Finish the local browser import experience

[IlyaasK]

What

• hands a completed local browser import back to the originating dashboard operation
• displays Managed Auth usage, plan maximum, and remaining new-connection capacity
• constrains only net-new connections; existing imported connections remain refreshable at capacity
• shows a four-stage elapsed-time progress bar during preparation, upload, profile apply/save, and completion
• exits the connector flow once the durable API queue starts, allowing its Terminal tab to close
• reports imported/skipped browser-data counts and preserves partial storage results
• defaults repeat local-browser imports to updating the existing Kernel profile instead of creating a suffixed duplicate
• makes creating a separate profile explicit and shows when the same account is already managed on another profile

This is the CLI finished-experience layer for KERNEL-1975.

Why

The customer must understand how many Managed Auth connections their plan permits and must see that a multi-minute server apply is progressing. Once the API owns durable post-import authentication, the local CLI should not remain open while that background queue runs. Repeat imports should refresh the existing profile and its attached Managed Auth connections instead of silently creating helium-you-2 and consuming duplicate connection slots.

How

• reads the merged max_auth_connections and auth_connections_used organization-limit fields exposed by the current API/SDK
• distinguishes unlimited, known-zero, positive, and temporarily unknown capacity
• classifies existing connections before applying capacity to net-new selections
• keeps create-time API quota enforcement authoritative for races
• advances an honest coarse progress bar only at completed client/server milestones
• treats finishing_managed_auth as a successful dashboard handoff phase
• looks up the default Kernel profile before upload and offers Update (recommended) or Create separate
• sends the immutable existing profile ID only when Update is selected
• when Create separate is selected, detects the same imported credential on other profiles and defaults to Keep existing (0 slots); Also manage on the new profile explicitly consumes a slot

The latest published Go SDK does not yet expose connections_used on /org/entitlements; using the generated /org/limits fields avoids a hand-written HTTP path while preserving the merged entitlement values.

Deployment

Stacked on #229. Merge only after kernel/kernel#3453 and the explicit profile-update API in kernel/kernel#3477 are deployed, then publish and verify the Homebrew CLI before enabling the dashboard consumer. Old APIs reject target_profile_id, so this order is required.

Verification

• focused go test -race ./cmd for repeat-profile selection, cross-profile Managed Auth choices, quota handling, and label behavior
• go test ./cmd ./internal/browserimport -count=1
• go vet ./cmd ./internal/browserimport
• dashboard handoff regression proves the CLI returns at finishing_managed_auth
• git diff --check origin/browser-import/05-finished-experience...HEAD

The full unfiltered CLI race suite still reports an unrelated pre-existing pterm spinner race in template-creation tests; every changed path passes under -race.

---

Note

Medium Risk
Orchestrates dashboard-started imports, helper grants, and Managed Auth provisioning (credentials and connection quota). Failure/cancel reporting and profile-update targeting are new client-side control paths that need the matching API deployed.

Overview
Completes the local Chromium import flow so dashboard-started jobs can resume with a scoped helper grant, report client completion/cancel/failure, and return once the server reaches finishing_managed_auth instead of blocking on background auth.

Profile upload/apply now runs in the background with a four-stage progress bar while the user picks Managed Auth websites and accounts. Capacity UI shows used/max/remaining (including unlimited), and only net-new connections consume slots. Repeat imports default to updating the existing Kernel profile; creating a separate profile is explicit, and accounts already managed elsewhere default to keep-existing.

Oversized local-storage keys are skipped instead of failing the export, with imported vs skipped counts from the apply result. Bitwarden approved-item reads are parallelized (capped). The macOS connector deep link accepts import_id and auto-closes the Terminal tab after a successful run.

^{Reviewed by Cursor Bugbot for commit f68d104. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a2326b4. Configure here.}

[cursor]

Other-profile check is fatal

Medium Severity

A failed ExistingProfiles lookup returns a hard error, unlike Existing, which warns and continues when Managed Auth is optional. Because this runs after the profile job has started, a problem listing other profiles aborts selection and can fail an import that could still refresh this profile’s connections.

Additional Locations (1)

• cmd/profiles_import_local.go#L771-L780

 

^{Reviewed by Cursor Bugbot for commit a2326b4. Configure here.}