Cookie auto-extraction fails on Windows 11 (Chrome/Edge app-bound encryption): 'Unable to get key for cookie decryption'

[lapl7212136q2-blip]

Summary

On Windows 11, automatic browser cookie extraction fails with Unable to get key for cookie decryption, so twitter status (and every authenticated command) returns not_authenticated even when logged into x.com. This appears to be Chrome/Edge app-bound cookie encryption (Chrome ≥127 on Windows) that the current browser_cookie3 path cannot decrypt.

Environment

• OS: Windows 11 (build 26200)
• Python: 3.14
• twitter-cli: 0.8.5 (installed via pip install --user twitter-cli)

Steps to reproduce

1. pip install twitter-cli
2. Log into x.com in Chrome.
3. Run twitter -v status.

Actual result

ok: false, code: not_authenticated. Verbose diagnostics, identical in both in-process and subprocess modes:

DEBUG twitter_cli.auth: chrome in-process extraction failed: Unable to get key for cookie decryption
DEBUG twitter_cli.auth: edge in-process extraction failed: Unable to get key for cookie decryption
DEBUG twitter_cli.auth: firefox in-process extraction failed: Could not find Firefox profile directory
DEBUG twitter_cli.auth: brave in-process extraction failed: Failed to find cookies for Brave browser
WARNING twitter_cli.auth: Twitter cookie extraction failed in both in-process and subprocess modes

Why this is not the documented "Chrome is running / DB locked" cause

The error message lists "Chrome is running (locks the cookie database)" as the likely cause, but:

• The failure is Unable to get key for cookie decryption (a key-decryption error), not an SQLite "database is locked" error.
• Edge is not running on this machine, yet Edge extraction fails with the exact same Unable to get key for cookie decryption. A browser that isn't running cannot have a locked DB.
• The error persists with browsers closed.

This isolates the cause to app-bound cookie encryption, not a file lock.

Impact

The zero-config flow ("be logged into x.com in your browser") does not work on Windows 11. Only the manual TWITTER_AUTH_TOKEN / TWITTER_CT0 workaround functions.

Suggested fixes

• Document the Windows limitation prominently (point users to the manual-token workaround).
• Consider a Windows cookie-extraction path that handles Chrome/Edge app-bound encryption (e.g. the DPAPI + VSS shadow-copy approach, or a maintained library such as rookie).

Minor, possibly related

twitter --help crashes on a stock Windows console (cp1252) with a UnicodeEncodeError while rendering the help text (contains a 🐦 emoji); it only works with PYTHONIOENCODING=utf-8.