slack-term 1.35.0 → 1.37.0

package/ts/slack-app.ts

@@ -2,11 +2,12 @@
 // Reads raw .ldb/.log files with regex — works even while Slack is running (no exclusive lock).
 // Also extracts the xoxd session cookie from the Slack Cookies SQLite database (macOS only).
 
-import { readdirSync, readFileSync, existsSync, copyFileSync, unlinkSync } from "node:fs";
+import { readdirSync, readFileSync, existsSync, copyFileSync, mkdtempSync, rmSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join, dirname } from "node:path";
-import { pbkdf2Sync, createDecipheriv } from "node:crypto";
-import { execSync } from "node:child_process";
+import { pbkdf2Sync, createDecipheriv, createHash, timingSafeEqual } from "node:crypto";
+import { execSync, execFileSync } from "node:child_process";
+import { ldbDecompressedBytes } from "./leveldb.ts";
 
 export type SlackAppSession = {
   token: string;   // xoxc-...
@@ -16,23 +17,27 @@ export type SlackAppSession = {
   url?: string;
 };
 
-function leveldbPath(): string {
-  const home = homedir();
+function leveldbPaths(): string[] {
+  const home = process.env.HOME ?? homedir();
   if (process.platform === "darwin") {
-    return join(home, "Library", "Application Support", "Slack", "Local Storage", "leveldb");
+    return [join(home, "Library", "Application Support", "Slack", "Local Storage", "leveldb")];
   }
   if (process.platform === "linux") {
-    return join(home, ".config", "Slack", "Local Storage", "leveldb");
+    return [
+      join(home, ".config", "Slack", "Local Storage", "leveldb"),
+      join(home, "snap", "slack", "current", ".config", "Slack", "Local Storage", "leveldb"),
+      join(home, ".var", "app", "com.slack.Slack", "config", "Slack", "Local Storage", "leveldb"),
+    ];
   }
   if (process.platform === "win32") {
     const appData = process.env.APPDATA ?? join(home, "AppData", "Roaming");
-    return join(appData, "Slack", "Local Storage", "leveldb");
+    return [join(appData, "Slack", "Local Storage", "leveldb")];
   }
   throw new Error(`Unsupported platform: ${process.platform}`);
 }
 
 function cookiesDbPath(): string {
-  const home = homedir();
+  const home = process.env.HOME ?? homedir();
   if (process.platform === "darwin") {
     return join(home, "Library", "Application Support", "Slack", "Cookies");
   }
@@ -91,88 +96,61 @@ export function extractXoxd(): string | undefined {
   }
 }
 
-// Scan raw LevelDB files for xoxc- tokens without opening the DB exclusively.
-// Works while Slack is running.
-//
-// Strategy:
-//  1. .log files (write-ahead log): values are stored as readable JSON strings.
-//     Scan for "token":"xoxc-..." to get complete, clean tokens + workspace URL.
-//  2. .ldb files (sorted tables): values are length-prefixed with binary framing
-//     bytes that can split the token mid-segment. Use gap-bridging as fallback.
-export async function extractSessions(): Promise<SlackAppSession[]> {
-  const dbPath = leveldbPath();
-  if (!existsSync(dbPath)) {
-    throw new Error(
-      `Slack desktop app LevelDB not found at:\n  ${dbPath}\nIs Slack installed and opened at least once?`,
-    );
-  }
+// Scan a LevelDB directory for xoxc- tokens without opening the DB exclusively
+// (works while the owning app is running). Reads the raw .log/.ldb files, then
+// pulls "token":"xoxc-…" plus nearby workspace url/name out of the values. .ldb
+// data blocks are Snappy-compressed, so they are decompressed first.
+function scanLevelDbSessions(dbPath: string): SlackAppSession[] {
+  if (!existsSync(dbPath)) return [];
 
   const files = readdirSync(dbPath).filter((f) => f.endsWith(".ldb") || f.endsWith(".log"));
-  if (files.length === 0) throw new Error(`No LevelDB data files found in ${dbPath}`);
-
-  const sessions = new Map<string, SlackAppSession>();
-
-  for (const file of files) {
-    let content: string;
+  if (files.length === 0) return [];
+
+  // Readable text per file: .ldb data blocks are Snappy-compressed (a copy-op can
+  // split "token":"xoxc-…" apart), so decompress them; .log (write-ahead log) values
+  // are already plaintext JSON. Memoized — both passes below reuse it.
+  const textCache = new Map<string, string>();
+  const fileText = (file: string): string => {
+    const cached = textCache.get(file);
+    if (cached !== undefined) return cached;
+    let text = "";
     try {
-      content = readFileSync(join(dbPath, file), "latin1");
+      const raw = readFileSync(join(dbPath, file));
+      text = file.endsWith(".ldb")
+        ? (ldbDecompressedBytes(raw).toString("latin1") || raw.toString("latin1"))
+        : raw.toString("latin1");
     } catch {
-      continue;
+      text = "";
     }
+    textCache.set(file, text);
+    return text;
+  };
 
-    if (file.endsWith(".log")) {
-      // .log files store JSON values verbatim — extract complete token + URL + name in one pass.
-      for (const m of content.matchAll(/"token":"(xoxc-[^"]+)"/g)) {
-        const token = m[1]!;
-        const teamId = token.split("-")[1] ?? "";
-        if (!teamId || token.length < 40) continue;
-
-        // Look for workspace metadata near this token (within ±2KB)
-        const start = Math.max(0, m.index! - 2000);
-        const end = Math.min(content.length, m.index! + 2000);
-        const ctx = content.slice(start, end);
-        const urlMatch = ctx.match(/"url":"(https:\/\/[a-z0-9-]+\.slack\.com\/)"/);
-        const nameMatch = ctx.match(/"(?:team_name|name)":"([^"]{2,60})"/);
-
-        const existing = sessions.get(teamId);
-        if (!existing || token.length > existing.token.length) {
-          const entry: SlackAppSession = { token, teamId };
-          const url = urlMatch?.[1] ?? existing?.url;
-          const teamName = nameMatch?.[1] ?? existing?.teamName;
-          if (url) entry.url = url;
-          if (teamName) entry.teamName = teamName;
-          sessions.set(teamId, entry);
-        }
-      }
-    } else {
-      // .ldb files: binary framing bytes split the token mid-segment.
-      // Match the first 3 numeric segments, then bridge over binary bytes to find the rest.
-      for (const m of content.matchAll(/xoxc-(\d+)-(\d+)-(\d+)/g)) {
-        const teamId = m[1]!;
-        // Skip if already found in a .log file (prefer clean .log data)
-        if (sessions.has(teamId)) continue;
-
-        let i = m.index! + m[0].length;
-        const limit = Math.min(i + 10, content.length);
-        while (i < limit && (content.charCodeAt(i) < 0x30 || content.charCodeAt(i) > 0x39)) i++;
-
-        let seg3tail = "";
-        while (i < content.length && content.charCodeAt(i) >= 0x30 && content.charCodeAt(i) <= 0x39) {
-          seg3tail += content[i++];
-        }
-        if (content[i] !== "-") continue;
-        i++;
-        let hex = "";
-        while (i < content.length) {
-          const code = content.charCodeAt(i);
-          if ((code >= 0x30 && code <= 0x39) || (code >= 0x61 && code <= 0x66)) {
-            hex += content[i++];
-          } else break;
-        }
-        if (hex.length < 20) continue;
+  const sessions = new Map<string, SlackAppSession>();
 
-        const token = `${m[0]}${seg3tail}-${hex}`;
-        sessions.set(teamId, { token, teamId });
+  for (const file of files) {
+    const content = fileText(file);
+    // Values are verbatim JSON (after decompression) — extract token + URL + name in one pass.
+    for (const m of content.matchAll(/"token":"(xoxc-[^"]+)"/g)) {
+      const token = m[1]!;
+      const teamId = token.split("-")[1] ?? "";
+      if (!teamId || token.length < 40) continue;
+
+      // Look for workspace metadata near this token (within ±2KB)
+      const start = Math.max(0, m.index! - 2000);
+      const end = Math.min(content.length, m.index! + 2000);
+      const ctx = content.slice(start, end);
+      const urlMatch = ctx.match(/"url":"(https:\/\/[a-z0-9-]+\.slack\.com\/)"/);
+      const nameMatch = ctx.match(/"(?:team_name|name)":"([^"]{2,60})"/);
+
+      const existing = sessions.get(teamId);
+      if (!existing || token.length > existing.token.length) {
+        const entry: SlackAppSession = { token, teamId };
+        const url = urlMatch?.[1] ?? existing?.url;
+        const teamName = nameMatch?.[1] ?? existing?.teamName;
+        if (url) entry.url = url;
+        if (teamName) entry.teamName = teamName;
+        sessions.set(teamId, entry);
       }
     }
   }
@@ -180,17 +158,7 @@ export async function extractSessions(): Promise<SlackAppSession[]> {
   // Second pass: for sessions still missing a name, search all file content
   // (printable-transformed) for team_name/name near the numeric team ID, then
   // fall back to a title-cased URL slug.
-  const allFiles = readdirSync(dbPath).filter((f) => f.endsWith(".ldb") || f.endsWith(".log"));
-  const allContent = allFiles
-    .map((f) => {
-      try {
-        // Replace non-printable bytes with spaces to expose readable text in binary ldb frames.
-        return readFileSync(join(dbPath, f), "latin1").replace(/[^\x20-\x7e]/g, " ");
-      } catch {
-        return "";
-      }
-    })
-    .join(" ");
+  const allContent = files.map((f) => fileText(f).replace(/[^\x20-\x7e]/g, " ")).join(" ");
 
   for (const session of sessions.values()) {
     if (session.teamName) continue;
@@ -233,36 +201,104 @@ export async function extractSessions(): Promise<SlackAppSession[]> {
     }
   }
 
+  return [...sessions.values()];
+}
+
+/**
+ * Import sessions from a LevelDB store. Defaults to the Slack desktop app (all
+ * platforms for the xoxc token; the shared xoxd cookie is attached on macOS only).
+ * `leveldbOverride` points it at another store (e.g. a Chrome profile's LocalStorage,
+ * used by extractChromeSessions) — no desktop xoxd cookie is attached in that case.
+ * .ldb data blocks are Snappy-compressed, so scanLevelDbSessions decompresses them.
+ */
+export async function extractSessions(leveldbOverride?: string): Promise<SlackAppSession[]> {
+  const dbPath = leveldbOverride ?? leveldbPaths().find(existsSync);
+  if (!dbPath) {
+    throw new Error(
+      `Slack desktop app LevelDB not found at:\n  ${leveldbPaths().join("\n  ")}\nIs Slack installed and opened at least once?`,
+    );
+  }
+  const result = scanLevelDbSessions(dbPath);
   // Attach xoxd cookie to all sessions (shared — one Slack desktop app, one cookie jar)
-  const xoxd = extractXoxd();
-  const result = [...sessions.values()];
+  const xoxd = leveldbOverride ? undefined : extractXoxd();
   if (xoxd) {
     for (const s of result) s.cookie = xoxd;
   }
   return result;
 }
 
+/** Account email for a Chrome profile from Local State → info_cache (never the gaia real name). */
+function chromeProfileEmail(userDataDir: string, profileDir: string): string | undefined {
+  try {
+    const localState = JSON.parse(
+      readFileSync(join(userDataDir, "Local State"), "utf8"),
+    ) as { profile?: { info_cache?: Record<string, { user_name?: string }> } };
+    const email = localState.profile?.info_cache?.[profileDir]?.user_name;
+    return email || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export type ChromeSessionProfile = {
+  profileDir: string;         // "Default", "Profile 3", …
+  email?: string;             // account email from Local State, if known
+  label: string;              // display name (nickname + email)
+  sessions: SlackAppSession[]; // xoxc tokens found in this profile's LocalStorage (no cookie)
+};
+
+/**
+ * Discover Slack web sessions in Chrome by scanning each profile's LocalStorage
+ * LevelDB for xoxc- tokens. LocalStorage is plaintext, so this works on all
+ * platforms and needs no keychain/DPAPI access — it yields tokens only. The
+ * xoxd cookie is fetched separately (macOS at-rest via discoverChromeCookies,
+ * or a live CDP read on other platforms).
+ */
+export function discoverChromeSessions(): ChromeSessionProfile[] {
+  const userDataDir = chromeUserDataDir();
+  if (!userDataDir || !existsSync(userDataDir)) return [];
+
+  const profileDirs = ["Default", ...readdirSync(userDataDir).filter((d) => d.startsWith("Profile "))];
+  const out: ChromeSessionProfile[] = [];
+  for (const profileDir of profileDirs) {
+    const dbPath = join(userDataDir, profileDir, "Local Storage", "leveldb");
+    const sessions = scanLevelDbSessions(dbPath);
+    if (sessions.length === 0) continue;
+    const email = chromeProfileEmail(userDataDir, profileDir);
+    out.push({ profileDir, ...(email ? { email } : {}), label: chromeProfileName(userDataDir, profileDir), sessions });
+  }
+  return out;
+}
+
 /**
- * Try both AES-128-CBC variants used across Chromium versions to decrypt a v10 cookie.
+ * Try both AES-128-CBC layouts for a versioned Chromium cookie.
  * Returns the decrypted string if it starts with "xoxd-", otherwise undefined.
  *
  * Variant A (older Chrome):      IV = 16 spaces, ciphertext = enc[3:]
  * Variant B (newer Chrome 127+): IV = enc[19:35], ciphertext = enc[35:]
  */
-function decryptV10Cookie(enc: Buffer, aesKey: Buffer): string | undefined {
+function decryptV10Cookie(enc: Buffer, aesKey: Buffer, hostKey: string, allowEmbedded = false): string | undefined {
   const tryDecrypt = (iv: Buffer, ciphertext: Buffer): string | undefined => {
     try {
       const decipher = createDecipheriv("aes-128-cbc", aesKey, iv);
       decipher.setAutoPadding(true);
-      const result = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
-      return result.startsWith("xoxd-") ? result : undefined;
+      const result = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+      if (result.subarray(0, 5).toString() === "xoxd-") return result.toString("utf8");
+      if (result.length >= 37) {
+        const hostHash = createHash("sha256").update(hostKey).digest();
+        if (timingSafeEqual(result.subarray(0, 32), hostHash)) {
+          const value = result.subarray(32).toString("utf8");
+          if (value.startsWith("xoxd-")) return value;
+        }
+      }
+      return undefined;
     } catch {
       return undefined;
     }
   };
 
   return tryDecrypt(Buffer.alloc(16, 32), enc.slice(3))
-    ?? (enc.length >= 35 ? tryDecrypt(enc.slice(19, 35), enc.slice(35)) : undefined);
+    ?? (allowEmbedded && enc.length >= 35 ? tryDecrypt(enc.slice(19, 35), enc.slice(35)) : undefined);
 }
 
 export type ChromeCookieCandidate = {
@@ -309,101 +345,168 @@ function chromeProfileName(userDataDir: string, profileDir: string): string {
   }
 }
 
-/**
- * Discover all Chrome browser profiles that have a Slack xoxd cookie (macOS only).
- *
- * Requires the Chrome Safe Storage key from the system keychain. When called from an
- * interactive terminal, macOS will show a dialog asking for the login password.
- * Throws on v20 (app-bound encryption). Returns [] if keychain is inaccessible.
- */
+/** Discover Slack cookies in Chrome profiles on macOS and Linux. */
 export type ChromeDiscoveryResult = {
   candidates: ChromeCookieCandidate[];
-  totalProfiles: number; // how many Chrome profile dirs were scanned
+  totalProfiles: number;
 };
 
-export function discoverChromeCookies(): ChromeDiscoveryResult {
-  if (process.platform !== "darwin") return { candidates: [], totalProfiles: 0 };
-
-  const userDataDir = join(homedir(), "Library", "Application Support", "Google", "Chrome");
-  if (!existsSync(userDataDir)) return { candidates: [], totalProfiles: 0 };
+function chromeUserDataDir(): string {
+  const home = process.env.HOME ?? homedir();
+  if (process.platform === "darwin") return join(home, "Library", "Application Support", "Google", "Chrome");
+  if (process.platform === "linux") return join(process.env.XDG_CONFIG_HOME ?? join(home, ".config"), "google-chrome");
+  return "";
+}
 
-  let keychainPw: string;
+function linuxChromePassword(): string | undefined {
   try {
-    keychainPw = execSync(
-      `security find-generic-password -a Chrome -s "Chrome Safe Storage" -w`,
-      { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] },
-    ).trimEnd();
+    const password = execFileSync("secret-tool", ["lookup", "application", "chrome"], {
+      encoding: "utf8", stdio: ["ignore", "pipe", "ignore"],
+    }).trimEnd();
+    return password || undefined;
   } catch {
+    return undefined;
+  }
+}
+
+export function discoverChromeCookies(): ChromeDiscoveryResult {
+  if (process.platform !== "darwin" && process.platform !== "linux") {
     return { candidates: [], totalProfiles: 0 };
   }
-  if (!keychainPw) return { candidates: [], totalProfiles: 0 };
+  const userDataDir = chromeUserDataDir();
+  if (!existsSync(userDataDir)) return { candidates: [], totalProfiles: 0 };
 
-  const aesKey = pbkdf2Sync(keychainPw, "saltysalt", 1003, 16, "sha1");
+  let macKey: Buffer | undefined;
+  if (process.platform === "darwin") {
+    let keychainPw: string;
+    try {
+      keychainPw = execSync(
+        `security find-generic-password -a Chrome -s "Chrome Safe Storage" -w`,
+        { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] },
+      ).trimEnd();
+    } catch {
+      return { candidates: [], totalProfiles: 0 };
+    }
+    if (!keychainPw) return { candidates: [], totalProfiles: 0 };
+    macKey = pbkdf2Sync(keychainPw, "saltysalt", 1003, 16, "sha1");
+  }
 
   const profileDirs = ["Default", ...readdirSync(userDataDir).filter((d) => d.startsWith("Profile "))];
   const candidates: ChromeCookieCandidate[] = [];
+  let linuxV11Key: Buffer | undefined;
+  let missingLinuxKey = false;
 
   for (const profileDir of profileDirs) {
-    const dbPath = join(userDataDir, profileDir, "Cookies");
-    if (!existsSync(dbPath)) continue;
+    const dbPath = [join(userDataDir, profileDir, "Network", "Cookies"), join(userDataDir, profileDir, "Cookies")]
+      .find(existsSync);
+    if (!dbPath) continue;
 
-    const tmp = join(tmpdir(), `slack-chrome-cookies-${Date.now()}-${profileDir}.db`);
+    const tmpDir = mkdtempSync(join(tmpdir(), "slack-chrome-cookies-"));
+    const tmp = join(tmpDir, "Cookies");
     try {
       copyFileSync(dbPath, tmp);
+      if (existsSync(`${dbPath}-wal`)) copyFileSync(`${dbPath}-wal`, `${tmp}-wal`);
       const { default: Database } = require("bun:sqlite") as typeof import("bun:sqlite");
       const db = new Database(tmp, { readonly: true });
-      const row = db
-        .prepare("SELECT encrypted_value FROM cookies WHERE name='d' AND host_key LIKE '%slack%'")
-        .get() as { encrypted_value: Uint8Array } | null;
-      db.close();
+      let row: { encrypted_value: Uint8Array; value: string; host_key: string } | null;
+      try {
+        row = db.prepare(
+          "SELECT encrypted_value, value, host_key FROM cookies WHERE name='d' AND (host_key='slack.com' OR host_key LIKE '%.slack.com') LIMIT 1",
+        ).get() as typeof row;
+      } finally {
+        db.close();
+      }
       if (!row) continue;
-
       const enc = Buffer.from(row.encrypted_value);
-      const prefix = enc.slice(0, 3).toString();
-      if (prefix === "v10") {
-        // Try both AES-128-CBC variants used by different Chromium versions:
-        //   1. Standard (older Chrome):  IV = 16 spaces, ciphertext = enc[3:]
-        //   2. Embedded (newer Chrome/Electron): IV = enc[19:35], ciphertext = enc[35:]
-        const cookie = decryptV10Cookie(enc, aesKey);
-        if (!cookie) continue; // neither format produced a valid xoxd- value
-        candidates.push({ profileDir, profileName: chromeProfileName(userDataDir, profileDir), cookie });
-      } else if (prefix === "v20") {
-        throw new Error(
-          `Chrome cookie uses v20 (app-bound AES-256-GCM) which is not supported yet. ` +
-          `Prefix found: ${enc.slice(0, 4).toString("hex")}`,
-        );
-      } else {
-        throw new Error(`Unknown cookie encryption prefix: ${enc.slice(0, 4).toString("hex")}`);
+      const prefix = enc.subarray(0, 3).toString();
+      let cookie: string | undefined;
+      if (prefix === "v20") {
+        throw new Error("Chrome cookie uses unsupported v20 app-bound encryption.");
+      }
+      if (process.platform === "linux") {
+        if (!enc.length && row.value?.startsWith("xoxd-")) cookie = row.value;
+        else if (prefix === "v10") {
+          cookie = decryptV10Cookie(enc, pbkdf2Sync("peanuts", "saltysalt", 1, 16, "sha1"), row.host_key);
+        } else if (prefix === "v11") {
+          if (!linuxV11Key) {
+            const password = linuxChromePassword();
+            if (password) linuxV11Key = pbkdf2Sync(password, "saltysalt", 1, 16, "sha1");
+          }
+          if (linuxV11Key) cookie = decryptV10Cookie(enc, linuxV11Key, row.host_key);
+          else missingLinuxKey = true;
+        }
+      } else if (prefix === "v10" && macKey) {
+        cookie = decryptV10Cookie(enc, macKey, row.host_key, true);
+      } else if (prefix !== "v10") {
+        throw new Error("Unknown cookie encryption prefix.");
       }
+      if (cookie) candidates.push({ profileDir, profileName: chromeProfileName(userDataDir, profileDir), cookie });
     } catch (e: unknown) {
-      if (e instanceof Error && (e.message.includes("app-bound") || e.message.includes("Unknown cookie"))) throw e;
-      // Otherwise skip this profile
+      if (e instanceof Error && (e.message.includes("unsupported v20") || e.message.includes("Unknown cookie"))) throw e;
+      // Skip unreadable profiles without exposing cookie or key material.
     } finally {
-      try { unlinkSync(tmp); } catch { /* ignore */ }
+      rmSync(tmpDir, { recursive: true, force: true });
     }
   }
+  if (missingLinuxKey && candidates.length === 0) {
+    throw new Error("Chrome v11 cookie key is unavailable. Install secret-tool and unlock the GNOME keyring, or use slack auth firefox.");
+  }
   return { candidates, totalProfiles: profileDirs.length };
 }
 
+/** Read xoxc tokens from Chrome's Slack local storage and pair cookies from the same profile. */
+export async function extractChromeSessions(): Promise<SlackAppSession[]> {
+  if (process.platform !== "linux") throw new Error("Chrome session import is currently supported on Linux only.");
+  const userDataDir = chromeUserDataDir();
+  if (!existsSync(userDataDir)) throw new Error("Chrome profile directory was not found.");
+  const cookies = new Map(discoverChromeCookies().candidates.map((c) => [c.profileDir, c.cookie]));
+  const sessions = new Map<string, SlackAppSession>();
+  const profileDirs = ["Default", ...readdirSync(userDataDir).filter((d) => d.startsWith("Profile "))];
+  for (const profileDir of profileDirs) {
+    const leveldb = join(userDataDir, profileDir, "Local Storage", "leveldb");
+    if (!existsSync(leveldb)) continue;
+    let found: SlackAppSession[];
+    try {
+      found = await extractSessions(leveldb);
+    } catch {
+      continue;
+    }
+    for (const session of found) {
+      if (sessions.has(session.teamId)) {
+        throw new Error("More than one Chrome profile has a token for the same workspace. Select one browser profile first.");
+      }
+      const cookie = cookies.get(profileDir);
+      if (cookie) session.cookie = cookie;
+      sessions.set(session.teamId, session);
+    }
+  }
+  return [...sessions.values()];
+}
+
 export type FirefoxCookieCandidate = {
   profileDir: string;  // e.g. "abc123.default-release"
   profileName: string; // display name from profiles.ini, or the dir name
   cookie: string;      // plaintext xoxd-... (Firefox stores cookies unencrypted)
 };
 
-function firefoxProfilesDir(): string {
-  const home = homedir();
-  if (process.platform === "darwin") return join(home, "Library", "Application Support", "Firefox", "Profiles");
-  if (process.platform === "linux") return join(home, ".mozilla", "firefox");
+function firefoxProfilesDirs(): string[] {
+  const home = process.env.HOME ?? homedir();
+  if (process.platform === "darwin") return [join(home, "Library", "Application Support", "Firefox", "Profiles")];
+  if (process.platform === "linux") return [
+    join(home, ".mozilla", "firefox"),
+    join(home, "snap", "firefox", "common", ".mozilla", "firefox"),
+    join(home, ".var", "app", "org.mozilla.firefox", ".mozilla", "firefox"),
+  ];
   if (process.platform === "win32") {
-    return join(process.env.APPDATA ?? join(home, "AppData", "Roaming"), "Mozilla", "Firefox", "Profiles");
+    return [join(process.env.APPDATA ?? join(home, "AppData", "Roaming"), "Mozilla", "Firefox", "Profiles")];
   }
-  return "";
+  return [];
 }
 
 /** Read Firefox profiles.ini to map profile dir names to display names. */
 function firefoxProfileNames(profilesDir: string): Record<string, string> {
-  const iniPath = join(dirname(profilesDir), "profiles.ini");
+  const localIni = join(profilesDir, "profiles.ini");
+  const iniPath = existsSync(localIni) ? localIni : join(dirname(profilesDir), "profiles.ini");
   const map: Record<string, string> = {};
   if (!existsSync(iniPath)) return map;
   try {
@@ -431,39 +534,38 @@ function firefoxProfileNames(profilesDir: string): Record<string, string> {
  * Returns [] if Firefox is not installed or has no Slack session.
  */
 export function discoverFirefoxCookies(): FirefoxCookieCandidate[] {
-  const profilesDir = firefoxProfilesDir();
-  if (!profilesDir || !existsSync(profilesDir)) return [];
-
-  const nameMap = firefoxProfileNames(profilesDir);
   const candidates: FirefoxCookieCandidate[] = [];
-
-  let profileDirs: string[];
-  try {
-    profileDirs = readdirSync(profilesDir);
-  } catch {
-    return [];
-  }
-
-  for (const profileDir of profileDirs) {
-    const dbPath = join(profilesDir, profileDir, "cookies.sqlite");
-    if (!existsSync(dbPath)) continue;
-
-    const tmp = join(tmpdir(), `slack-firefox-cookies-${Date.now()}-${profileDir}.db`);
+  for (const profilesDir of firefoxProfilesDirs().filter(existsSync)) {
+    const nameMap = firefoxProfileNames(profilesDir);
+    let profileDirs: string[];
     try {
-      copyFileSync(dbPath, tmp);
-      const { default: Database } = require("bun:sqlite") as typeof import("bun:sqlite");
-      const db = new Database(tmp, { readonly: true });
-      const row = db
-        .prepare("SELECT value FROM moz_cookies WHERE name='d' AND host LIKE '%slack%' LIMIT 1")
-        .get() as { value: string } | null;
-      db.close();
-      if (!row?.value || !row.value.startsWith("xoxd-")) continue;
-      const profileName = nameMap[profileDir] ?? profileDir;
-      candidates.push({ profileDir, profileName, cookie: row.value });
+      profileDirs = readdirSync(profilesDir);
     } catch {
-      // skip this profile
-    } finally {
-      try { unlinkSync(tmp); } catch { /* ignore */ }
+      continue;
+    }
+
+    for (const profileDir of profileDirs) {
+      const dbPath = join(profilesDir, profileDir, "cookies.sqlite");
+      if (!existsSync(dbPath)) continue;
+
+      const tmpDir = mkdtempSync(join(tmpdir(), "slack-firefox-cookies-"));
+      const tmp = join(tmpDir, "cookies.sqlite");
+      try {
+        copyFileSync(dbPath, tmp);
+        const { default: Database } = require("bun:sqlite") as typeof import("bun:sqlite");
+        const db = new Database(tmp, { readonly: true });
+        const row = db
+          .prepare("SELECT value FROM moz_cookies WHERE name='d' AND (host='slack.com' OR host LIKE '%.slack.com') LIMIT 1")
+          .get() as { value: string } | null;
+        db.close();
+        if (!row?.value || !row.value.startsWith("xoxd-")) continue;
+        const profileName = nameMap[profileDir] ?? profileDir;
+        candidates.push({ profileDir, profileName, cookie: row.value });
+      } catch {
+        // skip this profile
+      } finally {
+        rmSync(tmpDir, { recursive: true, force: true });
+      }
     }
   }
   return candidates;