Module desktop 

Available on crate feature desktop-session only.

Read and decrypt the Grok Bot desktop app’s saved gateway session.

Enabled by the desktop-session feature. Nothing here runs unless you call it; only read the desktop session when the user explicitly asks you to.

Mirrors grok-bot-cli’s src/core/app-session.js. The app stores gateway-descriptor.json in its data dir; the payload is encrypted with the Chromium “Safe Storage” (OSCrypt) scheme:

• Linux v11: key from the Secret Service password (secret-tool), PBKDF2-HMAC-SHA1, salt saltysalt, 1 iteration, 16-byte AES-128-CBC key, IV = 16 spaces.
• Linux v10: keyring-less “basic text” backend, password peanuts, otherwise as v11.
• macOS v10: key from the login Keychain item Grok Bot Safe Storage, 1003 iterations.
• Windows v10 (compiled in only on Windows): AES-256-GCM with a DPAPI-wrapped key from Local State.

If gateway-descriptor.json is missing, DesktopConfig::load_credential falls back to the Cursor access token in sand-secrets.json (exchange it with ensure_sandbox). detect_app_version reads the installed app’s version for the x-cursor-client-version header. See the DESKTOP.md guide.

use grokbot_api::desktop::{DesktopConfig, DesktopCredential, Platform};
use grokbot_api::{Client, ClientOptions, Policy};

let platform = Platform::current().expect("supported OS");
let cfg = DesktopConfig::new(platform);
let client = match cfg.load_credential(None, &Policy::default())? {
    DesktopCredential::Session(session) => Client::new(session, ClientOptions::default())?,
    DesktopCredential::CursorToken(token) => {
        Client::connect_cursor(&token, ClientOptions::default()).await?
    }
};

Structs

DesktopConfig

How to locate and unlock the desktop session. Every field can be overridden (tests do).

DesktopEntry

One saved entry’s ciphertext (base64). key is "default" for the v1 single-entry format.

SandAccount

A Cursor account found in sand-secrets.json, labeled for selection.

Enums

DesktopCredential

What DesktopConfig::load_credential resolved to. Debug redacts the secrets.

Platform

The OS whose desktop-app layout and encryption scheme to use.

Functions

app_data_dir

The app data directory (“Grok Bot”) for a platform.

decrypt_safe_storage

Decrypt a Safe Storage string (Linux/macOS). password is the keychain password; it is ignored for the Linux v10 basic-text backend (which uses peanuts).

descriptor_path

Path to gateway-descriptor.json.

detect_app_version

Detect the installed Grok Bot desktop app version (e.g. "0.70.2").

find_install_dir

Locate the Grok Bot desktop install directory for this platform, if present.

needs_keychain

Does this ciphertext need the OS keychain password? (Linux v10 “basic text” does not.)

normalize_semver

Strip a leading v and keep MAJOR.MINOR.PATCH (desktop app does the same).

parse_entries

Parse a descriptor’s JSON into the list of encrypted entries (v1 → one, v2 → many).

sand_secrets_path

Path to sand-secrets.json (the fallback source of a Cursor access token).

session_from_clear

Turn a decrypted inner descriptor ({baseUrl, token, headers?}) into a validated Session.

version_from_asar

Read package.json (or product.json) version out of an Electron .asar.

Type Aliases

AppVersion

Semver-ish app version string (e.g. "0.70.2"), as used for x-cursor-client-version.

EnvLookup

Environment-variable lookup (injectable for tests).