slack-term 1.20.0 → 1.21.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slack-term",
-  "version": "1.20.0",
+  "version": "1.21.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/slack-term.git"

package/ts/auth.ts

@@ -263,6 +263,29 @@ export async function cmdAuthChrome(opts: { workspace?: string } = {}): Promise<
     }
   }
 
+  // A Chrome xoxd session cookie only augments a desktop *user* session token (xoxc-); it has
+  // no effect on a bot token (xoxb-). Attaching it to a bot profile silently does nothing and
+  // user-level actions (tail @user, DMs, users.list) still fail with missing_scope /
+  // cannot_dm_bot. Stop early with a pointer to a user-token workspace instead.
+  const selected = profiles.find((p) => p.name === profileName)!;
+  if (selected.profile.token.startsWith("xoxb-")) {
+    console.error(
+      `\nWorkspace "${profileName}" uses a bot token (xoxb-). A Chrome session cookie only\n` +
+      `augments a user session token (xoxc-) — it has no effect on a bot token, so user-level\n` +
+      `actions (tail @user, DMs, listing users) would still fail.`,
+    );
+    const userProfiles = profiles.filter(
+      (p) => p.profile.token.startsWith("xoxc-") || p.profile.token.startsWith("xoxp-"),
+    );
+    if (userProfiles.length > 0) {
+      console.error(`  Target a user-token workspace instead: ${userProfiles.map((p) => p.name).join(", ")}`);
+      console.error(`    slack auth chrome -w ${userProfiles[0]!.name}`);
+    } else {
+      console.error(`  Import your Slack desktop user session instead:  slack workspace import`);
+    }
+    process.exit(1);
+  }
+
   console.log("Scanning Chrome profiles for Slack session...");
   console.log("macOS may show a dialog asking for your login password — click Allow.");
 

package/ts/cli.ts

@@ -24,6 +24,8 @@ import {
   updateDraft,
   editMessage,
   deleteMessage,
+  reactionAdd,
+  reactionRemove,
   filesInfo,
   history,
   listConversations,
@@ -588,6 +590,49 @@ function safetyCode(...parts: string[]): string {
   return sha256Hex(parts.join("\n")).slice(0, 4);
 }
 
+// Slack API method → the token scope that grants it, for missing_scope guidance.
+const SCOPE_FOR_METHOD: Record<string, string> = {
+  "reactions.add": "reactions:write",
+  "reactions.remove": "reactions:write",
+  "chat.postMessage": "chat:write",
+  "chat.update": "chat:write",
+  "chat.delete": "chat:write",
+  "conversations.replies": "channels:history (or groups:history)",
+  "conversations.history": "channels:history (or groups:history)",
+};
+
+/** Turn a raw Slack API error into a single clean line of guidance, hiding the
+ *  yargs usage dump / stack trace that a thrown handler would otherwise print.
+ *  Recognizes the common reaction/message failure codes; falls back to the
+ *  original message for anything unmapped. */
+function friendlySlackError(e: unknown): string {
+  const raw = e instanceof Error ? e.message : String(e);
+  const m = raw.match(/Slack error on (\S+): (\w+)/);
+  if (!m) return raw;
+  const [, method, code] = m;
+  switch (code) {
+    case "missing_scope": {
+      const scope = SCOPE_FOR_METHOD[method!] ?? "the required";
+      // Note the token-type gotcha: the CLI uses the USER token (xoxp) by default,
+      // so the scope must be in "User Token Scopes" — adding it only to "Bot Token
+      // Scopes" fixes `--as-bot`/`doctor` but not the default path. Then reinstall.
+      return `Error: token lacks the ${scope} scope (needed for ${method}). Add it to your Slack App's User Token Scopes (or Bot Token Scopes if you use a bot token / --as-bot) — it must be on the token type the CLI actually uses — then reinstall to the workspace.`;
+    }
+    case "invalid_name":
+      return `Error: not a valid emoji shortcode — use the name without colons (e.g. white_check_mark), and make sure it exists in the workspace.`;
+    case "already_reacted":
+      return `Error: you've already added that reaction to the message.`;
+    case "no_reaction":
+      return `Error: that reaction isn't on the message — nothing to remove.`;
+    case "message_not_found":
+      return `Error: no message found at that timestamp in the channel — check the target ts/permalink.`;
+    case "channel_not_found":
+      return `Error: channel not found — check the target.`;
+    default:
+      return raw;
+  }
+}
+
 /** Dry-run gate: print context, print required --code=, exit 1.
  *  Call this when --code is absent or wrong. */
 function requireCode(provided: string | undefined, expected: string, contextLines: string[]): void {
@@ -661,26 +706,73 @@ async function destLabel(token: string, channelId: string, ref: string): Promise
   return name === channelId ? channelId : `${name} (${channelId})`;
 }
 
+/** One-line description of a single thread message for confirm gates:
+ *  "2026-06-11 08:05 @handle: head…". `headLen` bounds the text preview. */
+async function threadMsgLine(token: string, m: Record<string, Json>, headLen = 60): Promise<string> {
+  const author = typeof m.user === "string"
+    ? await userName(token, m.user)
+    : typeof m.username === "string"
+    ? m.username
+    : "?";
+  const head = (typeof m.text === "string" ? m.text : "").split("\n")[0] ?? "";
+  const headShort = head.length > headLen ? `${head.slice(0, headLen)}…` : head;
+  const ts = typeof m.ts === "string" ? m.ts : "";
+  const stamp = ts ? slackTsToIso(ts).slice(0, 16).replace("T", " ") : "";
+  return `${stamp} @${author}${headShort ? `: ${headShort}` : ""}`;
+}
+
 /** One-line thread-parent description for confirm gates: "2026-06-11 08:05 @handle: head…".
- *  Fail-soft: returns the raw ts if the parent cannot be fetched. */
-async function threadParentLine(token: string, channelId: string, threadTs: string): Promise<string> {
-  try {
-    const resp = (await replies(token, channelId, threadTs, 1)) as Record<string, Json>;
-    const msgs = asArray(resp.messages).map(asRecord);
-    const parent = msgs.find((m) => String(m.ts) === threadTs) ?? msgs[0];
-    if (!parent) return threadTs;
-    const author = typeof parent.user === "string"
-      ? await userName(token, parent.user)
-      : typeof parent.username === "string"
-      ? parent.username
-      : "?";
-    const head = (typeof parent.text === "string" ? parent.text : "").split("\n")[0] ?? "";
-    const headShort = head.length > 40 ? `${head.slice(0, 40)}…` : head;
-    const stamp = slackTsToIso(threadTs).slice(0, 16).replace("T", " ");
-    return `${stamp} @${author}${headShort ? `: ${headShort}` : ""}`;
-  } catch {
-    return threadTs;
+ *  Fail-soft: returns the raw ts if the parent cannot be found. */
+async function threadParentLine(token: string, threadTs: string, threadMsgs: Record<string, Json>[]): Promise<string> {
+  const parent = threadMsgs.find((m) => String(m.ts) === threadTs) ?? threadMsgs[0];
+  if (!parent) return threadTs;
+  return threadMsgLine(token, parent, 40);
+}
+
+/** Normalize a message for duplicate comparison: lowercase, collapse whitespace,
+ *  strip <@U…>/<#C…> markup and surrounding punctuation so cosmetic differences
+ *  (a trailing period, an added mention) don't hide a re-post. */
+function normalizeForDup(s: string): string {
+  return s
+    .toLowerCase()
+    .replace(/<[@#!][^>]+>/g, " ")
+    .replace(/[^\p{L}\p{N}\s]/gu, " ")
+    .replace(/\s+/g, " ")
+    .trim();
+}
+
+/** Character-bigram Dice coefficient (0..1) over normalized text — robust to
+ *  minor edits, good at catching near-identical re-posts. Identical strings →1;
+ *  a shared word or two in otherwise different messages stays low. */
+function textSimilarity(a: string, b: string): number {
+  const na = normalizeForDup(a);
+  const nb = normalizeForDup(b);
+  if (!na || !nb) return 0;
+  if (na === nb) return 1;
+  const bigrams = (s: string): Map<string, number> => {
+    const m = new Map<string, number>();
+    for (let i = 0; i < s.length - 1; i++) {
+      const g = s.slice(i, i + 2);
+      m.set(g, (m.get(g) ?? 0) + 1);
+    }
+    return m;
+  };
+  const ba = bigrams(na);
+  const bb = bigrams(nb);
+  if (ba.size === 0 || bb.size === 0) return 0;
+  let overlap = 0;
+  for (const [g, count] of ba) {
+    const other = bb.get(g);
+    if (other) overlap += Math.min(count, other);
   }
+  const total = sumCounts(ba) + sumCounts(bb);
+  return total === 0 ? 0 : (2 * overlap) / total;
+}
+
+function sumCounts(m: Map<string, number>): number {
+  let n = 0;
+  for (const v of m.values()) n += v;
+  return n;
 }
 
 // --- edit ---
@@ -774,6 +866,38 @@ async function cmdDelete(token: string, args: DeleteArgs): Promise<void> {
   console.log(`✓ Deleted (ts: ${ts})`);
 }
 
+// --- react ---
+interface ReactArgs {
+  target: string;
+  emoji: string;
+  remove?: boolean;
+  channelId?: string;
+}
+// Add (or --remove) an emoji reaction. No confirm gate: a reaction is trivial
+// and fully reversible (`--remove`), and the whole point is a lightweight ack
+// that doesn't grow the thread. The emoji is a shortcode without colons
+// (e.g. "eyes", "white_check_mark", "hourglass").
+async function cmdReact(token: string, args: ReactArgs): Promise<void> {
+  const { ref, ts } = splitRefTs(args.target);
+  if (!ts) {
+    console.error("Error: target must embed a message ts (e.g. #chan:2026-05-11T06:01:04.000100 or a Slack permalink URL)");
+    process.exit(2);
+  }
+  const emoji = args.emoji.replace(/^:|:$/g, "");
+
+  let channelId: string;
+  if (args.channelId) channelId = args.channelId;
+  else channelId = await resolveChannel(token, ref);
+
+  if (args.remove) {
+    await reactionRemove(token, channelId, ts, emoji);
+    console.log(`✓ Removed :${emoji}: (ts: ${ts})`);
+  } else {
+    await reactionAdd(token, channelId, ts, emoji);
+    console.log(`✓ Reacted :${emoji}: (ts: ${ts})`);
+  }
+}
+
 // --- send ---
 interface SendArgs {
   target: string;
@@ -841,25 +965,62 @@ async function cmdSend(token: string, args: SendArgs): Promise<void> {
     // best-effort; ignore
   }
 
-  // Fetch last 1 message for context hash. Fail-soft: a bot token without
-  // im:history (or channels:history) can still send — only the preview of the
-  // prior message is lost, so default to empty rather than blocking the send.
+  // Gather context for the confirm gate. For a THREAD reply, pull the thread's
+  // own recent messages so the preview shows what's already been said there —
+  // this is what stops accidental duplicate replies (the channel's last message
+  // is irrelevant when you're deep in a thread). For a top-level send, fall back
+  // to the channel's last message. Fail-soft throughout: a bot token without
+  // history scope can still send; only the preview degrades.
   let lastText = "";
   let lastUser = "?";
-  try {
-    const ctx = (await history(token, channelId, 1)) as Record<string, Json>;
-    const lastMsg = asArray(ctx.messages).map(asRecord)
-      .filter((m) => m.subtype === undefined || m.subtype === null)[0];
-    lastText = typeof lastMsg?.text === "string" ? lastMsg.text : "";
-    // Resolve the author's user ID to a display name for the preview; fall back
-    // to the bot username, then the raw ID. userName() is fail-soft.
-    lastUser = typeof lastMsg?.user === "string"
-      ? await userName(token, lastMsg.user)
-      : typeof lastMsg?.username === "string"
-      ? lastMsg.username
-      : "?";
-  } catch {
-    // best-effort preview only
+  let threadMsgs: Record<string, Json>[] = [];
+  if (threadTs) {
+    try {
+      // Fetch a generous window and preview its tail. conversations.replies is
+      // oldest-first from the parent, so a very long thread's true tail may lie
+      // beyond this window — 100 covers essentially all real threads.
+      const resp = (await replies(token, channelId, threadTs, 100)) as Record<string, Json>;
+      threadMsgs = asArray(resp.messages).map(asRecord);
+      const lastMsg = threadMsgs[threadMsgs.length - 1];
+      // Bind the hash to the thread's most recent message: if someone replies
+      // between preview and confirm, the code invalidates and re-previews.
+      lastText = typeof lastMsg?.text === "string" ? lastMsg.text : "";
+    } catch {
+      // best-effort preview only
+    }
+  } else {
+    try {
+      const ctx = (await history(token, channelId, 1)) as Record<string, Json>;
+      const lastMsg = asArray(ctx.messages).map(asRecord)
+        .filter((m) => m.subtype === undefined || m.subtype === null)[0];
+      lastText = typeof lastMsg?.text === "string" ? lastMsg.text : "";
+      // Resolve the author's user ID to a display name for the preview; fall back
+      // to the bot username, then the raw ID. userName() is fail-soft.
+      lastUser = typeof lastMsg?.user === "string"
+        ? await userName(token, lastMsg.user)
+        : typeof lastMsg?.username === "string"
+        ? lastMsg.username
+        : "?";
+    } catch {
+      // best-effort preview only
+    }
+  }
+
+  // Duplicate guard: if the outgoing message closely matches something already
+  // in the thread, warn (never block). Catches re-posting a reply you already
+  // sent. Threshold is deliberately high so only near-identical text trips it.
+  if (threadTs && threadMsgs.length) {
+    let best = { sim: 0, msg: null as Record<string, Json> | null };
+    for (const m of threadMsgs) {
+      const t = typeof m.text === "string" ? m.text : "";
+      if (!t) continue;
+      const sim = textSimilarity(message, t);
+      if (sim > best.sim) best = { sim, msg: m };
+    }
+    if (best.msg && best.sim >= 0.82) {
+      const pct = Math.round(best.sim * 100);
+      console.error(`⚠ possible duplicate: ${pct}% similar to an existing thread message — ${await threadMsgLine(token, best.msg)}`);
+    }
   }
 
   // Hash covers the destination too — a code minted for one channel/thread
@@ -868,17 +1029,32 @@ async function cmdSend(token: string, args: SendArgs): Promise<void> {
 
   if (args.code !== code) {
     const dest = await destLabel(token, channelId, ref);
-    const destLine = threadTs
-      ? `  → ${dest} thread of ${await threadParentLine(token, channelId, threadTs)} — THREAD REPLY`
-      : `  → ${dest} — NEW top-level message`;
-    requireCode(args.code, code, [
-      `--- Last message in channel ------------------`,
-      `  ${lastUser}: ${lastText.split("\n")[0]?.slice(0, 100) ?? "(empty)"}`,
-      `--- Sending ----------------------------------`,
-      destLine,
-      `  Message: ${message}`,
-      `--------------------------------────────────`,
-    ]);
+    if (threadTs) {
+      const parentLine = await threadParentLine(token, threadTs, threadMsgs);
+      // Preview the tail of the thread (up to 3 most recent messages) so the
+      // sender can see what's already been said and avoid repeating it.
+      const recent = threadMsgs.slice(-3);
+      const recentLines = recent.length
+        ? await Promise.all(recent.map(async (m) => `  ${await threadMsgLine(token, m)}`))
+        : ["  (thread context unavailable)"];
+      requireCode(args.code, code, [
+        `--- Recent messages in thread ----------------`,
+        ...recentLines,
+        `--- Sending ----------------------------------`,
+        `  → ${dest} thread of ${parentLine} — THREAD REPLY`,
+        `  Message: ${message}`,
+        `--------------------------------────────────`,
+      ]);
+    } else {
+      requireCode(args.code, code, [
+        `--- Last message in channel ------------------`,
+        `  ${lastUser}: ${lastText.split("\n")[0]?.slice(0, 100) ?? "(empty)"}`,
+        `--- Sending ----------------------------------`,
+        `  → ${dest} — NEW top-level message`,
+        `  Message: ${message}`,
+        `--------------------------------────────────`,
+      ]);
+    }
   }
   const ts = await slackSend(token, channelId, message, threadTs, args.broadcast);
   let permalink = "";
@@ -1121,6 +1297,21 @@ async function main(): Promise<void> {
 
   await yargs(hideBin(process.argv))
     .scriptName("slack")
+    // A thrown handler error (e.g. a Slack API failure) is a runtime error, not a usage
+    // mistake — print just the clean one-line message, never the command's --help block or a
+    // minified source stack. Reserve the usage/help output for actual argument-parse errors
+    // (err is undefined then). showHelpOnFail(false) stops yargs' default help dump.
+    .showHelpOnFail(false)
+    .fail((msg, err, y) => {
+      if (err) {
+        console.error(err.message);
+        process.exit(1);
+      }
+      console.error(msg);
+      console.error("");
+      y.showHelp();
+      process.exit(1);
+    })
     .option("workspace", { alias: "w", type: "string", describe: "Workspace name" })
     .middleware(async (argv) => {
       const cmd = String((argv._ ?? [])[0] ?? "");
@@ -1446,7 +1637,7 @@ async function main(): Promise<void> {
         try {
           await cmdSend(sendToken, args);
         } catch (e: unknown) {
-          console.error(e instanceof Error ? e.message : String(e));
+          console.error(friendlySlackError(e));
           process.exit(1);
         }
       },
@@ -1549,6 +1740,28 @@ async function main(): Promise<void> {
         await cmdDelete(tok(argv as W), args);
       },
     )
+    .command(
+      "react <target> <emoji>",
+      "Add (or --remove) an emoji reaction — a lightweight ack that doesn't grow the thread",
+      (y) => y
+        .positional("target", { type: "string", demandOption: true, describe: "#chan:ts, @user:ts, or permalink" })
+        .positional("emoji", { type: "string", demandOption: true, describe: "Emoji shortcode without colons (e.g. eyes, white_check_mark, hourglass)" })
+        .option("remove", { type: "boolean", default: false, describe: "Remove the reaction instead of adding it" })
+        .option("channel-id", { type: "string", describe: "Raw channel ID" }),
+      async (argv) => {
+        const args: ReactArgs = { target: argv.target!, emoji: argv.emoji! };
+        if (argv.remove) args.remove = true;
+        if (argv["channel-id"]) args.channelId = argv["channel-id"];
+        // Print a clean one-line error instead of yargs' usage dump + stack when
+        // the reaction fails at runtime (missing_scope, invalid_name, etc.).
+        try {
+          await cmdReact(tok(argv as W), args);
+        } catch (e: unknown) {
+          console.error(friendlySlackError(e));
+          process.exit(1);
+        }
+      },
+    )
     .command(
       "upload <target> <file..>",
       "Upload one or more files to a channel or DM",

package/ts/slack-app.ts

@@ -271,16 +271,39 @@ export type ChromeCookieCandidate = {
   cookie: string;      // decrypted xoxd-...
 };
 
-/** Read the display name for a Chrome profile from its Preferences JSON. */
+/**
+ * Read a human-friendly display name (nickname + email) for a Chrome profile so a bare
+ * "Default"/"Profile N" is never shown alone.
+ *
+ * Prefers Chrome's `Local State` → profile.info_cache, which reliably carries both the
+ * nickname (`name`) and account email (`user_name`); the per-profile Preferences file
+ * often has neither. Only nickname + email are surfaced — the gaia real name is never read.
+ */
 function chromeProfileName(userDataDir: string, profileDir: string): string {
+  const label = (name: string, email: string): string => {
+    if (name && email) return `${name} (${email})`;
+    return name || email || profileDir;
+  };
+  try {
+    const localState = JSON.parse(
+      readFileSync(join(userDataDir, "Local State"), "utf8"),
+    ) as { profile?: { info_cache?: Record<string, { name?: string; user_name?: string }> } };
+    const info = localState.profile?.info_cache?.[profileDir];
+    if (info && (info.name || info.user_name)) {
+      return label(info.name ?? "", info.user_name ?? "");
+    }
+  } catch {
+    // fall through to Preferences
+  }
   try {
     const prefs = JSON.parse(
       readFileSync(join(userDataDir, profileDir, "Preferences"), "utf8"),
     ) as Record<string, unknown>;
     const profile = prefs.profile as Record<string, unknown> | undefined;
-    const name = (profile?.name as string | undefined) ?? "";
-    const email = (profile?.user_name as string | undefined) ?? "";
-    return email ? `${name} (${email})` : name || profileDir;
+    return label(
+      (profile?.name as string | undefined) ?? "",
+      (profile?.user_name as string | undefined) ?? "",
+    );
   } catch {
     return profileDir;
   }

package/ts/slack.ts

@@ -47,6 +47,19 @@ async function call(token: string, method: string, init: RequestInit, cookie?: s
         `  slack workspace set-token <name> <xoxp-token>`,
       );
     }
+    // Bot tokens (xoxb-) can't act as a user: they lack user scopes (missing_scope) and can't
+    // open a DM with themselves (cannot_dm_bot, e.g. `tail @you`). Point at a user-token workspace.
+    if ((err === "missing_scope" || err === "cannot_dm_bot") && token.startsWith("xoxb-")) {
+      const why = err === "cannot_dm_bot"
+        ? `you're authenticated as a bot, so "@you" is the bot itself and it can't DM itself`
+        : `this bot token lacks the user scope this action needs`;
+      throw new Error(
+        `Slack error on ${method}: ${err} — ${why}.\n` +
+        `Tailing/DMing people and listing users need a user session, not a bot token.\n` +
+        `  Switch workspace:  slack workspace ls   then   slack workspace use <name>\n` +
+        `  Or import your Slack desktop session:  slack workspace import`,
+      );
+    }
     throw new Error(`Slack error on ${method}: ${err}`);
   }
   return body as Json;
@@ -321,6 +334,28 @@ export async function deleteMessage(
   await post(token, "chat.delete", { channel, ts });
 }
 
+// Add or remove an emoji reaction on a message. `name` is the emoji shortcode
+// without colons (e.g. "eyes", "white_check_mark"). Slack's reactions.add
+// returns already_reacted when the reaction exists; reactions.remove returns
+// no_reaction when it doesn't — both surface to the caller as API errors.
+export async function reactionAdd(
+  token: string,
+  channel: string,
+  ts: string,
+  name: string,
+): Promise<void> {
+  await post(token, "reactions.add", { channel, timestamp: ts, name });
+}
+
+export async function reactionRemove(
+  token: string,
+  channel: string,
+  ts: string,
+  name: string,
+): Promise<void> {
+  await post(token, "reactions.remove", { channel, timestamp: ts, name });
+}
+
 // Create a public (or private) channel via conversations.create. Slack
 // lowercases the name and rejects spaces/most punctuation; the raw API error
 // (e.g. name_taken, invalid_name_specials) surfaces to the caller. Returns the