slack-term 1.31.6 → 1.32.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slack-term",
-  "version": "1.31.6",
+  "version": "1.32.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/slack-term.git"

package/ts/cli.ts

@@ -929,14 +929,27 @@ async function recipientTzFor(token: string, channelId: string, cookie?: string)
   }
 }
 
-function requireCode(provided: string | undefined, expected: string, contextLines: string[], recipientTz?: string | null): void {
+/** `when` is the moment the message will ACTUALLY reach the person — which is
+ *  now for a send, and `post_at` for a schedule. Judging a scheduled message by
+ *  the clock at schedule time answers a question nobody asked: `schedule send`
+ *  is the one command where the delivery time is stated outright, and reading
+ *  it off `Date.now()` warned about a message set for December because it was
+ *  scheduled after 23:00. A warning that is false on the command where the
+ *  answer is written in the arguments teaches people to ignore the warning. */
+function requireCode(
+  provided: string | undefined,
+  expected: string,
+  contextLines: string[],
+  recipientTz?: string | null,
+  when: Date = new Date(),
+): void {
   // The clock goes to stdout with the rest of the preview, not to stderr with
   // the code. The preview is what you are asked to LOOK at before committing,
   // and "what time is it where they are" is part of that picture — a caller
   // doing `send ... 2>/dev/null` to read the preview would otherwise drop the
   // one line added to stop a 01:00 send.
   for (const line of contextLines) console.log(line);
-  const clock = quietHoursNotice(new Date(), recipientTz);
+  const clock = quietHoursNotice(when, recipientTz);
   if (clock) console.log(clock);
   if (provided !== undefined) {
     console.error(`Code mismatch (got ${provided}, expected ${expected})`);
@@ -2615,6 +2628,37 @@ async function cmdDoctor(token: string): Promise<void> {
 }
 
 // --- schedule ---
+
+/** The xoxb bot token, or a clean exit. `--as-bot` is only ever a token switch,
+ *  and its failure is always the same one: the env var is not set. */
+function requireBotToken(): string {
+  const botToken = resolveBotToken();
+  if (!botToken) {
+    console.error(
+      "Error: --as-bot needs a bot token, but no xoxb- token was found.\n" +
+      "  Set SLACK_BOT_TOKEN=xoxb-... in ~/.config/slack-cli/.env (or your shell).",
+    );
+    process.exit(1);
+  }
+  return botToken;
+}
+
+/** The bot↔user DM for an `@handle`. The handle is resolved on the USER token
+ *  (which has users:read) and the DM is opened on the BOT token, so the channel
+ *  is the bot's IM with that person and not the person's own self-DM. That
+ *  distinction is the entire point of `--as-bot` here: Slack never notifies you
+ *  about your own message, so a digest scheduled into a self-DM is delivered
+ *  into silence at the one moment nobody is at the terminal to notice. */
+async function botDmForTarget(
+  target: string,
+  botToken: string,
+  userToken: string,
+  userCookie?: string,
+): Promise<string> {
+  const userId = await resolveUserId(userToken, target, userCookie);
+  return openDm(botToken, userId);
+}
+
 function parsePostAt(at: string): number {
   if (/^\d{10,}$/.test(at)) return parseInt(at, 10);
   const d = new Date(at.replace(" ", "T"));
@@ -2650,6 +2694,10 @@ interface ScheduleSendArgs {
   channelId?: string;
   userId?: string;
   cookie?: string;
+  asBot?: boolean;
+  /** How the caller overrode the target text, e.g. `--user-id U0123`. Set only
+   *  when a FLAG supplied it — never when the command resolved the id itself. */
+  targetOverride?: string;
 }
 async function cmdScheduleSend(token: string, args: ScheduleSendArgs): Promise<void> {
   const getSelf = selfLookup(token, args.cookie);
@@ -2670,26 +2718,73 @@ async function cmdScheduleSend(token: string, args: ScheduleSendArgs): Promise<v
   // Self-DM is worst here: the message fires later, unattended, and Slack never
   // notifies you about your own post — so a scheduled reminder to yourself is
   // delivered into silence at exactly the moment you were counting on it.
-  if (await isSelfDmChannel(token, channelId, self?.userId, args.cookie)) {
+  // --as-bot is exempt: that posts as the app, a different identity, which does
+  // notify you. Being unable to say that is what made this warning a dead end —
+  // it named the problem and offered no way out.
+  if (!args.asBot && await isSelfDmChannel(token, channelId, self?.userId, args.cookie)) {
     console.error(
-      `Warning: "${args.target}" is a DM to yourself — Slack will NOT notify you when this fires.`,
+      `Warning: "${args.target}" is a DM to yourself — Slack will NOT notify you when this fires.\n` +
+      `  To be notified, schedule it as the bot:  slack schedule send '${args.target}' '...' --at '${args.at}' --as-bot`,
     );
   }
 
   const code = safetyCode(channelId, args.message, String(postAt), self?.userId ?? "");
 
+  // `--channel-id` / `--user-id` win over the target text, so the target stops
+  // being where this goes the moment the two disagree — and the gate printed
+  // only the target. `schedule send @alice … --user-id <bob>` read "To: @alice"
+  // and went to bob. A confirm gate that names the wrong recipient with no sign
+  // it was overridden is worse than no gate: it gets read, and it gets passed.
+  const destOverride = args.targetOverride ? `  [${args.targetOverride} → ${channelId}]` : "";
+
   if (args.code !== code) {
+    // Quiet hours are judged on post_at, in the recipient's zone — the two facts
+    // that decide whether a phone buzzes at 3am, and the two this gate was
+    // guessing at. `send` already resolves the zone; here the time is known
+    // exactly, which is the one command where it is.
+    const recipientTz = await recipientTzFor(token, channelId, args.cookie);
     requireCode(args.code, code, [
       `--- Scheduling message -----------------------`,
-      fromLine(self, { pad: 9 }),
-      `  To:      ${ref}${threadTs ? ` (thread ${threadTs})` : ""}`,
+      fromLine(self, { asBot: args.asBot, pad: 9 }),
+      `  To:      ${ref}${threadTs ? ` (thread ${threadTs})` : ""}${destOverride}`,
       `  At:      ${fmtPostAt(postAt)}`,
       `  Message: ${args.message}`,
       `---------------------------------------------`,
-    ]);
+    ], recipientTz, new Date(postAt * 1000));
   }
   const id = await scheduleMessage(token, channelId, args.message, postAt, threadTs, args.cookie);
   console.log(`✓ Scheduled (id: ${id}, at: ${postAtDate})`);
+
+  if (args.asBot) {
+    // The message now belongs to the BOT, so `schedule ls` on the user token
+    // cannot see it and `schedule rm` cannot cancel it. Said at the only moment
+    // the id is in front of the reader.
+    console.error(
+      `  Scheduled as the bot — the user token cannot see or cancel it. Use the same flag:\n` +
+      `    slack schedule ls --as-bot\n` +
+      `    slack schedule rm '${args.target}' ${id} --as-bot`,
+    );
+    // A scheduled bot DM fires unattended, so an app that cannot actually carry
+    // a DM fails at the one moment nobody is watching. Same check `send --as-bot`
+    // runs after the fact; here it is the difference between finding out now and
+    // finding out from an empty inbox.
+    if (channelId.startsWith("D")) {
+      try {
+        const diag = await diagnoseBotMessaging(token);
+        if (!diag.ok) {
+          for (const line of formatDiagnosis(diag, true)) console.error(line);
+        } else {
+          const appUrl = diag.appId ? `https://api.slack.com/apps/${diag.appId}` : "https://api.slack.com/apps";
+          console.error(
+            `Note: if ${args.target} can't reply (app messaging may be off), ` +
+            `enable Messages Tab: ${appUrl} → App Home.`,
+          );
+        }
+      } catch {
+        // diagnosis is best-effort; never turn a successful schedule into a failure.
+      }
+    }
+  }
 }
 
 async function cmdScheduleList(token: string, target?: string, channelId?: string, cookie?: string): Promise<void> {
@@ -2716,6 +2811,9 @@ interface ScheduleRmArgs {
   code?: string;
   channelId?: string;
   cookie?: string;
+  asBot?: boolean;
+  /** How the caller overrode the target text, e.g. `--channel-id C0123`. */
+  targetOverride?: string;
 }
 async function cmdScheduleRm(token: string, args: ScheduleRmArgs): Promise<void> {
   let channelId: string;
@@ -2727,8 +2825,8 @@ async function cmdScheduleRm(token: string, args: ScheduleRmArgs): Promise<void>
   if (args.code !== code) {
     requireCode(args.code, code, [
       `--- Deleting scheduled message ---------------`,
-      fromLine(self, { pad: 9 }),
-      `  Channel: ${args.target}`,
+      fromLine(self, { asBot: args.asBot, pad: 9 }),
+      `  Channel: ${args.target}${args.targetOverride ? `  [${args.targetOverride} → ${channelId}]` : ""}`,
       `  ID:      ${args.id}`,
       `---------------------------------------------`,
     ]);
@@ -3729,15 +3827,52 @@ async function main(): Promise<void> {
             .option("at", { type: "string", demandOption: true, describe: "Delivery time (ISO datetime or Unix ts)" })
             .option("code", { type: "string", describe: "Safety hash to confirm" })
             .option("channel-id", { type: "string", describe: "Raw channel ID" })
-            .option("user-id", { type: "string", describe: "Raw user ID (opens DM)" }),
+            .option("user-id", { type: "string", describe: "Raw user ID (opens DM)" })
+            .option("as-bot", { type: "boolean", default: false, describe: "Schedule via the bot token (xoxb / SLACK_BOT_TOKEN) so a DM notifies the recipient. Without it a scheduled DM to yourself is posted by you, and Slack never notifies you of your own message — it fires into silence." }),
           async (argv) => {
             const args: ScheduleSendArgs = { target: argv.target!, message: argv.message!, at: argv.at! };
             if (argv.code) args.code = argv.code;
-            if (argv["channel-id"]) args.channelId = argv["channel-id"];
-            if (argv["user-id"]) args.userId = argv["user-id"];
-            const cookie = ck(argv as W);
-            if (cookie) args.cookie = cookie;
-            await cmdScheduleSend(tok(argv as W), args);
+            // Recorded here, not in the command, because only a flag counts as an
+            // override — under --as-bot the command sets args.userId itself from
+            // the target, and claiming THAT was an override would be a new lie.
+            if (argv["channel-id"]) {
+              args.channelId = argv["channel-id"];
+              args.targetOverride = `--channel-id ${argv["channel-id"]}`;
+            }
+            if (argv["user-id"]) {
+              args.userId = argv["user-id"];
+              args.targetOverride = `--user-id ${argv["user-id"]}`;
+            }
+            let scheduleToken: string;
+            if (argv["as-bot"]) {
+              const botToken = requireBotToken();
+              // Resolve @user → user_id with the *user* token (has users:read),
+              // then let cmdScheduleSend open the DM with the bot token
+              // (im:write). Same split as `send --as-bot`: the bot never needs
+              // users:read, and the DM is bot↔user rather than a self-DM.
+              if (!args.channelId && !args.userId && args.target.startsWith("@")) {
+                try {
+                  args.userId = await resolveUserId(tok(argv as W), args.target, ck(argv as W));
+                } catch (e: unknown) {
+                  console.error(
+                    `Error: could not resolve ${args.target} to a user for the bot DM.\n` +
+                    `  ${e instanceof Error ? e.message : String(e)}\n` +
+                    `  Tip: pass --user-id <Uxxxx> to skip the lookup.`,
+                  );
+                  process.exit(1);
+                }
+              }
+              scheduleToken = botToken;
+              args.asBot = true;
+            } else {
+              scheduleToken = tok(argv as W);
+              // Session cookie for the token that will actually schedule — an
+              // xoxc- desktop token is rejected by the public API without it.
+              // Bot tokens need none.
+              const cookie = ck(argv as W);
+              if (cookie) args.cookie = cookie;
+            }
+            await cmdScheduleSend(scheduleToken, args);
           },
         )
         .command(
@@ -3745,9 +3880,20 @@ async function main(): Promise<void> {
           "List pending scheduled messages",
           (y2) => y2
             .positional("target", { type: "string", describe: "#channel to filter by" })
-            .option("channel-id", { type: "string", describe: "Raw channel ID" }),
+            .option("channel-id", { type: "string", describe: "Raw channel ID" })
+            .option("as-bot", { type: "boolean", default: false, describe: "List what the BOT token scheduled. A message from `schedule send --as-bot` belongs to the app, so the user token's listing does not contain it — and an invisible pending message cannot be cancelled." }),
           async (argv) => {
-            await cmdScheduleList(tok(argv as W), argv.target as string | undefined, argv["channel-id"], ck(argv as W));
+            const target = argv.target as string | undefined;
+            if (argv["as-bot"]) {
+              const botToken = requireBotToken();
+              let channelId = argv["channel-id"] as string | undefined;
+              if (!channelId && target?.startsWith("@")) {
+                channelId = await botDmForTarget(target, botToken, tok(argv as W), ck(argv as W));
+              }
+              await cmdScheduleList(botToken, target, channelId);
+              return;
+            }
+            await cmdScheduleList(tok(argv as W), target, argv["channel-id"], ck(argv as W));
           },
         )
         .command(
@@ -3757,13 +3903,26 @@ async function main(): Promise<void> {
             .positional("target", { type: "string", demandOption: true, describe: "#channel or @user" })
             .positional("id", { type: "string", demandOption: true, describe: "Scheduled message ID" })
             .option("code", { type: "string", describe: "Safety hash to confirm" })
-            .option("channel-id", { type: "string", describe: "Raw channel ID" }),
+            .option("channel-id", { type: "string", describe: "Raw channel ID" })
+            .option("as-bot", { type: "boolean", default: false, describe: "Cancel a message scheduled with `schedule send --as-bot`. It belongs to the bot token, so the user token cannot delete it." }),
           async (argv) => {
             const args: ScheduleRmArgs = { target: argv.target!, id: argv.id! };
             if (argv.code) args.code = argv.code;
+            if (argv["channel-id"]) {
+              args.channelId = argv["channel-id"];
+              args.targetOverride = `--channel-id ${argv["channel-id"]}`;
+            }
+            if (argv["as-bot"]) {
+              const botToken = requireBotToken();
+              if (!args.channelId && args.target.startsWith("@")) {
+                args.channelId = await botDmForTarget(args.target, botToken, tok(argv as W), ck(argv as W));
+              }
+              args.asBot = true;
+              await cmdScheduleRm(botToken, args);
+              return;
+            }
             const cookie = ck(argv as W);
             if (cookie) args.cookie = cookie;
-            if (argv["channel-id"]) args.channelId = argv["channel-id"];
             await cmdScheduleRm(tok(argv as W), args);
           },
         )