fix(main): route browser cookie key commands through runner

src/main/browser/browser-cookie-key.ts

@@ -1,4 +1,3 @@
-import { execFileSync } from 'node:child_process'
 import { pbkdf2Sync } from 'node:crypto'
 import { existsSync, readFileSync } from 'node:fs'
 import { join } from 'node:path'
@@ -16,6 +15,14 @@ const PBKDF2_ITERATIONS = 1003
 const PBKDF2_KEY_LENGTH = 16
 const PBKDF2_SALT = 'saltysalt'
 
+function runKeychainCommand(program: string, args: readonly string[], timeoutMs: number): string {
+  const result = runProcessSync({ program, args, timeoutMs })
+  if (result.code !== 0 || result.timedOut) {
+    throw new Error(`${program} exited with code ${result.code ?? 'unknown'}`)
+  }
+  return result.stdout.trim()
+}
+
 export function getEncryptionKey(
   keychainService: string,
   keychainAccount: string,
@@ -38,11 +45,11 @@ export function getMacEncryptionKey(
   keychainAccount: string
 ): EncryptionKeyResult | null {
   try {
-    const raw = execFileSync(
+    const raw = runKeychainCommand(
       'security',
       ['find-generic-password', '-s', keychainService, '-a', keychainAccount, '-w'],
-      { encoding: 'utf-8', timeout: 30_000 }
-    ).trim()
+      30_000
+    )
     return {
       mode: 'aes-128-cbc',
       keysByVersion: {
@@ -65,19 +72,16 @@ export function getLinuxEncryptionKey(
   let keyringPassword = ''
   try {
     // Why: GNOME keyring stores the Chrome Safe Storage password via secret-tool.
-    keyringPassword = execFileSync(
+    keyringPassword = runKeychainCommand(
       'secret-tool',
       ['lookup', 'service', keychainService, 'account', keychainAccount],
-      { encoding: 'utf-8', timeout: 5_000 }
-    ).trim()
+      5_000
+    )
   } catch {
     // Why: fall back to application-based lookup used by newer Chromium versions.
     try {
       const app = keychainAccount.toLowerCase().replaceAll(' ', '')
-      keyringPassword = execFileSync('secret-tool', ['lookup', 'application', app], {
-        encoding: 'utf-8',
-        timeout: 5_000
-      }).trim()
+      keyringPassword = runKeychainCommand('secret-tool', ['lookup', 'application', app], 5_000)
     } catch {
       diag('  Linux keyring unavailable — v11 cookies cannot be decrypted')
     }

src/shared/child-process/__fixtures__/windows-console-visibility-allowlist.txt

@@ -9,7 +9,6 @@ main/agent-hooks/managed-hook-owner-identity.ts
 main/agent-hooks/managed-hook-runtime.ts
 main/app-icon.ts
 main/automations/precheck-runner.ts
-main/browser/browser-cookie-import.ts
 main/claude-accounts/keychain.ts
 main/computer/macos-computer-use-permission-status.ts
 main/computer/macos-computer-use-permissions.ts
@@ -27,7 +26,6 @@ main/external-editor-launch.ts
 main/hooks.ts
 main/ipc/app.ts
 main/ipc/developer-permissions.ts
-main/ipc/filesystem.ts
 main/ipc/macos-keyboard-layout-snapshot.ts
 main/ipc/notification-authorization-status.ts
 main/ipc/worktree-apfs-clone.ts
@@ -43,7 +41,6 @@ main/pty/posix-pty-foreground-group.ts
 main/pty/posix-pty-process-groups.ts
 main/pty/windows-environment-path.ts
 main/rate-limits/codex-fetcher.ts
-main/runtime/orca-runtime-files.ts
 main/runtime/tls-certificate.ts
 main/ssh/ssh-connection.ts
 main/startup/appimage-cli-redirect.ts