slack-term 1.22.0 → 1.23.1

package/ts/cli.ts

@@ -8,13 +8,14 @@ import { join } from "node:path";
 
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
-import { listProfiles, removeProfile, resolveBotToken, resolveCookie, resolveToken, useProfile } from "./profiles.ts";
+import { listProfiles, removeProfile, resolveBotToken, resolveCookie, resolveToken, useProfile, type Profile } from "./profiles.ts";
 import { diagnoseBotMessaging, formatDiagnosis } from "./botdoctor.ts";
 import { cmdAuthLogin, cmdAuthChrome, cmdAuthFirefox, cmdAuthToken, cmdAuthApp } from "./auth.ts";
 import { cmdTail } from "./tail.ts";
 
 import {
   authTest,
+  authScopes,
   authTestSession,
   conversationInfoSession,
   createChannel,
@@ -386,8 +387,52 @@ async function cmdChannels(token: string, limit: number, filter?: string, all?:
 }
 
 // --- search ---
-async function cmdSearch(token: string, query: string, count: number, json: boolean): Promise<void> {
-  const resp = await searchAll(token, query, count);
+
+/** search.messages (and most read/write Web API methods) reject a bot token
+ *  (xoxb-) with not_allowed_token_type — it's a user-only endpoint. Find a
+ *  sibling profile that holds a user token (xoxp-/xoxc-) for the *same*
+ *  workspace (teamId) as the bot profile currently in use, so the caller can
+ *  retry with it automatically instead of just erroring. Deliberately does
+ *  NOT fall back to a user-token profile for a different workspace — that
+ *  would silently run the search against the wrong (possibly private)
+ *  workspace instead of failing loudly. Returns undefined (no fallback) when
+ *  the current token isn't a known profile at all, since its workspace can't
+ *  be verified. */
+function findUserTokenProfile(currentToken: string): { name: string; profile: Profile } | undefined {
+  const isUserToken = (t: string) => t.startsWith("xoxp-") || t.startsWith("xoxc-");
+  const profiles = listProfiles();
+  const current = profiles.find((p) => p.profile.token === currentToken);
+  if (!current) return undefined;
+  return profiles.find((p) => isUserToken(p.profile.token) && p.profile.teamId === current.profile.teamId);
+}
+
+async function cmdSearch(token: string, query: string, count: number, json: boolean, cookie?: string): Promise<void> {
+  let searchToken = token;
+  let searchCookie = cookie;
+  let resp: Json;
+  try {
+    resp = await searchAll(searchToken, query, count, searchCookie);
+  } catch (e: unknown) {
+    const msg = e instanceof Error ? e.message : String(e);
+    if (token.startsWith("xoxb-") && msg.includes("not_allowed_token_type")) {
+      const fallback = findUserTokenProfile(token);
+      if (fallback) {
+        console.error(`Note: search.messages needs a user token — the active profile is a bot token (xoxb-); falling back to profile "${fallback.name}".`);
+        searchToken = fallback.profile.token;
+        searchCookie = fallback.profile.cookie;
+        resp = await searchAll(searchToken, query, count, searchCookie);
+      } else {
+        console.error(
+          "Error: search requires a user token (xoxp-/xoxc-) — the active profile is a bot token (xoxb-), which Slack rejects for search.messages.\n" +
+          "  Add a user-token profile:  slack auth login   (or slack auth token)\n" +
+          "  Then select it:            slack auth use <name>   (or pass --workspace <name>)",
+        );
+        process.exit(1);
+      }
+    } else {
+      throw e;
+    }
+  }
   if (json) {
     console.log(JSON.stringify(resp, null, 2));
     return;
@@ -402,7 +447,7 @@ async function cmdSearch(token: string, query: string, count: number, json: bool
     if (isIm && rawName.startsWith("U")) {
       const handleKey = "@" + rawName;
       if (!cache.has(handleKey)) {
-        const [, h] = await userInfoPair(token, rawName);
+        const [, h] = await userInfoPair(searchToken, rawName, searchCookie);
         cache.set(handleKey, h);
       }
       chLabel = `@${cache.get(handleKey) ?? rawName}`;
@@ -411,7 +456,7 @@ async function cmdSearch(token: string, query: string, count: number, json: bool
     } else {
       chLabel = `#${rawName}`;
     }
-    console.log(await formatMsgLine(token, m, cache, chLabel));
+    console.log(await formatMsgLine(searchToken, m, cache, chLabel));
   }
 }
 
@@ -704,15 +749,15 @@ function parseTargetThread(s: string): { ref: string; threadTs?: string } {
 /** Human-readable destination label for confirm gates, e.g. "#symval (C0B0L6SSAMD)".
  *  When ref is already a #channel/@user label, keep it; otherwise resolve the channel
  *  name via conversations.info (fail-soft: a raw ID is still unambiguous). */
-async function destLabel(token: string, channelId: string, ref: string): Promise<string> {
+async function destLabel(token: string, channelId: string, ref: string, cookie?: string): Promise<string> {
   let name = ref;
   if (!ref.startsWith("#") && !ref.startsWith("@")) {
     try {
-      const info = asRecord((await conversationInfo(token, channelId)) as Json);
+      const info = asRecord((await conversationInfo(token, channelId, cookie)) as Json);
       const ch = asRecord(info.channel);
       if (ch.is_im === true) {
         const uid = typeof ch.user === "string" ? ch.user : "";
-        name = uid ? `@${await userName(token, uid)}` : channelId;
+        name = uid ? `@${await userName(token, uid, cookie)}` : channelId;
       } else {
         name = typeof ch.name === "string" ? `#${ch.name}` : channelId;
       }
@@ -725,9 +770,9 @@ async function destLabel(token: string, channelId: string, ref: string): Promise
 
 /** One-line description of a single thread message for confirm gates:
  *  "2026-06-11 08:05 @handle: head…". `headLen` bounds the text preview. */
-async function threadMsgLine(token: string, m: Record<string, Json>, headLen = 60): Promise<string> {
+async function threadMsgLine(token: string, m: Record<string, Json>, headLen = 60, cookie?: string): Promise<string> {
   const author = typeof m.user === "string"
-    ? await userName(token, m.user)
+    ? await userName(token, m.user, cookie)
     : typeof m.username === "string"
     ? m.username
     : "?";
@@ -740,10 +785,10 @@ async function threadMsgLine(token: string, m: Record<string, Json>, headLen = 6
 
 /** One-line thread-parent description for confirm gates: "2026-06-11 08:05 @handle: head…".
  *  Fail-soft: returns the raw ts if the parent cannot be found. */
-async function threadParentLine(token: string, threadTs: string, threadMsgs: Record<string, Json>[]): Promise<string> {
+async function threadParentLine(token: string, threadTs: string, threadMsgs: Record<string, Json>[], cookie?: string): Promise<string> {
   const parent = threadMsgs.find((m) => String(m.ts) === threadTs) ?? threadMsgs[0];
   if (!parent) return threadTs;
-  return threadMsgLine(token, parent, 40);
+  return threadMsgLine(token, parent, 40, cookie);
 }
 
 /** Normalize a message for duplicate comparison: lowercase, collapse whitespace,
@@ -799,6 +844,9 @@ interface EditArgs {
   code?: string;
   channelId?: string;
   mentions?: boolean;
+  // Session cookie (xoxd) for `token` — required for an xoxc- desktop session
+  // token to be accepted by the public Slack API at all.
+  cookie?: string;
 }
 async function cmdEdit(token: string, args: EditArgs): Promise<void> {
   const { ref, ts } = splitRefTs(args.target);
@@ -809,10 +857,10 @@ async function cmdEdit(token: string, args: EditArgs): Promise<void> {
 
   let channelId: string;
   if (args.channelId) channelId = args.channelId;
-  else channelId = await resolveChannel(token, ref);
+  else channelId = await resolveChannel(token, ref, args.cookie);
 
   // Fetch the message to display the original text and compute the safety hash.
-  const resp = (await replies(token, channelId, ts, 1)) as Record<string, Json>;
+  const resp = (await replies(token, channelId, ts, 1, args.cookie)) as Record<string, Json>;
   const msgs = asArray(resp.messages).map(asRecord);
   const original = msgs.find((m) => String(m.ts) === ts);
   if (!original) {
@@ -823,7 +871,7 @@ async function cmdEdit(token: string, args: EditArgs): Promise<void> {
 
   // Convert @handle → <@USERID> before hashing/editing (unresolved stay as text).
   const newText = args.mentions
-    ? await encodeMentions(token, args.newText, channelId)
+    ? await encodeMentions(token, args.newText, channelId, args.cookie ? { cookie: args.cookie } : {})
     : args.newText;
 
   const code = safetyCode(originalText, newText);
@@ -837,7 +885,7 @@ async function cmdEdit(token: string, args: EditArgs): Promise<void> {
     ]);
   }
 
-  const newTs = await editMessage(token, channelId, ts, newText);
+  const newTs = await editMessage(token, channelId, ts, newText, args.cookie);
   console.log(`✓ Edited (ts: ${newTs})`);
 }
 
@@ -846,6 +894,7 @@ interface DeleteArgs {
   target: string;
   code?: string;
   channelId?: string;
+  cookie?: string;
 }
 async function cmdDelete(token: string, args: DeleteArgs): Promise<void> {
   const { ref, ts } = splitRefTs(args.target);
@@ -856,10 +905,10 @@ async function cmdDelete(token: string, args: DeleteArgs): Promise<void> {
 
   let channelId: string;
   if (args.channelId) channelId = args.channelId;
-  else channelId = await resolveChannel(token, ref);
+  else channelId = await resolveChannel(token, ref, args.cookie);
 
   // Fetch the message to display what is being deleted and compute the safety hash.
-  const resp = (await replies(token, channelId, ts, 1)) as Record<string, Json>;
+  const resp = (await replies(token, channelId, ts, 1, args.cookie)) as Record<string, Json>;
   const msgs = asArray(resp.messages).map(asRecord);
   const original = msgs.find((m) => String(m.ts) === ts);
   if (!original) {
@@ -870,7 +919,7 @@ async function cmdDelete(token: string, args: DeleteArgs): Promise<void> {
 
   const code = safetyCode(channelId, ts, originalText);
   if (args.code !== code) {
-    const dest = await destLabel(token, channelId, ref);
+    const dest = await destLabel(token, channelId, ref, args.cookie);
     requireCode(args.code, code, [
       `--- Deleting message -------------------------`,
       `  → ${dest} at ${slackTsToIso(ts)}`,
@@ -879,7 +928,7 @@ async function cmdDelete(token: string, args: DeleteArgs): Promise<void> {
     ]);
   }
 
-  await deleteMessage(token, channelId, ts);
+  await deleteMessage(token, channelId, ts, args.cookie);
   console.log(`✓ Deleted (ts: ${ts})`);
 }
 
@@ -889,6 +938,7 @@ interface ReactArgs {
   emoji: string;
   remove?: boolean;
   channelId?: string;
+  cookie?: string;
 }
 // Add (or --remove) an emoji reaction. No confirm gate: a reaction is trivial
 // and fully reversible (`--remove`), and the whole point is a lightweight ack
@@ -904,13 +954,13 @@ async function cmdReact(token: string, args: ReactArgs): Promise<void> {
 
   let channelId: string;
   if (args.channelId) channelId = args.channelId;
-  else channelId = await resolveChannel(token, ref);
+  else channelId = await resolveChannel(token, ref, args.cookie);
 
   if (args.remove) {
-    await reactionRemove(token, channelId, ts, emoji);
+    await reactionRemove(token, channelId, ts, emoji, args.cookie);
     console.log(`✓ Removed :${emoji}: (ts: ${ts})`);
   } else {
-    await reactionAdd(token, channelId, ts, emoji);
+    await reactionAdd(token, channelId, ts, emoji, args.cookie);
     console.log(`✓ Reacted :${emoji}: (ts: ${ts})`);
   }
 }
@@ -932,18 +982,22 @@ interface SendArgs {
   // Session cookie (xoxd) for the mention token — required for an xoxc- user
   // token to call users.list on the public API (it is rejected without it).
   mentionCookie?: string;
+  // Session cookie (xoxd) for `token` itself — required for an xoxc- desktop
+  // session token to be accepted by the public Slack API at all (chat.postMessage
+  // included). Not set when sending --as-bot (the bot token needs no cookie).
+  cookie?: string;
 }
 
 // Detect the silent-failure footgun: DMing yourself with your own user token.
 // Slack does not notify you about messages you sent to yourself, so an
 // escalation DM via `send @me` (or @your-own-handle) is delivered but never
 // surfaces. Returns true when ref names the token's own user.
-async function isSelfDm(token: string, ref: string): Promise<boolean> {
+async function isSelfDm(token: string, ref: string, cookie?: string): Promise<boolean> {
   if (!ref.startsWith("@")) return false;
   const name = ref.slice(1).toLowerCase().replace(/[^a-z0-9]/g, "");
   if (name === "me" || name === "you") return true;
   try {
-    const self = await authTest(token);
+    const self = await authTest(token, cookie);
     const selfName = (self.user ?? "").toLowerCase().replace(/[^a-z0-9]/g, "");
     return selfName !== "" && selfName === name;
   } catch {
@@ -953,10 +1007,11 @@ async function isSelfDm(token: string, ref: string): Promise<boolean> {
 
 async function cmdSend(token: string, args: SendArgs): Promise<void> {
   const { ref, threadTs } = parseTargetThread(args.target);
+  const cookie = args.cookie;
 
   // Guard the self-DM footgun before doing anything else, unless sending as the
   // bot (which delivers a notifiable DM from a different identity).
-  if (!args.asBot && !args.channelId && !args.userId && await isSelfDm(token, ref)) {
+  if (!args.asBot && !args.channelId && !args.userId && await isSelfDm(token, ref, cookie)) {
     console.error(
       `Warning: "${ref}" is a DM to yourself — Slack will NOT notify you of your own message.\n` +
       `  To reach yourself with a notification, send as the bot:  slack send '${ref}' '...' --as-bot`,
@@ -965,8 +1020,8 @@ async function cmdSend(token: string, args: SendArgs): Promise<void> {
 
   let channelId: string;
   if (args.channelId) channelId = args.channelId;
-  else if (args.userId) channelId = await openDm(token, args.userId);
-  else channelId = await resolveChannel(token, ref);
+  else if (args.userId) channelId = await openDm(token, args.userId, cookie);
+  else channelId = await resolveChannel(token, ref, cookie);
 
   // Convert @handle / @名前 tokens to <@USERID> before hashing/sending so the
   // safety gate covers exactly what will be posted. Unresolved tokens stay as
@@ -1021,38 +1076,99 @@ async function cmdSend(token: string, args: SendArgs): Promise<void> {
   let lastText = "";
   let lastUser = "?";
   let threadMsgs: Record<string, Json>[] = [];
+  // Author of the destination's TRUE most recent message (thread-scoped for a
+  // thread reply, channel-scoped for a top-level send) — feeds the unreplied-warn
+  // check below. Tracks `user` (normal message) and `bot_id` (a `bot_message`
+  // subtype post — e.g. `send --as-bot` — which carries bot_id/username but no
+  // `user`) so ownership can be determined either way. Undefined when the
+  // preview fetch failed (fail-soft).
+  let lastMsgUserId: string | undefined;
+  let lastMsgBotId: string | undefined;
+  let lastMsgTs: string | undefined;
   if (threadTs) {
     try {
       // Fetch a generous window and preview its tail. conversations.replies is
       // oldest-first from the parent, so a very long thread's true tail may lie
       // beyond this window — 100 covers essentially all real threads.
-      const resp = (await replies(token, channelId, threadTs, 100)) as Record<string, Json>;
+      const resp = (await replies(token, channelId, threadTs, 100, cookie)) as Record<string, Json>;
       threadMsgs = asArray(resp.messages).map(asRecord);
       const lastMsg = threadMsgs[threadMsgs.length - 1];
       // Bind the hash to the thread's most recent message: if someone replies
       // between preview and confirm, the code invalidates and re-previews.
       lastText = typeof lastMsg?.text === "string" ? lastMsg.text : "";
+      lastMsgUserId = typeof lastMsg?.user === "string" ? lastMsg.user : undefined;
+      lastMsgBotId = typeof lastMsg?.bot_id === "string" ? lastMsg.bot_id : undefined;
+      lastMsgTs = typeof lastMsg?.ts === "string" ? lastMsg.ts : undefined;
     } catch {
       // best-effort preview only
     }
   } else {
     try {
-      const ctx = (await history(token, channelId, 1)) as Record<string, Json>;
-      const lastMsg = asArray(ctx.messages).map(asRecord)
-        .filter((m) => m.subtype === undefined || m.subtype === null)[0];
+      const ctx = (await history(token, channelId, 1, undefined, undefined, cookie)) as Record<string, Json>;
+      // limit=1 already narrows this to exactly the channel's true last message
+      // (subtype or not) — take it raw for the ownership check below. The
+      // subtype filter is only for the human-readable preview text/author: it
+      // deliberately hides system events (channel_join etc.), but a bot_message
+      // post is a real message and must NOT be dropped here, or a bot's own
+      // last post would silently disable the unreplied-warn for --as-bot sends.
+      const rawMsgs = asArray(ctx.messages).map(asRecord);
+      const lastMsg = rawMsgs.filter((m) => m.subtype === undefined || m.subtype === null)[0];
       lastText = typeof lastMsg?.text === "string" ? lastMsg.text : "";
       // Resolve the author's user ID to a display name for the preview; fall back
       // to the bot username, then the raw ID. userName() is fail-soft.
       lastUser = typeof lastMsg?.user === "string"
-        ? await userName(token, lastMsg.user)
+        ? await userName(token, lastMsg.user, cookie)
         : typeof lastMsg?.username === "string"
         ? lastMsg.username
         : "?";
+      const rawLast = rawMsgs[0];
+      lastMsgUserId = typeof rawLast?.user === "string" ? rawLast.user : undefined;
+      lastMsgBotId = typeof rawLast?.bot_id === "string" ? rawLast.bot_id : undefined;
+      lastMsgTs = typeof rawLast?.ts === "string" ? rawLast.ts : undefined;
     } catch {
       // best-effort preview only
     }
   }
 
+  // Unreplied guard: the destination's last message is our own and no one has
+  // replied since (by definition, since it's still the most recent message) —
+  // sending another new message risks spamming the same person twice. Warn
+  // (never block) and point at `slack edit` on that message instead. Reply-status
+  // based, not time-based, so it still fires even long after the last send.
+  // Self-identity covers both a normal post (`user` = our user id) and a
+  // `bot_message`-subtype post (`bot_id` = our app's bot id, no `user`), the
+  // shape `send --as-bot` produces. Opt out with SLACK_UNREPLIED_WARN=0.
+  if (process.env.SLACK_UNREPLIED_WARN !== "0" && lastMsgTs && (lastMsgUserId || lastMsgBotId)) {
+    try {
+      const self = await authScopes(token, cookie);
+      const isSelfAuthor =
+        (!!lastMsgUserId && !!self.userId && self.userId === lastMsgUserId) ||
+        (!!lastMsgBotId && !!self.botId && self.botId === lastMsgBotId);
+      if (isSelfAuthor) {
+        // Prefer a real permalink (exact, copy-pasteable). If that lookup fails,
+        // fall back to a form guaranteed parseable by `slack edit` regardless of
+        // what shape `ref` is in (a bare channel/user name, a raw ID resolved
+        // from a permalink, or a thread ref) — `#<channelId>:<ts>` always yields
+        // a ts split, and `--channel-id` makes the leading "#name" irrelevant to
+        // resolution, so it never depends on ref's original prefix or an
+        // embedded thread_ts colliding with the appended message ts.
+        let editCmd = `slack edit "#${channelId}:${lastMsgTs}" "<新しい本文>" --channel-id ${channelId}`;
+        try {
+          const permalink = await getPermalink(token, channelId, lastMsgTs, cookie);
+          if (permalink) editCmd = `slack edit "${permalink}" "<新しい本文>"`;
+        } catch {
+          // fall back to the --channel-id form above
+        }
+        console.error(`⚠ 相手はまだ返信していません(最後のメッセージはあなたのものです)。`);
+        console.error(`  連投を避けるため、新規送信でなく直前のメッセージの edit を検討してください:`);
+        console.error(`    ${editCmd}`);
+        console.error(`  このまま送信する場合は --code=XXXX で確定。`);
+      }
+    } catch {
+      // best-effort; a failed self-identity lookup must not block the send
+    }
+  }
+
   // Duplicate guard: if the outgoing message closely matches something already
   // in the thread, warn (never block). Catches re-posting a reply you already
   // sent. Threshold is deliberately high so only near-identical text trips it.
@@ -1066,7 +1182,7 @@ async function cmdSend(token: string, args: SendArgs): Promise<void> {
     }
     if (best.msg && best.sim >= 0.82) {
       const pct = Math.round(best.sim * 100);
-      console.error(`⚠ possible duplicate: ${pct}% similar to an existing thread message — ${await threadMsgLine(token, best.msg)}`);
+      console.error(`⚠ possible duplicate: ${pct}% similar to an existing thread message — ${await threadMsgLine(token, best.msg, 60, cookie)}`);
     }
   }
 
@@ -1075,14 +1191,14 @@ async function cmdSend(token: string, args: SendArgs): Promise<void> {
   const code = safetyCode(channelId, threadTs ?? "", lastText, message);
 
   if (args.code !== code) {
-    const dest = await destLabel(token, channelId, ref);
+    const dest = await destLabel(token, channelId, ref, cookie);
     if (threadTs) {
-      const parentLine = await threadParentLine(token, threadTs, threadMsgs);
+      const parentLine = await threadParentLine(token, threadTs, threadMsgs, cookie);
       // Preview the tail of the thread (up to 3 most recent messages) so the
       // sender can see what's already been said and avoid repeating it.
       const recent = threadMsgs.slice(-3);
       const recentLines = recent.length
-        ? await Promise.all(recent.map(async (m) => `  ${await threadMsgLine(token, m)}`))
+        ? await Promise.all(recent.map(async (m) => `  ${await threadMsgLine(token, m, 60, cookie)}`))
         : ["  (thread context unavailable)"];
       requireCode(args.code, code, [
         `--- Recent messages in thread ----------------`,
@@ -1105,10 +1221,10 @@ async function cmdSend(token: string, args: SendArgs): Promise<void> {
       ]);
     }
   }
-  const ts = await slackSend(token, channelId, message, threadTs, args.broadcast);
+  const ts = await slackSend(token, channelId, message, threadTs, args.broadcast, cookie);
   let permalink = "";
   try {
-    permalink = await getPermalink(token, channelId, ts);
+    permalink = await getPermalink(token, channelId, ts, cookie);
   } catch {
     // fail-soft: getPermalink failure (rate limit, network, etc.) should not
     // mask send success — fall back to ts-only output below.
@@ -1162,14 +1278,15 @@ interface ScheduleSendArgs {
   code?: string;
   channelId?: string;
   userId?: string;
+  cookie?: string;
 }
 async function cmdScheduleSend(token: string, args: ScheduleSendArgs): Promise<void> {
   const { ref, threadTs } = parseTargetThread(args.target);
 
   let channelId: string;
   if (args.channelId) channelId = args.channelId;
-  else if (args.userId) channelId = await openDm(token, args.userId);
-  else channelId = await resolveChannel(token, ref);
+  else if (args.userId) channelId = await openDm(token, args.userId, args.cookie);
+  else channelId = await resolveChannel(token, ref, args.cookie);
 
   const postAt = parsePostAt(args.at);
   const postAtDate = new Date(postAt * 1000).toISOString();
@@ -1184,18 +1301,18 @@ async function cmdScheduleSend(token: string, args: ScheduleSendArgs): Promise<v
       `---------------------------------------------`,
     ]);
   }
-  const id = await scheduleMessage(token, channelId, args.message, postAt, threadTs);
+  const id = await scheduleMessage(token, channelId, args.message, postAt, threadTs, args.cookie);
   console.log(`✓ Scheduled (id: ${id}, at: ${postAtDate})`);
 }
 
-async function cmdScheduleList(token: string, target?: string, channelId?: string): Promise<void> {
+async function cmdScheduleList(token: string, target?: string, channelId?: string, cookie?: string): Promise<void> {
   let channel: string | undefined;
   if (channelId) {
     channel = channelId;
   } else if (target) {
-    channel = await resolveChannel(token, target);
+    channel = await resolveChannel(token, target, cookie);
   }
-  const resp = (await listScheduledMessages(token, channel)) as {
+  const resp = (await listScheduledMessages(token, channel, cookie)) as {
     scheduled_messages?: { id: string; channel_id: string; post_at: number; text: string }[];
   };
   const msgs = resp.scheduled_messages ?? [];
@@ -1211,11 +1328,12 @@ interface ScheduleRmArgs {
   id: string;
   code?: string;
   channelId?: string;
+  cookie?: string;
 }
 async function cmdScheduleRm(token: string, args: ScheduleRmArgs): Promise<void> {
   let channelId: string;
   if (args.channelId) channelId = args.channelId;
-  else channelId = await resolveChannel(token, args.target);
+  else channelId = await resolveChannel(token, args.target, args.cookie);
 
   const code = safetyCode(channelId, args.id);
   if (args.code !== code) {
@@ -1226,7 +1344,7 @@ async function cmdScheduleRm(token: string, args: ScheduleRmArgs): Promise<void>
       `---------------------------------------------`,
     ]);
   }
-  await deleteScheduledMessage(token, channelId, args.id);
+  await deleteScheduledMessage(token, channelId, args.id, args.cookie);
   console.log(`✓ Deleted scheduled message ${args.id}`);
 }
 
@@ -1239,6 +1357,7 @@ interface UploadArgs {
   code?: string;
   channelId?: string;
   userId?: string;
+  cookie?: string;
 }
 async function cmdUpload(token: string, args: UploadArgs): Promise<void> {
   const { statSync, existsSync } = await import("node:fs");
@@ -1255,8 +1374,8 @@ async function cmdUpload(token: string, args: UploadArgs): Promise<void> {
 
   let channelId: string;
   if (args.channelId) channelId = args.channelId;
-  else if (args.userId) channelId = await openDm(token, args.userId);
-  else channelId = await resolveChannel(token, ref);
+  else if (args.userId) channelId = await openDm(token, args.userId, args.cookie);
+  else channelId = await resolveChannel(token, ref, args.cookie);
 
   const isBatch = args.filePaths.length > 1;
   const files = args.filePaths.map((fp) => {
@@ -1293,7 +1412,7 @@ async function cmdUpload(token: string, args: UploadArgs): Promise<void> {
     const uploadOpts: { title?: string; threadTs?: string; initialComment?: string } = { title: f.title };
     if (threadTs !== undefined) uploadOpts.threadTs = threadTs;
     if (args.comment !== undefined && i === 0) uploadOpts.initialComment = args.comment;
-    const { fileId, permalink } = await uploadFile(token, channelId, f.fp, uploadOpts);
+    const { fileId, permalink } = await uploadFile(token, channelId, f.fp, uploadOpts, args.cookie);
     const prefix = total > 1 ? `[${i + 1}/${total}] ` : "";
     console.log(`${prefix}✓ Uploaded (file_id: ${fileId}${permalink ? `, url: ${permalink}` : ""})`);
   }
@@ -1429,10 +1548,11 @@ async function main(): Promise<void> {
           (y2) => y2.positional("channel", { type: "string", demandOption: true, describe: "#name or channel ID" }),
           async (argv) => {
             const token = tok(argv as W);
+            const cookie = ck(argv as W);
             const ref = argv.channel!;
             const channelRef = ref.startsWith("#") || ref.startsWith("@") || ref.startsWith("C") || ref.startsWith("G") || ref.startsWith("D") ? ref : `#${ref}`;
-            const channelId = await resolveChannel(token, channelRef);
-            const resp = asRecord((await conversationInfo(token, channelId)) as Json);
+            const channelId = await resolveChannel(token, channelRef, cookie);
+            const resp = asRecord((await conversationInfo(token, channelId, cookie)) as Json);
             const ch = asRecord(resp.channel);
             const name = typeof ch.name === "string" ? ch.name : channelId;
             const isIm = ch.is_im === true;
@@ -1457,6 +1577,7 @@ async function main(): Promise<void> {
             .option("code", { type: "string", describe: "Safety hash to confirm create" }),
           async (argv) => {
             const token = tok(argv as W);
+            const cookie = ck(argv as W);
             // Slack lowercases and strips the leading #; normalize for preview + code.
             const name = argv.name!.replace(/^#/, "").toLowerCase();
             const isPrivate = argv.private === true;
@@ -1471,7 +1592,7 @@ async function main(): Promise<void> {
             ]);
             let created: { id: string; name: string };
             try {
-              created = await createChannel(token, name, isPrivate);
+              created = await createChannel(token, name, isPrivate, cookie);
             } catch (e: unknown) {
               console.error(e instanceof Error ? e.message : String(e));
               process.exit(1);
@@ -1481,14 +1602,32 @@ async function main(): Promise<void> {
               const ids: string[] = [];
               for (const ref of invites) {
                 try {
-                  ids.push(ref.startsWith("U") || ref.startsWith("W") ? ref : await resolveUserId(token, ref));
+                  ids.push(ref.startsWith("U") || ref.startsWith("W") ? ref : await resolveUserId(token, ref, cookie));
                 } catch (e: unknown) {
                   console.error(`  ! could not resolve ${ref}: ${e instanceof Error ? e.message : String(e)}`);
                 }
               }
+              // conversations.invite returns ok:true but silently no-ops for a
+              // single-channel guest (is_ultra_restricted) — they can only ever
+              // belong to the one channel they were created in. Warn up front
+              // (fail-soft, never blocks) so a no-op invite isn't mistaken for
+              // success.
+              for (const uid of ids) {
+                try {
+                  const info = asRecord((await userInfo(token, uid, cookie)) as Json);
+                  const u = asRecord(info.user);
+                  if (u.is_ultra_restricted === true) {
+                    console.error(`⚠ ${uid} is a single-channel guest — Slack restricts them to their one existing channel; this invite will likely report success but not actually add them.`);
+                  } else if (u.is_restricted === true) {
+                    console.error(`⚠ ${uid} is a multi-channel guest — double-check they were actually added (guest invites can silently no-op depending on workspace restrictions).`);
+                  }
+                } catch {
+                  // best-effort; a lookup failure must not block the invite
+                }
+              }
               if (ids.length) {
                 try {
-                  await inviteToChannel(token, created.id, ids);
+                  await inviteToChannel(token, created.id, ids, cookie);
                   console.log(`✓ Invited ${ids.length} member${ids.length === 1 ? "" : "s"}`);
                 } catch (e: unknown) {
                   console.error(`  ! invite failed: ${e instanceof Error ? e.message : String(e)}`);
@@ -1619,7 +1758,7 @@ async function main(): Promise<void> {
         .option("count", { alias: "n", type: "number", default: 100 })
         .option("json", { type: "boolean", default: false, describe: "Output raw JSON" }),
       async (argv) => {
-        await cmdSearch(tok(argv as W), argv.query!, argv.count, argv.json);
+        await cmdSearch(tok(argv as W), argv.query!, argv.count, argv.json, ck(argv as W));
       },
     )
     .command(
@@ -1668,7 +1807,7 @@ async function main(): Promise<void> {
           // (not the user's own self-DM).
           if (!args.channelId && !args.userId && args.target.startsWith("@")) {
             try {
-              args.userId = await resolveUserId(tok(argv as W), args.target);
+              args.userId = await resolveUserId(tok(argv as W), args.target, ck(argv as W));
             } catch (e: unknown) {
               console.error(
                 `Error: could not resolve ${args.target} to a user for the bot DM.\n` +
@@ -1682,6 +1821,11 @@ async function main(): Promise<void> {
           args.asBot = true;
         } else {
           sendToken = tok(argv as W);
+          // Session cookie for `sendToken` itself — needed for an xoxc- desktop
+          // token to be accepted by the public API at all. Not applicable to the
+          // bot token above (bot tokens need no cookie).
+          const sc = ck(argv as W);
+          if (sc) args.cookie = sc;
         }
         // Print a clean error instead of yargs' usage dump when a send fails at
         // runtime (e.g. missing scope, channel not found). The confirm gate
@@ -1729,6 +1873,8 @@ async function main(): Promise<void> {
             if (argv.code) args.code = argv.code;
             if (argv["channel-id"]) args.channelId = argv["channel-id"];
             if (argv["user-id"]) args.userId = argv["user-id"];
+            const cookie = ck(argv as W);
+            if (cookie) args.cookie = cookie;
             await cmdScheduleSend(tok(argv as W), args);
           },
         )
@@ -1739,7 +1885,7 @@ async function main(): Promise<void> {
             .positional("target", { type: "string", describe: "#channel to filter by" })
             .option("channel-id", { type: "string", describe: "Raw channel ID" }),
           async (argv) => {
-            await cmdScheduleList(tok(argv as W), argv.target as string | undefined, argv["channel-id"]);
+            await cmdScheduleList(tok(argv as W), argv.target as string | undefined, argv["channel-id"], ck(argv as W));
           },
         )
         .command(
@@ -1753,6 +1899,8 @@ async function main(): Promise<void> {
           async (argv) => {
             const args: ScheduleRmArgs = { target: argv.target!, id: argv.id! };
             if (argv.code) args.code = argv.code;
+            const cookie = ck(argv as W);
+            if (cookie) args.cookie = cookie;
             if (argv["channel-id"]) args.channelId = argv["channel-id"];
             await cmdScheduleRm(tok(argv as W), args);
           },
@@ -1775,6 +1923,8 @@ async function main(): Promise<void> {
         if (argv.code) args.code = argv.code;
         if (argv["channel-id"]) args.channelId = argv["channel-id"];
         if (argv.mentions !== false) args.mentions = true;
+        const cookie = ck(argv as W);
+        if (cookie) args.cookie = cookie;
         await cmdEdit(tok(argv as W), args);
       },
     )
@@ -1789,6 +1939,8 @@ async function main(): Promise<void> {
         const args: DeleteArgs = { target: argv.target! };
         if (argv.code) args.code = argv.code;
         if (argv["channel-id"]) args.channelId = argv["channel-id"];
+        const cookie = ck(argv as W);
+        if (cookie) args.cookie = cookie;
         await cmdDelete(tok(argv as W), args);
       },
     )
@@ -1804,6 +1956,8 @@ async function main(): Promise<void> {
         const args: ReactArgs = { target: argv.target!, emoji: argv.emoji! };
         if (argv.remove) args.remove = true;
         if (argv["channel-id"]) args.channelId = argv["channel-id"];
+        const cookie = ck(argv as W);
+        if (cookie) args.cookie = cookie;
         // Print a clean one-line error instead of yargs' usage dump + stack when
         // the reaction fails at runtime (missing_scope, invalid_name, etc.).
         try {
@@ -1832,6 +1986,8 @@ async function main(): Promise<void> {
         if (argv.code) args.code = argv.code;
         if (argv["channel-id"]) args.channelId = argv["channel-id"];
         if (argv["user-id"]) args.userId = argv["user-id"];
+        const cookie = ck(argv as W);
+        if (cookie) args.cookie = cookie;
         await cmdUpload(tok(argv as W), args);
       },
     )