fix(app-session): reconnect from the active Grok Bot account on Windows (descriptor absent, app version header)

[trippjak]

Context

Fixes #147 on Windows, and carries #143 (descriptor v3). Builds on #145 by @tomer-ben-david, whose active-account reconnect is reused here with credit; this PR adds what was missing for it to work on Windows and adds Windows test coverage.

Since the October desktop update, Grok Bot 0.70.x on Windows no longer leaves %APPDATA%\Grok Bot\gateway-descriptor.json on disk once the cloud computer has been parked (see the analysis in #147). hasGrokBotGatewaySession() then returns false and every command falls back to files mode with Could not find a Grok Bot agents directory, even though desktop-status.json says signedIn: true.

What is on disk instead (key names only; no secret values were read or printed): sand-secrets.json holds cursor-accounts, a JSON string with active and per-account cursor-access-token / cursor-refresh-token / cursor-account-profile, each a v10 Safe Storage blob decryptable with the DPAPI-wrapped key from Local State. The box route itself is not persisted anywhere (leveldb and sand-client-persistence blobs hold UI state only).

Changes

• Reconnect from the active account when the descriptor is absent (from fix: keep Grok Bot CLI connected when the desktop gateway route disappears #145): decrypt only the active account's access token from sand-secrets.json and call EnsureSandBox for a fresh route. The cached descriptor is still preferred when present; GROK_BOT_GATEWAY_URL + GROK_BOT_GATEWAY_TOKEN and CURSOR_ACCESS_TOKEN keep precedence.
• Send the installed app version on every platform. With fix: keep Grok Bot CLI connected when the desktop gateway route disappears #145 alone, Windows still failed: EnsureSandBox returned 401 This version of Grok Bot is no longer supported because headers.js sends a fixed x-cursor-client-version: 0.20.0, and fix: keep Grok Bot CLI connected when the desktop gateway route disappears #145 only reads the real version from the macOS app bundle. grokBotAppVersion() now reads appVersion from the app's own desktop-status.json (written on macOS, Linux and Windows), falling back to the macOS Info.plist. SAND_CLIENT_VERSION still overrides.
• The new credential functions accept the same appData option as the other Windows entry points, so Windows fixtures work without poking env.APPDATA.
• Descriptor v3 support (from fix(app-session): read gateway descriptor version 3 #143 / fix: keep Grok Bot CLI connected when the desktop gateway route disappears #145).
• gbot doctor reports whether active account credentials are present.

Tests

• New Windows fixtures: active account + DPAPI Safe Storage key yields { accessToken } with no team; missing Safe Storage key raises MISSING_SAFE_STORAGE_KEY; desktop-status.json version read on win32, invalid version rejected on linux.
• fix: keep Grok Bot CLI connected when the desktop gateway route disappears #145's Linux basic_text and macOS keychain tests retained (the macOS integration test skips off-darwin).
• npm run typecheck, npm test, npm run build, npm run validate:artifact pass locally on Windows 11.

Verification on a real machine

Windows 11, Grok Bot desktop 0.70.2 signed in, no gateway-descriptor.json, no GROK_BOT_* / CURSOR_* / SAND_* env set:

Command	Before	After
node artifact/bin/gbot.mjs bots list --json	render-failed: Could not find a Grok Bot agents directory	22-entry roster
node artifact/bin/gbot.mjs doctor	gateway auth: no	gateway auth: present, Grok Bot active account credentials: present

Not verified here: macOS and Linux (no machine available). The desktop-status.json path was reported present on macOS in #147's comments.

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 0f29266

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
grok-bot-cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[scort1213]

Tested this branch on macOS (Apple Silicon, Grok Bot desktop 0.70.2, Node 22.23), built from source:

• With the box parked, the app had deleted gateway-descriptor.json. gbot doctor showed Grok Bot active account credentials: present, and bots list --json, groups list --json, send and thread --after all worked (roster in ~6 s).
• With the box awake, the app writes a version 3 descriptor, so fix(app-session): read gateway descriptor version 3 #143 alone only covers that state — this PR covers both.
• macOS note: the first run blocks on the Keychain prompt for "Grok Bot Safe Storage" with no output until the user clicks Allow, which can look like a hang. Might be worth a hint in doctor or the README.

Separately, sends report delivery: "unknown" on this app version because the gateway returns { accepted: true } without a messageId; opened #153 for that.