agent-messenger 2.25.0 → 2.27.0

package/dist/src/platforms/discord/remote-auth.js

@@ -0,0 +1,208 @@
+import { constants as cryptoConstants, createHash, createPrivateKey, createPublicKey, generateKeyPairSync, privateDecrypt, } from 'node:crypto';
+import WebSocket from 'ws';
+import { DiscordError } from './client.js';
+import { getDiscordHeaders } from './super-properties.js';
+const REMOTE_AUTH_GATEWAY_URL = 'wss://remote-auth-gateway.discord.gg/?v=2';
+const REMOTE_AUTH_ORIGIN = 'https://discord.com';
+const REMOTE_AUTH_LOGIN_URL = 'https://discord.com/api/v9/users/@me/remote-auth/login';
+const QR_URL_PREFIX = 'https://discord.com/ra/';
+const DEFAULT_TIMEOUT_MS = 150_000;
+/**
+ * Authenticate a Discord user account via the Remote Auth ("scan QR with the mobile app") flow.
+ *
+ * The desktop side (this function) opens a WebSocket to Discord's remote-auth gateway, performs an
+ * RSA-OAEP key exchange, and renders a QR code. Once the user scans it with an authenticated Discord
+ * mobile app and confirms, Discord returns an encrypted ticket which is exchanged for the user token.
+ */
+export function loginWithRemoteAuth(options = {}) {
+    const debug = options.debug;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const { publicKey, privateKey } = generateKeyPairSync('rsa', {
+        modulusLength: 2048,
+        publicExponent: 0x10001,
+    });
+    const ws = options.createWebSocket
+        ? options.createWebSocket(REMOTE_AUTH_GATEWAY_URL)
+        : new WebSocket(REMOTE_AUTH_GATEWAY_URL, { headers: { Origin: REMOTE_AUTH_ORIGIN } });
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let heartbeatTimer = null;
+        let pendingUser = null;
+        let exchangeStarted = false;
+        const cleanup = () => {
+            if (heartbeatTimer) {
+                clearInterval(heartbeatTimer);
+                heartbeatTimer = null;
+            }
+            clearTimeout(timeoutTimer);
+            try {
+                ws.close();
+            }
+            catch { }
+        };
+        const fail = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(error);
+        };
+        const succeed = (session) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            resolve(session);
+        };
+        const timeoutTimer = setTimeout(() => {
+            fail(new DiscordError('Remote auth timed out before the QR code was scanned.', 'remote_auth_timeout'));
+        }, timeoutMs);
+        timeoutTimer.unref?.();
+        const send = (payload) => {
+            try {
+                ws.send(JSON.stringify(payload));
+            }
+            catch (error) {
+                fail(error instanceof Error ? error : new Error(String(error)));
+            }
+        };
+        ws.on('open', () => {
+            debug?.('Connected to remote auth gateway');
+        });
+        ws.on('message', (raw) => {
+            let message;
+            try {
+                message = JSON.parse(raw.toString());
+            }
+            catch {
+                return;
+            }
+            try {
+                handleMessage(message);
+            }
+            catch (error) {
+                fail(error instanceof Error ? error : new Error(String(error)));
+            }
+        });
+        const handleMessage = (message) => {
+            switch (message.op) {
+                case 'hello': {
+                    const interval = message.heartbeat_interval;
+                    heartbeatTimer = setInterval(() => send({ op: 'heartbeat' }), interval);
+                    heartbeatTimer.unref?.();
+                    send({ op: 'init', encoded_public_key: encodePublicKey(publicKey) });
+                    debug?.('Sent init with public key');
+                    break;
+                }
+                case 'nonce_proof': {
+                    const encrypted = message.encrypted_nonce;
+                    const proof = computeNonceProof(privateKey, encrypted);
+                    send({ op: 'nonce_proof', proof });
+                    debug?.('Sent nonce proof');
+                    break;
+                }
+                case 'pending_remote_init': {
+                    const { fingerprint } = message;
+                    const qrUrl = `${QR_URL_PREFIX}${fingerprint}`;
+                    debug?.('Received fingerprint; QR ready');
+                    Promise.resolve(options.onQrUrl?.(qrUrl)).catch((error) => {
+                        fail(error instanceof Error ? error : new Error(String(error)));
+                    });
+                    break;
+                }
+                case 'pending_ticket': {
+                    const payload = decryptPayload(privateKey, message.encrypted_user_payload);
+                    pendingUser = parseUserPayload(payload.toString('utf8'));
+                    options.onPendingLogin?.(pendingUser);
+                    debug?.(`QR scanned by ${pendingUser.username}`);
+                    break;
+                }
+                case 'pending_login': {
+                    if (exchangeStarted)
+                        break;
+                    exchangeStarted = true;
+                    const { ticket } = message;
+                    debug?.('Exchanging ticket for token');
+                    exchangeTicket(ticket, privateKey, options.fetchImpl ?? fetch)
+                        .then((token) => succeed({ token, user: pendingUser }))
+                        .catch(fail);
+                    break;
+                }
+                case 'cancel': {
+                    fail(new DiscordError('Remote auth was cancelled from the mobile device.', 'remote_auth_cancelled'));
+                    break;
+                }
+            }
+        };
+        ws.on('close', (code) => {
+            if (settled)
+                return;
+            // The gateway closes the socket right after pending_login; the in-flight
+            // ticket exchange settles the result, so this close must not preempt it.
+            if (exchangeStarted)
+                return;
+            // 4003 is the gateway's timeout close code.
+            if (code === 4003) {
+                fail(new DiscordError('Remote auth session expired. Generate a new QR code and try again.', 'remote_auth_timeout'));
+                return;
+            }
+            fail(new DiscordError(`Remote auth connection closed before completion (code ${code}).`, 'remote_auth_closed'));
+        });
+        ws.on('error', (error) => {
+            fail(error instanceof Error ? error : new Error(String(error)));
+        });
+    });
+}
+function encodePublicKey(publicKey) {
+    const spki = publicKey.export({ type: 'spki', format: 'der' });
+    return spki.toString('base64');
+}
+function decryptPayload(privateKey, encryptedBase64) {
+    return privateDecrypt({
+        key: privateKey,
+        padding: cryptoConstants.RSA_PKCS1_OAEP_PADDING,
+        oaepHash: 'sha256',
+    }, Buffer.from(encryptedBase64, 'base64'));
+}
+function computeNonceProof(privateKey, encryptedNonce) {
+    const nonce = decryptPayload(privateKey, encryptedNonce);
+    return base64UrlNoPadding(createHash('sha256').update(nonce).digest());
+}
+function parseUserPayload(payload) {
+    const [id = '', discriminator = '0', avatar = '', username = ''] = payload.split(':');
+    return { id, username, discriminator, avatar: avatar || null };
+}
+async function exchangeTicket(ticket, privateKey, fetchImpl) {
+    const { Authorization: _omit, ...headers } = getDiscordHeaders('');
+    const response = await fetchImpl(REMOTE_AUTH_LOGIN_URL, {
+        method: 'POST',
+        headers: { ...headers, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ ticket }),
+    });
+    if (response.status === 400) {
+        const body = (await response.json().catch(() => ({})));
+        if (body.captcha_sitekey) {
+            throw new DiscordError('Discord requires a captcha to complete this login. Captcha solving is not supported; use `auth extract` instead.', 'remote_auth_captcha');
+        }
+    }
+    if (!response.ok) {
+        throw new DiscordError(`Failed to exchange remote auth ticket (HTTP ${response.status}).`, 'remote_auth_login_failed');
+    }
+    const body = (await response.json());
+    if (!body.encrypted_token) {
+        throw new DiscordError('Remote auth response did not include a token.', 'remote_auth_login_failed');
+    }
+    return decryptPayload(privateKey, body.encrypted_token).toString('utf8');
+}
+function base64UrlNoPadding(buffer) {
+    return buffer.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+export const __test = {
+    encodePublicKey,
+    computeNonceProof,
+    parseUserPayload,
+    base64UrlNoPadding,
+    createPublicKey,
+    createPrivateKey,
+};
+//# sourceMappingURL=remote-auth.js.map

package/dist/src/platforms/discord/remote-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-auth.js","sourceRoot":"","sources":["../../../../src/platforms/discord/remote-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,IAAI,eAAe,EAC5B,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,cAAc,GACf,MAAM,aAAa,CAAA;AAEpB,OAAO,SAAS,MAAM,IAAI,CAAA;AAE1B,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEtD,MAAM,uBAAuB,GAAG,2CAA2C,CAAA;AAC3E,MAAM,kBAAkB,GAAG,qBAAqB,CAAA;AAChD,MAAM,qBAAqB,GAAG,wDAAwD,CAAA;AACtF,MAAM,aAAa,GAAG,yBAAyB,CAAA;AAC/C,MAAM,kBAAkB,GAAG,OAAO,CAAA;AA2DlC;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAA6B,EAAE;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAA;IAEzD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE;QAC3D,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,OAAO;KACxB,CAAC,CAAA;IAEF,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe;QAChC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,uBAAuB,CAAC;QAClD,CAAC,CAAC,IAAI,SAAS,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;IAEvF,OAAO,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxD,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,IAAI,cAAc,GAA0C,IAAI,CAAA;QAChE,IAAI,WAAW,GAA0B,IAAI,CAAA;QAC7C,IAAI,eAAe,GAAG,KAAK,CAAA;QAE3B,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,IAAI,cAAc,EAAE,CAAC;gBACnB,aAAa,CAAC,cAAc,CAAC,CAAA;gBAC7B,cAAc,GAAG,IAAI,CAAA;YACvB,CAAC;YACD,YAAY,CAAC,YAAY,CAAC,CAAA;YAC1B,IAAI,CAAC;gBACH,EAAE,CAAC,KAAK,EAAE,CAAA;YACZ,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC,CAAA;QAED,MAAM,IAAI,GAAG,CAAC,KAAY,EAAQ,EAAE;YAClC,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,OAAO,EAAE,CAAA;YACT,MAAM,CAAC,KAAK,CAAC,CAAA;QACf,CAAC,CAAA;QAED,MAAM,OAAO,GAAG,CAAC,OAA0B,EAAQ,EAAE;YACnD,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,OAAO,EAAE,CAAA;YACT,OAAO,CAAC,OAAO,CAAC,CAAA;QAClB,CAAC,CAAA;QAED,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YACnC,IAAI,CAAC,IAAI,YAAY,CAAC,uDAAuD,EAAE,qBAAqB,CAAC,CAAC,CAAA;QACxG,CAAC,EAAE,SAAS,CAAC,CAAA;QACb,YAAY,CAAC,KAAK,EAAE,EAAE,CAAA;QAEtB,MAAM,IAAI,GAAG,CAAC,OAAgC,EAAQ,EAAE;YACtD,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YACjE,CAAC;QACH,CAAC,CAAA;QAED,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACjB,KAAK,EAAE,CAAC,kCAAkC,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAsB,EAAE,EAAE;YAC1C,IAAI,OAA0B,CAAA;YAC9B,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAsB,CAAA;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAM;YACR,CAAC;YAED,IAAI,CAAC;gBACH,aAAa,CAAC,OAAO,CAAC,CAAA;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YACjE,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,aAAa,GAAG,CAAC,OAA0B,EAAQ,EAAE;YACzD,QAAQ,OAAO,CAAC,EAAE,EAAE,CAAC;gBACnB,KAAK,OAAO,CAAC,CAAC,CAAC;oBACb,MAAM,QAAQ,GAAI,OAA2B,CAAC,kBAAkB,CAAA;oBAChE,cAAc,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;oBACvE,cAAc,CAAC,KAAK,EAAE,EAAE,CAAA;oBACxB,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;oBACpE,KAAK,EAAE,CAAC,2BAA2B,CAAC,CAAA;oBACpC,MAAK;gBACP,CAAC;gBAED,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,MAAM,SAAS,GAAI,OAAgC,CAAC,eAAe,CAAA;oBACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;oBACtD,IAAI,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAA;oBAClC,KAAK,EAAE,CAAC,kBAAkB,CAAC,CAAA;oBAC3B,MAAK;gBACP,CAAC;gBAED,KAAK,qBAAqB,CAAC,CAAC,CAAC;oBAC3B,MAAM,EAAE,WAAW,EAAE,GAAG,OAAsC,CAAA;oBAC9D,MAAM,KAAK,GAAG,GAAG,aAAa,GAAG,WAAW,EAAE,CAAA;oBAC9C,KAAK,EAAE,CAAC,gCAAgC,CAAC,CAAA;oBACzC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;wBACxD,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;oBACjE,CAAC,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;gBAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;oBACtB,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,EAAG,OAAmC,CAAC,sBAAsB,CAAC,CAAA;oBACvG,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;oBACxD,OAAO,CAAC,cAAc,EAAE,CAAC,WAAW,CAAC,CAAA;oBACrC,KAAK,EAAE,CAAC,iBAAiB,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAA;oBAChD,MAAK;gBACP,CAAC;gBAED,KAAK,eAAe,CAAC,CAAC,CAAC;oBACrB,IAAI,eAAe;wBAAE,MAAK;oBAC1B,eAAe,GAAG,IAAI,CAAA;oBACtB,MAAM,EAAE,MAAM,EAAE,GAAG,OAAiC,CAAA;oBACpD,KAAK,EAAE,CAAC,6BAA6B,CAAC,CAAA;oBACtC,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;yBAC3D,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;yBACtD,KAAK,CAAC,IAAI,CAAC,CAAA;oBACd,MAAK;gBACP,CAAC;gBAED,KAAK,QAAQ,CAAC,CAAC,CAAC;oBACd,IAAI,CAAC,IAAI,YAAY,CAAC,mDAAmD,EAAE,uBAAuB,CAAC,CAAC,CAAA;oBACpG,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC,CAAA;QAED,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAY,EAAE,EAAE;YAC9B,IAAI,OAAO;gBAAE,OAAM;YACnB,yEAAyE;YACzE,yEAAyE;YACzE,IAAI,eAAe;gBAAE,OAAM;YAC3B,4CAA4C;YAC5C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,IAAI,CACF,IAAI,YAAY,CAAC,oEAAoE,EAAE,qBAAqB,CAAC,CAC9G,CAAA;gBACD,OAAM;YACR,CAAC;YACD,IAAI,CAAC,IAAI,YAAY,CAAC,yDAAyD,IAAI,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAA;QACjH,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YAC9B,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACjE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,SAA8D;IACrF,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9D,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,cAAc,CACrB,UAAgE,EAChE,eAAuB;IAEvB,OAAO,cAAc,CACnB;QACE,GAAG,EAAE,UAAU;QACf,OAAO,EAAE,eAAe,CAAC,sBAAsB;QAC/C,QAAQ,EAAE,QAAQ;KACnB,EACD,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CACvC,CAAA;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,UAAgE,EAChE,cAAsB;IAEtB,MAAM,KAAK,GAAG,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;IACxD,OAAO,kBAAkB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AACxE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,aAAa,GAAG,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACrF,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAAA;AAChE,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,MAAc,EACd,UAAgE,EAChE,SAAuB;IAEvB,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAA;IAClE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,qBAAqB,EAAE;QACtD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;KACjC,CAAC,CAAA;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAiC,CAAA;QACtF,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,MAAM,IAAI,YAAY,CACpB,kHAAkH,EAClH,qBAAqB,CACtB,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CACpB,+CAA+C,QAAQ,CAAC,MAAM,IAAI,EAClE,0BAA0B,CAC3B,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiC,CAAA;IACpE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC1B,MAAM,IAAI,YAAY,CAAC,+CAA+C,EAAE,0BAA0B,CAAC,CAAA;IACrG,CAAC;IAED,OAAO,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC1E,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAC7F,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,kBAAkB;IAClB,eAAe;IACf,gBAAgB;CACjB,CAAA"}

package/dist/src/platforms/slack/qr-http-login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"qr-http-login.d.ts","sourceRoot":"","sources":["../../../../src/platforms/slack/qr-http-login.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAClC;AAMD,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CAwBnG;AAqDD,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAQnD;AAED,wBAAgB,YAAY,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGnE"}
+{"version":3,"file":"qr-http-login.d.ts","sourceRoot":"","sources":["../../../../src/platforms/slack/qr-http-login.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAClC;AAMD,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CAwBnG;AA8JD,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAQnD;AAED,wBAAgB,YAAY,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGnE"}

package/dist/src/platforms/slack/qr-http-login.js

@@ -7,9 +7,9 @@ export async function loginWithQr(dataUrl, options = {}) {
     const login = decodeSlackQr(dataUrl.trim());
     const debug = options.debug;
     debug?.(`Decoded QR for workspace ${login.workspace}`);
-    const cookie = await captureDCookie(login.url, options);
+    const { cookie, denialReason, ssoProvider } = await captureDCookie(login.url, options);
     if (!cookie) {
-        throw new SlackError('Could not establish a Slack session from the QR code. The link may have expired — generate a new QR code and try again.', 'qr_session_failed');
+        throw new SlackError(qrSessionFailureMessage(denialReason, { workspace: login.workspace, ssoProvider }), 'qr_session_failed');
     }
     debug?.('Captured session cookie');
     const token = await refreshTokenFromWeb(login.workspace, cookie, options.fetchImpl ?? fetch);
@@ -19,12 +19,60 @@ export async function loginWithQr(dataUrl, options = {}) {
     debug?.('Retrieved client token');
     return { token, cookie, workspace: login.workspace };
 }
+function qrSessionFailureMessage(denialReason, context = {}) {
+    const workspace = context.workspace ? `"${context.workspace}"` : 'this workspace';
+    if (denialReason === 'sso_required') {
+        const via = context.ssoProvider ? ` (via ${context.ssoProvider})` : '';
+        return [
+            `Slack workspace ${workspace} enforces SSO${via}, so QR sign-in cannot complete here.`,
+            '',
+            `Why: scanning the QR redirects the login to your identity provider${via}. agent-slack follows the`,
+            'redirect chain over plain HTTP and never sends your session cookie off Slack-owned hosts, so it',
+            'stops at the IdP and no Slack session (the "d" cookie) is ever issued. Completing SSO requires a',
+            'real browser, which a headless environment does not have.',
+            '',
+            'What to do instead:',
+            '  On a computer where you are already signed in to Slack (desktop app or a Chromium browser),',
+            '  run:  agent-slack auth extract',
+            '  This reads your existing session locally — no SSO re-login, no DevTools.',
+            '',
+            'Background: https://github.com/agent-messenger/agent-messenger/issues/260',
+        ].join('\n');
+    }
+    if (denialReason === 'link_expired') {
+        return [
+            `The Slack QR code for ${workspace} has expired or was already used.`,
+            'The z-app sign-in link is single-use and short-lived: it is consumed the first time it is opened',
+            '(including previewing or scanning it), and re-using it returns "Link Expired".',
+            '',
+            'Generate a fresh QR (your name → "Sign in on mobile") and pipe it in immediately, without',
+            'previewing or scanning it first.',
+        ].join('\n');
+    }
+    if (denialReason === 'awaiting_device_confirmation') {
+        return [
+            `Slack requires this sign-in to ${workspace} to be confirmed on an already-authenticated device.`,
+            'QR sign-in over HTTP cannot complete that approval step.',
+            '',
+            'Use  agent-slack auth extract  on a computer already signed in to Slack instead.',
+        ].join('\n');
+    }
+    return [
+        `Could not establish a Slack session for ${workspace} from the QR code.`,
+        'The link may have expired, or the workspace requires a sign-in step that QR-over-HTTP cannot complete.',
+        '',
+        'Generate a fresh QR and try again, or run  agent-slack auth extract  on a computer already signed in',
+        'to Slack.',
+    ].join('\n');
+}
 async function captureDCookie(startUrl, options) {
     const doFetch = options.fetchImpl ?? fetch;
     const maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
     const debug = options.debug;
     let url = startUrl;
     let dCookie = null;
+    let sessionDenialReason = null;
+    let ssoProvider = null;
     const cookieJar = [];
     for (let hop = 0; hop < maxRedirects; hop++) {
         // Only ever send captured cookies (including the d session cookie) to Slack
@@ -43,26 +91,77 @@ async function captureDCookie(startUrl, options) {
                 ...(cookieJar.length ? { Cookie: cookieJar.join('; ') } : {}),
             },
         });
+        const cookieNames = [];
         for (const setCookie of getSetCookies(response)) {
             const value = parseDCookie(setCookie);
             if (value)
                 dCookie = value;
+            const name = setCookie.split('=')[0]?.trim();
+            if (name)
+                cookieNames.push(name);
             const pair = setCookie.split(';')[0]?.trim();
             if (pair)
                 cookieJar.push(pair);
         }
-        debug?.(`hop ${hop}: ${response.status}`);
+        debug?.(`hop ${hop}: ${response.status} set-cookie=[${cookieNames.join(',') || 'none'}]`);
         const location = response.status >= 300 && response.status < 400 ? response.headers.get('location') : null;
-        if (!location)
+        if (!location) {
+            if (!dCookie)
+                sessionDenialReason = await classifySessionDenial(response);
             break;
+        }
         const next = new URL(location, url).toString();
         if (!isSlackHost(next)) {
-            debug?.(`hop ${hop}: redirect target is not a Slack host, stopping`);
+            // A no-cookie login QR that redirects off Slack is an SSO/IdP hand-off the
+            // HTTP flow cannot complete — classify it regardless of whether the IdP
+            // host is a recognized provider (custom/vanity SAML domains included).
+            if (!dCookie) {
+                sessionDenialReason = 'sso_required';
+                ssoProvider = ssoProviderFromUrl(next);
+            }
+            debug?.(`hop ${hop}: redirect target is not a Slack host (${new URL(next).hostname}), stopping`);
             break;
         }
         url = next;
     }
-    return dCookie;
+    return { cookie: dCookie, denialReason: sessionDenialReason, ssoProvider };
+}
+function ssoProviderFromUrl(rawUrl) {
+    let hostname;
+    try {
+        hostname = new URL(rawUrl).hostname;
+    }
+    catch {
+        return null;
+    }
+    if (hostname === 'accounts.google.com')
+        return 'Google';
+    if (hostname.endsWith('.okta.com') || hostname.endsWith('.oktapreview.com'))
+        return 'Okta';
+    if (hostname === 'login.microsoftonline.com')
+        return 'Microsoft';
+    if (hostname.endsWith('.onelogin.com'))
+        return 'OneLogin';
+    if (hostname.endsWith('.pingidentity.com') || hostname.endsWith('.pingone.com'))
+        return 'Ping Identity';
+    if (hostname.endsWith('.auth0.com'))
+        return 'Auth0';
+    return null;
+}
+async function classifySessionDenial(response) {
+    try {
+        const body = await response.text();
+        if (/Link Expired/i.test(body) || /trouble signing you in/i.test(body)) {
+            return 'link_expired';
+        }
+        if (/sign in on your other device/i.test(body) || /open Slack/i.test(body) || /confirm/i.test(body)) {
+            return 'awaiting_device_confirmation';
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
 }
 export function isSlackHost(rawUrl) {
     try {

package/dist/src/platforms/slack/qr-http-login.js.map

@@ -1 +1 @@
-{"version":3,"file":"qr-http-login.js","sourceRoot":"","sources":["../../../../src/platforms/slack/qr-http-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAc1C,MAAM,kBAAkB,GACtB,uHAAuH,CAAA;AACzH,MAAM,qBAAqB,GAAG,EAAE,CAAA;AAEhC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,UAA0B,EAAE;IAC7E,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IAC3B,KAAK,EAAE,CAAC,4BAA4B,KAAK,CAAC,SAAS,EAAE,CAAC,CAAA;IAEtD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACvD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAClB,yHAAyH,EACzH,mBAAmB,CACpB,CAAA;IACH,CAAC;IACD,KAAK,EAAE,CAAC,yBAAyB,CAAC,CAAA;IAElC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAA;IAC5F,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,UAAU,CAClB,4EAA4E,EAC5E,iBAAiB,CAClB,CAAA;IACH,CAAC;IACD,KAAK,EAAE,CAAC,wBAAwB,CAAC,CAAA;IAEjC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAA;AACtD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAuB;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAA;IAClE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IAE3B,IAAI,GAAG,GAAG,QAAQ,CAAA;IAClB,IAAI,OAAO,GAAkB,IAAI,CAAA;IACjC,MAAM,SAAS,GAAa,EAAE,CAAA;IAE9B,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,YAAY,EAAE,GAAG,EAAE,EAAE,CAAC;QAC5C,4EAA4E;QAC5E,uEAAuE;QACvE,sCAAsC;QACtC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC,OAAO,GAAG,2BAA2B,CAAC,CAAA;YAC9C,MAAK;QACP,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAClC,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE;gBACP,YAAY,EAAE,kBAAkB;gBAChC,MAAM,EAAE,iEAAiE;gBACzE,iBAAiB,EAAE,gBAAgB;gBACnC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D;SACF,CAAC,CAAA;QAEF,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;YACrC,IAAI,KAAK;gBAAE,OAAO,GAAG,KAAK,CAAA;YAC1B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;YAC5C,IAAI,IAAI;gBAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChC,CAAC;QAED,KAAK,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAEzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1G,IAAI,CAAC,QAAQ;YAAE,MAAK;QAEpB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC9C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,KAAK,EAAE,CAAC,OAAO,GAAG,iDAAiD,CAAC,CAAA;YACpE,MAAK;QACP,CAAC;QACD,GAAG,GAAG,IAAI,CAAA;IACZ,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAC9C,IAAI,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QACvC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,eAAuB;IAClD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;IAC/D,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAChC,CAAC;AAED,SAAS,aAAa,CAAC,QAAkB;IACvC,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAsD,CAAA;IAClF,IAAI,OAAO,UAAU,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QAClD,OAAO,UAAU,CAAC,YAAY,EAAE,CAAA;IAClC,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACjD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC/B,CAAC"}
+{"version":3,"file":"qr-http-login.js","sourceRoot":"","sources":["../../../../src/platforms/slack/qr-http-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAc1C,MAAM,kBAAkB,GACtB,uHAAuH,CAAA;AACzH,MAAM,qBAAqB,GAAG,EAAE,CAAA;AAEhC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,UAA0B,EAAE;IAC7E,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IAC3B,KAAK,EAAE,CAAC,4BAA4B,KAAK,CAAC,SAAS,EAAE,CAAC,CAAA;IAEtD,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACtF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAClB,uBAAuB,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,EAClF,mBAAmB,CACpB,CAAA;IACH,CAAC;IACD,KAAK,EAAE,CAAC,yBAAyB,CAAC,CAAA;IAElC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAA;IAC5F,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,UAAU,CAClB,4EAA4E,EAC5E,iBAAiB,CAClB,CAAA;IACH,CAAC;IACD,KAAK,EAAE,CAAC,wBAAwB,CAAC,CAAA;IAEjC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAA;AACtD,CAAC;AAOD,SAAS,uBAAuB,CAAC,YAA2B,EAAE,UAA4B,EAAE;IAC1F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAA;IAEjF,IAAI,YAAY,KAAK,cAAc,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;QACtE,OAAO;YACL,mBAAmB,SAAS,gBAAgB,GAAG,uCAAuC;YACtF,EAAE;YACF,qEAAqE,GAAG,2BAA2B;YACnG,iGAAiG;YACjG,kGAAkG;YAClG,2DAA2D;YAC3D,EAAE;YACF,qBAAqB;YACrB,+FAA+F;YAC/F,kCAAkC;YAClC,4EAA4E;YAC5E,EAAE;YACF,2EAA2E;SAC5E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACd,CAAC;IACD,IAAI,YAAY,KAAK,cAAc,EAAE,CAAC;QACpC,OAAO;YACL,yBAAyB,SAAS,mCAAmC;YACrE,kGAAkG;YAClG,gFAAgF;YAChF,EAAE;YACF,2FAA2F;YAC3F,kCAAkC;SACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACd,CAAC;IACD,IAAI,YAAY,KAAK,8BAA8B,EAAE,CAAC;QACpD,OAAO;YACL,kCAAkC,SAAS,sDAAsD;YACjG,0DAA0D;YAC1D,EAAE;YACF,kFAAkF;SACnF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACd,CAAC;IACD,OAAO;QACL,2CAA2C,SAAS,oBAAoB;QACxE,wGAAwG;QACxG,EAAE;QACF,sGAAsG;QACtG,WAAW;KACZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAQD,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAuB;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAA;IAClE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IAE3B,IAAI,GAAG,GAAG,QAAQ,CAAA;IAClB,IAAI,OAAO,GAAkB,IAAI,CAAA;IACjC,IAAI,mBAAmB,GAAkB,IAAI,CAAA;IAC7C,IAAI,WAAW,GAAkB,IAAI,CAAA;IACrC,MAAM,SAAS,GAAa,EAAE,CAAA;IAE9B,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,YAAY,EAAE,GAAG,EAAE,EAAE,CAAC;QAC5C,4EAA4E;QAC5E,uEAAuE;QACvE,sCAAsC;QACtC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC,OAAO,GAAG,2BAA2B,CAAC,CAAA;YAC9C,MAAK;QACP,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAClC,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE;gBACP,YAAY,EAAE,kBAAkB;gBAChC,MAAM,EAAE,iEAAiE;gBACzE,iBAAiB,EAAE,gBAAgB;gBACnC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D;SACF,CAAC,CAAA;QAEF,MAAM,WAAW,GAAa,EAAE,CAAA;QAChC,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;YACrC,IAAI,KAAK;gBAAE,OAAO,GAAG,KAAK,CAAA;YAC1B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;YAC5C,IAAI,IAAI;gBAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAChC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;YAC5C,IAAI,IAAI;gBAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChC,CAAC;QAED,KAAK,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,MAAM,gBAAgB,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,CAAA;QAEzF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1G,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,OAAO;gBAAE,mBAAmB,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAA;YACzE,MAAK;QACP,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC9C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,2EAA2E;YAC3E,wEAAwE;YACxE,uEAAuE;YACvE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,mBAAmB,GAAG,cAAc,CAAA;gBACpC,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;YACxC,CAAC;YACD,KAAK,EAAE,CAAC,OAAO,GAAG,0CAA0C,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,aAAa,CAAC,CAAA;YAChG,MAAK;QACP,CAAC;QACD,GAAG,GAAG,IAAI,CAAA;IACZ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAA;AAC5E,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,QAAQ,KAAK,qBAAqB;QAAE,OAAO,QAAQ,CAAA;IACvD,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,MAAM,CAAA;IAC1F,IAAI,QAAQ,KAAK,2BAA2B;QAAE,OAAO,WAAW,CAAA;IAChE,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,UAAU,CAAA;IACzD,IAAI,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,eAAe,CAAA;IACvG,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,OAAO,CAAA;IACnD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,QAAkB;IACrD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvE,OAAO,cAAc,CAAA;QACvB,CAAC;QACD,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpG,OAAO,8BAA8B,CAAA;QACvC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QAC9C,IAAI,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QACvC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,eAAuB;IAClD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;IAC/D,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAChC,CAAC;AAED,SAAS,aAAa,CAAC,QAAkB;IACvC,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAsD,CAAA;IAClF,IAAI,OAAO,UAAU,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QAClD,OAAO,UAAU,CAAC,YAAY,EAAE,CAAA;IAClC,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IACjD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC/B,CAAC"}

package/docs/content/docs/sdk/discord.mdx

@@ -206,6 +206,28 @@ await client.archiveThread(threadId, false) // unarchive
 // → DiscordChannel
 ```
 
+## QR Code Login
+
+Sign in by scanning a QR code with the Discord mobile app — no desktop app or browser token extraction required. `loginWithRemoteAuth` implements Discord's Remote Auth protocol: it opens a WebSocket to Discord's remote-auth gateway, performs an RSA key exchange, and hands you a QR URL to display. Once the user scans it with an authenticated Discord mobile app and confirms, you receive the user token.
+
+```typescript
+import { DiscordClient, loginWithRemoteAuth } from 'agent-messenger/discord'
+
+const session = await loginWithRemoteAuth({
+  onQrUrl: (url) => {
+    // Render this URL as a QR code (e.g. with the `qrcode` package)
+    console.log('Scan this with the Discord mobile app:', url)
+  },
+  onPendingLogin: (user) => {
+    console.log(`Scanned by ${user.username}. Confirm on your phone...`)
+  },
+})
+
+const client = await new DiscordClient().login({ token: session.token })
+```
+
+`session` is `{ token, user: RemoteAuthUser | null }`, where `RemoteAuthUser` is `{ id, username, discriminator, avatar }`. `user` is populated from the scan confirmation, but can be `null` if the gateway skips the user payload — if you need the identity, guard for `null` and call `await client.testAuth()` after login. Discord may require an hCaptcha on the final token exchange; when it does, the call rejects with a `DiscordError` of code `remote_auth_captcha` — fall back to `auth extract` in that case. The flow requires a phone with the Discord app, so it cannot run headlessly.
+
 ## Real-Time Events
 
 `DiscordListener` connects to Discord's Gateway WebSocket for instant event streaming.
@@ -235,15 +257,7 @@ await listener.start() // connects via Gateway WebSocket
 // listener.stop()      // clean shutdown
 ```
 
-Custom intents (default includes non-privileged message/reaction/typing intents — add `MessageContent` to read message text):
-
-```typescript
-import { DiscordIntent } from 'agent-messenger/discord'
-
-const listener = new DiscordListener(client, {
-  intents: DiscordIntent.Guilds | DiscordIntent.GuildMessages | DiscordIntent.MessageContent, // MessageContent is privileged
-})
-```
+The user-account listener does not take intents — Gateway intents are a bot concept. It identifies as a user session and automatically receives full message content (including other users' messages), so no configuration is required.
 
 ### Available Events
 

package/e2e/README.md

@@ -41,7 +41,7 @@ Before running E2E tests, you need:
 
 ## Running E2E Tests Locally
 
-### Step 1: Extract Credentials
+### Step 1: Authenticate
 
 First, make sure the desktop apps (Slack/Discord) are running and logged into your **test** workspaces.
 
@@ -56,6 +56,8 @@ agent-discord auth extract
 agent-teams auth extract
 ```
 
+> For local runs you can also use QR code sign-in for the **test** accounts (`agent-slack auth qr` / `agent-discord auth qr`) instead of extraction — it's the recommended auth method and doesn't require the desktop app. CI uses the environment variables below (extracted token/cookie values), since QR sign-in is interactive.
+
 ### Step 2: Switch to Test Workspace
 
 Ensure you're targeting the correct test workspace:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-messenger",
-  "version": "2.25.0",
+  "version": "2.27.0",
   "description": "Multi-platform messaging CLI for AI agents (Slack, Discord, Teams, Webex, Telegram, Telegram Bot, WhatsApp, LINE, Instagram, KakaoTalk, Channel Talk)",
   "repository": {
     "type": "git",

package/skills/agent-channeltalk/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-channeltalk
 description: Interact with Channel Talk using extracted desktop app or browser credentials - read chats, send messages, search messages, manage groups
-version: 2.25.0
+version: 2.27.0
 allowed-tools: Bash(agent-channeltalk:*)
 metadata:
   openclaw:

package/skills/agent-channeltalkbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-channeltalkbot
 description: Interact with Channel Talk workspaces using API credentials - send messages, read chats, manage groups and bots
-version: 2.25.0
+version: 2.27.0
 allowed-tools: Bash(agent-channeltalkbot:*)
 metadata:
   openclaw:

package/skills/agent-discord/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-discord
 description: Interact with Discord servers - send messages, read channels, manage reactions
-version: 2.25.0
+version: 2.27.0
 allowed-tools: Bash(agent-discord:*)
 metadata:
   openclaw:
@@ -37,7 +37,22 @@ Credentials are extracted automatically from the Discord desktop app (or Chromiu
 
 On macOS, the system may prompt for your Keychain password the first time (required to decrypt Discord's stored token). This is a one-time prompt.
 
-**IMPORTANT**: Always use `agent-discord auth extract` to obtain tokens. The CLI extracts from the desktop app first, falling back to Chromium browsers if the app isn't installed.
+**Obtaining tokens** — two options:
+
+- **`agent-discord auth qr` — recommended**: signs in by scanning a QR code with the Discord mobile app (Settings → Scan QR Code). This is the safest and most reliable method — it authenticates through Discord's official Remote Auth flow instead of reading credentials off disk, and needs no desktop app or browser. Requires a phone to scan, so it cannot run headlessly.
+- **`agent-discord auth extract`**: extracts from the Discord desktop app first, falling back to Chromium browsers if the app isn't installed. Best for automated/headless use where no phone is available to scan.
+
+### QR Code Sign-In (Recommended)
+
+```bash
+# Generate a QR code and wait for you to scan it with the Discord mobile app
+agent-discord auth qr
+
+# Show protocol details while debugging
+agent-discord auth qr --debug
+```
+
+Open the Discord mobile app → **Settings → Scan QR Code**, scan the printed code, and confirm on your phone. The token (plus all discovered servers) is validated and stored like `auth extract`. The QR code expires after ~150 seconds — re-run the command to generate a fresh one. See [references/authentication.md](references/authentication.md) for the full flow.
 
 ### Multi-Server Support
 
@@ -142,6 +157,10 @@ agent-discord auth extract --browser-profile "$HOME/work-profile,$HOME/personal-
 
 # --browser-profile accepts repeatable or comma-separated Chromium profile/user-data dirs
 
+# Sign in by scanning a QR code with the Discord mobile app (Settings -> Scan QR Code)
+agent-discord auth qr
+agent-discord auth qr --debug
+
 # Check auth status
 agent-discord auth status
 
@@ -411,7 +430,7 @@ All commands return consistent error format:
 
 Common errors:
 
-- `Not authenticated`: No valid token (auto-extraction failed — see Troubleshooting)
+- `Not authenticated`: No valid token (auto-extraction failed — run `auth qr` to sign in, or see Troubleshooting)
 - `No current server set`: Run `server switch <id>` first
 - `Message not found`: Invalid message ID
 - `Unknown Channel`: Invalid channel ID
@@ -445,6 +464,25 @@ if (!token) {
 const client = await new DiscordClient().login({ token })
 ```
 
+### QR Code Login (Recommended)
+
+`loginWithRemoteAuth` signs in by scanning a QR code with the Discord mobile app — no desktop app or token extraction required. It runs Discord's Remote Auth protocol and hands you a QR URL to display; once the user scans and confirms on their phone, you receive the user token.
+
+```typescript
+import { DiscordClient, loginWithRemoteAuth } from 'agent-messenger/discord'
+
+const session = await loginWithRemoteAuth({
+  onQrUrl: (url) => {
+    // Render this URL as a QR code (e.g. with the `qrcode` package)
+    console.log('Scan this with the Discord mobile app:', url)
+  },
+})
+
+const client = await new DiscordClient().login({ token: session.token })
+```
+
+`session` is `{ token, user }`, where `user` may be `null` if the gateway skips the user payload — call `await client.testAuth()` after login if you need the identity. If Discord requires a captcha on the final token exchange, the call rejects with a `DiscordError` of code `remote_auth_captcha`; fall back to `auth extract` in that case. Requires a phone with the Discord app, so it cannot run headlessly.
+
 ### Example
 
 ```typescript
@@ -471,12 +509,10 @@ await client.sendMessage(thread.id, 'First message in thread')
 `DiscordListener` connects to Discord's Gateway WebSocket for instant event streaming:
 
 ```typescript
-import { DiscordClient, DiscordListener, DiscordIntent } from 'agent-messenger/discord'
+import { DiscordClient, DiscordListener } from 'agent-messenger/discord'
 
 const client = await new DiscordClient().login()
-const listener = new DiscordListener(client, {
-  intents: DiscordIntent.Guilds | DiscordIntent.GuildMessages | DiscordIntent.MessageContent,
-})
+const listener = new DiscordListener(client)
 
 listener.on('message_create', (event) => {
   console.log(`${event.author.username}: ${event.content}`)