@@ -0,0 +1,35 @@
+import { expect, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import { ChildProcessSpawner } from "effect/unstable/process";
+import { vi } from "vite-plus/test";
+
+vi.mock("@napi-rs/keyring", () => {
+  throw new Error("Cannot find native binding");
+});
+
+it("loads browser import code without a keyring native binding", async () => {
+  await expect(import("./ChromiumKeys.ts")).resolves.toBeDefined();
+});
+
+it.effect("reports an unavailable keychain when the macOS binding cannot load", () =>
+  Effect.gen(function* () {
+    const { ChromiumKeyError, resolveChromiumKeys } = yield* Effect.promise(
+      () => import("./ChromiumKeys.ts"),
+    );
+    const error = yield* resolveChromiumKeys({
+      platform: "darwin",
+      keychainService: "Chrome Safe Storage",
+      keychainAccount: "Chrome",
+      linuxSecretApplication: undefined,
+    }).pipe(Effect.flip);
+
+    expect(error).toBeInstanceOf(ChromiumKeyError);
+    expect(error.reason).toBe("keychainUnavailable");
+    expect(error.cause).toBeInstanceOf(Error);
+  }).pipe(
+    Effect.provideService(
+      ChildProcessSpawner.ChildProcessSpawner,
+      ChildProcessSpawner.make(() => Effect.die("must not spawn")),
+    ),
+  ),
+);
@@ -7,6 +7,7 @@ import * as Sink from "effect/Sink";
 import * as Stream from "effect/Stream";
 import * as PlatformError from "effect/PlatformError";
 import { ChildProcessSpawner } from "effect/unstable/process";
+import { beforeEach, vi } from "vite-plus/test";
 
 import {
   ChromiumKeyError,
@@ -17,6 +18,18 @@ import {
 } from "./ChromiumKeys.ts";
 import { LinuxBrowserSecretPath } from "./LinuxBrowserSecret.ts";
 
+const { getPassword } = vi.hoisted(() => ({ getPassword: vi.fn<() => string | null>() }));
+
+vi.mock("@napi-rs/keyring", () => ({
+  Entry: class {
+    getPassword = getPassword;
+  },
+}));
+
+beforeEach(() => {
+  getPassword.mockReset();
+});
+
 type CapturedCommand = {
   readonly command: string;
   readonly args: ReadonlyArray<string>;
@@ -63,6 +76,47 @@ const helperLayer = (input: {
     ),
   );
 
+describe("macOS Chromium secrets", () => {
+  const request = {
+    platform: "darwin",
+    keychainService: "Chrome Safe Storage",
+    keychainAccount: "Chrome",
+    linuxSecretApplication: undefined,
+  } as const;
+  const noProcesses = Layer.succeed(
+    ChildProcessSpawner.ChildProcessSpawner,
+    ChildProcessSpawner.make(() => Effect.die("must not spawn")),
+  );
+
+  it.effect("derives the cookie key from the keychain secret", () =>
+    Effect.gen(function* () {
+      getPassword.mockReturnValue("macos-secret");
+      const keys = yield* resolveChromiumKeys(request);
+      expect(keys.cbcV10?.toString("hex")).toBe("3df7306fb1eac353289565a2f6b64f74");
+    }).pipe(Effect.provide(noProcesses)),
+  );
+
+  it.effect("reports a missing keychain entry", () =>
+    Effect.gen(function* () {
+      getPassword.mockReturnValue(null);
+      const error = yield* resolveChromiumKeys(request).pipe(Effect.flip);
+      expect(error.reason).toBe("keychainItemMissing");
+    }).pipe(Effect.provide(noProcesses)),
+  );
+
+  it.effect("preserves a denied keychain approval", () =>
+    Effect.gen(function* () {
+      const denied = new Error("User denied access");
+      getPassword.mockImplementation(() => {
+        throw denied;
+      });
+      const error = yield* resolveChromiumKeys(request).pipe(Effect.flip);
+      expect(error.reason).toBe("needsKeychainApproval");
+      expect(error.cause).toBe(denied);
+    }).pipe(Effect.provide(noProcesses)),
+  );
+});
+
 describe("Linux Chromium secrets", () => {
   it.effect("retains a missing helper failure alongside the keyring-free fallback", () =>
     Effect.gen(function* () {
 
@@ -17,7 +17,6 @@
  *
  * @module ChromiumKeys
  */
-import * as Keyring from "@napi-rs/keyring";
 import * as NodeCrypto from "node:crypto";
 
 import { HostProcessEnvironment } from "@t3tools/shared/hostProcess";
@@ -102,6 +101,12 @@ const readKeychainSecret = Effect.fn("ChromiumKeys.readKeychainSecret")(function
   service: string,
   account: string,
 ) {
+  // Only macOS cookie imports need this binding; loading it at startup can
+  // prevent the desktop from opening on platforms that never use it.
+  const Keyring = yield* Effect.tryPromise({
+    try: () => import("@napi-rs/keyring"),
+    catch: (cause) => new ChromiumKeyError({ reason: "keychainUnavailable", cause }),
+  });
   const secret = yield* Effect.try({
     try: () => new Keyring.Entry(service, account).getPassword(),
     catch: (cause) => {