookie Bridge currently ships for macOS. A separate Windows app is being
 |---|---:|---|
 | **Cookies and sessions** | ✅ Default | Transfers supported cookie values and attributes |
 | **Full site data → Codex** | Optional | Replaces compatible origin storage from a closed Chromium profile; backs up Codex first |
-| **History URLs** | ◐ Optional | Original visit times and page titles cannot be preserved |
+| **Encrypted Grok Bot export** | Manual | Cookie sessions only, written to a local `.bcbx` file; history and full site data are excluded |
+| **History URLs** | ◐ Optional | Supported for browser and Codex targets; excluded for Cursor and Grok Bot. Original visit times and page titles cannot be preserved |
 | **Local storage and IndexedDB** | ◐ Optional | Full site data into Codex, or an explicit Browserless authenticated-profile upload |
 | **Passwords** | — Never | Chromium extensions cannot read the browser password store |
 | **Bookmarks, autofill, payments** | — Never | Not requested or accessed |
@@ -90,7 +92,7 @@ Some websites bind sessions to a specific device or browser and may ask you to s
 ## Requirements
 
 - **macOS 13.5+**
-- A supported Chromium browser, or ChatGPT Codex as the destination
+- A supported Chromium browser as the source, plus ChatGPT Codex, Cursor, Grok Bot, another supported browser, or optional Browserless Cloud as the destination
 
 The DMG is self-contained. Node.js 24+ and Xcode Command Line Tools are required only for npm or source installation.
 
@@ -143,16 +145,40 @@ The final command compiles the native SwiftUI app, enables **Open at login**, **
 
 ## Setup
 
-### Browser → ChatGPT Codex
+### Browser → ChatGPT Codex or Cursor
 
 No browser extension is needed for this path.
 
-1. Select a source browser and **ChatGPT Codex** as the destination.
-2. Quit Codex completely, or enable **Restart Codex automatically**. Closing only its browser panel is not enough.
-3. Choose **Cookies** and, optionally, **History URLs**.
-4. Press **Sync now** and reopen Codex after the success message if automatic restart is off.
+Cursor support is experimental and currently limited to cookie sessions in its dedicated browser partition. The importer validates the audited Cursor schema and fails closed if Cursor changes it.
 
-By default, an open Codex blocks the transfer. The optional **Restart Codex automatically** setting applies only to a manual Sync: it force quits Codex, waits for its database to close, and reopens Codex only after the transfer succeeds. Scheduled and login syncs never force quit it.
+1. Select a source browser and **ChatGPT Codex** or **Cursor browser** as the destination.
+2. Quit the destination app completely. For Codex, you can instead enable **Restart Codex automatically**. Closing only the app's browser panel is not enough.
+3. Choose **Cookies**. For Codex, you can also choose **History URLs** and **Full site data**. Both are excluded for Cursor until its other browser stores can be validated safely.
+4. Press **Sync now**, then reopen the destination app after the success message.
+
+An open destination app blocks the transfer. The optional **Restart Codex automatically** setting applies only to a manual Codex sync: it force quits Codex, waits for its database to close, and reopens Codex only after the transfer succeeds. Cursor must be quit manually. Scheduled and login syncs never force quit either app.
+
+### Browser → Grok Bot (encrypted `.bcbx`)
+
+No browser extension is needed for this path.
+
+Grok Bot cannot receive a local database merge. The app writes a one-time encrypted transfer file that you attach to any Grok Bot.
+
+1. Select a source browser and **Grok Bot** as the destination. The tile uses the official Grok Bot app icon.
+2. Keep **Cookies** on. History URLs and Full site data are excluded from Grok Bot transfer files.
+3. Optionally limit the export with **Only these domains**. Leave it blank to include every readable cookie.
+4. Press **Create transfer file** and choose where to save `GrokBot-Import.bcbx`.
+5. The result sheet shows the one-time decryption key and the prompt to paste. Use **Reveal file** or **Copy prompt**. Keep the key off chat logs; do not paste cookie values into chat.
+6. Attach the `.bcbx` file to any Grok Bot, paste the prompt, then enter the one-time key privately through Agent Computer when asked.
+
+The bundle is a zip-compatible `.bcbx` file containing `manifest.json`, encrypted `payload.enc`, `import.mjs`, and `PROMPT.txt`. Cookies are encrypted with AES-256-GCM using a scrypt-derived key. The file is written with user-only permissions (`0600`). Daily sync and Sync at login never create Grok Bot bundles.
+
+On the Grok Bot cloud computer the bundled importer:
+
+1. Expects you to unzip `GrokBot-Import.bcbx` and run `node import.mjs`.
+2. Prompts for the one-time decryption key. Do not print cookie names or values.
+3. Injects cookies into the cloud browser and reports only how many cookies were imported.
+4. Deletes the unzipped files and the bundle copy.
 
 ### Browser → browser
 
@@ -187,7 +213,7 @@ The official CLI records the Browserless upload-disclaimer acceptance timestamp
 | Control | What it does |
 |---|---|
 | **Export from** | Selects the browser whose data will be read |
-| **Import into** | Selects a different browser, ChatGPT Codex, or optional Browserless Cloud |
+| **Import into** | Selects a different browser, ChatGPT Codex, experimental Cursor browser, Grok Bot, or optional Browserless Cloud |
 | **Cookies** | Moves cookies and supported session attributes; on by default |
 | **History URLs** | Adds visited URLs without their original timestamps or titles |
 | **Daily sync** | Runs at one fixed local time; off by default |
@@ -197,15 +223,15 @@ The official CLI records the Browserless upload-disclaimer acceptance timestamp
 | **Restart Codex automatically** | Force quits Codex for a manual sync and reopens it only after success; off by default |
 | **Check for updates** | Finds a newer GitHub release, verifies its DMG, and offers install + relaunch |
 
-Automation uses the saved source, destination, and data choices for local transfers. A scheduled Codex sync safely exits without making changes when Codex is open. Browserless cloud uploads are always manual and require an explicit upload action.
+Automation uses the saved source, destination, and data choices for local transfers. A scheduled embedded-browser sync safely exits without making changes when its destination app is open. Browserless cloud uploads and Grok Bot `.bcbx` exports are always manual.
 
 ## CLI
 
 ```bash
 browser-cookie-bridge install-app [--no-open] [--replace-system-from-source]
 browser-cookie-bridge setup [--hour 9] [--minute 0] [--no-schedule]
-browser-cookie-bridge preferences --source brave --target codex --cookies on --history off --site-storage off --auto-restart-codex off --auto-restart-both off
-browser-cookie-bridge sync [--timeout 300] [--allow-cloud-upload]
+browser-cookie-bridge preferences --source brave --target codex --cookies on --history off --site-storage off --auto-restart-codex off --auto-restart-both off [--grok-bot-domains example.com]
+browser-cookie-bridge sync [--timeout 300] [--allow-cloud-upload] [--output /path/GrokBot-Import.bcbx]
 browser-cookie-bridge browserless-preflight
 browser-cookie-bridge doctor
 browser-cookie-bridge enable-login-sync
@@ -215,26 +241,28 @@ browser-cookie-bridge disable-app-login
 browser-cookie-bridge remove-schedule
 ```
 
-Supported source IDs are `brave`, `chrome`, `edge`, `arc`, `vivaldi`, `opera`, and `comet`. Target IDs are the same plus `codex` and `browserless`. The same browser cannot be both endpoints. Browserless requires `BROWSERLESS_TOKEN` and the explicit `--allow-cloud-upload` flag; the native app supplies the token from Keychain without placing it in the OS command line or app configuration.
+Supported source IDs are `brave`, `chrome`, `edge`, `arc`, `vivaldi`, `opera`, and `comet`. Target IDs are the same plus `codex`, `cursor`, `browserless`, and `grok-bot`. The same browser cannot be both endpoints. Cursor import currently supports cookies only. Grok Bot export requires `--output /path/GrokBot-Import.bcbx` and writes cookies only; `--grok-bot-domains` optionally limits the bundle. The CLI prints a one-time decryption key after export—keep it private and never paste cookie values into chat. Browserless requires `BROWSERLESS_TOKEN` and the explicit `--allow-cloud-upload` flag; the native app supplies the token from Keychain without placing it in the OS command line or app configuration.
 
 ## How it works
 
 | Path | Transfer method |
 |---|---|
 | **Browser → browser** | Unpacked extensions connect to a short-lived broker on IPv4 loopback. Selected data stays in memory and is never written to logs. |
-| **Browser → Codex** | The app reads the selected local Chromium profile, creates a consistent Codex SQLite backup, merges into a working copy, validates it, then replaces the destination atomically. |
+| **Browser → Codex / Cursor** | The app reads the selected local Chromium profile, creates a consistent destination SQLite backup, merges cookies into a working copy, validates it, then replaces only the embedded browser's cookie database atomically. Codex also supports optional history and full site data. Cursor import is experimental and limited to the dedicated browser-partition cookie store. |
+| **Browser → Grok Bot** | The app reads the selected local Chromium profile, encrypts cookie sessions into a `.bcbx` bundle with a one-time key, and writes that file locally. You attach it to a Grok Bot; the bundled importer decrypts and injects cookies on the cloud computer only. |
 | **Browser → Browserless** | The bundled official Browserless CLI copies a closed local profile, captures cookies/local storage/IndexedDB, and uploads it directly to the selected Browserless region. |
 
 The broker validates a random token and extension origin, limits payload size, and normally exits after five minutes. Only the endpoints selected in the app respond to a transfer.
 
 ## Security & privacy
 
-- Cookie values and history URLs are never logged.
+- Cookie values and history URLs are never logged. Never paste cookie values or Grok Bot decryption keys into chat.
 - Browser-to-browser data is held only in broker memory.
-- Codex backups are stored with user-only permissions under `~/Library/Application Support/BraveCodexCookieSync/backups/codex`; the newest 14 are retained.
-- Full site-data import is opt-in and requires both Codex and the source browser to be closed. It replaces compatible Codex origin-storage directories rather than attempting an unsafe LevelDB merge; the previous directories are included in the same backup.
-- The app refuses unknown Codex database schemas instead of guessing.
-- Imported Codex rows use an empty `encrypted_value` because OpenAI's Safe Storage key is protected by a private macOS Keychain access group. Those imported rows can therefore remain readable to software running as your macOS user until the website refreshes them.
+- Grok Bot `.bcbx` files are encrypted locally with AES-256-GCM. Treat the bundle and its one-time key as credentials. Enter the key privately through Agent Computer when the importer asks; do not ask Grok Bot to print cookie names or values. The bundled importer reports only import counts, then deletes the unzipped files and the bundle copy.
+- Direct-import backups are stored with user-only permissions under `~/Library/Application Support/BraveCodexCookieSync/backups/codex` or `backups/cursor`; the newest 14 per destination are retained.
+- Full site-data import is opt-in for Codex and requires both Codex and the source browser to be closed. It replaces compatible origin-storage directories rather than attempting an unsafe LevelDB merge; the previous directories are included in the same backup.
+- The app refuses unknown destination database schemas instead of guessing and writes only to Cursor's dedicated `Partitions/cursor-browser` profile, never Cursor's main application cookie store.
+- Direct imports currently store imported cookie values in SQLite's plaintext `value` column with an empty `encrypted_value`. Those imported rows can therefore remain readable to software running as your macOS user until the website refreshes them.
 - Anyone who can use your logged-in macOS account or modify a generated extension may be able to access transferred browser sessions.
 - The optional Browserless destination sends authenticated state to Browserless under their terms and privacy practices. Its API token is stored in macOS Keychain, uploads are manual, and Browserless CLI telemetry is disabled by the app.
 
@@ -294,4 +322,4 @@ npm run web
 
 [MIT](LICENSE) © 2026 [Apoorv Darshan](https://github.com/apoorvdarshan)
 
-<sub>Not affiliated with Brave, Google, Microsoft, The Browser Company, Vivaldi, Opera, Perplexity, OpenAI, or Browserless. Their names and marks belong to their respective owners.</sub>
+<sub>Not affiliated with Brave, Google, Microsoft, The Browser Company, Vivaldi, Opera, Perplexity, OpenAI, Cursor, xAI, or Browserless. Their names and marks belong to their respective owners.</sub>

package/extension-template/manifest.json

@@ -1,8 +1,8 @@
 {
   "manifest_version": 3,
   "name": "Browser Cookie Bridge",
-  "version": "1.4.7",
-  "description": "Transfers selected browser data locally between supported browsers and into ChatGPT Codex.",
+  "version": "1.5.0",
+  "description": "Transfers selected browser data locally between supported browsers and embedded app browsers.",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5o6lDkXzU/23Jm2QRk4mfuxNnr3VlEIjRHcZr93Gdo7PI7asHJQhigaMGT6UOz0lkaTn1F+TGIPlsJo9GNBSsxbCfxWoBSXcFQFrPolY5LEfKaMtZQQ6eb4UAnp+bbUwb1den4On0piWU47Yzl6i0Jcdg4EG5H1kCSF/6nJsbKgF7OTaR/3drULu40yRvflzSXRhly3UDO7c5mgHJsaMwVV+VILsxbcPOoRINjuo3zDC737HFs67dpf38xF3tjSVL0HURAWKKobMvfABiDfVEm5O0Lvf+57d1Ib12QLT2qtVXNDy3iYwX+w2S0wH2vIMsfvoFPlRdmeqft70kZOqXwIDAQAB",
   "permissions": ["alarms", "cookies", "history"],
   "host_permissions": ["<all_urls>", "http://127.0.0.1/*"],

package/macos-app/Info.plist

@@ -10,8 +10,8 @@
   <key>CFBundleInfoDictionaryVersion</key><string>6.0</string>
   <key>CFBundleName</key><string>Browser Cookie Bridge</string>
   <key>CFBundlePackageType</key><string>APPL</string>
-  <key>CFBundleShortVersionString</key><string>1.4.7</string>
-  <key>CFBundleVersion</key><string>35</string>
+  <key>CFBundleShortVersionString</key><string>1.5.0</string>
+  <key>CFBundleVersion</key><string>36</string>
   <key>LSMinimumSystemVersion</key><string>13.5</string>
   <key>NSHighResolutionCapable</key><true/>
 </dict>

package/macos-app/Sources/BraveCodexSyncApp/BraveCodexSyncApp.swift

@@ -239,6 +239,9 @@ struct ContentView: View {
     .sheet(isPresented: $model.showingBrowserlessSetup) {
       BrowserlessSetupSheet().environmentObject(model)
     }
+    .sheet(isPresented: $model.showingGrokBotResult) {
+      GrokBotResultSheet().environmentObject(model)
+    }
   }
 
   private var header: some View {
@@ -291,7 +294,7 @@ struct ContentView: View {
       .buttonStyle(.plain)
       .foregroundStyle(.secondary)
       .help("Refresh status")
-      if model.selectedTargetID != "codex" && !model.isBrowserlessTarget {
+      if !model.isDirectTarget && !model.isBrowserlessTarget && !model.isGrokBotTarget {
         Button("Extension setup…") { showingSetup = true }
           .controlSize(.small)
       }
@@ -384,17 +387,18 @@ struct SyncPanel: View {
     if model.isBrowserlessTarget && model.uploadCanceling { return "Canceling…" }
     if model.isBrowserlessTarget && model.isSyncing { return "Cancel upload" }
     if model.isSyncing { return "Syncing…" }
-    if model.codexBlocked { return "Close Codex first" }
+    if model.cursorHasNoDataSelected || model.grokBotHasNoDataSelected { return "Turn on Cookies" }
+    if model.directTargetBlocked { return "Close \(model.targetName) first" }
     if model.isBrowserlessTarget && !model.browserlessConfigured { return "Connect Browserless" }
     if model.isBrowserlessTarget && model.selectedSourceID == "comet" { return "Choose another browser" }
     if model.isBrowserlessTarget && model.sourceBrowserRunning { return "Close \(model.selectedBrowser.name) first" }
-    return model.isBrowserlessTarget ? "Upload now" : "Sync now"
+    return model.isGrokBotTarget ? "Create transfer file" : model.isBrowserlessTarget ? "Upload now" : "Sync now"
   }
 
   private var syncButtonIcon: String {
     if model.isBrowserlessTarget && model.isSyncing { return "xmark.circle.fill" }
     if model.syncBlocked { return model.isBrowserlessTarget && !model.browserlessConfigured ? "key.fill" : "xmark.circle.fill" }
-    return model.isBrowserlessTarget ? "icloud.and.arrow.up.fill" : "arrow.triangle.2.circlepath"
+    return model.isBrowserlessTarget ? "icloud.and.arrow.up.fill" : model.isGrokBotTarget ? "arrow.up.doc.fill" : "arrow.triangle.2.circlepath"
   }
 
 }
@@ -461,6 +465,14 @@ struct TargetPicker: View {
         }
         HStack(spacing: 5) {
           ForEach(Array(model.browsers.dropFirst(4))) { browser in targetButton(browser) }
+        }
+        HStack(spacing: 5) {
+          EndpointButton(
+            icon: model.cursorIcon,
+            name: "Cursor browser",
+            selected: model.selectedTargetID == "cursor",
+            disabled: model.isWorking || model.isSyncing
+          ) { model.selectTarget("cursor") }
           EndpointButton(
             icon: model.codexIcon,
             name: "ChatGPT Codex",
@@ -470,10 +482,16 @@ struct TargetPicker: View {
             iconWidth: 66,
             iconHeight: 38
           ) { model.selectTarget("codex") }
+          EndpointButton(
+            icon: model.grokBotIcon,
+            name: "Grok Bot",
+            selected: model.selectedTargetID == "grok-bot",
+            disabled: model.isWorking || model.isSyncing
+          ) { model.selectTarget("grok-bot") }
         }
       }
     }
-    .frame(width: 199)
+    .frame(width: 220)
   }
 
   private func targetButton(_ browser: BrowserChoice) -> some View {
@@ -562,12 +580,56 @@ struct PreferencesPanel: View {
               .help("Rescan local profile size")
             }
           }
+        } else if model.isGrokBotTarget {
+          PreferenceRow(
+            icon: "network",
+            color: Theme.accent,
+            title: "Cookies",
+            detail: "Encrypted cookie sessions for Grok Bot's shared cloud browser"
+          ) {
+            Toggle("", isOn: Binding(get: { model.cookiesEnabled }, set: { model.setCookiesEnabled($0) }))
+              .labelsHidden().toggleStyle(.switch).tint(Theme.active).disabled(model.isWorking)
+          }
+          RowDivider()
+          PreferenceRow(icon: "externaldrive.badge.plus", color: .secondary, title: "Full site data", detail: "Not included in Grok Bot transfer files", muted: true) {
+            FixedBadge("Excluded")
+          }
+          RowDivider()
+          PreferenceRow(icon: "clock.arrow.circlepath", color: .secondary, title: "History URLs", detail: "Not included in Grok Bot transfer files", muted: true) {
+            FixedBadge("Excluded")
+          }
+          RowDivider()
+          PreferenceRow(icon: "line.3.horizontal.decrease.circle", color: Theme.accent, title: "Only these domains", detail: "Leave blank to export every readable cookie") {
+            TextField("example.com, app.example.com", text: Binding(
+              get: { model.grokBotOnlyDomains },
+              set: { model.setGrokBotOnlyDomains($0) }
+            ))
+            .textFieldStyle(.roundedBorder)
+            .frame(width: 220)
+            .disabled(model.isWorking || model.isSyncing)
+          }
         } else {
-          PreferenceRow(icon: "network", color: Theme.accent, title: "Cookies", detail: "Site sessions and sign-ins") {
+          PreferenceRow(
+            icon: "network",
+            color: Theme.accent,
+            title: "Cookies",
+            detail: model.selectedTargetID == "cursor" ? "Experimental direct import into Cursor's browser partition" : "Site sessions and sign-ins"
+          ) {
             Toggle("", isOn: Binding(get: { model.cookiesEnabled }, set: { model.setCookiesEnabled($0) }))
               .labelsHidden().toggleStyle(.switch).tint(Theme.active).disabled(model.isWorking)
           }
-          if model.selectedTargetID == "codex" {
+          if model.selectedTargetID == "cursor" {
+            RowDivider()
+            PreferenceRow(
+              icon: "externaldrive.badge.plus",
+              color: .secondary,
+              title: "Full site data",
+              detail: "Not enabled for Cursor browser yet",
+              muted: true
+            ) {
+              FixedBadge("Excluded")
+            }
+          } else if model.selectedTargetID == "codex" {
             RowDivider()
             PreferenceRow(
               icon: "externaldrive.badge.plus",
@@ -580,9 +642,15 @@ struct PreferencesPanel: View {
             }
           }
           RowDivider()
-          PreferenceRow(icon: "clock.arrow.circlepath", color: Theme.accent, title: "History URLs", detail: "Original visit times are not preserved") {
-            Toggle("", isOn: Binding(get: { model.historyEnabled }, set: { model.setHistoryEnabled($0) }))
-              .labelsHidden().toggleStyle(.switch).tint(Theme.active).disabled(model.isWorking)
+          if model.selectedTargetID == "cursor" {
+            PreferenceRow(icon: "clock.arrow.circlepath", color: .secondary, title: "History URLs", detail: "Cursor browser does not expose a history store", muted: true) {
+              FixedBadge("Excluded")
+            }
+          } else {
+            PreferenceRow(icon: "clock.arrow.circlepath", color: Theme.accent, title: "History URLs", detail: "Original visit times are not preserved") {
+              Toggle("", isOn: Binding(get: { model.historyEnabled }, set: { model.setHistoryEnabled($0) }))
+                .labelsHidden().toggleStyle(.switch).tint(Theme.active).disabled(model.isWorking)
+            }
           }
           RowDivider()
           PreferenceRow(icon: "key.slash", color: .secondary, title: "Passwords", detail: "Browser extensions cannot access passwords", muted: true) {
@@ -615,8 +683,8 @@ struct PreferencesPanel: View {
         }
 
         SectionLabel(title: "Automation", detail: "Runs in the background", separated: true)
-        PreferenceRow(icon: "clock.badge.checkmark", color: Theme.accent, title: "Daily sync", detail: model.isBrowserlessTarget ? "Unavailable for cloud uploads" : (model.dailyEnabled ? "At the selected local time" : "Off")) {
-          if model.isBrowserlessTarget {
+        PreferenceRow(icon: "clock.badge.checkmark", color: Theme.accent, title: "Daily sync", detail: model.isBrowserlessTarget || model.isGrokBotTarget ? "Unavailable for this destination" : (model.dailyEnabled ? "At the selected local time" : "Off")) {
+          if model.isBrowserlessTarget || model.isGrokBotTarget {
             FixedBadge("Manual only")
           } else {
             HStack(spacing: 8) {
@@ -635,8 +703,8 @@ struct PreferencesPanel: View {
           }
         }
         RowDivider()
-        PreferenceRow(icon: "sunrise.fill", color: Theme.accent, title: "Sync at login", detail: model.isBrowserlessTarget ? "Unavailable for cloud uploads" : (model.loginSyncEnabled ? "Once whenever you sign in" : "Off")) {
-          if model.isBrowserlessTarget {
+        PreferenceRow(icon: "sunrise.fill", color: Theme.accent, title: "Sync at login", detail: model.isBrowserlessTarget || model.isGrokBotTarget ? "Unavailable for this destination" : (model.loginSyncEnabled ? "Once whenever you sign in" : "Off")) {
+          if model.isBrowserlessTarget || model.isGrokBotTarget {
             FixedBadge("Manual only")
           } else {
             Toggle("", isOn: Binding(get: { model.loginSyncEnabled }, set: { model.setLoginSyncEnabled($0) }))
@@ -863,7 +931,7 @@ struct ExtensionSetupSheet: View {
           Button("Open page") { model.openExtensions(for: model.selectedSourceID) }
           Button("Show folder") { model.revealExtension(model.selectedSourceID) }
         }
-        if model.selectedTargetID != "codex" {
+        if !model.isDirectTarget && !model.isGrokBotTarget {
           Divider().padding(.leading, 58)
           SetupEndpointRow(icon: model.targetIcon, title: model.targetName, detail: "Load the destination extension") {
             Button("Open page") { model.openExtensions(for: model.selectedTargetID) }
@@ -874,8 +942,10 @@ struct ExtensionSetupSheet: View {
       .background(Color(nsColor: .controlBackgroundColor).opacity(0.65), in: RoundedRectangle(cornerRadius: 12, style: .continuous))
       .overlay(RoundedRectangle(cornerRadius: 12, style: .continuous).stroke(Color.primary.opacity(0.07)))
 
-      Text(model.selectedTargetID == "codex"
-        ? "Codex uses a direct local merge, so no extension is required. Quit Codex before syncing. Password access is never requested."
+      Text(model.isDirectTarget
+        ? "\(model.targetName) uses a direct local merge, so no extension is required. Quit \(model.targetName) before syncing. Password access is never requested."
+        : model.isGrokBotTarget
+          ? "Grok Bot uses a one-time encrypted transfer file, so no extension is required. Create the .bcbx bundle, attach it to any Grok Bot, and paste the prompt."
         : "In both endpoints, enable Developer mode and choose Load unpacked. Password access is never requested.")
         .font(.system(size: 10.5))
         .foregroundStyle(.secondary)
@@ -1089,3 +1159,73 @@ enum Theme {
   static let accent = Color(red: 0.46, green: 0.46, blue: 0.48)
   static let active = Color(red: 0.54, green: 0.12, blue: 0.18)
 }
+
+struct GrokBotResultSheet: View {
+  @EnvironmentObject private var model: SyncModel
+  @Environment(\.dismiss) private var dismiss
+
+  var body: some View {
+    VStack(alignment: .leading, spacing: 16) {
+      HStack(alignment: .top, spacing: 12) {
+        Image(nsImage: model.grokBotIcon)
+          .resizable()
+          .scaledToFit()
+          .frame(width: 24, height: 24)
+          .frame(width: 40, height: 40)
+          .background(Theme.accent.opacity(0.11), in: RoundedRectangle(cornerRadius: 11, style: .continuous))
+        VStack(alignment: .leading, spacing: 3) {
+          Text("Grok Bot transfer ready")
+            .font(.system(size: 18, weight: .bold, design: .rounded))
+          Text(URL(fileURLWithPath: model.grokBotOutputPath).lastPathComponent)
+            .font(.system(size: 11.5))
+            .foregroundStyle(.secondary)
+        }
+        Spacer()
+      }
+
+      VStack(alignment: .leading, spacing: 8) {
+        Text("One-time decryption key")
+          .font(.system(size: 11, weight: .semibold))
+          .foregroundStyle(.secondary)
+        Text(model.grokBotPassphrase)
+          .font(.system(size: 15, weight: .semibold, design: .monospaced))
+          .textSelection(.enabled)
+          .padding(10)
+          .frame(maxWidth: .infinity, alignment: .leading)
+          .background(Color.primary.opacity(0.04), in: RoundedRectangle(cornerRadius: 10, style: .continuous))
+      }
+
+      VStack(alignment: .leading, spacing: 8) {
+        Text("Prompt for Grok Bot")
+          .font(.system(size: 11, weight: .semibold))
+          .foregroundStyle(.secondary)
+        ScrollView {
+          Text(model.grokBotPrompt)
+            .font(.system(size: 11))
+            .frame(maxWidth: .infinity, alignment: .leading)
+            .textSelection(.enabled)
+        }
+        .frame(height: 180)
+        .padding(10)
+        .background(Color.primary.opacity(0.04), in: RoundedRectangle(cornerRadius: 10, style: .continuous))
+      }
+
+      HStack {
+        Button("Reveal file") {
+          let url = URL(fileURLWithPath: model.grokBotOutputPath)
+          NSWorkspace.shared.activateFileViewerSelecting([url])
+        }
+        Button("Copy prompt") {
+          NSPasteboard.general.clearContents()
+          NSPasteboard.general.setString(model.grokBotPrompt, forType: .string)
+        }
+        Spacer()
+        Button("Done") { dismiss() }
+          .keyboardShortcut(.defaultAction)
+      }
+      .controlSize(.regular)
+    }
+    .padding(20)
+    .frame(width: 520)
+  }
+}