slack-term 1.32.2 → 1.32.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slack-term",
-  "version": "1.32.2",
+  "version": "1.32.3",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/slack-term.git"

package/ts/cli.ts

@@ -1168,7 +1168,62 @@ interface EditArgs {
   // Session cookie (xoxd) for `token` — required for an xoxc- desktop session
   // token to be accepted by the public Slack API at all.
   cookie?: string;
+  asBot?: boolean;
+  /** The USER token, kept for mention resolution when the edit itself runs as
+   *  the bot. A bot token has no users:read, and an unresolved @handle degrades
+   *  to plain text SILENTLY — which is the precise failure `edit` exists to
+   *  correct, so re-introducing it here would be circular. Same split as
+   *  `send --as-bot`. */
+  mentionToken?: string;
+  mentionCookie?: string;
+}
+/** The bot token, plus the bot↔user DM when the target names an `@handle`.
+ *
+ *  Both halves are load-bearing. A bot token has no `users:read`, so resolving
+ *  `@bob` with it does not merely pick the wrong channel — it fails outright with
+ *  `missing_scope`, before the confirm gate is ever printed. And even where it
+ *  could resolve, a BOT-authored DM lives in the bot's conversation with that
+ *  person, not in the user's: looking the handle up as the user and opening the
+ *  DM as the bot is the only combination that names the message being corrected.
+ *  Same split `send --as-bot` makes.
+ *
+ *  Found by the cross-vendor review of this change, which also named why the
+ *  first round of tests missed it: they all targeted a permalink, and
+ *  `resolveChannel` parses those locally without touching the API. */
+async function asBotTarget(
+  target: string,
+  userToken: string,
+  userCookie: string | undefined,
+  /** Already known from `--channel-id`. Passed in so the DM lookup is SKIPPED
+   *  rather than performed and discarded: `conversations.open` is a side effect,
+   *  and opening a DM the caller did not ask for is not undone by ignoring the
+   *  result. */
+  knownChannelId?: string,
+): Promise<{ botToken: string; channelId?: string }> {
+  const botToken = resolveBotToken();
+  if (!botToken) {
+    console.error(
+      "Error: --as-bot needs a bot token, but no xoxb- token was found.\n" +
+      "  Set SLACK_BOT_TOKEN=xoxb-... in ~/.config/slack-cli/.env (or your shell).",
+    );
+    process.exit(1);
+  }
+  if (knownChannelId) return { botToken };
+  const { ref } = splitRefTs(target);
+  if (!ref.startsWith("@")) return { botToken };
+  try {
+    const userId = await resolveUserId(userToken, ref, userCookie);
+    return { botToken, channelId: await openDm(botToken, userId) };
+  } catch (e: unknown) {
+    console.error(
+      `Error: could not resolve ${stripTerminalControls(ref)} to the bot's DM.\n` +
+      `  ${e instanceof Error ? e.message : String(e)}\n` +
+      `  Tip: pass the message permalink, or --channel-id <D…>, to skip the lookup.`,
+    );
+    process.exit(1);
+  }
 }
+
 async function cmdEdit(token: string, args: EditArgs): Promise<void> {
   const getSelf = selfLookup(token, args.cookie);
   const { ref, ts } = splitRefTs(args.target);
@@ -1192,8 +1247,9 @@ async function cmdEdit(token: string, args: EditArgs): Promise<void> {
   const originalText = typeof original.text === "string" ? original.text : "";
 
   // Convert @handle → <@USERID> before hashing/editing (unresolved stay as text).
+  const mentionCookie = args.mentionCookie ?? args.cookie;
   const newText = args.mentions
-    ? await encodeMentions(token, args.newText, channelId, args.cookie ? { cookie: args.cookie } : {})
+    ? await encodeMentions(args.mentionToken ?? token, args.newText, channelId, mentionCookie ? { cookie: mentionCookie } : {})
     : args.newText;
 
   // Identity is part of the hash for the same reason it is on `send`: a code
@@ -1205,7 +1261,7 @@ async function cmdEdit(token: string, args: EditArgs): Promise<void> {
   if (args.code !== code) {
     requireCode(args.code, code, [
       `--- Editing as -------------------------------`,
-      fromLine(self),
+      fromLine(self, { asBot: args.asBot }),
       `--- Original message -------------------------`,
       ...originalText.split("\n").map((l) => `  ${l}`),
       `--- Replacing with ---------------------------`,
@@ -1224,6 +1280,7 @@ interface DeleteArgs {
   code?: string;
   channelId?: string;
   cookie?: string;
+  asBot?: boolean;
 }
 async function cmdDelete(token: string, args: DeleteArgs): Promise<void> {
   const getSelf = selfLookup(token, args.cookie);
@@ -1255,7 +1312,7 @@ async function cmdDelete(token: string, args: DeleteArgs): Promise<void> {
     const dest = await destLabel(token, channelId, ref, args.cookie);
     requireCode(args.code, code, [
       `--- Deleting message -------------------------`,
-      fromLine(self),
+      fromLine(self, { asBot: args.asBot }),
       `  → ${dest} at ${slackTsToIso(ts)}`,
       ...originalText.split("\n").map((l) => `  ${l}`),
       `---------------------------------------------`,
@@ -4021,15 +4078,39 @@ async function main(): Promise<void> {
         .positional("newText", { type: "string", demandOption: true })
         .option("code", { type: "string", describe: "Safety hash to confirm edit" })
         .option("channel-id", { type: "string", describe: "Raw channel ID" })
-        .option("mentions", { type: "boolean", default: true, describe: "Convert @handle tokens in the new text to real <@USERID> mentions (on by default). Unresolved handles stay as plain text. Disable with --no-mentions for literal @text." }),
+        .option("mentions", { type: "boolean", default: true, describe: "Convert @handle tokens in the new text to real <@USERID> mentions (on by default). Unresolved handles stay as plain text. Disable with --no-mentions for literal @text." })
+        .option("as-bot", { type: "boolean", default: false, describe: "Edit as the bot (xoxb / SLACK_BOT_TOKEN). REQUIRED to correct a message the bot posted: Slack only lets a token edit its OWN messages, so a bot-authored message is uneditable by the user token and chat.update returns cant_update_message. Address it by permalink or --channel-id; an @user target resolves against the BOT's DM list, which is where a bot-authored DM actually lives." }),
       async (argv) => {
         const args: EditArgs = { target: argv.target!, newText: argv.newText! };
         if (argv.code) args.code = argv.code;
         if (argv["channel-id"]) args.channelId = argv["channel-id"];
         if (argv.mentions !== false) args.mentions = true;
-        const cookie = ck(argv as W);
-        if (cookie) args.cookie = cookie;
-        await cmdEdit(tok(argv as W), args);
+        let editToken: string;
+        if (argv["as-bot"]) {
+          // --as-bot is not a switch on chat.update. It selects a DIFFERENT
+          // resolved token, and until now `edit` never wired one — so every
+          // message the bot posted was uncorrectable, and the workaround people
+          // reached for was RESENDING, which this repo's own etiquette forbids.
+          // Bot identity is what makes a DM notify at all, so "uncorrectable"
+          // applied to exactly the messages that matter most.
+          const resolved = await asBotTarget(args.target, tok(argv as W), ck(argv as W), args.channelId);
+          editToken = resolved.botToken;
+          if (resolved.channelId && !args.channelId) args.channelId = resolved.channelId;
+          args.asBot = true;
+          // Mentions still resolve on the USER token: the bot has no users:read,
+          // and a silently unresolved @handle in a CORRECTION is the same defect
+          // twice.
+          args.mentionToken = tok(argv as W);
+          const mc = ck(argv as W);
+          if (mc) args.mentionCookie = mc;
+        } else {
+          editToken = tok(argv as W);
+          // Not set under --as-bot: a bot token needs no session cookie, and
+          // attaching one is how a working call starts failing.
+          const cookie = ck(argv as W);
+          if (cookie) args.cookie = cookie;
+        }
+        await cmdEdit(editToken, args);
       },
     )
     .command(
@@ -4038,14 +4119,28 @@ async function main(): Promise<void> {
       (y) => y
         .positional("target", { type: "string", demandOption: true, describe: "#chan:ts, @user:ts, or permalink" })
         .option("code", { type: "string", describe: "Safety hash to confirm delete" })
-        .option("channel-id", { type: "string", describe: "Raw channel ID" }),
+        .option("channel-id", { type: "string", describe: "Raw channel ID" })
+        .option("as-bot", { type: "boolean", default: false, describe: "Delete as the bot (xoxb / SLACK_BOT_TOKEN). REQUIRED for a message the bot posted: chat.delete refuses another token's message exactly as chat.update does." }),
       async (argv) => {
         const args: DeleteArgs = { target: argv.target! };
         if (argv.code) args.code = argv.code;
         if (argv["channel-id"]) args.channelId = argv["channel-id"];
-        const cookie = ck(argv as W);
-        if (cookie) args.cookie = cookie;
-        await cmdDelete(tok(argv as W), args);
+        let deleteToken: string;
+        if (argv["as-bot"]) {
+          // The SECOND call site of one defect, not a second defect: `delete`
+          // had the identical unconditional `tok(argv)`, and chat.delete refuses
+          // another token's message exactly as chat.update does. Fixing one and
+          // leaving the other is how the next person finds it the hard way.
+          const resolved = await asBotTarget(args.target, tok(argv as W), ck(argv as W), args.channelId);
+          deleteToken = resolved.botToken;
+          if (resolved.channelId && !args.channelId) args.channelId = resolved.channelId;
+          args.asBot = true;
+        } else {
+          deleteToken = tok(argv as W);
+          const cookie = ck(argv as W);
+          if (cookie) args.cookie = cookie;
+        }
+        await cmdDelete(deleteToken, args);
       },
     )
     .command(