@jtalk22/slack-mcp 4.2.1 → 4.3.0

package/README.md

@@ -42,9 +42,9 @@ This server uses your browser's session tokens instead. If you can see it in Sla
 | Tools | Limited | **21** |
 | Visible to admins | Yes | **No — session-token transport** |
 
-## Workflow Primitives (new in 4.2)
+## Workflow Primitives
 
-Save a workflow profile that binds a `workflow_kind` to channels + priority people + retention + cadence. Stored locally at `~/.slack-mcp-workflows.json`. The hosted brain at [mcp.revasserlabs.com](https://mcp.revasserlabs.com) reads these profiles and returns **structured JSON per workflow_kind** — downstream automation (Linear, Notion, status dashboards) consumes the JSON directly.
+Introduced in 4.2. Save a workflow profile that binds a `workflow_kind` to channels + priority people + retention + cadence. Stored locally at `~/.slack-mcp-workflows.json`. The hosted brain at [mcp.revasserlabs.com](https://mcp.revasserlabs.com) reads these profiles and returns **structured JSON per workflow_kind** — downstream automation (Linear, Notion, status dashboards) consumes the JSON directly.
 
 | `workflow_kind` | Returns (structured JSON) |
 |---|---|
@@ -305,7 +305,8 @@ Session tokens (`xoxc-` + `xoxd-`) from your browser. If you can see it in Slack
 
 Tokens expire. The server notices before you do — proactive health monitoring, automatic refresh on macOS, warnings when tokens age out. File writes are atomic (temp file → chmod → rename) to prevent corruption. Concurrent refresh attempts are mutex-locked.
 
-## What's New in 4.2.0
+<details>
+<summary><strong>What's New in 4.2.0</strong></summary>
 
 - **Workflow primitives** — `slack_workflow_save` + `slack_workflows` bind a `workflow_kind` (`incident_room`, `exec_brief`, `support_inbox`, `product_launch_watch`, `custom`) to channels, priority people, retention, and cadence. The hosted brain returns structured JSON per kind — `incident_room` returns `{incident_summary, timeline, open_risks, owner_gaps, next_actions}`, `exec_brief` returns `{summary, decisions, risks, asks, action_items}`. Downstream automation (Linear, Notion, dashboards) consumes the JSON directly.
 - **Discoverable upgrade stubs** — `slack_smart_search`, `slack_catch_me_up`, `slack_triage` appear in OSS as upgrade payloads pointing at the hosted brain. Response shape is `{signup_url, free_tier_quota, pro_value_prop}` — no interruptions, the AI routes the user cleanly.
@@ -315,6 +316,8 @@ Tokens expire. The server notices before you do — proactive health monitoring,
 
 Full release notes on [GitHub releases/latest](https://github.com/jtalk22/slack-mcp-server/releases/latest).
 
+</details>
+
 ## Hosted HTTP Mode
 
 For remote MCP endpoints (Cloudflare Worker, VPS, etc.):
@@ -331,7 +334,7 @@ Details: [docs/DEPLOYMENT-MODES.md](docs/DEPLOYMENT-MODES.md)
 
 ## Troubleshooting
 
-**Tokens expired:** Run `npx -y @jtalk22/slack-mcp --setup` or use `slack_refresh_tokens` (macOS).
+**Tokens expired:** Run `npx -y @jtalk22/slack-mcp --setup` or use `slack_refresh_tokens` (macOS). To prevent silent expiration during long Claude-idle windows, set up the optional [token-refresh LaunchAgent](docs/SETUP.md#keep-tokens-fresh-while-claude-is-closed-macos-optional).
 
 **DMs not showing:** Use `slack_list_conversations` with `discover_dms=true`.
 
@@ -371,4 +374,4 @@ Not affiliated with Slack Technologies, Inc. Uses browser session credentials
 
 ---
 
-Hosted version live at [mcp.revasserlabs.com](https://mcp.revasserlabs.com): Free tier (no card), $9/mo Pro, $49/mo Team flat, Ops from $199/mo. Hosted owns the AI brain (smart_search, catch_me_up, triage), the scheduled morning catch-up DM at 8am workspace time *(rolling out Q2 2026)*, permanent OAuth (no 2-week token rotation), 90-day Vectorize retention, and shared workflow profiles. The OSS package owns local stdio + all 16 read/write Slack tools + workflow profile primitives (slack_workflow_save, slack_workflows). The 3 paid stubs (slack_smart_search, slack_catch_me_up, slack_triage) appear in OSS as discoverable upgrade prompts.
+Hosted version live at [mcp.revasserlabs.com](https://mcp.revasserlabs.com): Free tier (no card), $9/mo Pro, $49/mo Team flat, Ops from $199/mo. Hosted owns the AI brain (smart_search, catch_me_up, triage), the scheduled morning catch-up DM at 8am workspace time *(rolling out Q2 2026)*, permanent OAuth (no 2-week token rotation), 90-day Vectorize retention, and shared workflow profiles. The OSS package owns local stdio + the 16 Slack tools (12 read, 4 write) + workflow profile primitives (slack_workflow_save, slack_workflows). The 3 paid stubs (slack_smart_search, slack_catch_me_up, slack_triage) appear in OSS as discoverable upgrade prompts.

package/docs/SETUP.md

@@ -138,6 +138,54 @@ slack_health_check
 
 You should see your username and team name.
 
+## Keep Tokens Fresh While Claude Is Closed (macOS, Optional)
+
+The MCP server auto-refreshes tokens every 4 hours while Claude is running. But if you keep Claude closed for a couple weeks, tokens expire silently — your next session opens with `invalid_auth`.
+
+A LaunchAgent fixes this. It runs token refresh twice a day regardless of whether Claude is open, as long as Chrome is running with a Slack tab somewhere.
+
+Create `~/Library/LaunchAgents/com.yourname.slack-token-refresh.plist`:
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.yourname.slack-token-refresh</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>/bin/bash</string>
+        <string>-c</string>
+        <string>export NVM_DIR="$HOME/.nvm" &amp;&amp; [ -s "$NVM_DIR/nvm.sh" ] &amp;&amp; \. "$NVM_DIR/nvm.sh" &amp;&amp; exec npx -y @jtalk22/slack-mcp --refresh-tokens</string>
+    </array>
+    <key>StartCalendarInterval</key>
+    <array>
+        <dict><key>Hour</key><integer>6</integer><key>Minute</key><integer>17</integer></dict>
+        <dict><key>Hour</key><integer>18</integer><key>Minute</key><integer>17</integer></dict>
+    </array>
+    <key>RunAtLoad</key><true/>
+    <key>StandardErrorPath</key><string>/tmp/slack-token-refresh.log</string>
+</dict>
+</plist>
+```
+
+Load it:
+
+```bash
+launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.yourname.slack-token-refresh.plist
+```
+
+Check it ran:
+
+```bash
+tail /tmp/slack-token-refresh.log
+```
+
+**Why the `bash -c` wrapper:** LaunchAgents start without a TTY, so a bare `node` won't be on PATH if you use nvm. The wrapper sources `nvm.sh` first, then runs the refresher. (If you installed node via Homebrew, replace the whole inner command with `/opt/homebrew/bin/node /opt/homebrew/bin/npx -y @jtalk22/slack-mcp --refresh-tokens`.)
+
+**Trade-off:** Chrome must be running for extraction to succeed. If it's not, the LaunchAgent logs "Failed to extract" and tokens stay where they are — which is fine for another 12 hours.
+
 ## Troubleshooting
 
 ### "No credentials found"
@@ -151,7 +199,7 @@ Tokens have expired. Run `npx -y @jtalk22/slack-mcp --doctor` and follow the sug
 ### MCP Server Not Loading
 
 1. Check `~/.claude.json` syntax
-2. Verify the path to server.js is correct
+2. Verify JSON syntax in your client's MCP config
 3. Restart Claude Code
 
 ### Chrome Extraction Fails

package/lib/handlers.js

@@ -4,8 +4,7 @@
  * Implementation of all MCP tool handlers.
  */
 
-import { writeFileSync, readFileSync, existsSync, renameSync, unlinkSync, mkdirSync } from "fs";
-import { execSync } from "child_process";
+import { writeFileSync, readFileSync, existsSync, renameSync, unlinkSync, mkdirSync, chmodSync } from "fs";
 import { homedir, platform } from "os";
 import { join } from "path";
 import {
@@ -55,7 +54,7 @@ function atomicWriteSync(filePath, content) {
   try {
     writeFileSync(tempPath, content);
     if (platform() === 'darwin' || platform() === 'linux') {
-      try { execSync(`chmod 600 "${tempPath}"`); } catch {}
+      try { chmodSync(tempPath, 0o600); } catch {}
     }
     renameSync(tempPath, filePath);
   } catch (e) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@jtalk22/slack-mcp",
   "mcpName": "io.github.jtalk22/slack-mcp-server",
-  "version": "4.2.1",
+  "version": "4.3.0",
   "description": "Slack MCP without OAuth. 21 tools (16 read/write Slack + 2 workflow profile primitives + 3 hosted-brain upgrade stubs). Free OSS or hosted (free tier no card; $9/mo Pro = unlimited; morning DM rolling out Q2 2026).",
   "type": "module",
   "main": "src/server.js",

package/scripts/token-cli.js

@@ -133,7 +133,7 @@ async function autoExtract() {
 
 async function clearTokens() {
   const fs = await import("fs");
-  const { execSync } = await import("child_process");
+  const { spawnSync } = await import("child_process");
 
   try {
     fs.unlinkSync(TOKEN_FILE);
@@ -142,11 +142,12 @@ async function clearTokens() {
     console.log("No token file to delete");
   }
 
-  try {
-    execSync(`security delete-generic-password -s "${KEYCHAIN_SERVICE}" -a "token" 2>/dev/null`);
-    execSync(`security delete-generic-password -s "${KEYCHAIN_SERVICE}" -a "cookie" 2>/dev/null`);
+  const securityArgs = (account) => ["delete-generic-password", "-s", KEYCHAIN_SERVICE, "-a", account];
+  const tokenResult = spawnSync("security", securityArgs("token"), { stdio: "ignore" });
+  const cookieResult = spawnSync("security", securityArgs("cookie"), { stdio: "ignore" });
+  if (tokenResult.status === 0 || cookieResult.status === 0) {
     console.log("Deleted keychain entries");
-  } catch (e) {
+  } else {
     console.log("No keychain entries to delete");
   }
 

package/server.json

@@ -17,7 +17,7 @@
     "url": "https://github.com/jtalk22/slack-mcp-server",
     "source": "github"
   },
-  "version": "4.2.1",
+  "version": "4.3.0",
   "remotes": [
     {
       "type": "streamable-http",
@@ -28,7 +28,7 @@
     {
       "registryType": "npm",
       "identifier": "@jtalk22/slack-mcp",
-      "version": "4.2.1",
+      "version": "4.3.0",
       "transport": {
         "type": "stdio"
       },

package/src/cli.js

@@ -37,6 +37,9 @@ if (firstArg === "web") {
 } else if (firstArg === "--apply-template" || firstArg === "apply-template") {
   scriptPath = join(__dirname, "../scripts/apply-template.js");
   scriptArgs = args.slice(1);
+} else if (firstArg === "--refresh-tokens" || firstArg === "refresh-tokens") {
+  scriptPath = join(__dirname, "../scripts/token-cli.js");
+  scriptArgs = ["auto"];
 } else if (WIZARD_ARGS.has(firstArg)) {
   scriptPath = join(__dirname, "../scripts/setup-wizard.js");
   scriptArgs = args;