feat: Add Windows support for import-desktop command

[tusharmagar]

Summary

• Adds Windows support for agent-slack auth import-desktop, which was previously limited to macOS and Linux
• Supports both the regular Electron installer (%APPDATA%\Slack) and Microsoft Store version (%LOCALAPPDATA%\Packages\com.tinyspeck.slackdesktop_*)
• Implements DPAPI + AES-256-GCM cookie decryption (Windows uses a different encryption scheme than macOS/Linux)
• Copies the Cookies SQLite DB to a temp file before reading, since Windows holds an exclusive file lock while Slack is running
• URL-decodes the decrypted cookie value (Windows stores it URL-encoded)
• Removes the win32 platform guard from refreshFromDesktopIfPossible()

How it works

On Windows, Chromium-based apps (including Slack/Electron) encrypt cookies using:

1. An AES-256 key stored in Local State → os_crypt.encrypted_key (base64, "DPAPI" prefixed)
2. The AES key is decrypted via Windows DPAPI (ProtectedData.Unprotect) through PowerShell
3. Cookies are then decrypted with AES-256-GCM (12-byte nonce + ciphertext + 16-byte tag)

This is different from macOS (Keychain + AES-128-CBC) and Linux (secret-tool/peanuts + AES-128-CBC).

Test plan

• Tested on Windows 11 ARM64 (Parallels) with Slack installed from Microsoft Store
• agent-slack auth import-desktop successfully extracts xoxc token + xoxd cookie
• agent-slack auth test returns ok: true
• agent-slack message send works with the imported credentials
• Should also work with the regular (non-Store) Slack Windows installer (same data layout at %APPDATA%\Slack)

Note

Slack must be fully quit before running import-desktop on Windows, as it holds an exclusive lock on the Cookies database file. This is consistent with the macOS behavior where Slack's LevelDB is also locked while running.

[AmethystLiang]

Here are the feedback from Codex

• 1. High: require(...) inside an ESM module will break in Node runtime on the Windows path.
In desktop.ts line 407:407, decryptCookieWindows does:
const { createDecipheriv: createDecipherivGcm } = require("node:crypto")...
This repo is ESM ("type": "module"), so require is not defined in standard Node ESM execution. If import-
desktop is used on Windows in Node builds, this can throw ReferenceError: require is not defined.
2. Medium: PowerShell command construction is unsafe/fragile for valid Windows paths containing '.
In desktop.ts lines 429-433:429, temp file paths are injected into single-quoted PowerShell strings without
escaping.
A profile path like C:\Users\O'Connor... will break the script (and can become command-injection-prone in
principle). This can cause Windows auth import to fail for legitimate user profiles.
3. Low: Feature/docs mismatch for platform support.
PR adds Windows desktop import support, but README still frames auto-auth as macOS-only (see README.md line
98:98: “On macOS, authentication happens automatically”). This is now outdated and likely to confuse users.

 Once it's addressed, we can merge this in

[tusharmagar]

Hey @AmethystLiang, I have addressed the above comments, and the PR should be ready to merge. Please check it out.

[AmethystLiang]

All 3 Codex feedback items verified as addressed:

1. require() in ESM — Fixed: createDecipheriv now uses the top-level ESM import from node:crypto
2. PowerShell injection — Fixed: single quotes escaped via replaceAll("'", "''") before interpolation
3. Docs mismatch — Fixed: README, SKILL.md, and commands.md updated for Windows support

Code looks good — LGTM!