@ruminaider/slack-cli 0.1.0

package/bin/slack.js

@@ -0,0 +1,348 @@
+#!/usr/bin/env node
+
+import { getAuthStatus, getCredentials, login, logout, importCredentials, parseCurl } from "../lib/auth.js";
+import * as api from "../lib/api.js";
+import { CLI_NAME, PACKAGE_VERSION } from "../lib/config.js";
+
+const BOOLEAN_FLAGS = new Set([
+  "--private",
+  "--include-archived",
+  "--inclusive",
+  "--broadcast",
+  "--json",
+  "--help",
+  "-h",
+  "--version",
+  "-v",
+]);
+
+const VALUE_FLAGS = new Set([
+  "--token",
+  "--cookie",
+  "--cookie-ds",
+  "--curl",
+  "--host",
+  "--team",
+  "--channel",
+  "--user",
+  "--limit",
+  "--cursor",
+  "--oldest",
+  "--latest",
+  "--page",
+  "--sort",
+  "--sort-dir",
+  "--types",
+  "--ts",
+  "--thread-ts",
+  "--text",
+  "--blocks",
+  "--name",
+  "--at",
+  "--file",
+]);
+
+const ALL_FLAGS = new Set([...BOOLEAN_FLAGS, ...VALUE_FLAGS]);
+
+function parseArgs(argv) {
+  const positionals = [];
+  const values = new Map();
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    // Everything after a bare `--` is positional, so message text may start
+    // with a dash: `message send C -- "-1 from baseline"`.
+    if (arg === "--") {
+      positionals.push(...argv.slice(i + 1));
+      break;
+    }
+    if (!arg.startsWith("-") || arg === "-") {
+      positionals.push(arg);
+      continue;
+    }
+    const eq = arg.indexOf("=");
+    if (eq !== -1) {
+      const flag = arg.slice(0, eq);
+      if (!VALUE_FLAGS.has(flag)) throw new Error(`Unknown or non-value flag: ${flag}`);
+      values.set(flag, arg.slice(eq + 1));
+      continue;
+    }
+    if (BOOLEAN_FLAGS.has(arg)) {
+      values.set(arg, true);
+      continue;
+    }
+    if (VALUE_FLAGS.has(arg)) {
+      const next = argv[i + 1];
+      if (next === undefined || ALL_FLAGS.has(next)) throw new Error(`Flag ${arg} requires a value`);
+      values.set(arg, next);
+      i++;
+      continue;
+    }
+    throw new Error(`Unknown flag: ${arg}`);
+  }
+  return { positionals, values };
+}
+
+function out(data) {
+  process.stdout.write(`${JSON.stringify(data, null, 2)}\n`);
+}
+
+function fail(message, code = 1) {
+  process.stderr.write(`${message}\n`);
+  process.exit(code);
+}
+
+function need(value, label) {
+  if (value === undefined || value === null || value === "") {
+    throw new Error(`Missing required ${label}`);
+  }
+  return value;
+}
+
+const HELP = `${CLI_NAME} ${PACKAGE_VERSION} — Slack from the terminal, authenticated as you.
+
+Auth (no app, no OAuth; uses your Slack desktop session):
+  ${CLI_NAME} auth login              Extract + persist credentials from the Slack app
+  ${CLI_NAME} auth status             Show authenticated workspaces
+  ${CLI_NAME} auth import --curl '<curl>'        Import from a copied devtools cURL
+  ${CLI_NAME} auth import --token xoxc-... --cookie xoxd-...
+  ${CLI_NAME} auth logout
+
+Channels:
+  ${CLI_NAME} channel list [--types ...] [--limit N] [--include-archived]
+  ${CLI_NAME} channel info <channel>
+  ${CLI_NAME} channel history <channel> [--limit N] [--oldest ts] [--latest ts]
+  ${CLI_NAME} channel members <channel>
+  ${CLI_NAME} channel join <channel>
+  ${CLI_NAME} channel create <name> [--private]
+
+Messages:
+  ${CLI_NAME} message send <channel> <text> [--thread-ts ts] [--broadcast]
+  ${CLI_NAME} message reply <channel> <thread-ts> <text>
+  ${CLI_NAME} message update <channel> <ts> <text>
+  ${CLI_NAME} message delete <channel> <ts>
+  ${CLI_NAME} message schedule <channel> <text> --at <unix-ts>
+  ${CLI_NAME} thread read <channel> <thread-ts>
+
+Search:
+  ${CLI_NAME} search messages <query> [--limit N] [--sort score|timestamp]
+  ${CLI_NAME} search files <query>
+  ${CLI_NAME} search all <query>
+
+People & reactions:
+  ${CLI_NAME} user list | user info <user> | user me
+  ${CLI_NAME} reaction add <channel> <ts> <emoji>
+  ${CLI_NAME} reaction remove <channel> <ts> <emoji>
+
+Files, pins, canvases:
+  ${CLI_NAME} file list [--channel C] | file info <file>
+  ${CLI_NAME} pin list <channel> | pin add <channel> <ts> | pin remove <channel> <ts>
+  ${CLI_NAME} canvas list [--channel C] | canvas get <canvas-id>
+
+Global: --team <name|id|host> to target a workspace. Output is JSON.
+Text starting with a dash: put it after a bare '--', e.g. message send C0123 -- "-1 vs baseline".`;
+
+async function creds(values) {
+  return getCredentials({
+    token: values.get("--token"),
+    cookie: values.get("--cookie"),
+    cookieDs: values.get("--cookie-ds"),
+    host: values.get("--host"),
+    team: values.get("--team"),
+  });
+}
+
+async function runAuth(sub, positionals, values) {
+  switch (sub) {
+    case "login":
+    case undefined:
+      return out(await login({ team: values.get("--team") }));
+    case "status":
+      return out(await getAuthStatus());
+    case "logout":
+      return out(await logout());
+    case "import": {
+      if (values.get("--curl")) {
+        const parsed = parseCurl(values.get("--curl"));
+        return out(await importCredentials({
+          ...parsed,
+          cookieDs: values.get("--cookie-ds") || parsed.cookieDs,
+          host: values.get("--host") || parsed.host,
+        }));
+      }
+      return out(await importCredentials({
+        token: values.get("--token"),
+        cookie: values.get("--cookie"),
+        cookieDs: values.get("--cookie-ds"),
+        host: values.get("--host"),
+        team: values.get("--team"),
+      }));
+    }
+    default:
+      throw new Error(`Unknown auth subcommand: ${sub}`);
+  }
+}
+
+async function runChannel(sub, p, values) {
+  const c = await creds(values);
+  const opts = {
+    types: values.get("--types"),
+    limit: values.get("--limit"),
+    cursor: values.get("--cursor"),
+    oldest: values.get("--oldest"),
+    latest: values.get("--latest"),
+    inclusive: values.get("--inclusive"),
+    includeArchived: values.get("--include-archived"),
+    private: values.get("--private"),
+  };
+  switch (sub) {
+    case "list": return out(await api.channelList(c, opts));
+    case "info": return out(await api.channelInfo(c, need(p[0] || values.get("--channel"), "channel")));
+    case "history": return out(await api.channelHistory(c, need(p[0] || values.get("--channel"), "channel"), opts));
+    case "members": return out(await api.channelMembers(c, need(p[0] || values.get("--channel"), "channel"), opts));
+    case "join": return out(await api.channelJoin(c, need(p[0] || values.get("--channel"), "channel")));
+    case "create": return out(await api.channelCreate(c, need(p[0] || values.get("--name"), "name"), opts));
+    default: throw new Error(`Unknown channel subcommand: ${sub}`);
+  }
+}
+
+async function runMessage(sub, p, values) {
+  const c = await creds(values);
+  const channel = () => need(p[0] || values.get("--channel"), "channel");
+  switch (sub) {
+    case "send":
+      return out(await api.messageSend(c, channel(), need(p[1] ?? values.get("--text"), "text"), {
+        threadTs: values.get("--thread-ts"),
+        broadcast: values.get("--broadcast"),
+        blocks: values.get("--blocks"),
+      }));
+    case "reply":
+      return out(await api.messageSend(c, channel(), need(p[2] ?? values.get("--text"), "text"), {
+        threadTs: need(p[1] || values.get("--thread-ts"), "thread-ts"),
+        broadcast: values.get("--broadcast"),
+      }));
+    case "update":
+      return out(await api.messageUpdate(c, channel(), need(p[1] || values.get("--ts"), "ts"), need(p[2] ?? values.get("--text"), "text"), {
+        blocks: values.get("--blocks"),
+      }));
+    case "delete":
+      return out(await api.messageDelete(c, channel(), need(p[1] || values.get("--ts"), "ts")));
+    case "schedule":
+      return out(await api.messageSchedule(c, channel(), need(p[1] ?? values.get("--text"), "text"), need(values.get("--at"), "--at"), {
+        threadTs: values.get("--thread-ts"),
+      }));
+    default: throw new Error(`Unknown message subcommand: ${sub}`);
+  }
+}
+
+async function runThread(sub, p, values) {
+  const c = await creds(values);
+  if (sub !== "read") throw new Error(`Unknown thread subcommand: ${sub}`);
+  return out(await api.threadRead(c, need(p[0] || values.get("--channel"), "channel"), need(p[1] || values.get("--thread-ts"), "thread-ts"), {
+    limit: values.get("--limit"),
+    cursor: values.get("--cursor"),
+  }));
+}
+
+async function runSearch(sub, p, values) {
+  const c = await creds(values);
+  const query = need(p[0] || values.get("--text"), "query");
+  const opts = { limit: values.get("--limit"), page: values.get("--page"), sort: values.get("--sort"), sortDir: values.get("--sort-dir") };
+  switch (sub) {
+    case "messages": return out(await api.searchMessages(c, query, opts));
+    case "files": return out(await api.searchFiles(c, query, opts));
+    case "all": return out(await api.searchAll(c, query, opts));
+    default: throw new Error(`Unknown search subcommand: ${sub}`);
+  }
+}
+
+async function runUser(sub, p, values) {
+  const c = await creds(values);
+  switch (sub) {
+    case "list": return out(await api.userList(c, { limit: values.get("--limit"), cursor: values.get("--cursor") }));
+    case "info": return out(await api.userInfo(c, need(p[0] || values.get("--user"), "user")));
+    case "me": {
+      const who = await api.authTest(c);
+      return out(await api.userInfo(c, who.user_id));
+    }
+    default: throw new Error(`Unknown user subcommand: ${sub}`);
+  }
+}
+
+async function runReaction(sub, p, values) {
+  const c = await creds(values);
+  const channel = need(p[0] || values.get("--channel"), "channel");
+  const ts = need(p[1] || values.get("--ts"), "ts");
+  const name = need(p[2] || values.get("--name"), "emoji");
+  if (sub === "add") return out(await api.reactionAdd(c, channel, ts, name));
+  if (sub === "remove") return out(await api.reactionRemove(c, channel, ts, name));
+  throw new Error(`Unknown reaction subcommand: ${sub}`);
+}
+
+async function runFile(sub, p, values) {
+  const c = await creds(values);
+  switch (sub) {
+    case "list": return out(await api.fileList(c, { channel: values.get("--channel"), user: values.get("--user"), limit: values.get("--limit"), page: values.get("--page") }));
+    case "info": return out(await api.fileInfo(c, need(p[0] || values.get("--file"), "file")));
+    default: throw new Error(`Unknown file subcommand: ${sub}`);
+  }
+}
+
+async function runPin(sub, p, values) {
+  const c = await creds(values);
+  const channel = need(p[0] || values.get("--channel"), "channel");
+  switch (sub) {
+    case "list": return out(await api.pinList(c, channel));
+    case "add": return out(await api.pinAdd(c, channel, need(p[1] || values.get("--ts"), "ts")));
+    case "remove": return out(await api.pinRemove(c, channel, need(p[1] || values.get("--ts"), "ts")));
+    default: throw new Error(`Unknown pin subcommand: ${sub}`);
+  }
+}
+
+async function runCanvas(sub, p, values) {
+  const c = await creds(values);
+  if (sub === "list") return out(await api.canvasList(c, { channel: values.get("--channel"), limit: values.get("--limit") }));
+  if (sub === "get") return out(await api.canvasGet(c, need(p[0], "canvas-id")));
+  throw new Error(`Unknown canvas subcommand: ${sub}`);
+}
+
+async function main() {
+  const argv = process.argv.slice(2);
+  let parsed;
+  try {
+    parsed = parseArgs(argv);
+  } catch (err) {
+    fail(err.message);
+  }
+  const { positionals, values } = parsed;
+
+  if (values.get("--version") || values.get("-v")) return out({ name: CLI_NAME, version: PACKAGE_VERSION });
+  const command = positionals[0];
+  if (!command || command === "help" || values.get("--help") || values.get("-h")) {
+    process.stdout.write(`${HELP}\n`);
+    return;
+  }
+
+  const sub = positionals[1];
+  const rest = positionals.slice(2);
+
+  try {
+    switch (command) {
+      case "auth": return await runAuth(sub, rest, values);
+      case "channel": return await runChannel(sub, rest, values);
+      case "message": return await runMessage(sub, rest, values);
+      case "thread": return await runThread(sub, rest, values);
+      case "search": return await runSearch(sub, rest, values);
+      case "user": return await runUser(sub, rest, values);
+      case "reaction": return await runReaction(sub, rest, values);
+      case "file": return await runFile(sub, rest, values);
+      case "pin": return await runPin(sub, rest, values);
+      case "canvas": return await runCanvas(sub, rest, values);
+      default:
+        fail(`Unknown command: ${command}. Run \`${CLI_NAME} help\`.`);
+    }
+  } catch (err) {
+    fail(err.message);
+  }
+}
+
+main();

package/lib/api.js

@@ -0,0 +1,247 @@
+// Slack web API client for native-session (xoxc + xoxd) credentials.
+//
+// xoxc tokens only authenticate when paired with the xoxd `d` cookie, so every
+// request sends the token in the form body and the cookie in the Cookie header,
+// against the workspace host. Command wrappers take resolved credentials so
+// this module never imports auth.js (no import cycle).
+
+import { DEFAULT_API_HOST } from "./config.js";
+
+class SlackApiError extends Error {
+  constructor(method, error, response) {
+    super(`Slack API ${method} failed: ${error}`);
+    this.name = "SlackApiError";
+    this.slackError = error;
+    this.response = response;
+  }
+}
+
+function apiHost(creds) {
+  return creds?.host || DEFAULT_API_HOST;
+}
+
+function buildBody(token, params) {
+  const body = new URLSearchParams();
+  body.set("token", token);
+  for (const [key, value] of Object.entries(params || {})) {
+    if (value === undefined || value === null || value === "") continue;
+    body.set(key, typeof value === "object" ? JSON.stringify(value) : String(value));
+  }
+  return body;
+}
+
+// Low-level call. Returns the parsed Slack response on ok:true, throws
+// SlackApiError otherwise.
+export async function webApiCall(method, params, creds) {
+  if (!creds?.token || !creds?.cookie) {
+    throw new Error("Missing Slack credentials (token + cookie).");
+  }
+  const url = `https://${apiHost(creds)}/api/${method}`;
+  // The xoxd `d` cookie value is stored and transmitted percent-encoded; send
+  // it verbatim. Re-encoding it (e.g. encodeURIComponent) corrupts the trailing
+  // `%3D` and Slack rejects the request with invalid_auth. The `d-s` companion
+  // (Enterprise Grid / SSO) is appended when present.
+  const cookieValue = creds.cookie.startsWith("xoxd-") ? creds.cookie : `xoxd-${creds.cookie}`;
+  const cookieHeader = creds.cookieDs ? `d=${cookieValue}; d-s=${creds.cookieDs}` : `d=${cookieValue}`;
+
+  const res = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded; charset=utf-8",
+      Cookie: cookieHeader,
+      Accept: "application/json",
+    },
+    body: buildBody(creds.token, params),
+  });
+
+  if (!res.ok) {
+    throw new Error(`Slack API ${method} HTTP ${res.status}: ${await res.text()}`);
+  }
+  const data = await res.json();
+  if (!data.ok) {
+    throw new SlackApiError(method, data.error || "unknown_error", data);
+  }
+  return data;
+}
+
+const num = (v) => (v === undefined || v === null || v === "" ? undefined : Number(v));
+
+// ─── auth ────────────────────────────────────────────────────
+export function authTest(creds) {
+  return webApiCall("auth.test", {}, creds);
+}
+
+// ─── channels / conversations ────────────────────────────────
+export function channelList(creds, options = {}) {
+  return webApiCall("conversations.list", {
+    types: options.types || "public_channel,private_channel,mpim,im",
+    limit: num(options.limit) ?? 200,
+    cursor: options.cursor,
+    exclude_archived: options.includeArchived ? false : true,
+  }, creds);
+}
+
+export function channelInfo(creds, channel) {
+  return webApiCall("conversations.info", { channel }, creds);
+}
+
+export function channelHistory(creds, channel, options = {}) {
+  return webApiCall("conversations.history", {
+    channel,
+    limit: num(options.limit) ?? 50,
+    cursor: options.cursor,
+    oldest: options.oldest,
+    latest: options.latest,
+    inclusive: options.inclusive ? true : undefined,
+  }, creds);
+}
+
+export function channelMembers(creds, channel, options = {}) {
+  return webApiCall("conversations.members", {
+    channel,
+    limit: num(options.limit) ?? 200,
+    cursor: options.cursor,
+  }, creds);
+}
+
+export function channelJoin(creds, channel) {
+  return webApiCall("conversations.join", { channel }, creds);
+}
+
+export function channelCreate(creds, name, options = {}) {
+  return webApiCall("conversations.create", {
+    name,
+    is_private: options.private ? true : undefined,
+  }, creds);
+}
+
+// ─── threads ─────────────────────────────────────────────────
+export function threadRead(creds, channel, ts, options = {}) {
+  return webApiCall("conversations.replies", {
+    channel,
+    ts,
+    limit: num(options.limit) ?? 100,
+    cursor: options.cursor,
+  }, creds);
+}
+
+// ─── messages ────────────────────────────────────────────────
+export function messageSend(creds, channel, text, options = {}) {
+  return webApiCall("chat.postMessage", {
+    channel,
+    text,
+    thread_ts: options.threadTs,
+    reply_broadcast: options.broadcast ? true : undefined,
+    blocks: options.blocks,
+  }, creds);
+}
+
+export function messageUpdate(creds, channel, ts, text, options = {}) {
+  return webApiCall("chat.update", { channel, ts, text, blocks: options.blocks }, creds);
+}
+
+export function messageDelete(creds, channel, ts) {
+  return webApiCall("chat.delete", { channel, ts }, creds);
+}
+
+export function messageSchedule(creds, channel, text, postAt, options = {}) {
+  return webApiCall("chat.scheduleMessage", {
+    channel,
+    text,
+    post_at: num(postAt),
+    thread_ts: options.threadTs,
+    blocks: options.blocks,
+  }, creds);
+}
+
+// ─── search ──────────────────────────────────────────────────
+export function searchMessages(creds, query, options = {}) {
+  return webApiCall("search.messages", {
+    query,
+    count: num(options.limit) ?? 20,
+    page: num(options.page),
+    sort: options.sort,
+    sort_dir: options.sortDir,
+  }, creds);
+}
+
+export function searchFiles(creds, query, options = {}) {
+  return webApiCall("search.files", {
+    query,
+    count: num(options.limit) ?? 20,
+    page: num(options.page),
+  }, creds);
+}
+
+export function searchAll(creds, query, options = {}) {
+  return webApiCall("search.all", {
+    query,
+    count: num(options.limit) ?? 20,
+    page: num(options.page),
+  }, creds);
+}
+
+// ─── users ───────────────────────────────────────────────────
+export function userList(creds, options = {}) {
+  return webApiCall("users.list", {
+    limit: num(options.limit) ?? 200,
+    cursor: options.cursor,
+  }, creds);
+}
+
+export function userInfo(creds, user) {
+  return webApiCall("users.info", { user }, creds);
+}
+
+// ─── reactions ───────────────────────────────────────────────
+export function reactionAdd(creds, channel, ts, name) {
+  return webApiCall("reactions.add", { channel, timestamp: ts, name }, creds);
+}
+
+export function reactionRemove(creds, channel, ts, name) {
+  return webApiCall("reactions.remove", { channel, timestamp: ts, name }, creds);
+}
+
+// ─── files ───────────────────────────────────────────────────
+export function fileList(creds, options = {}) {
+  return webApiCall("files.list", {
+    channel: options.channel,
+    user: options.user,
+    count: num(options.limit) ?? 50,
+    page: num(options.page),
+  }, creds);
+}
+
+export function fileInfo(creds, file) {
+  return webApiCall("files.info", { file }, creds);
+}
+
+// ─── pins ────────────────────────────────────────────────────
+export function pinList(creds, channel) {
+  return webApiCall("pins.list", { channel }, creds);
+}
+
+export function pinAdd(creds, channel, ts) {
+  return webApiCall("pins.add", { channel, timestamp: ts }, creds);
+}
+
+export function pinRemove(creds, channel, ts) {
+  return webApiCall("pins.remove", { channel, timestamp: ts }, creds);
+}
+
+// ─── canvases ────────────────────────────────────────────────
+export function canvasList(creds, options = {}) {
+  return webApiCall("files.list", {
+    types: "canvas",
+    count: num(options.limit) ?? 50,
+    channel: options.channel,
+  }, creds);
+}
+
+export function canvasGet(creds, canvas) {
+  // Canvases are files; files.info returns the canvas file record, including the
+  // url fields Slack provides for fetching the content.
+  return webApiCall("files.info", { file: canvas }, creds);
+}
+
+export { SlackApiError };

package/lib/auth.js

@@ -0,0 +1,255 @@
+// Credential storage and resolution for native-session (xoxc + xoxd) auth.
+//
+// Resolution order when a command needs credentials:
+//   1. explicit options.token + options.cookie
+//   2. env SLACK_TOKEN + SLACK_COOKIE
+//   3. persisted ~/.config/slack-cli/credentials.json (team selected by
+//      options.team, env SLACK_TEAM, persisted default, or first workspace)
+
+import { readFile, writeFile, mkdir, unlink } from "node:fs/promises";
+import { dirname } from "node:path";
+import { CLI_NAME, CONFIG_ENV_KEYS, CREDENTIALS_FILE } from "./config.js";
+import { extractCredentials } from "./extract.js";
+import { webApiCall } from "./api.js";
+
+const CREDENTIALS_DIR = dirname(CREDENTIALS_FILE);
+
+function nowIso() {
+  return new Date().toISOString();
+}
+
+async function readStore() {
+  try {
+    return JSON.parse(await readFile(CREDENTIALS_FILE, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+async function writeStore(store) {
+  await mkdir(CREDENTIALS_DIR, { recursive: true });
+  await writeFile(CREDENTIALS_FILE, `${JSON.stringify(store, null, 2)}\n`, { mode: 0o600 });
+}
+
+export async function clearCredentials() {
+  try {
+    await unlink(CREDENTIALS_FILE);
+  } catch (err) {
+    if (err?.code !== "ENOENT") throw err;
+  }
+}
+
+function hostFrom(workspace) {
+  return workspace?.host || (workspace?.url ? workspace.url.replace(/^https?:\/\//, "").split("/")[0] : null);
+}
+
+function matchWorkspace(workspaces, selector) {
+  if (!selector || !Array.isArray(workspaces)) return null;
+  const needle = String(selector).toLowerCase().replace(/^https?:\/\//, "").replace(/\/+$/, "");
+  return (
+    workspaces.find((w) => w.id && String(w.id).toLowerCase() === needle) ||
+    workspaces.find((w) => w.name && w.name.toLowerCase() === needle) ||
+    workspaces.find((w) => hostFrom(w) && hostFrom(w).toLowerCase() === needle) ||
+    workspaces.find((w) => hostFrom(w) && hostFrom(w).toLowerCase().startsWith(`${needle}.`)) ||
+    null
+  );
+}
+
+function selectWorkspace(store, selector) {
+  const workspaces = store?.workspaces || [];
+  if (workspaces.length === 0) return null;
+  return (
+    matchWorkspace(workspaces, selector) ||
+    matchWorkspace(workspaces, store?.default_team) ||
+    workspaces[0]
+  );
+}
+
+function hostFromUrl(url) {
+  if (!url) return null;
+  try {
+    return new URL(url).host;
+  } catch {
+    return url.replace(/^https?:\/\//, "").split("/")[0] || null;
+  }
+}
+
+// Turn raw xoxc tokens into verified workspace records by calling auth.test for
+// each with the shared cookie. Invalid or stale tokens are dropped; duplicates
+// for the same workspace collapse to one.
+async function enrichTokens(tokens, cookie, cookieDs) {
+  const byTeam = new Map();
+  const errors = [];
+  for (const token of tokens) {
+    try {
+      const who = await webApiCall("auth.test", {}, { token, cookie, cookieDs, host: null });
+      const url = who.url ? who.url.replace(/\/+$/, "") : null;
+      byTeam.set(who.team_id || url || token, {
+        id: who.team_id || null,
+        name: who.team || null,
+        url,
+        host: hostFromUrl(who.url),
+        user_id: who.user_id || null,
+        token,
+      });
+    } catch (err) {
+      errors.push(err.message);
+    }
+  }
+  const workspaces = [...byTeam.values()];
+  if (workspaces.length === 0) {
+    throw new Error(
+      `Found ${tokens.length} token(s) but none verified against Slack${
+        errors.length ? ` (last error: ${errors[errors.length - 1]})` : ""
+      }. The session may have expired; reopen Slack or use \`slack-cli auth import\`.`,
+    );
+  }
+  return workspaces;
+}
+
+// Resolve { token, cookie, cookieDs, host, team } for an API call.
+export async function getCredentials(options = {}) {
+  if (options.token && options.cookie) {
+    return {
+      token: options.token,
+      cookie: options.cookie,
+      cookieDs: options.cookieDs || null,
+      host: options.host || null,
+      team: null,
+    };
+  }
+
+  const envToken = process.env[CONFIG_ENV_KEYS.token];
+  const envCookie = process.env[CONFIG_ENV_KEYS.cookie];
+  if (envToken && envCookie) {
+    return {
+      token: envToken,
+      cookie: envCookie,
+      cookieDs: process.env[CONFIG_ENV_KEYS.cookieDs] || null,
+      host: options.host || null,
+      team: null,
+    };
+  }
+
+  const store = await readStore();
+  if (!store?.cookie || !store?.workspaces?.length) {
+    throw new Error(`Not authenticated. Run: ${CLI_NAME} auth login`);
+  }
+  const selector = options.team || process.env[CONFIG_ENV_KEYS.team];
+  const workspace = selectWorkspace(store, selector);
+  if (!workspace?.token) {
+    throw new Error(`No matching Slack workspace. Run: ${CLI_NAME} auth status`);
+  }
+  return {
+    token: workspace.token,
+    cookie: store.cookie,
+    cookieDs: store.cookie_ds || null,
+    host: hostFrom(workspace),
+    team: workspace,
+  };
+}
+
+export async function getAuthStatus() {
+  const envToken = process.env[CONFIG_ENV_KEYS.token];
+  const envCookie = process.env[CONFIG_ENV_KEYS.cookie];
+  if (envToken && envCookie) {
+    return { authenticated: true, source: "env", workspaces: [] };
+  }
+  const store = await readStore();
+  if (!store?.cookie || !store?.workspaces?.length) {
+    return { authenticated: false, source: "missing", workspaces: [] };
+  }
+  return {
+    authenticated: true,
+    source: "persisted",
+    default_team: store.default_team || null,
+    stored_at: store.stored_at || null,
+    workspaces: store.workspaces.map((w) => ({
+      id: w.id,
+      name: w.name,
+      host: hostFrom(w),
+      user_id: w.user_id,
+    })),
+  };
+}
+
+// Extract from the desktop app, verify each token, and persist.
+export async function login(options = {}) {
+  const { tokens, cookie, cookieDs } = extractCredentials();
+  const workspaces = await enrichTokens(tokens, cookie, cookieDs);
+  const store = {
+    auth_type: "session",
+    cookie,
+    cookie_ds: cookieDs || null,
+    workspaces,
+    default_team: matchWorkspace(workspaces, options.team)?.id || workspaces[0]?.id || null,
+    stored_at: nowIso(),
+  };
+  await writeStore(store);
+
+  const active = selectWorkspace(store, options.team);
+  return {
+    persisted: true,
+    workspace_count: workspaces.length,
+    active: { team: active.name, team_id: active.id, user_id: active.user_id, url: active.url },
+    workspaces: workspaces.map((w) => ({ team: w.name, id: w.id, host: w.host })),
+  };
+}
+
+// Persist credentials supplied by hand (token + cookie), bypassing extraction.
+export async function importCredentials({ token, cookie, cookieDs, host, team } = {}) {
+  if (!token || !token.startsWith("xoxc-")) {
+    throw new Error("`--token` must be an xoxc- web token.");
+  }
+  if (!cookie) {
+    throw new Error("`--cookie` is required (the xoxd- `d` cookie value).");
+  }
+  const cookieValue = cookie.startsWith("xoxd-") ? cookie : `xoxd-${cookie}`;
+  const cookieDsValue = cookieDs || null;
+  const resolvedHost = host || null;
+  const verify = await webApiCall("auth.test", {}, { token, cookie: cookieValue, cookieDs: cookieDsValue, host: resolvedHost });
+
+  const workspace = {
+    id: verify.team_id || null,
+    name: verify.team || team || null,
+    url: verify.url ? verify.url.replace(/\/+$/, "") : null,
+    host: verify.url ? new URL(verify.url).host : resolvedHost,
+    user_id: verify.user_id || null,
+    token,
+  };
+  await writeStore({
+    auth_type: "session",
+    cookie: cookieValue,
+    cookie_ds: cookieDsValue,
+    workspaces: [workspace],
+    default_team: workspace.id,
+    stored_at: nowIso(),
+  });
+  return { persisted: true, verified: Boolean(verify.ok), active: { team: workspace.name, user: verify.user } };
+}
+
+// Parse token + cookie out of a cURL command copied from browser devtools.
+export function parseCurl(curl) {
+  if (typeof curl !== "string" || !curl.trim()) {
+    throw new Error("Provide the cURL string copied from devtools.");
+  }
+  const tokenMatch = curl.match(/xoxc-[A-Za-z0-9-]+/);
+  const cookieMatch = curl.match(/xoxd-[A-Za-z0-9%._-]+/);
+  const dsMatch = curl.match(/d-s=([^;'"\s]+)/);
+  const hostMatch = curl.match(/https?:\/\/([a-z0-9-]+\.slack\.com)/i);
+  if (!tokenMatch) throw new Error("No xoxc- token found in the cURL command.");
+  if (!cookieMatch) throw new Error("No xoxd- cookie found in the cURL command.");
+  // Keep cookie values verbatim (percent-encoded as they travel on the wire);
+  // decoding would corrupt the trailing `%3D` and Slack would reject it.
+  return {
+    token: tokenMatch[0],
+    cookie: cookieMatch[0],
+    cookieDs: dsMatch ? dsMatch[1] : null,
+    host: hostMatch ? hostMatch[1] : null,
+  };
+}
+
+export async function logout() {
+  await clearCredentials();
+  return { loggedOut: true };
+}

package/lib/config.js

@@ -0,0 +1,57 @@
+import { createRequire } from "node:module";
+import { homedir, platform } from "node:os";
+import { join } from "node:path";
+
+const require = createRequire(import.meta.url);
+const { version: PACKAGE_JSON_VERSION } = require("../package.json");
+
+export const TOOL_NAME = "slack";
+export const PACKAGE_NAME = "@ruminaider/slack-cli";
+export const CLI_NAME = "slack-cli";
+export const PACKAGE_VERSION = PACKAGE_JSON_VERSION;
+
+export const CONFIG_DIR = join(homedir(), ".config", CLI_NAME);
+export const CREDENTIALS_FILE = join(CONFIG_DIR, "credentials.json");
+
+// Environment overrides (CI / headless use).
+export const CONFIG_ENV_KEYS = Object.freeze({
+  token: "SLACK_TOKEN", // xoxc- web token
+  cookie: "SLACK_COOKIE", // xoxd- d cookie value
+  cookieDs: "SLACK_COOKIE_DS", // optional d-s companion cookie (Enterprise Grid / SSO)
+  team: "SLACK_TEAM", // default team name, id, or host
+});
+
+// Slack desktop app data locations by platform.
+function slackAppDir() {
+  const home = homedir();
+  switch (platform()) {
+    case "darwin":
+      return join(home, "Library", "Application Support", "Slack");
+    case "linux":
+      return join(home, ".config", "Slack");
+    case "win32":
+      return join(process.env.APPDATA || join(home, "AppData", "Roaming"), "Slack");
+    default:
+      return null;
+  }
+}
+
+export const SLACK_APP_DIR = slackAppDir();
+export const SLACK_LEVELDB_DIR = SLACK_APP_DIR
+  ? join(SLACK_APP_DIR, "Local Storage", "leveldb")
+  : null;
+
+// Slack has shipped the Cookies file at the app root and, on some builds, under
+// Network/ or Default/. Resolution tries each in order at extraction time.
+export const SLACK_COOKIE_CANDIDATES = SLACK_APP_DIR
+  ? [
+      join(SLACK_APP_DIR, "Cookies"),
+      join(SLACK_APP_DIR, "Network", "Cookies"),
+      join(SLACK_APP_DIR, "Default", "Cookies"),
+    ]
+  : [];
+
+// macOS Keychain accounts that have held the Slack cookie-encryption key.
+export const MACOS_KEYCHAIN_SERVICES = ["Slack Safe Storage", "Slack Key", "Slack App Store Key"];
+
+export const DEFAULT_API_HOST = "slack.com";

package/lib/extract.js

@@ -0,0 +1,218 @@
+// Native-session credential extraction from the local Slack desktop app.
+//
+// Two pieces are needed to call the Slack web API as the logged-in user:
+//   - the xoxc web token(s), one per workspace, stored in the app's LevelDB
+//     localStorage under the `localConfig_v2` key
+//   - the xoxd `d` cookie, stored encrypted in the app's Chromium SQLite cookie
+//     store and decrypted with a per-platform key
+//
+// The LevelDB data blocks are Snappy-compressed, so the surrounding JSON is not
+// readable by a plain scan. The xoxc tokens, however, are unique random strings
+// that Snappy always stores as verbatim literals, so we regex them straight out
+// of the raw bytes and enrich each one over the network with auth.test rather
+// than parsing the compressed structure. Everything uses Node built-ins only
+// (node:sqlite, node:crypto, node:child_process, node:fs); no npm dependencies.
+
+import { readFileSync, readdirSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { platform } from "node:os";
+import { execFileSync } from "node:child_process";
+import { pbkdf2Sync, createDecipheriv, createHash } from "node:crypto";
+import { createRequire } from "node:module";
+import {
+  SLACK_LEVELDB_DIR,
+  SLACK_COOKIE_CANDIDATES,
+  MACOS_KEYCHAIN_SERVICES,
+} from "./config.js";
+
+// ─── xoxc tokens from LevelDB ───────────────────────────────
+
+// xoxc tokens look like `xoxc-<digits>-<digits>-<digits>-<hex>`; the trailing
+// segment is long, so a 40-char minimum avoids matching a truncated fragment
+// left at a Snappy block boundary.
+const TOKEN_RE = /xoxc-[A-Za-z0-9-]{40,}/g;
+
+// Regex every xoxc token out of the raw LevelDB files and dedupe. Tokens are
+// unique literals that survive Snappy compression intact; we do not try to
+// parse the surrounding JSON. Any valid token wins after auth.test enrichment,
+// so order here does not matter.
+export function extractTokens() {
+  if (!SLACK_LEVELDB_DIR || !existsSync(SLACK_LEVELDB_DIR)) {
+    throw new Error(
+      "Slack desktop app data not found. Open the Slack app and sign in, or import credentials manually with `slack-cli auth import`.",
+    );
+  }
+
+  const files = readdirSync(SLACK_LEVELDB_DIR)
+    .filter((name) => name.endsWith(".ldb") || name.endsWith(".log"))
+    .map((name) => join(SLACK_LEVELDB_DIR, name));
+
+  const tokens = new Set();
+  for (const file of files) {
+    let text;
+    try {
+      text = readFileSync(file).toString("latin1");
+    } catch {
+      continue;
+    }
+    for (const match of text.matchAll(TOKEN_RE)) tokens.add(match[0]);
+  }
+
+  const list = [...tokens];
+  if (list.length === 0) {
+    throw new Error(
+      "No Slack workspace tokens found in the desktop app. Sign in to Slack, or import credentials manually with `slack-cli auth import`.",
+    );
+  }
+  return list;
+}
+
+// ─── xoxd cookie from the Chromium SQLite store ─────────────
+
+function resolveCookieDb() {
+  for (const path of SLACK_COOKIE_CANDIDATES) {
+    if (existsSync(path)) return path;
+  }
+  throw new Error("Slack cookie store not found. Sign in to the Slack desktop app first.");
+}
+
+// node:sqlite is a built-in but was flag-gated before Node 24, so it is loaded
+// lazily here: only auto-extraction touches the cookie DB, leaving the env-var
+// and `auth import` paths usable on older Node.
+function loadSqlite() {
+  const require = createRequire(import.meta.url);
+  try {
+    return require("node:sqlite");
+  } catch (err) {
+    throw new Error(
+      `Reading the Slack cookie store needs Node's built-in node:sqlite (Node 24+, or Node 22–23 with --experimental-sqlite). Upgrade Node, or use \`slack-cli auth import\`. (${err.message})`,
+    );
+  }
+}
+
+// Read the encrypted `d` cookie (required) and its `d-s` companion (optional,
+// present on Enterprise Grid and some SSO setups) from the cookie store.
+function readEncryptedCookies() {
+  const { DatabaseSync } = loadSqlite();
+  const dbPath = resolveCookieDb();
+  const db = new DatabaseSync(dbPath, { readOnly: true });
+  try {
+    const pick = (name) =>
+      db
+        .prepare(
+          "SELECT encrypted_value, host_key FROM cookies WHERE name = ? ORDER BY length(encrypted_value) DESC LIMIT 1",
+        )
+        .get(name);
+    const dRow = pick("d");
+    if (!dRow?.encrypted_value) {
+      throw new Error("No `d` cookie present in the Slack cookie store.");
+    }
+    // node:sqlite returns BLOBs as Uint8Array.
+    const toEntry = (row) =>
+      row?.encrypted_value
+        ? { encrypted: Buffer.from(row.encrypted_value), hostKey: row.host_key || ".slack.com" }
+        : null;
+    return { d: toEntry(dRow), ds: toEntry(pick("d-s")) };
+  } finally {
+    db.close();
+  }
+}
+
+// Chromium prepends a 32-byte SHA-256(host_key) to the plaintext for newer
+// cookie store versions. Strip it when present so we return the raw value.
+function stripHostPrefix(plaintext, hostKey) {
+  if (plaintext.length <= 32) return plaintext;
+  const expected = createHash("sha256").update(hostKey).digest();
+  if (plaintext.subarray(0, 32).equals(expected)) {
+    return plaintext.subarray(32);
+  }
+  return plaintext;
+}
+
+function macosDecryptionKey() {
+  let lastError;
+  for (const service of MACOS_KEYCHAIN_SERVICES) {
+    try {
+      const secret = execFileSync(
+        "security",
+        ["find-generic-password", "-w", "-s", service],
+        { encoding: "utf8" },
+      ).trim();
+      if (secret) {
+        return pbkdf2Sync(secret, "saltysalt", 1003, 16, "sha1");
+      }
+    } catch (err) {
+      lastError = err;
+    }
+  }
+  throw new Error(
+    `Could not read the Slack cookie-encryption key from the macOS Keychain${
+      lastError ? ` (${lastError.message})` : ""
+    }. Approve the Keychain prompt, or import credentials manually with \`slack-cli auth import\`.`,
+  );
+}
+
+function linuxDecryptionKey() {
+  // Slack on Linux commonly uses Chromium's hardcoded v10 fallback key.
+  return pbkdf2Sync("peanuts", "saltysalt", 1, 16, "sha1");
+}
+
+// requireXoxd validates the decrypted value looks like a `d` cookie (`xoxd-`).
+// The `d-s` companion is an opaque session value, so it passes requireXoxd:false.
+function decryptCookieValue(encrypted, hostKey, requireXoxd = true) {
+  const prefix = encrypted.subarray(0, 3).toString("utf8");
+  if (prefix !== "v10" && prefix !== "v11") {
+    // Some stores keep the value in plaintext (older Slack builds).
+    const asText = encrypted.toString("utf8");
+    if (!requireXoxd || asText.startsWith("xoxd-")) return asText;
+    throw new Error(`Unsupported cookie encryption version: ${JSON.stringify(prefix)}.`);
+  }
+
+  const os = platform();
+  let key;
+  if (os === "darwin") key = macosDecryptionKey();
+  else if (os === "linux") key = linuxDecryptionKey();
+  else throw new Error(`Cookie decryption is not implemented for platform ${os}. Use \`slack-cli auth import\`.`);
+
+  const iv = Buffer.alloc(16, " ");
+  const decipher = createDecipheriv("aes-128-cbc", key, iv);
+  decipher.setAutoPadding(true);
+  const body = encrypted.subarray(3);
+  let plaintext;
+  try {
+    plaintext = Buffer.concat([decipher.update(body), decipher.final()]);
+  } catch (err) {
+    throw new Error(`Cookie decryption failed: ${err.message}. Try \`slack-cli auth import\`.`);
+  }
+  const value = stripHostPrefix(plaintext, hostKey).toString("utf8").replace(/\u0000+$/, "");
+  if (requireXoxd && !value.startsWith("xoxd-")) {
+    throw new Error("Decrypted cookie does not look like a Slack `d` cookie.");
+  }
+  return value;
+}
+
+// Returns { d, ds } where ds is null when the workspace has no d-s cookie.
+export function extractCookies() {
+  const { d, ds } = readEncryptedCookies();
+  return {
+    d: decryptCookieValue(d.encrypted, d.hostKey, true),
+    ds: ds ? decryptCookieValue(ds.encrypted, ds.hostKey, false) : null,
+  };
+}
+
+// ─── combined ────────────────────────────────────────────────
+
+// Extract every workspace token plus the shared d cookie (and its optional d-s
+// companion). The cookies are the same across all workspaces, so they are read
+// once. Tokens are enriched into full workspace records by the caller via
+// auth.test.
+export function extractCredentials() {
+  if (!SLACK_LEVELDB_DIR) {
+    throw new Error(
+      `Automatic extraction is not supported on platform ${platform()}. Use \`slack-cli auth import\`.`,
+    );
+  }
+  const tokens = extractTokens();
+  const { d, ds } = extractCookies();
+  return { tokens, cookie: d, cookieDs: ds };
+}

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@ruminaider/slack-cli",
+  "version": "0.1.0",
+  "description": "Slack CLI that authenticates as you using your existing Slack desktop session. Read channels, send messages, search, and manage reactions, files, pins, and canvases from the terminal. No app, no OAuth, no admin approval.",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ruminaider/agent-clis.git",
+    "directory": "slack/cli"
+  },
+  "keywords": [
+    "slack",
+    "cli",
+    "mcp",
+    "agent",
+    "pi-package"
+  ],
+  "bin": {
+    "slack-cli": "bin/slack.js"
+  },
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "engines": {
+    "node": ">=22"
+  }
+}