agent-messenger 1.9.2 → 1.10.0

package/src/platforms/slack/token-extractor.test.ts

@@ -31,6 +31,213 @@ function createCookiesDb(
   db.close()
 }
 
+describe('TokenExtractor token deduplication', () => {
+  test('keeps first token per team and upgrades unknown team name', async () => {
+    // given — two .log entries for the same team: first has unknown name, second has a name
+    const slackDir = mkdtempSync(join(tmpdir(), 'slack-dedup-'))
+    tempDirs.push(slackDir)
+
+    const hex64a = 'a'.repeat(64)
+    const hex64b = 'b'.repeat(64)
+    const tokenA = `xoxc-1111111111-2222222222-3333333333-${hex64a}`
+    const tokenB = `xoxc-4444444444-5555555555-6666666666-${hex64b}`
+
+    const leveldbDir = join(slackDir, 'Local Storage', 'leveldb')
+    mkdirSync(leveldbDir, { recursive: true })
+    // First entry: tokenA with team ID but no name
+    // Second entry: tokenB with same team ID and a name
+    writeFileSync(join(leveldbDir, '000001.log'), `"${tokenA}"T12345678xxx"${tokenB}"T12345678"name":"workspace-name"`)
+
+    // when
+    const extractor = new TokenExtractor('darwin', slackDir)
+    const result = await extractor.extract()
+
+    // then — first token wins, but team name is upgraded
+    expect(result.length).toBe(1)
+    expect(result[0].token).toBe(tokenA)
+    expect(result[0].workspace_name).toBe('workspace-name')
+  })
+
+  test('prefers .log tokens over .ldb tokens for same team', async () => {
+    // given — same team ID in both .log (fresh) and .ldb (stale)
+    const slackDir = mkdtempSync(join(tmpdir(), 'slack-dedup-order-'))
+    tempDirs.push(slackDir)
+
+    const hex64fresh = 'f'.repeat(64)
+    const hex64stale = 's'.repeat(64)
+    const freshToken = `xoxc-1111111111-2222222222-3333333333-${hex64fresh}`
+    const staleToken = `xoxc-9999999999-8888888888-7777777777-${hex64stale}`
+
+    const leveldbDir = join(slackDir, 'Local Storage', 'leveldb')
+    mkdirSync(leveldbDir, { recursive: true })
+    writeFileSync(join(leveldbDir, '000001.log'), `"${freshToken}"T12345678"name":"fresh-workspace"`)
+    writeFileSync(join(leveldbDir, '000002.ldb'), `"${staleToken}"T12345678"team_name":"stale-workspace"`)
+
+    // when
+    const extractor = new TokenExtractor('darwin', slackDir)
+    const result = await extractor.extract()
+
+    // then — .log token wins
+    expect(result.length).toBe(1)
+    expect(result[0].token).toBe(freshToken)
+  })
+})
+
+describe('TokenExtractor LevelDB fragmentation markers', () => {
+  function buildFragmentedLdbContent(tokenParts: string[], marker: number[]): Buffer {
+    // given — build binary content simulating LevelDB fragmentation:
+    // token segments joined by 4-byte marker instead of hyphens
+    const segments: Buffer[] = []
+    for (let i = 0; i < tokenParts.length; i++) {
+      segments.push(Buffer.from(tokenParts[i]))
+      if (i < tokenParts.length - 1) {
+        segments.push(Buffer.from(marker))
+      }
+    }
+    // Surround with team ID context and a terminator
+    const prefix = Buffer.from('"team_name":"test-workspace"T12345678')
+    const suffix = Buffer.from('"')
+    return Buffer.concat([prefix, segments[0] ? Buffer.concat(segments) : Buffer.alloc(0), suffix])
+  }
+
+  test('extracts token with old fragmentation marker [19 0d f0 NN]', async () => {
+    // given
+    const slackDir = mkdtempSync(join(tmpdir(), 'slack-marker-old-'))
+    tempDirs.push(slackDir)
+
+    const hex64 = 'a'.repeat(64)
+    const tokenParts = ['xoxc-1111111111', '2222222222', '3333333333', hex64]
+    const content = buildFragmentedLdbContent(tokenParts, [0x19, 0x0d, 0xf0, 0x5e])
+
+    const leveldbDir = join(slackDir, 'Local Storage', 'leveldb')
+    mkdirSync(leveldbDir, { recursive: true })
+    writeFileSync(join(leveldbDir, '000001.ldb'), content)
+
+    // when
+    const extractor = new TokenExtractor('darwin', slackDir)
+    const result = await extractor.extract()
+
+    // then
+    expect(result.length).toBe(1)
+    expect(result[0].token).toBe(`xoxc-1111111111-2222222222-3333333333-${hex64}`)
+  })
+
+  test('extracts token with new fragmentation marker [15 0b f0 43]', async () => {
+    // given — marker whose 4th byte (0x43 = "C") is a valid hex char
+    const slackDir = mkdtempSync(join(tmpdir(), 'slack-marker-new-'))
+    tempDirs.push(slackDir)
+
+    const hex64 = 'b'.repeat(64)
+    const tokenParts = ['xoxc-4063338523', '4063338531', '8150876260673', hex64]
+    const content = buildFragmentedLdbContent(tokenParts, [0x15, 0x0b, 0xf0, 0x43])
+
+    const leveldbDir = join(slackDir, 'Local Storage', 'leveldb')
+    mkdirSync(leveldbDir, { recursive: true })
+    writeFileSync(join(leveldbDir, '000001.ldb'), content)
+
+    // when
+    const extractor = new TokenExtractor('darwin', slackDir)
+    const result = await extractor.extract()
+
+    // then — 0x43 ("C") must NOT leak into the token
+    expect(result.length).toBe(1)
+    expect(result[0].token).toBe(`xoxc-4063338523-4063338531-8150876260673-${hex64}`)
+    expect(result[0].token).not.toContain('C')
+  })
+
+  test('extracts token with new fragmentation marker [15 0b f0 58]', async () => {
+    // given — marker whose 4th byte (0x58 = "X") is not a valid hex char
+    const slackDir = mkdtempSync(join(tmpdir(), 'slack-marker-58-'))
+    tempDirs.push(slackDir)
+
+    const hex64 = 'c'.repeat(64)
+    const tokenParts = ['xoxc-5555555555', '6666666666', '7777777777', hex64]
+    const content = buildFragmentedLdbContent(tokenParts, [0x15, 0x0b, 0xf0, 0x58])
+
+    const leveldbDir = join(slackDir, 'Local Storage', 'leveldb')
+    mkdirSync(leveldbDir, { recursive: true })
+    writeFileSync(join(leveldbDir, '000001.ldb'), content)
+
+    // when
+    const extractor = new TokenExtractor('darwin', slackDir)
+    const result = await extractor.extract()
+
+    // then
+    expect(result.length).toBe(1)
+    expect(result[0].token).toBe(`xoxc-5555555555-6666666666-7777777777-${hex64}`)
+  })
+})
+
+describe('TokenExtractor Linux cookie decryption', () => {
+  test('decrypts v10 cookie using peanuts password on Linux', async () => {
+    // given — LevelDB with valid token + v10-encrypted cookie using Linux key
+    const slackDir = mkdtempSync(join(tmpdir(), 'slack-linux-'))
+    tempDirs.push(slackDir)
+
+    const cookiePlaintext = 'xoxd-linuxTestCookie%2Bvalue'
+    const key = require('node:crypto').pbkdf2Sync('peanuts', 'saltysalt', 1, 16, 'sha1')
+    const iv = Buffer.alloc(16, ' ')
+    const cipher = createCipheriv('aes-128-cbc', key, iv)
+    const ciphertext = Buffer.concat([cipher.update(cookiePlaintext, 'utf8'), cipher.final()])
+    const encryptedCookie = Buffer.concat([Buffer.from('v10'), ciphertext])
+
+    createCookiesDb(join(slackDir, 'Cookies'), [
+      {
+        name: 'd',
+        value: '',
+        encrypted_value: new Uint8Array(encryptedCookie),
+        host_key: '.slack.com',
+        last_access_utc: 1,
+      },
+    ])
+
+    const token = `xoxc-1111111111-2222222222-3333333333-${'a'.repeat(64)}`
+    const leveldbDir = join(slackDir, 'Local Storage', 'leveldb')
+    mkdirSync(leveldbDir, { recursive: true })
+    writeFileSync(join(leveldbDir, '000001.log'), `"${token}"T12345678"name":"test-workspace"`)
+
+    // when
+    const extractor = new TokenExtractor('linux', slackDir)
+    const result = await extractor.extract()
+
+    // then
+    expect(result.length).toBe(1)
+    expect(result[0].cookie).toBe(cookiePlaintext)
+    expect(result[0].token).toBe(token)
+  })
+})
+
+describe('TokenExtractor debug logging', () => {
+  test('calls debugLog callback during extraction', async () => {
+    // given
+    const slackDir = mkdtempSync(join(tmpdir(), 'slack-debug-'))
+    tempDirs.push(slackDir)
+    mkdirSync(join(slackDir, 'storage'), { recursive: true })
+
+    const messages: string[] = []
+    const debugLog = (msg: string) => messages.push(msg)
+
+    // when
+    const extractor = new TokenExtractor('darwin', slackDir, undefined, debugLog)
+    await extractor.extract()
+
+    // then — should have emitted debug messages
+    expect(messages.length).toBeGreaterThan(0)
+  })
+
+  test('does not throw when debugLog is not provided', async () => {
+    // given
+    const slackDir = mkdtempSync(join(tmpdir(), 'slack-no-debug-'))
+    tempDirs.push(slackDir)
+    mkdirSync(join(slackDir, 'storage'), { recursive: true })
+
+    // when — then — should not throw
+    const extractor = new TokenExtractor('darwin', slackDir)
+    const result = await extractor.extract()
+    expect(result).toEqual([])
+  })
+})
+
 describe('TokenExtractor Windows DPAPI', () => {
   test('decryptDPAPI returns null on non-win32 platform', () => {
     const extractor = new TokenExtractor('darwin', '/tmp/slack-test')

package/src/platforms/slack/token-extractor.ts

@@ -1,6 +1,6 @@
 import { execSync } from 'node:child_process'
 import { createDecipheriv, pbkdf2Sync } from 'node:crypto'
-import { copyFileSync, existsSync, readdirSync, readFileSync, rmSync } from 'node:fs'
+import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs'
 import { createRequire } from 'node:module'
 import { homedir, tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -26,8 +26,14 @@ export class TokenExtractor {
   private platform: NodeJS.Platform
   private slackDir: string
   private keyCache: DerivedKeyCache
-
-  constructor(platform?: NodeJS.Platform, slackDir?: string, keyCache?: DerivedKeyCache) {
+  private debugLog: ((message: string) => void) | null
+
+  constructor(
+    platform?: NodeJS.Platform,
+    slackDir?: string,
+    keyCache?: DerivedKeyCache,
+    debugLog?: (message: string) => void,
+  ) {
     this.platform = platform ?? process.platform
 
     if (!['darwin', 'linux', 'win32'].includes(this.platform)) {
@@ -36,6 +42,11 @@ export class TokenExtractor {
 
     this.slackDir = slackDir ?? this.getSlackDir()
     this.keyCache = keyCache ?? new DerivedKeyCache()
+    this.debugLog = debugLog ?? null
+  }
+
+  private debug(message: string): void {
+    this.debugLog?.(message)
   }
 
   getSlackDir(): string {
@@ -72,6 +83,26 @@ export class TokenExtractor {
     }
   }
 
+  async extractCookie(): Promise<string> {
+    if (!existsSync(this.slackDir)) {
+      return ''
+    }
+
+    await this.getDerivedKeyAsync()
+
+    const cookie = await this.extractCookieFromSQLite()
+    if (!cookie && this.usedCachedKey) {
+      await this.clearKeyCache()
+      this.cachedKey = this.getDerivedKeyFromKeychain()
+      if (this.cachedKey) {
+        await this.keyCache.set('slack', this.cachedKey)
+        return await this.extractCookieFromSQLite()
+      }
+    }
+
+    return cookie
+  }
+
   async extract(): Promise<ExtractedWorkspace[]> {
     if (!existsSync(this.slackDir)) {
       throw new Error(`Slack directory not found: ${this.slackDir}`)
@@ -142,8 +173,11 @@ export class TokenExtractor {
   private deduplicateTokens(tokens: TokenInfo[]): TokenInfo[] {
     const seen = new Map<string, TokenInfo>()
     for (const token of tokens) {
-      if (!seen.has(token.teamId) || token.teamName !== 'unknown') {
+      const existing = seen.get(token.teamId)
+      if (!existing) {
         seen.set(token.teamId, token)
+      } else if (existing.teamName === 'unknown' && token.teamName !== 'unknown') {
+        seen.set(token.teamId, { ...token, token: existing.token })
       }
     }
     return Array.from(seen.values())
@@ -180,25 +214,57 @@ export class TokenExtractor {
   }
 
   private async extractFromLevelDB(dbPath: string): Promise<TokenInfo[]> {
-    const tokens: TokenInfo[] = []
+    // ClassicLevel on a copy avoids LevelDB prefix-compression artifacts
+    // that corrupt tokens when reading raw .ldb files
+    const classicLevelTokens = await this.extractViaClassicLevelCopy(dbPath)
+    if (classicLevelTokens.length > 0) {
+      return classicLevelTokens
+    }
 
-    // First try reading LDB files directly (more reliable for sandboxed apps)
     const directTokens = this.extractTokensFromLDBFiles(dbPath)
     if (directTokens.length > 0) {
       return directTokens
     }
 
-    // Fallback to ClassicLevel for standard installations
+    return this.extractViaClassicLevel(dbPath)
+  }
+
+  private async extractViaClassicLevelCopy(dbPath: string): Promise<TokenInfo[]> {
+    const tempDir = join(tmpdir(), `slack-leveldb-${Date.now()}-${Math.random().toString(36).slice(2)}`)
+
+    try {
+      mkdirSync(tempDir, { recursive: true })
+
+      const files = readdirSync(dbPath)
+      for (const file of files) {
+        if (file === 'LOCK') continue // ClassicLevel creates its own
+        const src = join(dbPath, file)
+        try {
+          if (statSync(src).isFile()) {
+            copyFileSync(src, join(tempDir, file))
+          }
+        } catch {}
+      }
+
+      return await this.extractViaClassicLevel(tempDir)
+    } catch {
+      return []
+    } finally {
+      try {
+        rmSync(tempDir, { recursive: true, force: true })
+      } catch {}
+    }
+  }
+
+  private async extractViaClassicLevel(dbPath: string): Promise<TokenInfo[]> {
+    const tokens: TokenInfo[] = []
     let db: ClassicLevel<string, string> | null = null
     try {
       db = new ClassicLevel(dbPath, { valueEncoding: 'utf8' })
 
       for await (const [key, value] of db.iterator()) {
         if (typeof value === 'string' && value.includes('xoxc-')) {
-          const extracted = this.parseTokenData(key, value)
-          if (extracted) {
-            tokens.push(extracted)
-          }
+          tokens.push(...this.parseTokenValue(key, value))
         }
       }
     } catch {
@@ -209,7 +275,6 @@ export class TokenExtractor {
         } catch {}
       }
     }
-
     return tokens
   }
 
@@ -219,7 +284,13 @@ export class TokenExtractor {
       // Prioritize .log files (not compacted, have clean data)
       // Then fall back to .ldb files
       const logFiles = readdirSync(dbPath).filter((f) => f.endsWith('.log'))
-      const ldbFiles = readdirSync(dbPath).filter((f) => f.endsWith('.ldb'))
+      const ldbFiles = readdirSync(dbPath)
+        .filter((f) => f.endsWith('.ldb'))
+        .sort((a, b) => {
+          const statA = statSync(join(dbPath, a))
+          const statB = statSync(join(dbPath, b))
+          return statB.mtimeMs - statA.mtimeMs
+        })
       const files = [...logFiles, ...ldbFiles]
 
       for (const file of files) {
@@ -305,8 +376,10 @@ export class TokenExtractor {
         i++
       } else {
         // Check for 4-byte fragmentation marker pattern
-        // Pattern: 0x19 0x0d 0xf0 0xNN (where NN varies)
-        if (i + 3 < chunk.length && chunk[i] === 0x19 && chunk[i + 1] === 0x0d && chunk[i + 2] === 0xf0) {
+        // LevelDB compaction inserts 4-byte markers where hyphens should be.
+        // Known patterns: [19 0d f0 NN], [15 0b f0 NN] — the 3rd byte (0xf0) is consistent.
+        // Match any 4-byte sequence where byte at offset +2 is 0xf0.
+        if (i + 3 < chunk.length && chunk[i + 2] === 0xf0) {
           // Skip the 4 garbage bytes and insert a hyphen
           result.push(0x2d) // hyphen
           i += 4
@@ -370,33 +443,57 @@ export class TokenExtractor {
     return { token, teamId, teamName }
   }
 
-  private parseTokenData(_key: string, value: string): TokenInfo | null {
-    const tokenMatch = value.match(/xoxc-[a-zA-Z0-9-]+/)
-    if (!tokenMatch) {
-      return null
+  private parseTokenValue(_key: string, value: string): TokenInfo[] {
+    // LevelDB values may have leading control characters (e.g. 0x01).
+    // Built dynamically to satisfy biome's noControlCharactersInRegex.
+    const controlChars = new RegExp(
+      `[${String.fromCharCode(0)}-${String.fromCharCode(8)}${String.fromCharCode(11)}${String.fromCharCode(12)}${String.fromCharCode(14)}-${String.fromCharCode(31)}]`,
+      'g',
+    )
+    const cleaned = value.replace(controlChars, '')
+    try {
+      const parsed = JSON.parse(cleaned)
+      if (parsed?.teams && typeof parsed.teams === 'object') {
+        return this.parseTeamsObject(parsed.teams)
+      }
+    } catch {}
+
+    const single = this.parseSingleToken(cleaned)
+    return single ? [single] : []
+  }
+
+  private parseTeamsObject(teams: Record<string, any>): TokenInfo[] {
+    const tokens: TokenInfo[] = []
+    for (const [teamId, team] of Object.entries(teams)) {
+      if (!team?.token || typeof team.token !== 'string' || !team.token.startsWith('xoxc-')) continue
+      tokens.push({
+        token: team.token,
+        teamId: team.id || teamId,
+        teamName: team.name || 'unknown',
+      })
     }
+    return tokens
+  }
 
-    const token = tokenMatch[0]
+  private parseSingleToken(value: string): TokenInfo | null {
+    const tokenMatch = value.match(/xoxc-[a-zA-Z0-9-]+/)
+    if (!tokenMatch) return null
 
     let teamId = 'unknown'
     let teamName = 'unknown'
 
     const teamIdMatch = value.match(/"team_id"\s*:\s*"(T[A-Z0-9]+)"/)
-    if (teamIdMatch) {
-      teamId = teamIdMatch[1]
-    }
+    if (teamIdMatch) teamId = teamIdMatch[1]
 
     const teamNameMatch = value.match(/"team_name"\s*:\s*"([^"]+)"/)
     if (teamNameMatch) {
       teamName = teamNameMatch[1]
     } else {
       const domainMatch = value.match(/"domain"\s*:\s*"([^"]+)"/)
-      if (domainMatch) {
-        teamName = domainMatch[1]
-      }
+      if (domainMatch) teamName = domainMatch[1]
     }
 
-    return { token, teamId, teamName }
+    return { token: tokenMatch[0], teamId, teamName }
   }
 
   private async extractCookieFromSQLite(): Promise<string> {
@@ -404,10 +501,13 @@ export class TokenExtractor {
     if (!existsSync(cookiesPath)) {
       const networkCookiesPath = join(this.slackDir, 'Network', 'Cookies')
       if (!existsSync(networkCookiesPath)) {
+        this.debug(`Cookie file not found at ${cookiesPath} or ${networkCookiesPath}`)
         return ''
       }
+      this.debug(`Using Network cookies path: ${networkCookiesPath}`)
       return this.readCookieFromDB(networkCookiesPath)
     }
+    this.debug(`Using cookies path: ${cookiesPath}`)
     return this.readCookieFromDB(cookiesPath)
   }
 
@@ -425,6 +525,7 @@ export class TokenExtractor {
             'Quit the Slack app completely and try again.',
         )
       }
+      this.debug(`Failed to copy cookie DB: ${(error as Error).message}`)
       return ''
     }
 
@@ -451,22 +552,29 @@ export class TokenExtractor {
       }
 
       if (!row) {
+        this.debug('No cookie row found in database')
         return ''
       }
 
       if (row.value?.startsWith('xoxd-')) {
+        this.debug('Found plaintext cookie')
         return row.value
       }
 
       if (row.encrypted_value && row.encrypted_value.length > 0) {
+        this.debug(`Found encrypted cookie (${row.encrypted_value.length} bytes)`)
         const decrypted = this.tryDecryptCookie(Buffer.from(row.encrypted_value))
         if (decrypted) {
+          this.debug('Cookie decrypted successfully')
           return decrypted
         }
+        this.debug('Cookie decryption failed')
       }
 
+      this.debug('No usable cookie value in row')
       return ''
-    } catch {
+    } catch (error) {
+      this.debug(`Cookie DB query failed: ${(error as Error).message}`)
       return ''
     } finally {
       try {
@@ -485,6 +593,9 @@ export class TokenExtractor {
       if (this.platform === 'win32') {
         return this.decryptV10CookieWindows(encrypted)
       }
+      if (this.platform === 'linux') {
+        return this.decryptV10CookieLinux(encrypted)
+      }
       return this.decryptV10Cookie(encrypted)
     }
 
@@ -524,6 +635,23 @@ export class TokenExtractor {
     }
   }
 
+  private decryptV10CookieLinux(encrypted: Buffer): string | null {
+    try {
+      const key = pbkdf2Sync('peanuts', 'saltysalt', 1, 16, 'sha1')
+      const iv = Buffer.alloc(16, ' ')
+      const ciphertext = encrypted.subarray(3)
+
+      const decipher = createDecipheriv('aes-128-cbc', key, iv)
+      const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()])
+      const result = decrypted.toString('utf8')
+
+      const match = result.match(/xoxd-[A-Za-z0-9%]+/)
+      return match ? match[0] : null
+    } catch {
+      return null
+    }
+  }
+
   decryptV10CookieWindows(encrypted: Buffer): string | null {
     try {
       const masterKey = this.getWindowsMasterKey()
@@ -607,6 +735,7 @@ export class TokenExtractor {
 
   private async getDerivedKeyAsync(): Promise<Buffer | null> {
     if (this.platform !== 'darwin') {
+      this.debug(`Skipping Keychain key derivation (platform: ${this.platform})`)
       return null
     }
 
@@ -614,6 +743,7 @@ export class TokenExtractor {
     if (cached) {
       this.cachedKey = cached
       this.usedCachedKey = true
+      this.debug('Using cached derived key')
       return cached
     }
 
@@ -622,6 +752,9 @@ export class TokenExtractor {
       this.cachedKey = key
       await this.keyCache.set('slack', key)
       this.usedCachedKey = false
+      this.debug('Derived key from Keychain')
+    } else {
+      this.debug('Failed to derive key from Keychain')
     }
     return key
   }

package/src/platforms/teams/client.ts

@@ -86,7 +86,7 @@ export class TeamsClient {
 
   private async request<T>(method: string, path: string, body?: unknown, baseUrl: string = MSG_API_BASE): Promise<T> {
     if (this.isTokenExpired()) {
-      throw new TeamsError('Token has expired', 'token_expired')
+      throw new TeamsError('Token has expired. Run "auth extract" to refresh.', 'token_expired')
     }
 
     const url = `${baseUrl}${path}`
@@ -151,7 +151,7 @@ export class TeamsClient {
 
   private async requestFormData<T>(path: string, formData: FormData, baseUrl: string = MSG_API_BASE): Promise<T> {
     if (this.isTokenExpired()) {
-      throw new TeamsError('Token has expired', 'token_expired')
+      throw new TeamsError('Token has expired. Run "auth extract" to refresh.', 'token_expired')
     }
 
     const url = `${baseUrl}${path}`

package/src/platforms/teams/commands/team.ts

@@ -53,7 +53,12 @@ export async function switchAction(teamId: string, options: { pretty?: boolean }
     const account = await credManager.getCurrentAccount()
 
     if (!account?.teams?.[teamId]) {
-      console.log(formatOutput({ error: `Team not found: ${teamId}` }, options.pretty))
+      console.log(
+        formatOutput(
+          { error: `Team not found: ${teamId}`, hint: 'Run "team list" to see available teams.' },
+          options.pretty,
+        ),
+      )
       process.exit(1)
     }
 
@@ -87,18 +92,23 @@ export async function removeAction(teamId: string, options: { pretty?: boolean }
     const config = await credManager.loadConfig()
 
     if (!config) {
-      console.log(formatOutput({ error: 'No configuration found.' }, options.pretty))
+      console.log(formatOutput({ error: 'No configuration found. Run "auth extract" first.' }, options.pretty))
       process.exit(1)
     }
 
     const account = await credManager.getCurrentAccount()
     if (!account) {
-      console.log(formatOutput({ error: 'No active account.' }, options.pretty))
+      console.log(formatOutput({ error: 'No active account. Run "auth extract" first.' }, options.pretty))
       process.exit(1)
     }
 
     if (!account.teams[teamId]) {
-      console.log(formatOutput({ error: `Team not found: ${teamId}` }, options.pretty))
+      console.log(
+        formatOutput(
+          { error: `Team not found: ${teamId}`, hint: 'Run "team list" to see available teams.' },
+          options.pretty,
+        ),
+      )
       process.exit(1)
     }