slack-term 1.31.4 → 1.31.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slack-term",
-  "version": "1.31.4",
+  "version": "1.31.6",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/slack-term.git"

package/ts/cli.ts

@@ -38,6 +38,7 @@ import {
   pollParseMessage,
   pollTally,
 } from "./poll.ts";
+import { seedReactionsInOrder } from "./reactionSeed.ts";
 import {
   authTest,
   authScopes,
@@ -2133,25 +2134,21 @@ async function cmdAsk(token: string, args: AskArgs): Promise<void> {
   // NOTE the colons: the modifier's argument is itself colon-wrapped, and the
   // bare `has:question` form does NOT error — it silently degrades to a
   // full-text search and returns plausible-looking counts. See ts/todo.ts.
-  try {
-    await reactionAdd(token, channelId, ts, ASK_MARKER, cookie);
-  } catch (e: unknown) {
-    // Cosmetic + searchability, not correctness: the body still identifies it.
-    console.error(`  (marker ${ASK_MARKER} を付けられませんでした: ${e instanceof Error ? e.message : String(e)})`);
-  }
-
-  // Seeded one at a time and in order: Slack keeps reactions in the order they
-  // were added, so sequential adds are what make the pills read 1,2,3 rather
-  // than shuffled. A parallel add is not an optimization here, it is a bug.
-  for (let i = 0; i < reactable.length; i++) {
-    try {
-      await reactionAdd(token, channelId, ts, ASK_KEYCAPS[i]!.name, cookie);
-    } catch (e: unknown) {
-      // A missing seed only costs the answerer a trip to the emoji picker, so
-      // warn and keep going rather than abandon a question already posted.
-      console.error(`  (リアクション ${ASK_KEYCAPS[i]!.name} を付けられませんでした: ${e instanceof Error ? e.message : String(e)})`);
-    }
-  }
+  // Marker first, then 1,2,3 — and spaced out. Sequential awaits alone are NOT
+  // enough: measured on two real questions from the same build, one came back
+  // `two|one|question|three`. See ts/reactionSeed.ts for the evidence and for
+  // SLACK_REACTION_SEED_GAP_MS.
+  await seedReactionsInOrder(
+    [ASK_MARKER, ...reactable.map((_, i) => ASK_KEYCAPS[i]!.name)],
+    (name) => reactionAdd(token, channelId, ts, name, cookie),
+    (name, e) => {
+      const why = e instanceof Error ? e.message : String(e);
+      // The marker is cosmetic + searchability; a keycap only costs the
+      // answerer a trip to the emoji picker. Neither abandons a posted question.
+      if (name === ASK_MARKER) console.error(`  (marker ${name} を付けられませんでした: ${why})`);
+      else console.error(`  (リアクション ${name} を付けられませんでした: ${why})`);
+    },
+  );
 
   let permalink = "";
   try {
@@ -2453,24 +2450,19 @@ async function cmdPoll(token: string, args: PollArgs): Promise<void> {
   // `has::ballot_box_with_ballot:` list every poll. An unrelated reaction on the message is
   // already ignored by the tally (it counts keycap names only), so this costs
   // the ballot nothing.
-  try {
-    await reactionAdd(token, channelId, ts, POLL_MARKER, cookie);
-  } catch (e: unknown) {
-    console.error(`  (marker ${POLL_MARKER} を付けられませんでした: ${e instanceof Error ? e.message : String(e)})`);
-  }
-
-  // Sequential and in order: Slack keeps reactions in the order they were added,
-  // so this is what makes the pills read 1,2,3 rather than shuffled. Parallel
-  // adds are not an optimization here, they are a bug.
-  for (let i = 0; i < choices.length; i++) {
-    try {
-      await reactionAdd(token, channelId, ts, POLL_KEYCAPS[i]!.name, cookie);
-    } catch (e: unknown) {
+  // Marker first, then 1,2,3 — and spaced out, for the reason `ask` documents
+  // at its own seeding call and ts/reactionSeed.ts documents in full.
+  await seedReactionsInOrder(
+    [POLL_MARKER, ...choices.map((_, i) => POLL_KEYCAPS[i]!.name)],
+    (name) => reactionAdd(token, channelId, ts, name, cookie),
+    (name, e) => {
+      const why = e instanceof Error ? e.message : String(e);
       // A missing seed costs a voter a trip to the emoji picker; it does not
       // invalidate a poll that is already posted.
-      console.error(`  (リアクション ${POLL_KEYCAPS[i]!.name} を付けられませんでした: ${e instanceof Error ? e.message : String(e)})`);
-    }
-  }
+      if (name === POLL_MARKER) console.error(`  (marker ${name} を付けられませんでした: ${why})`);
+      else console.error(`  (リアクション ${name} を付けられませんでした: ${why})`);
+    },
+  );
 
   let permalink = "";
   try {
@@ -3325,17 +3317,23 @@ async function main(): Promise<void> {
           (y2) => y2.positional("user", { type: "string", demandOption: true, describe: "@handle or user ID" }),
           async (argv) => {
             const token = tok(argv as W);
-            const ref = argv.user!.startsWith("@") ? argv.user!.slice(1) : argv.user!;
-            // If not a Slack user ID (U + alphanumeric), resolve from users list by handle
-            let userId = ref;
-            if (!/^U[A-Z0-9]+$/.test(ref)) {
-              const listResp = (await listUsers(token, ck(argv as W))) as Record<string, Json>;
-              const match = asArray(listResp.members).map(asRecord)
-                .find((u) => String(u.name ?? "") === ref);
-              if (!match) { console.error(`User not found: @${ref}`); process.exit(1); }
-              userId = String(match.id);
+            const cookie = ck(argv as W);
+            const ref = argv.user!.startsWith("@") ? argv.user! : `@${argv.user!}`;
+            // resolveUserId owns every population: the id form, self, the
+            // workspace roster, and the Slack Connect partners users.list cannot
+            // see. Matching `u.name` against this list by hand — as this used to
+            // — missed display names, real names, and everyone from another team.
+            let userId = "";
+            try {
+              userId = await resolveUserId(token, ref, cookie);
+            } catch (e) {
+              console.error(e instanceof Error ? e.message : String(e));
+              process.exit(1);
             }
-            const resp = asRecord((await userInfo(token, userId)) as Json);
+            // The cookie is not optional here: on a desktop (xoxc-) token the
+            // public Web API answers invalid_auth without it, which read as
+            // "your token is wrong" on a lookup that was about to succeed.
+            const resp = asRecord((await userInfo(token, userId, cookie)) as Json);
             const u = asRecord(resp.user);
             const profile = asRecord(u.profile);
             const localTz = Intl.DateTimeFormat().resolvedOptions().timeZone;

package/ts/reactionSeed.ts

@@ -0,0 +1,82 @@
+// Seeding the answer pills on an `ask` / `poll` message, in order.
+//
+// MEASURED, 2026-08-31, two real questions posted five seconds apart by the
+// SAME build:
+//
+//   07:42:31   two | one | question | three          ← shuffled
+//   07:42:36   question | one | two | three | four   ← correct
+//
+// The adds have been sequential (`await` inside a `for`) since the first commit
+// of `ask`, and there has never been a `Promise.all` here — so the reordering
+// happens on Slack's side, not ours. The comments that used to sit at both call
+// sites ("Slack keeps reactions in the order they were added, so sequential
+// adds are what make the pills read 1,2,3") asserted a guarantee that does not
+// exist, and the shuffled message above is the counter-example.
+//
+// The working theory is that the display order comes from a reaction timestamp
+// stored at second resolution: adds landing inside one second are tie-broken
+// arbitrarily, while adds that straddle a boundary keep their order. That fits
+// both samples — the slower message came out right — and it is why the gap
+// below is just over a second rather than a token 100ms.
+//
+// It is a THEORY. Confirming it needs `reactions.add` against a real workspace,
+// which this repo's QA rule forbids (see CLAUDE.md: read-only only), and Slack
+// exposes no timestamp on a reaction to measure it from. So the gap is tunable
+// without a code change: set SLACK_REACTION_SEED_GAP_MS, and 0 restores the old
+// back-to-back behaviour.
+
+/** Just over one second, so two consecutive seeds cannot share a second. */
+export const DEFAULT_SEED_GAP_MS = 1100;
+
+/** True under vitest or `bun test`. Same check as ts/todo.ts, and for the same
+ *  reason: a seam that only tests replace gets forgotten, and then the suite
+ *  waits real seconds per seeded reaction.
+ *
+ *  It takes `env` so it can be tested by VALUE. Testing it by deleting
+ *  NODE_ENV/VITEST from `process.env` and putting them back is what a first
+ *  version did, and under `bun test --parallel=2` the deletion was visible to
+ *  every CLI subprocess another test file spawned in that window: the suite
+ *  went from 45s to 169s because those children then waited the real gap. */
+export function isTestEnv(env: NodeJS.ProcessEnv = process.env): boolean {
+  return !!env.VITEST || env.NODE_ENV === "test" || !!env.BUN_TEST;
+}
+
+export const _internals = {
+  isTestEnv: (): boolean => isTestEnv(),
+  sleep: (ms: number): Promise<void> =>
+    _internals.isTestEnv() ? Promise.resolve() : new Promise((res) => setTimeout(res, ms)),
+};
+
+/** The configured gap. Invalid values fall back to the default rather than
+ *  disabling the gap silently — a typo must not quietly restore the bug. */
+export function seedGapMs(env: NodeJS.ProcessEnv = process.env): number {
+  const raw = env.SLACK_REACTION_SEED_GAP_MS;
+  if (raw === undefined || raw === "") return DEFAULT_SEED_GAP_MS;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < 0) return DEFAULT_SEED_GAP_MS;
+  return n;
+}
+
+/** Add `names` one at a time, in order, pausing between them.
+ *
+ *  A failed seed is reported and skipped, never fatal: the message is already
+ *  posted, and a missing pill costs the answerer a trip to the emoji picker.
+ *  The pause is skipped after the last add, and after one that failed — there
+ *  is nothing left to keep in order. */
+export async function seedReactionsInOrder(
+  names: readonly string[],
+  add: (name: string) => Promise<void>,
+  onError: (name: string, e: unknown) => void,
+  gapMs: number = seedGapMs(),
+): Promise<void> {
+  for (let i = 0; i < names.length; i++) {
+    let ok = true;
+    try {
+      await add(names[i]!);
+    } catch (e: unknown) {
+      ok = false;
+      onError(names[i]!, e);
+    }
+    if (ok && gapMs > 0 && i < names.length - 1) await _internals.sleep(gapMs);
+  }
+}

package/ts/slack.ts

@@ -501,46 +501,215 @@ export async function openDm(token: string, userId: string, cookie?: string): Pr
   return id;
 }
 
+/** The existing IM with `userId`, or "" when there is none. Paginated: a
+ *  workspace with many DMs pages its im list like any other conversation, and
+ *  reading only the first page is how a DM that exists reads as missing. */
+async function findExistingDm(token: string, userId: string, cookie?: string): Promise<string> {
+  let cursor = "";
+  while (true) {
+    const params: Record<string, string> = { types: "im", limit: "200" };
+    if (cursor) params.cursor = cursor;
+    const resp = (await get(token, "conversations.list", params, cookie)) as {
+      channels?: Array<{ id?: string; user?: string }>;
+      response_metadata?: { next_cursor?: string };
+    };
+    for (const ch of resp.channels ?? []) {
+      if (ch.user === userId) return String(ch.id ?? "");
+    }
+    cursor = resp.response_metadata?.next_cursor ?? "";
+    if (!cursor) break;
+  }
+  return "";
+}
+
+/** The DM channel with a known user id. Read-only on purpose: opening a DM
+ *  needs im:write, which plenty of read tokens do not carry, so an absent DM is
+ *  reported rather than created. */
+async function dmWithUser(token: string, userId: string, cookie?: string, label?: string): Promise<string> {
+  const dm = await findExistingDm(token, userId, cookie);
+  if (dm) return dm;
+  const who = label ? `${label} (${userId})` : userId;
+  throw new Error(`No existing DM with ${who}. Open it once in Slack first.`);
+}
+
 /** Normalize for loose matching: lowercase + strip hyphens/underscores/whitespace.
  *  Lets `@deploy-bot` match handles like `deploybot` or display names like `Deploy-Bot`. */
 function normName(s: string): string {
   return s.toLowerCase().replace(/[-_\s]/g, "");
 }
 
-/**
- * Resolve `@name` (or a raw U…/W… id) to a user ID. Used when DMing as a bot:
- * the lookup runs on a *user* token (which has users:read), then the caller
- * opens the DM with the bot token — so the bot never needs users:read.
- */
-export async function resolveUserId(token: string, ref: string, cookie?: string): Promise<string> {
-  if (!ref.startsWith("@")) {
-    if (/^[UW][A-Za-z0-9]{6,}$/.test(ref)) return ref;
-    throw new Error(`Expected @user or a user ID, got: ${ref}`);
-  }
-  const nameNorm = normName(ref.slice(1));
-  const selfInfo = (await get(token, "auth.test", {}, cookie)) as { user_id?: string; user?: string };
-  if (nameNorm === "you" || nameNorm === "me" || normName(selfInfo.user ?? "") === nameNorm) {
-    if (!selfInfo.user_id) throw new Error("auth.test did not return user_id");
-    return selfInfo.user_id;
-  }
+type Member = {
+  id?: string;
+  name?: string;
+  real_name?: string;
+  profile?: { display_name?: string; real_name?: string };
+};
+
+function memberMatches(u: Member, nameNorm: string): boolean {
+  const n = normName(u.name ?? "");
+  const rn = normName(u.real_name ?? u.profile?.real_name ?? "");
+  const dn = normName(u.profile?.display_name ?? "");
+  return n === nameNorm || rn === nameNorm || (!!dn && dn === nameNorm);
+}
+
+/** What a `@name` lookup found, and — when it found nothing — which populations
+ *  it actually searched. The counts are the whole point: "not found" out of 40
+ *  people is a wrong handle, "not found" out of 0 is a broken token, and the
+ *  caller cannot tell those apart from the sentence alone. */
+type UserSearch = {
+  /** "" when nothing matched. */
+  id: string;
+  /** The existing IM with them, when the match came from the DM scan. */
+  dm?: string;
+  workspaceCount: number;
+  connectCount: number;
+  /** DM partners whose profile could not be read, so they were never compared. */
+  skipped: number;
+  /** True when the scan stopped at CONNECT_SCAN_LIMIT with partners left over. */
+  capped: boolean;
+};
+
+/** How many non-roster DM partners a failed lookup will resolve one at a time.
+ *  Each costs a `users.info`, so an account with thousands of Slack Connect DMs
+ *  would otherwise turn a single typo into thousands of sequential calls and
+ *  rate-limit the caller out of the API. Past the cap the scan stops and says it
+ *  stopped — an incomplete answer that admits it beats a complete-looking one. */
+const CONNECT_SCAN_LIMIT = 200;
+
+/** Search every population this token can see for `@name`.
+ *
+ *  `users.list` is scoped to YOUR workspace, so a Slack Connect counterpart —
+ *  who belongs to another team entirely — is never in it, no matter what
+ *  parameters the call is given. The only place they exist is the membership of
+ *  a conversation you share, and for a person you DM the cheapest such place is
+ *  your own IM list: it costs one `users.info` per external DM partner and hands
+ *  back the channel id the caller was about to look up anyway. */
+async function searchUsers(token: string, nameNorm: string, cookie?: string): Promise<UserSearch> {
+  let workspaceCount = 0;
+  const known = new Set<string>();
   let cursor = "";
   while (true) {
     const params: Record<string, string> = { limit: "200" };
     if (cursor) params.cursor = cursor;
     const resp = (await get(token, "users.list", params, cookie)) as {
-      members?: Array<{ id?: string; name?: string; real_name?: string; profile?: { display_name?: string } }>;
+      members?: Member[];
       response_metadata?: { next_cursor?: string };
     };
     for (const u of resp.members ?? []) {
-      const n = normName(u.name ?? "");
-      const rn = normName(u.real_name ?? "");
-      const dn = normName(u.profile?.display_name ?? "");
-      if (n === nameNorm || rn === nameNorm || (dn && dn === nameNorm)) return u.id ?? "";
+      workspaceCount++;
+      if (u.id) known.add(u.id);
+      if (memberMatches(u, nameNorm)) {
+        return { id: u.id ?? "", workspaceCount, connectCount: 0, skipped: 0, capped: false };
+      }
     }
     cursor = resp.response_metadata?.next_cursor ?? "";
     if (!cursor) break;
   }
-  throw new Error(`User not found: ${ref}`);
+
+  let connectCount = 0;
+  let skipped = 0;
+  let capped = false;
+  let dmCursor = "";
+  while (true) {
+    const params: Record<string, string> = { types: "im", limit: "200" };
+    if (dmCursor) params.cursor = dmCursor;
+    const resp = (await get(token, "conversations.list", params, cookie)) as {
+      channels?: Array<{ id?: string; user?: string }>;
+      response_metadata?: { next_cursor?: string };
+    };
+    for (const ch of resp.channels ?? []) {
+      const uid = ch.user;
+      if (!uid || known.has(uid)) continue;
+      if (connectCount >= CONNECT_SCAN_LIMIT) {
+        capped = true;
+        break;
+      }
+      known.add(uid);
+      connectCount++;
+      let u: Member | undefined;
+      try {
+        u = ((await get(token, "users.info", { user: uid }, cookie)) as { user?: Member }).user;
+      } catch (e) {
+        // A rate limit is not "this person does not match" — it is the scan
+        // being cut off mid-way, and swallowing it is precisely how a lookup
+        // that could not see its population ends up reporting absence. Let it
+        // out. Any other per-profile failure costs us that one person, and is
+        // counted so the error can admit the search was incomplete.
+        if (e instanceof RateLimitError) throw e;
+        skipped++;
+        continue;
+      }
+      if (u && memberMatches(u, nameNorm)) {
+        return { id: uid, dm: String(ch.id ?? ""), workspaceCount, connectCount, skipped, capped };
+      }
+    }
+    if (capped) break;
+    dmCursor = resp.response_metadata?.next_cursor ?? "";
+    if (!dmCursor) break;
+  }
+  return { id: "", workspaceCount, connectCount, skipped, capped };
+}
+
+/** The error for a lookup that came back empty. An empty roster and a wrong
+ *  handle must not share a sentence: the first is a token or scope fault the
+ *  caller can fix, the second is a typo, and "User not found" told both stories
+ *  at once — so a lookup that could not see its population reported absence.
+ *
+ *  "account(s)", not "member(s)", and the count will not match `user ls`: that
+ *  command hides deleted accounts and bots, and this counts the raw users.list
+ *  the search actually walked. The two differ by design — the number here is a
+ *  report on the search, not a headcount of the workspace. */
+function userNotFoundError(ref: string, found: UserSearch): Error {
+  if (found.workspaceCount === 0) {
+    return new Error(
+      `Cannot resolve ${ref}: users.list returned no members at all, so nothing could have matched.\n` +
+      `That is a token or scope fault, not a wrong handle — this says nothing about whether ${ref} exists.\n` +
+      `  Check who you are:  slack auth ls`,
+    );
+  }
+  const searched = found.connectCount
+    ? `${found.workspaceCount} workspace account(s) and ${found.connectCount} Slack Connect DM partner(s)`
+    : `${found.workspaceCount} workspace account(s)`;
+  // Anything the scan did not actually look at is said out loud. "None matched"
+  // is only true of what was compared, and the gap between that and "not there"
+  // is the whole bug this function exists to stop repeating.
+  const gaps: string[] = [];
+  if (found.capped) {
+    gaps.push(`stopped after ${CONNECT_SCAN_LIMIT} Slack Connect DM partners, so there may be more`);
+  }
+  if (found.skipped) {
+    gaps.push(`${found.skipped} DM partner profile(s) could not be read and were never compared`);
+  }
+  return new Error(
+    `User not found: ${ref} — searched ${searched}, none matched.\n` +
+    (gaps.length ? `This search was incomplete: ${gaps.join("; ")}.\n` : "") +
+    `Slack Connect people from another workspace are not in users.list, so if they never\n` +
+    `DMed you they cannot be found by name at all. Look them up and use their ID:\n` +
+    `  slack user ls --external`,
+  );
+}
+
+/**
+ * Resolve `@name` (or a raw U…/W… id) to a user ID. Used when DMing as a bot:
+ * the lookup runs on a *user* token (which has users:read), then the caller
+ * opens the DM with the bot token — so the bot never needs users:read.
+ */
+export async function resolveUserId(token: string, ref: string, cookie?: string): Promise<string> {
+  // `@U0123456789` — an id wearing the `@` that every other user target takes.
+  // Nobody is NAMED that, so the name walk below would end in "user not found"
+  // and point at the wrong problem: the user is there, only the `@` is not.
+  const bare = ref.startsWith("@") ? ref.slice(1) : ref;
+  if (isUserId(bare)) return bare;
+  if (!ref.startsWith("@")) throw new Error(`Expected @user or a user ID, got: ${ref}`);
+  const nameNorm = normName(bare);
+  const selfInfo = (await get(token, "auth.test", {}, cookie)) as { user_id?: string; user?: string };
+  if (nameNorm === "you" || nameNorm === "me" || normName(selfInfo.user ?? "") === nameNorm) {
+    if (!selfInfo.user_id) throw new Error("auth.test did not return user_id");
+    return selfInfo.user_id;
+  }
+  const found = await searchUsers(token, nameNorm, cookie);
+  if (found.id) return found.id;
+  throw userNotFoundError(ref, found);
 }
 
 /** Parse a Slack permalink, returning channel ID, optional message ts, and optional thread_ts.
@@ -576,6 +745,13 @@ function isChannelId(s: string): boolean {
   return /^[CDG][A-Z0-9]{8,}$/.test(s);
 }
 
+/** A Slack user ID: `U…` (member) or `W…` (Enterprise Grid member). Upper-case
+ *  only — that is what keeps a lowercase handle like `@u1234567` reading as a
+ *  name instead of being swallowed by the id branch. */
+function isUserId(s: string): boolean {
+  return /^[UW][A-Z0-9]{6,}$/.test(s);
+}
+
 export async function resolveChannel(token: string, ref: string, cookie?: string): Promise<string> {
   // Accept Slack permalinks directly
   const fromUrl = parseSlackUrl(ref);
@@ -583,6 +759,10 @@ export async function resolveChannel(token: string, ref: string, cookie?: string
   // Accept raw IDs (C..., D..., G...) as-is
   if (!ref.startsWith("@") && !ref.startsWith("#")) {
     if (isChannelId(ref)) return ref;
+    // A bare `U…` names a person, and the conversation meant by a person is the
+    // DM with them. Refusing it as a malformed target sent callers hunting for a
+    // syntax error when what they had handed over was a perfectly good user.
+    if (isUserId(ref)) return dmWithUser(token, ref, cookie);
     throw new Error(`Target must start with # or @ (or be a Slack URL/ID), got: ${ref}`);
   }
   // `#C0123456789` — an ID that was given the `#` every other target form takes.
@@ -596,6 +776,9 @@ export async function resolveChannel(token: string, ref: string, cookie?: string
   const nameNorm = normName(rawName);
 
   if (isIm) {
+    // `@U0123456789` — the id form wearing the `@`, same reasoning as the bare
+    // id above: resolve it as a person, not as a name nobody has.
+    if (isUserId(rawName)) return dmWithUser(token, rawName, cookie);
     // Use auth.test to check if @name refers to self (avoids users:read scope requirement).
     // auth.test is always available; users.list requires users:read which xoxc- tokens lack.
     const selfInfo = (await get(token, "auth.test", {}, cookie)) as { user_id?: string; user?: string };
@@ -603,55 +786,16 @@ export async function resolveChannel(token: string, ref: string, cookie?: string
     if (isSelf) {
       const userId = selfInfo.user_id;
       if (!userId) throw new Error("auth.test did not return user_id");
-      const dmResp = (await get(token, "conversations.list", { types: "im", limit: "200" }, cookie)) as {
-        channels?: Array<{ id?: string; user?: string }>;
-      };
-      const dm = (dmResp.channels ?? []).find((ch) => ch.user === userId);
-      if (dm?.id) return String(dm.id);
-      return openDm(token, userId, cookie);
+      const dm = await findExistingDm(token, userId, cookie);
+      return dm || openDm(token, userId, cookie);
     }
 
-    // Find user ID first via users.list (batch), then locate existing DM.
-    let userId = "";
-    let userCursor = "";
-    while (true) {
-      const params: Record<string, string> = { limit: "200" };
-      if (userCursor) params.cursor = userCursor;
-      const resp = (await get(token, "users.list", params, cookie)) as {
-        members?: Array<{ id?: string; name?: string; real_name?: string; profile?: { display_name?: string } }>;
-        response_metadata?: { next_cursor?: string };
-      };
-      for (const u of resp.members ?? []) {
-        const n = normName(u.name ?? "");
-        const rn = normName(u.real_name ?? "");
-        const dn = normName(u.profile?.display_name ?? "");
-        if (n === nameNorm || rn === nameNorm || (dn && dn === nameNorm)) {
-          userId = u.id ?? "";
-          break;
-        }
-      }
-      if (userId) break;
-      userCursor = resp.response_metadata?.next_cursor ?? "";
-      if (!userCursor) break;
-    }
-    if (!userId) throw new Error(`User not found: ${ref}`);
-
-    // Find an existing DM (avoids needing im:write scope)
-    let dmCursor = "";
-    while (true) {
-      const params: Record<string, string> = { types: "im", limit: "200" };
-      if (dmCursor) params.cursor = dmCursor;
-      const resp = (await get(token, "conversations.list", params, cookie)) as {
-        channels?: Array<{ id?: string; user?: string }>;
-        response_metadata?: { next_cursor?: string };
-      };
-      for (const ch of resp.channels ?? []) {
-        if (ch.user === userId) return String(ch.id ?? "");
-      }
-      dmCursor = resp.response_metadata?.next_cursor ?? "";
-      if (!dmCursor) break;
-    }
-    throw new Error(`No existing DM with ${ref} (${userId}). Open it once in Slack first.`);
+    const found = await searchUsers(token, nameNorm, cookie);
+    if (!found.id) throw userNotFoundError(ref, found);
+    // The Connect scan already walked the IM list to find them, so it knows the
+    // channel — asking again would only pay for the same pages twice.
+    if (found.dm) return found.dm;
+    return dmWithUser(token, found.id, cookie, ref);
   }
 
   // Channel lookup

package/ts/tail.ts

@@ -238,7 +238,9 @@ export async function cmdTail(
     process.exit(1);
   }
 
-  const channelId = await resolveChannel(token, target);
+  // Cookie included: a desktop (xoxc-) token is rejected by the public Web API
+  // without it, so dropping it here failed the lookup before the tail started.
+  const channelId = await resolveChannel(token, target, opts.cookie);
   const interval = opts.interval ?? 60000;
   // Optional auto-stop deadline (e.g. wait at most 30m for a reply).
   const deadline = opts.timeout ? _internals.now() + parseSince(opts.timeout) * 1000 : Infinity;