slack-term 1.35.0 → 1.37.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slack-term",
-  "version": "1.35.0",
+  "version": "1.37.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/slack-term.git"

package/ts/ask.ts

@@ -179,6 +179,12 @@ export function askBuildResolvedText(question: string, found: AskFound, who: str
   return `${ASK_RESOLVED_PREFIX}*${question}*\n_${found.how}で回答済み${who ? ` (${who})` : ""}_\n\n${quoted}`;
 }
 
+/** Undo Slack's storage escaping. Only these three are ever escaped, and `&`
+ *  goes LAST so an answer that literally contains `<` is not decoded twice. */
+function askDecodeEntities(s: string): string {
+  return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+}
+
 export type AskParsed =
   | { kind: "open"; question: string; reactable: string[]; overflow: string[]; threadOnly: boolean }
   | { kind: "resolved"; question: string; answer: string }
@@ -222,10 +228,15 @@ export function askParseMessage(text: string): AskParsed {
   // would re-poll a question that already has its answer.
   if (text.startsWith(ASK_RESOLVED_PREFIX)) {
     const head = lines[0]!.slice(ASK_RESOLVED_PREFIX.length);
-    const question = head.replace(/^\*/, "").replace(/\*$/, "");
+    const question = askDecodeEntities(head.replace(/^\*/, "").replace(/\*$/, ""));
+    // `&gt; `, not only `> `: Slack HTML-escapes `&`, `<` and `>` in the text it
+    // hands back, so the quote we wrote as `> ` is STORED as `&gt; `. Matching
+    // only the raw form made every collected question unreadable — re-running
+    // `--waitFor` on one exited 3 (measured 2026-09-27: 40 of 71 asks).
     const answer = lines
-      .filter((l) => l.startsWith("> "))
-      .map((l) => l.slice(2))
+      .map((l) => (l.startsWith("> ") ? l.slice(2) : l.startsWith("&gt; ") ? l.slice(5) : null))
+      .filter((l): l is string => l !== null)
+      .map(askDecodeEntities)
       .join("\n");
     // A ✅-stamped body with no quoted answer is not a settled question we can
     // report; treat it as unknown rather than answer with an empty string.

package/ts/auth.ts

@@ -1,10 +1,11 @@
 // Interactive auth setup: slack auth login / slack login
 import { createInterface, type Interface } from "node:readline/promises";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { homedir } from "node:os";
-import { addProfile, listProfiles, setCookie, saveToEnvFile } from "./profiles.ts";
+import { addProfile, listProfiles, setCookie, setUserCookie, saveToEnvFile, resolveToken, resolveCookie, resolveBotToken, type Profile } from "./profiles.ts";
 import { authTest } from "./slack.ts";
-import { extractSessions, discoverChromeCookies, discoverFirefoxCookies } from "./slack-app.ts";
+import { extractSessions, extractChromeSessions, discoverChromeCookies, discoverChromeSessions, discoverFirefoxCookies, type ChromeSessionProfile } from "./slack-app.ts";
+import { extractSlackXoxdWindows } from "./chromeCookieWin.ts";
 
 const USER_SCOPES = [
   "search:read",
@@ -53,9 +54,16 @@ async function ask(rl: Interface, q: string): Promise<string> {
 }
 
 
+async function allowBrowserProfileRead(rl: Interface | undefined, yes: boolean): Promise<boolean> {
+  if (yes) return true;
+  if (!rl) return false;
+  const answer = await ask(rl, "Read local browser profiles and Slack session cookies? [y/N]: ");
+  return answer.toLowerCase() === "y" || answer.toLowerCase() === "yes";
+}
+
 async function saveToken(rl: Interface | null, token: string, nameOverride?: string, cookie?: string): Promise<string> {
   console.error("Verifying token...");
-  const info = await authTest(token);
+  const info = await authTest(token, cookie);
   const defaultName = slugify(info.team);
   let name: string;
   if (nameOverride) {
@@ -106,16 +114,53 @@ async function saveToken(rl: Interface | null, token: string, nameOverride?: str
 }
 
 /** Shared logic for importing sessions from the Slack desktop app. */
-export async function importFromDesktop(rl?: Interface): Promise<void> {
+export async function importFromDesktop(
+  rl?: Interface, yes = false, browser: "auto" | "all" | "chrome" | "firefox" | "none" = "auto",
+  saveProfileOnly = false,
+): Promise<void> {
   console.error("Scanning Slack desktop app...");
   const sessions = await extractSessions();
   if (sessions.length === 0) {
     console.error("No sessions found. Make sure Slack is installed and you have signed in at least once.");
     process.exit(1);
   }
+  if (process.platform === "linux" && browser !== "none" && sessions.some((s) => !s.cookie) && await allowBrowserProfileRead(rl, yes)) {
+    const found: { source: string; profileName: string; cookie: string }[] = [];
+    if (browser !== "chrome") {
+      for (const candidate of discoverFirefoxCookies()) {
+        found.push({ source: "Firefox", profileName: candidate.profileName, cookie: candidate.cookie });
+      }
+    }
+    if (browser === "chrome" || browser === "all" || (browser === "auto" && found.length === 0)) {
+      try {
+        for (const candidate of discoverChromeCookies().candidates) {
+          found.push({ source: "Chrome", profileName: candidate.profileName, cookie: candidate.cookie });
+        }
+      } catch (e: unknown) {
+        console.error(e instanceof Error ? e.message : String(e));
+      }
+    }
+    if (found.length === 1) {
+      for (const session of sessions) session.cookie ??= found[0]!.cookie;
+      console.log(`Found Slack session cookie in ${found[0]!.source} profile: ${found[0]!.profileName}`);
+    } else if (found.length > 1) {
+      console.log("Multiple browser sessions found. Choose one later with slack auth chrome or slack auth firefox.");
+    }
+    if (sessions.some((s) => !s.cookie)) {
+      console.log("Desktop session needs an xoxd cookie on Linux. Run: slack auth chrome or slack auth firefox");
+    }
+  }
 
-  // Single workspace + interactive: offer save-destination choice
-  if (sessions.length === 1 && rl) {
+  await saveImportedSessions(sessions, rl, saveProfileOnly);
+}
+
+async function saveImportedSessions(
+  sessions: import("./slack-app.ts").SlackAppSession[], rl?: Interface, saveProfileOnly = false,
+): Promise<void> {
+  // A session token without a cookie cannot pass auth.test yet. Save its
+  // LevelDB metadata as a profile so auth firefox can attach the cookie later.
+  // Single workspace + interactive + cookie: offer save-destination choice
+  if (sessions.length === 1 && rl && sessions[0]?.cookie && !saveProfileOnly) {
     const s = sessions[0]!;
     const teamLabel = s.teamName ?? s.teamId;
     console.log(`Found workspace: ${teamLabel}${s.cookie ? " (+ xoxd cookie)" : ""}`);
@@ -220,9 +265,61 @@ async function loginNewApp(rl: Interface, mode: "user" | "bot"): Promise<void> {
  * When run interactively, macOS will show a system dialog asking for the login password
  * to grant access to the "Chrome Safe Storage" keychain item — click Allow.
  */
-export async function cmdAuthChrome(opts: { workspace?: string } = {}): Promise<void> {
-  if (process.platform !== "darwin") {
-    console.error("Chrome cookie extraction is only supported on macOS.");
+/**
+ * Extract the Slack xoxd cookie from Chrome on Windows (app-bound "v20" scheme) for the
+ * selected workspace. Picks the Chrome profile that holds the workspace's session (else by
+ * --profile / prompt), then runs the elevated extraction (a UAC prompt appears).
+ */
+async function pickChromeCookieWindows(selected: { name: string; profile: Profile }, profileOpt?: string): Promise<string> {
+  const found = discoverChromeSessions();
+  if (found.length === 0) {
+    console.error("No Slack session found in Chrome. Sign in to Slack in Chrome (app.slack.com) and retry.");
+    process.exit(1);
+  }
+  // The workspace's xoxc token embeds its numeric team id — match the Chrome profile that has it.
+  const numericTeamId = selected.profile.token.split("-")[1];
+  let chosen = found.find((p) => p.sessions.some((s) => s.teamId === numericTeamId));
+  if (!chosen && profileOpt) {
+    chosen = found.find((p) => p.email === profileOpt || p.profileDir === profileOpt || p.profileDir === `Profile ${profileOpt}`);
+    if (!chosen) {
+      console.error(`Chrome profile "${profileOpt}" has no Slack session. Available: ${found.map((p) => p.email ?? p.profileDir).join(", ")}`);
+      process.exit(1);
+    }
+  }
+  if (!chosen) {
+    if (found.length === 1) {
+      chosen = found[0]!;
+    } else if (process.stdin.isTTY) {
+      console.log("Multiple Chrome profiles have a Slack session:");
+      found.forEach((p, i) => console.log(`  ${i + 1}) ${p.email ?? p.label}  [${p.profileDir}]`));
+      const rl = createInterface({ input: process.stdin, output: process.stdout });
+      const choice = (await rl.question(`Choice [1-${found.length}]: `)).trim();
+      rl.close();
+      const idx = parseInt(choice, 10) - 1;
+      if (isNaN(idx) || idx < 0 || idx >= found.length) { console.error("Invalid choice."); process.exit(1); }
+      chosen = found[idx]!;
+    } else {
+      console.error(`Multiple Chrome profiles have a Slack session — choose one with --profile:`);
+      found.forEach((p) => console.error(`  slack auth cookie -w ${selected.name} --profile "${p.email ?? p.profileDir}"`));
+      process.exit(1);
+    }
+  }
+
+  console.log(`Using Chrome profile: ${chosen.email ?? chosen.label}  [${chosen.profileDir}]`);
+  console.log("Chrome's cookie is app-bound encrypted; a Windows elevation (UAC) prompt will appear — approve it.");
+  try {
+    return await extractSlackXoxdWindows(chosen.profileDir);
+  } catch (e: unknown) {
+    console.error(`\nCould not extract the cookie automatically: ${e instanceof Error ? e.message : String(e)}`);
+    console.error("Fallback (manual): Chrome > DevTools (F12) > Application > Cookies > https://app.slack.com > copy the `d` value,");
+    console.error("then set it via an env file:  SLACK_COOKIE=xoxd-...  (in .slack-term/.env.local)");
+    process.exit(1);
+  }
+}
+
+export async function cmdAuthChrome(opts: { workspace?: string; profile?: string; yes?: boolean } = {}): Promise<void> {
+  if (process.platform !== "darwin" && process.platform !== "linux" && process.platform !== "win32") {
+    console.error("Chrome cookie extraction is supported on macOS, Linux, and Windows.");
     process.exit(1);
   }
 
@@ -286,60 +383,172 @@ export async function cmdAuthChrome(opts: { workspace?: string } = {}): Promise<
     process.exit(1);
   }
 
-  console.log("Scanning Chrome profiles for Slack session...");
-  console.log("macOS may show a dialog asking for your login password — click Allow.");
+  let cookie: string;
+  if (process.platform === "win32") {
+    // Windows: app-bound (v20) extraction, elevated (UAC) — its own consent/flow.
+    cookie = await pickChromeCookieWindows(selected, opts.profile);
+  } else {
+    // Reading the browser's cookie store needs explicit consent (macOS keychain / Linux keyring).
+    if (!opts.yes && !process.stdin.isTTY) {
+      console.error("Reading browser profiles requires confirmation. Re-run interactively or pass --yes.");
+      process.exit(1);
+    }
+    const confirmRl = opts.yes ? undefined : createInterface({ input: process.stdin, output: process.stdout });
+    try {
+      if (!await allowBrowserProfileRead(confirmRl, opts.yes ?? false)) {
+        console.log("Browser profile scan cancelled.");
+        return;
+      }
+    } finally {
+      confirmRl?.close();
+    }
+    console.log("Scanning Chrome profiles for Slack session...");
+    if (process.platform === "darwin") console.log("macOS may show a dialog asking for your login password — click Allow.");
+
+    let candidates: import("./slack-app.ts").ChromeCookieCandidate[];
+    let totalProfiles: number;
+    try {
+      ({ candidates, totalProfiles } = discoverChromeCookies());
+    } catch (e: unknown) {
+      console.error(`Failed: ${e instanceof Error ? e.message : String(e)}`);
+      process.exit(1);
+    }
+
+    if (candidates.length === 0) {
+      console.error(`No Slack session found in Chrome (scanned ${totalProfiles} profile${totalProfiles !== 1 ? "s" : ""}). Possible reasons:`);
+      console.error("  - You denied the keychain dialog (try running again and click Allow)");
+      console.error("  - Chrome is not installed or has no Slack session");
+      console.error("  - You're not logged in to Slack in Chrome");
+      process.exit(1);
+    }
 
-  let candidates: import("./slack-app.ts").ChromeCookieCandidate[];
-  let totalProfiles: number;
-  try {
-    ({ candidates, totalProfiles } = discoverChromeCookies());
-  } catch (e: unknown) {
-    console.error(`Failed: ${e instanceof Error ? e.message : String(e)}`);
-    process.exit(1);
+    // Always prompt when multiple Chrome profiles exist, so users can confirm the right one.
+    if (candidates.length === 1 && totalProfiles <= 1) {
+      cookie = candidates[0]!.cookie;
+      console.log(`Found session in Chrome profile: ${candidates[0]!.profileName}`);
+    } else {
+      const label = candidates.length === 1
+        ? `Found 1 Slack session across ${totalProfiles} Chrome profiles:`
+        : `Found ${candidates.length} Slack sessions across ${totalProfiles} Chrome profiles:`;
+      console.log(label);
+      candidates.forEach((c, i) => console.log(`  ${i + 1}) ${c.profileName}  [${c.profileDir}]`));
+      console.log("");
+      const rl = createInterface({ input: process.stdin, output: process.stdout });
+      const defaultChoice = candidates.length === 1 ? " [Enter=1]" : "";
+      const choice = (await rl.question(`Choice [1-${candidates.length}]${defaultChoice}: `)).trim();
+      rl.close();
+      const idx = choice === "" && candidates.length === 1 ? 0 : parseInt(choice, 10) - 1;
+      if (isNaN(idx) || idx < 0 || idx >= candidates.length) {
+        console.error("Invalid choice.");
+        process.exit(1);
+      }
+      cookie = candidates[idx]!.cookie;
+    }
   }
 
-  if (candidates.length === 0) {
-    console.error(`No Slack session found in Chrome (scanned ${totalProfiles} profile${totalProfiles !== 1 ? "s" : ""}). Possible reasons:`);
-    console.error("  - You denied the keychain dialog (try running again and click Allow)");
-    console.error("  - Chrome is not installed or has no Slack session");
-    console.error("  - You're not logged in to Slack in Chrome");
+  setCookie(profileName, cookie);
+  console.log(`Saved xoxd cookie to workspace "${profileName}".`);
+  console.log(`RTM WebSocket mode is now available: slack tail @you`);
+}
+
+/**
+ * Log in from Chrome: read xoxc workspace tokens from a Chrome profile's (plaintext)
+ * LocalStorage and create a workspace profile for each, grouped under the profile's
+ * account email as the identity. Works on all platforms for the token.
+ *
+ * The xoxd cookie (needed for RTM/drafts/search fallback) is captured on macOS via
+ * the keychain; on other platforms it must be attached separately (e.g. a live CDP
+ * read via rech, or a manual paste with `slack auth cookie`).
+ */
+export async function cmdAuthLoginChrome(opts: { profile?: string } = {}): Promise<void> {
+  console.error("Scanning Chrome profiles for Slack sessions...");
+  const found = discoverChromeSessions();
+  if (found.length === 0) {
+    console.error("No Slack session found in Chrome.");
+    console.error("  Open Slack in Chrome (https://app.slack.com) and sign in, then retry.");
     process.exit(1);
   }
 
-  let cookie: string;
-  // Always prompt when multiple Chrome profiles exist, so users can confirm the right one.
-  if (candidates.length === 1 && totalProfiles <= 1) {
-    cookie = candidates[0]!.cookie;
-    console.log(`Found session in Chrome profile: ${candidates[0]!.profileName}`);
-  } else {
-    const label = candidates.length === 1
-      ? `Found 1 Slack session across ${totalProfiles} Chrome profiles:`
-      : `Found ${candidates.length} Slack sessions across ${totalProfiles} Chrome profiles:`;
-    console.log(label);
-    candidates.forEach((c, i) => console.log(`  ${i + 1}) ${c.profileName}  [${c.profileDir}]`));
-    console.log("");
+  // Pick a Chrome profile.
+  let chosen: ChromeSessionProfile;
+  if (opts.profile) {
+    const key = opts.profile;
+    const match = found.find(
+      (p) => p.email === key || p.profileDir === key || p.profileDir === `Profile ${key}`,
+    );
+    if (!match) {
+      console.error(`Chrome profile "${key}" has no Slack session. Available:`);
+      found.forEach((p) => console.error(`  - ${p.email ?? p.label}  [${p.profileDir}]  (${p.sessions.length} workspace${p.sessions.length !== 1 ? "s" : ""})`));
+      process.exit(1);
+    }
+    chosen = match;
+  } else if (found.length === 1) {
+    chosen = found[0]!;
+  } else if (process.stdin.isTTY) {
+    console.log("Found Slack sessions in multiple Chrome profiles:");
+    found.forEach((p, i) => console.log(`  ${i + 1}) ${p.email ?? p.label}  [${p.profileDir}]  (${p.sessions.length} workspace${p.sessions.length !== 1 ? "s" : ""})`));
     const rl = createInterface({ input: process.stdin, output: process.stdout });
-    const defaultChoice = candidates.length === 1 ? " [Enter=1]" : "";
-    const choice = (await rl.question(`Choice [1-${candidates.length}]${defaultChoice}: `)).trim();
+    const choice = (await rl.question(`Choice [1-${found.length}]: `)).trim();
     rl.close();
-    const idx = choice === "" && candidates.length === 1 ? 0 : parseInt(choice, 10) - 1;
-    if (isNaN(idx) || idx < 0 || idx >= candidates.length) {
+    const idx = parseInt(choice, 10) - 1;
+    if (isNaN(idx) || idx < 0 || idx >= found.length) {
       console.error("Invalid choice.");
       process.exit(1);
     }
-    cookie = candidates[idx]!.cookie;
+    chosen = found[idx]!;
+  } else {
+    console.error(`Multiple Chrome profiles have a Slack session — choose one with --profile:`);
+    found.forEach((p) => console.error(`  slack auth login chrome --profile "${p.email ?? p.profileDir}"`));
+    process.exit(1);
   }
 
-  setCookie(profileName, cookie);
-  console.log(`Saved xoxd cookie to workspace "${profileName}".`);
-  console.log(`RTM WebSocket mode is now available: slack tail @you`);
+  const identity = chosen.email ?? chosen.label ?? chosen.profileDir;
+
+  // Capture the shared xoxd cookie where possible (macOS keychain at rest).
+  let cookie: string | undefined;
+  if (process.platform === "darwin") {
+    try {
+      const { candidates } = discoverChromeCookies();
+      cookie = candidates.find((c) => c.profileDir === chosen.profileDir)?.cookie ?? candidates[0]?.cookie;
+    } catch {
+      // keychain denied or v20 — fall through to guidance below
+    }
+  }
+  if (cookie) setUserCookie(identity, cookie, `chrome:${chosen.profileDir}`);
+
+  for (const s of chosen.sessions) {
+    const teamLabel = s.teamName ?? s.teamId;
+    const name = slugify(teamLabel);
+    addProfile(name, {
+      token: s.token,
+      team: teamLabel,
+      teamId: s.teamId,
+      url: s.url ?? "",
+      user: "",
+      identity,
+    });
+    console.log(`Added workspace "${name}": ${teamLabel}  (identity: ${identity})`);
+  }
+
+  console.log("");
+  if (cookie) {
+    console.log(`Captured xoxd cookie for ${identity} — shared across its ${chosen.sessions.length} workspace(s).`);
+    console.log(`RTM WebSocket mode is now available: slack tail @you`);
+  } else {
+    console.log("Note: no xoxd cookie captured (LocalStorage yields the token only; the cookie is");
+    console.log("encrypted at rest on this platform). Some features (RTM, drafts, search fallback) need it.");
+    console.log("  Attach it from your live browser — e.g. a CDP read via rech — or paste it:");
+    console.log(`    slack auth cookie --workspace ${slugify(chosen.sessions[0]!.teamName ?? chosen.sessions[0]!.teamId)}`);
+  }
+  console.log("");
+  console.log("Select a workspace:  slack auth use <name>   (see: slack auth ls)");
 }
 
 /**
  * Attach the xoxd session cookie from Firefox browser to an existing workspace profile.
  * Firefox stores cookies in plaintext — no keychain access needed.
  */
-export async function cmdAuthFirefox(opts: { workspace?: string } = {}): Promise<void> {
+export async function cmdAuthFirefox(opts: { workspace?: string; yes?: boolean } = {}): Promise<void> {
   const profiles = listProfiles();
   if (profiles.length === 0) {
     console.error("No workspaces configured. Run: slack auth login");
@@ -376,6 +585,19 @@ export async function cmdAuthFirefox(opts: { workspace?: string } = {}): Promise
     }
   }
 
+  if (!opts.yes && !process.stdin.isTTY) {
+    console.error("Reading browser profiles requires confirmation. Re-run interactively or pass --yes.");
+    process.exit(1);
+  }
+  const confirmRl = opts.yes ? undefined : createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    if (!await allowBrowserProfileRead(confirmRl, opts.yes ?? false)) {
+      console.log("Browser profile scan cancelled.");
+      return;
+    }
+  } finally {
+    confirmRl?.close();
+  }
   console.log("Scanning Firefox profiles for Slack session...");
   const candidates = discoverFirefoxCookies();
 
@@ -450,7 +672,44 @@ export async function cmdAuthApp(opts: { bot?: boolean } = {}): Promise<void> {
   }
 }
 
-export async function cmdAuthLogin(opts: { token?: string; name?: string } = {}): Promise<void> {
+/** Print the currently resolved credentials as dotenv assignments. */
+export function cmdAuthTokens(opts: { workspace?: string } = {}): void {
+  const format = (name: string, value: string): string => {
+    if (/[\r\n]/.test(value)) throw new Error(`Invalid newline in ${name}.`);
+    return `${name}=${/^[A-Za-z0-9._=-]+$/.test(value) ? value : JSON.stringify(value)}`;
+  };
+  const lines = [format("SLACK_TOKEN", resolveToken(opts.workspace))];
+  const cookie = resolveCookie(opts.workspace);
+  if (cookie) lines.push(format("SLACK_COOKIE", cookie));
+  if (!opts.workspace) {
+    const bot = resolveBotToken();
+    if (bot) lines.push(format("SLACK_BOT_TOKEN", bot));
+  }
+  console.log(lines.join("\n"));
+}
+
+/** Export a selected profile for env-file based CLI use. */
+export function cmdAuthSave(opts: { envfile: string; workspace?: string }): void {
+  const profiles = listProfiles();
+  const selected = opts.workspace
+    ? profiles.find((entry) => entry.name === opts.workspace)
+    : profiles.find((entry) => entry.current) ?? (profiles.length === 1 ? profiles[0] : undefined);
+  if (!selected) {
+    throw new Error(opts.workspace
+      ? `Workspace "${opts.workspace}" not found. Run: slack auth ls`
+      : "Select a workspace with slack auth use <name>, or pass --workspace <name>.");
+  }
+  if (!selected.profile.cookie) {
+    throw new Error(`Workspace "${selected.name}" has no session cookie. Run: slack auth chrome -w ${selected.name} or slack auth firefox -w ${selected.name}`);
+  }
+  const filePath = resolve(opts.envfile);
+  saveToEnvFile(filePath, { SLACK_TOKEN: selected.profile.token, SLACK_COOKIE: selected.profile.cookie });
+  console.log(`Saved token and cookie for workspace "${selected.name}" to ${filePath}`);
+}
+
+export async function cmdAuthLogin(opts: {
+  token?: string; name?: string; yes?: boolean; fromDesktop?: boolean; fromChrome?: boolean; fromFirefox?: boolean; fromAll?: boolean;
+} = {}): Promise<void> {
   // Show existing profiles if any
   const existing = listProfiles();
   if (existing.length > 0) {
@@ -462,6 +721,68 @@ export async function cmdAuthLogin(opts: { token?: string; name?: string } = {})
     console.log("");
   }
 
+  if ([opts.fromChrome, opts.fromFirefox, opts.fromAll].filter(Boolean).length > 1) {
+    throw new Error("Choose only one browser source: --from-chrome, --from-firefox, or --from-all.");
+  }
+  if (opts.fromChrome && !opts.fromDesktop) {
+    if (!opts.yes && !process.stdin.isTTY) {
+      throw new Error("Reading browser profiles requires confirmation. Re-run interactively or pass --yes.");
+    }
+    const rl = process.stdin.isTTY ? createInterface({ input: process.stdin, output: process.stdout }) : undefined;
+    try {
+      if (!await allowBrowserProfileRead(rl, opts.yes ?? false)) {
+        console.log("Browser profile scan cancelled.");
+        return;
+      }
+      const sessions = await extractChromeSessions();
+      if (sessions.length === 0) throw new Error("No Slack session token found in Chrome profiles.");
+      await saveImportedSessions(sessions, rl, true);
+    } finally {
+      rl?.close();
+    }
+    return;
+  }
+  if (opts.fromAll && !opts.fromDesktop) {
+    if (!opts.yes && !process.stdin.isTTY) {
+      throw new Error("Reading browser profiles requires confirmation. Re-run interactively or pass --yes.");
+    }
+    const rl = process.stdin.isTTY ? createInterface({ input: process.stdin, output: process.stdout }) : undefined;
+    try {
+      try {
+        await importFromDesktop(rl, opts.yes ?? false, "all", true);
+      } catch (e: unknown) {
+        if (!(e instanceof Error) || !e.message.startsWith("Slack desktop app LevelDB not found")) throw e;
+        if (!await allowBrowserProfileRead(rl, opts.yes ?? false)) {
+          console.log("Browser profile scan cancelled.");
+          return;
+        }
+        const sessions = await extractChromeSessions();
+        if (sessions.length === 0) throw new Error("No Slack session token found in Chrome profiles.");
+        if (sessions.every((s) => !s.cookie)) {
+          const firefox = discoverFirefoxCookies();
+          if (firefox.length === 1) for (const session of sessions) session.cookie = firefox[0]!.cookie;
+        }
+        await saveImportedSessions(sessions, rl, true);
+      }
+    } finally {
+      rl?.close();
+    }
+    return;
+  }
+  if (opts.fromDesktop || opts.fromChrome || opts.fromFirefox || opts.fromAll) {
+    const browser = opts.fromChrome ? "chrome" : opts.fromFirefox ? "firefox" : opts.fromAll ? "all" : "none";
+    if (browser !== "none" && !opts.yes && !process.stdin.isTTY) {
+      throw new Error("Reading browser profiles requires confirmation. Re-run interactively or pass --yes.");
+    }
+    const rl = process.stdin.isTTY ? createInterface({ input: process.stdin, output: process.stdout }) : undefined;
+    try {
+      await importFromDesktop(rl, opts.yes ?? false, browser, true);
+    } finally {
+      rl?.close();
+    }
+    return;
+  }
+
   // Non-interactive: token passed via --token flag or piped via stdin
   if (opts.token) {
     await saveToken(null, opts.token, opts.name);
@@ -485,33 +806,41 @@ export async function cmdAuthLogin(opts: { token?: string; name?: string } = {})
   console.log("");
   console.log("  1) Slack desktop app - import session token");
   console.log("     Reads the xoxc- token directly from the installed app.");
+  console.log("     Token: all platforms  |  xoxd cookie: macOS, or Chrome/Firefox on Linux");
+  console.log("");
+  console.log("  2) Chrome browser - import workspaces");
+  console.log("     Reads xoxc- tokens from Chrome, grouped by account.");
   console.log("     Token: all platforms  |  xoxd cookie: macOS only");
   console.log("");
-  console.log("  2) Connect existing Slack app  [recommended if you have one]");
+  console.log("  3) Connect existing Slack app  [recommended if you have one]");
   console.log("     Paste a token from an app you already created.");
   console.log("");
-  console.log("  3) Create new Slack app - user token (xoxp-)");
+  console.log("  4) Create new Slack app - user token (xoxp-)");
   console.log("     Guided setup with manifest. Full access including search.");
   console.log("");
-  console.log("  4) Create new Slack app - bot token (xoxb-)");
+  console.log("  5) Create new Slack app - bot token (xoxb-)");
   console.log("     Bot is invited to channels. Search and news unavailable.");
   console.log("");
 
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   try {
-    const choice = await ask(rl, "Choice [1/2/3/4]: ");
+    const choice = await ask(rl, "Choice [1/2/3/4/5]: ");
     console.log("");
 
     if (choice === "1") {
-      await importFromDesktop(rl);
+      await importFromDesktop(rl, opts.yes ?? false);
     } else if (choice === "2") {
-      await loginExisting(rl);
+      rl.close();
+      await cmdAuthLoginChrome();
+      return;
     } else if (choice === "3") {
-      await loginNewApp(rl, "user");
+      await loginExisting(rl);
     } else if (choice === "4") {
+      await loginNewApp(rl, "user");
+    } else if (choice === "5") {
       await loginNewApp(rl, "bot");
     } else {
-      console.error(`Invalid choice: "${choice}". Enter 1, 2, 3, or 4.`);
+      console.error(`Invalid choice: "${choice}". Enter 1, 2, 3, 4, or 5.`);
       process.exit(1);
     }
   } finally {