slack-term 1.36.0 → 1.37.1

package/ts/cli.ts

@@ -11,7 +11,7 @@ import { hideBin } from "yargs/helpers";
 import { guardUrlBoundaries } from "./urlGuard.ts";
 import { listProfiles, removeProfile, resolveBotToken, resolveCookie, resolveToken, useProfile, type Profile } from "./profiles.ts";
 import { diagnoseBotMessaging, formatDiagnosis } from "./botdoctor.ts";
-import { cmdAuthLogin, cmdAuthChrome, cmdAuthFirefox, cmdAuthToken, cmdAuthApp, cmdAuthSave, cmdAuthTokens } from "./auth.ts";
+import { cmdAuthLogin, cmdAuthLoginChrome, cmdAuthChrome, cmdAuthFirefox, cmdAuthToken, cmdAuthApp, cmdAuthSave, cmdAuthTokens } from "./auth.ts";
 import { cmdTail } from "./tail.ts";
 import { agentCommands } from "./agent.ts";
 
@@ -4663,24 +4663,53 @@ async function main(): Promise<void> {
         )
         .command(
           "login",
-          "Interactive auth wizard (all auth methods: desktop app, token, new app)",
+          "Log in: interactive wizard, or a source (chrome, firefox)",
           (y2) => y2
+            .command(
+              "chrome",
+              "Import workspaces from Chrome, grouped by account (all platforms)",
+              (y3) => y3
+                .option("profile", { type: "string", alias: "p", describe: 'Chrome profile email or dir (e.g. "you@example.com" or "Profile 3")' }),
+              async (argv) => {
+                await cmdAuthLoginChrome({ ...(argv.profile !== undefined ? { profile: argv.profile } : {}) });
+              },
+            )
+            .command(
+              "firefox",
+              "Import the xoxd cookie from Firefox into a workspace",
+              (y3) => y3
+                .option("workspace", { type: "string", alias: "w", describe: "Workspace name to update (default: active)" }),
+              async (argv) => {
+                await cmdAuthFirefox({ ...(argv.workspace !== undefined ? { workspace: argv.workspace } : {}) });
+              },
+            )
             .option("token", { type: "string", describe: "Token to save directly (non-interactive)" })
             .option("name", { type: "string", describe: "Workspace name (used with --token)" })
             .option("yes", { type: "boolean", default: false, describe: "Allow reading browser profiles without a confirmation prompt" })
             .option("from-desktop", { type: "boolean", default: false, describe: "Import the Slack Desktop token without scanning a browser" })
             .option("from-chrome", { type: "boolean", default: false, describe: "Import the desktop token and Chrome cookie" })
             .option("from-firefox", { type: "boolean", default: false, describe: "Import the desktop token and Firefox cookie" })
-            .option("from-all", { type: "boolean", default: false, describe: "Import the desktop token and scan Chrome and Firefox" }),
+            .option("from-all", { type: "boolean", default: false, describe: "Import the desktop token and scan Chrome and Firefox" })
+            .command("$0", false as unknown as string, () => {}, async (argv) => {
+              await cmdAuthLogin({
+                ...(argv.token !== undefined ? { token: argv.token as string } : {}),
+                ...(argv.name !== undefined ? { name: argv.name as string } : {}),
+                yes: argv.yes as boolean,
+                fromDesktop: argv.fromDesktop as boolean,
+                fromChrome: argv.fromChrome as boolean,
+                fromFirefox: argv.fromFirefox as boolean,
+                fromAll: argv.fromAll as boolean,
+              });
+            }),
           async (argv) => {
             await cmdAuthLogin({
-              ...(argv.token !== undefined ? { token: argv.token } : {}),
-              ...(argv.name !== undefined ? { name: argv.name } : {}),
-              yes: argv.yes,
-              fromDesktop: argv.fromDesktop,
-              fromChrome: argv.fromChrome,
-              fromFirefox: argv.fromFirefox,
-              fromAll: argv.fromAll,
+              ...(argv.token !== undefined ? { token: argv.token as string } : {}),
+              ...(argv.name !== undefined ? { name: argv.name as string } : {}),
+              yes: argv.yes as boolean,
+              fromDesktop: argv.fromDesktop as boolean,
+              fromChrome: argv.fromChrome as boolean,
+              fromFirefox: argv.fromFirefox as boolean,
+              fromAll: argv.fromAll as boolean,
             });
           },
         )
@@ -4729,13 +4758,18 @@ async function main(): Promise<void> {
           },
         )
         .command(
-          ["chrome", "cookie"],
-          "Attach Chrome browser xoxd cookie to a workspace (macOS/Linux, interactive)",
+          ["cookie", "chrome"],
+          "Attach a Chrome xoxd cookie to a workspace (macOS/Linux/Windows). To import workspaces, use: slack auth login chrome",
           (y2) => y2
             .option("workspace", { type: "string", alias: "w", describe: "Workspace name to update (default: active)" })
+            .option("profile", { type: "string", alias: "p", describe: "Chrome profile email or dir (Windows, when several have a session)" })
             .option("yes", { type: "boolean", default: false, describe: "Allow reading browser profiles without a confirmation prompt" }),
           async (argv) => {
-            await cmdAuthChrome({ ...(argv.workspace !== undefined ? { workspace: argv.workspace } : {}), yes: argv.yes });
+            await cmdAuthChrome({
+              ...(argv.workspace !== undefined ? { workspace: argv.workspace } : {}),
+              ...(argv.profile !== undefined ? { profile: argv.profile } : {}),
+              yes: argv.yes as boolean,
+            });
           },
         )
         .command(

package/ts/leveldb.ts

@@ -0,0 +1,154 @@
+// Minimal read-only LevelDB SSTable (.ldb) reader + Snappy decompressor.
+//
+// Chrome/Electron store LocalStorage in LevelDB, and its .ldb (sorted table)
+// files keep data blocks Snappy-compressed, so a raw regex scan can't recover a
+// value that a Snappy copy-op split apart. This module decompresses the data
+// blocks and returns their concatenated bytes for scanning — it recovers record
+// VALUES only (enough to find "token":"xoxc-…"); it is not a general client and
+// does no key lookup, bloom/filter handling, or CRC verification.
+//
+// SSTable layout (github.com/google/leveldb/blob/main/doc/table_format.md):
+//   file = block* + metaindex_block + index_block + footer
+//   block = content-bytes + type(1) + crc32c(4)   (type 0 = raw, 1 = snappy)
+//   footer (last 48 bytes) = metaindex_handle + index_handle + pad + magic(8)
+//   BlockHandle = varint(offset) + varint(size)   (size excludes the 5-byte trailer)
+
+const FOOTER_LEN = 48;
+
+/** Read a LEB128 varint using float arithmetic so 64-bit offsets/sizes stay exact past 2^31. */
+function readVarint(buf: Buffer, pos: number): { value: number; pos: number } {
+  let value = 0;
+  let shift = 0;
+  let p = pos;
+  while (p < buf.length) {
+    const b = buf[p++]!;
+    value += (b & 0x7f) * 2 ** shift;
+    if ((b & 0x80) === 0) break;
+    shift += 7;
+  }
+  return { value, pos: p };
+}
+
+/** Decompress a Snappy block (raw format: varint uncompressed-length preamble, then tags). */
+export function snappyUncompress(input: Buffer): Buffer {
+  // Preamble: total uncompressed length.
+  let pos = 0;
+  let outLen = 0;
+  let shift = 0;
+  while (pos < input.length) {
+    const b = input[pos++]!;
+    outLen += (b & 0x7f) * 2 ** shift;
+    if ((b & 0x80) === 0) break;
+    shift += 7;
+  }
+
+  const out = Buffer.allocUnsafe(outLen);
+  let op = 0;
+  while (pos < input.length && op < outLen) {
+    const tag = input[pos++]!;
+    const type = tag & 0x3;
+    if (type === 0) {
+      // Literal: length-1 in the upper 6 bits, or in the following 1-4 bytes when >= 60.
+      let len = tag >> 2;
+      if (len >= 60) {
+        const extra = len - 59;
+        len = 0;
+        for (let i = 0; i < extra; i++) len += input[pos++]! * 2 ** (8 * i);
+      }
+      len += 1;
+      input.copy(out, op, pos, pos + len);
+      pos += len;
+      op += len;
+    } else {
+      // Copy: length + back-reference offset into the already-produced output.
+      let length: number;
+      let offset: number;
+      if (type === 1) {
+        length = 4 + ((tag >> 2) & 0x7);
+        offset = ((tag >> 5) & 0x7) * 256 + input[pos++]!;
+      } else if (type === 2) {
+        length = 1 + (tag >> 2);
+        offset = input[pos]! + input[pos + 1]! * 256;
+        pos += 2;
+      } else {
+        length = 1 + (tag >> 2);
+        offset = input[pos]! + input[pos + 1]! * 256 + input[pos + 2]! * 65536 + input[pos + 3]! * 16777216;
+        pos += 4;
+      }
+      let src = op - offset;
+      for (let i = 0; i < length && op < outLen; i++) out[op++] = out[src++]!;
+    }
+  }
+  return op === outLen ? out : out.subarray(0, op);
+}
+
+type BlockHandle = { offset: number; size: number };
+
+function decodeBlockHandle(buf: Buffer, pos: number): { handle: BlockHandle; pos: number } {
+  const off = readVarint(buf, pos);
+  const sz = readVarint(buf, off.pos);
+  return { handle: { offset: off.value, size: sz.value }, pos: sz.pos };
+}
+
+/** Read one block's content, decompressing when the trailer marks it Snappy (type 1). */
+function readBlockContent(file: Buffer, handle: BlockHandle): Buffer {
+  const { offset, size } = handle;
+  const raw = file.subarray(offset, offset + size);
+  const type = file[offset + size];
+  return type === 1 ? snappyUncompress(raw) : Buffer.from(raw);
+}
+
+/** Iterate a decompressed block's entries, yielding each value's bytes (keys reconstructed but unused here). */
+function blockValues(block: Buffer): Buffer[] {
+  if (block.length < 4) return [];
+  const numRestarts = block.readUInt32LE(block.length - 4);
+  const entriesEnd = block.length - (numRestarts + 1) * 4;
+  const values: Buffer[] = [];
+  let pos = 0;
+  let prevKey = Buffer.alloc(0);
+  while (pos < entriesEnd) {
+    const s = readVarint(block, pos);
+    const ns = readVarint(block, s.pos);
+    const vl = readVarint(block, ns.pos);
+    pos = vl.pos;
+    const shared = s.value;
+    const nonShared = ns.value;
+    const valueLen = vl.value;
+    const keyDelta = block.subarray(pos, pos + nonShared);
+    pos += nonShared;
+    const value = block.subarray(pos, pos + valueLen);
+    pos += valueLen;
+    prevKey = Buffer.concat([prevKey.subarray(0, shared), keyDelta]);
+    values.push(value);
+  }
+  return values;
+}
+
+/**
+ * Decompress every data block referenced by an SSTable's index and return their
+ * concatenated bytes. Record values survive intact (Slack stores a workspace's
+ * config as one JSON string value), so the result can be regex-scanned.
+ * Returns an empty buffer if the file isn't a parseable SSTable.
+ */
+export function ldbDecompressedBytes(file: Buffer): Buffer {
+  if (file.length < FOOTER_LEN) return Buffer.alloc(0);
+  try {
+    const footerStart = file.length - FOOTER_LEN;
+    const meta = decodeBlockHandle(file, footerStart);   // metaindex handle (skipped)
+    const index = decodeBlockHandle(file, meta.pos);     // index handle
+    const indexBlock = readBlockContent(file, index.handle);
+    const chunks: Buffer[] = [];
+    for (const handleBytes of blockValues(indexBlock)) {
+      // Each index entry's value is a BlockHandle pointing at a data block.
+      try {
+        const { handle } = decodeBlockHandle(handleBytes, 0);
+        chunks.push(readBlockContent(file, handle));
+      } catch {
+        // skip a malformed handle
+      }
+    }
+    return Buffer.concat(chunks);
+  } catch {
+    return Buffer.alloc(0);
+  }
+}

package/ts/profiles.ts

@@ -30,11 +30,19 @@ export type Profile = {
   teamId: string;
   url: string;
   user: string;
-  cookie?: string; // xoxd session cookie for internal APIs (drafts, etc.)
+  cookie?: string;   // xoxd session cookie for internal APIs (drafts, etc.)
+  identity?: string; // owning user identity (e.g. account email) — groups workspaces and shares one cookie
+};
+
+/** Per-identity auth shared across all that identity's workspaces. */
+export type UserAuth = {
+  cookie?: string; // xoxd session cookie (workspace-agnostic — one per browser/user)
+  source?: string; // where it came from, e.g. "chrome:Profile 3"
 };
 
 type ProfileStore = {
   profiles: Record<string, Profile>;
+  users?: Record<string, UserAuth>; // identity -> shared auth; cookie stored here once
 };
 
 function home(): string {
@@ -162,26 +170,66 @@ export function listProfiles(): { name: string; profile: Profile; current: boole
   const local = readLockfile(localLockfilePath());
   const global_ = readLockfile(globalLockfilePath());
   const current = local ?? global_;
-  return Object.entries(store.profiles).map(([name, profile]) => ({
-    name,
-    profile,
-    current: name === current,
-  }));
+  return Object.entries(store.profiles).map(([name, profile]) => {
+    // Surface the effective cookie (own, else the identity's shared one) so
+    // callers reading profile.cookie keep working after cookie hoisting.
+    const cookie = cookieFor(store, name);
+    return {
+      name,
+      profile: { ...profile, ...(cookie ? { cookie } : {}) },
+      current: name === current,
+    };
+  });
 }
 
 export function addProfile(name: string, profile: Profile): void {
   const store = load();
-  store.profiles[name] = profile;
+  // When the profile belongs to an identity, store its cookie once at the
+  // identity level (workspace-agnostic) rather than duplicating it per workspace.
+  if (profile.identity && profile.cookie) {
+    store.users ??= {};
+    const prev = store.users[profile.identity] ?? {};
+    store.users[profile.identity] = { ...prev, cookie: profile.cookie };
+    const { cookie: _drop, ...rest } = profile;
+    store.profiles[name] = rest;
+  } else {
+    store.profiles[name] = profile;
+  }
   save(store);
 }
 
 export function setCookie(name: string, cookie: string): void {
   const store = load();
-  if (!(name in store.profiles)) throw new Error(`Profile not found: ${name}`);
-  store.profiles[name]!.cookie = cookie;
+  const profile = store.profiles[name];
+  if (!profile) throw new Error(`Profile not found: ${name}`);
+  // Route through the identity's shared cookie when the workspace has one.
+  if (profile.identity) {
+    store.users ??= {};
+    store.users[profile.identity] = { ...(store.users[profile.identity] ?? {}), cookie };
+  } else {
+    profile.cookie = cookie;
+  }
   save(store);
 }
 
+/** Store (or refresh) the shared xoxd cookie for an identity — every workspace under it picks it up. */
+export function setUserCookie(identity: string, cookie: string, source?: string): void {
+  const store = load();
+  store.users ??= {};
+  store.users[identity] = { ...(store.users[identity] ?? {}), cookie, ...(source ? { source } : {}) };
+  save(store);
+}
+
+/** Resolve the effective xoxd cookie for a workspace: its own, else its identity's shared one. */
+function cookieFor(store: ProfileStore, name: string | undefined): string | undefined {
+  if (!name) return undefined;
+  const profile = store.profiles[name];
+  if (!profile) return undefined;
+  if (profile.cookie) return profile.cookie;
+  if (profile.identity) return store.users?.[profile.identity]?.cookie;
+  return undefined;
+}
+
 export function removeProfile(name: string): void {
   const store = load();
   if (!(name in store.profiles)) throw new Error(`Profile not found: ${name}`);
@@ -220,10 +268,16 @@ export function resolveToken(workspaceFlag?: string): string {
   // Bot tokens in shell env or .env files must not shadow workspace profiles.
   const legacyEnvToken = process.env.SLACK_BOT_TOKEN ?? process.env.SLACK_MCP_XOXP_TOKEN;
   if (legacyEnvToken && names.length === 0) return legacyEnvToken;
-  if (legacyEnvToken && names.length > 0) {
+  // A bot token (xoxb-) belongs in SLACK_BOT_TOKEN: it is how `slack ask` / --as-bot send, and
+  // ~/.config/slack-cli/.env is its documented home. It never stands in for the user token, so it is
+  // no conflict; warn only about a *user* token parked in the legacy variables.
+  const legacyUserToken = [process.env.SLACK_BOT_TOKEN, process.env.SLACK_MCP_XOXP_TOKEN].find(
+    (t) => t && !t.startsWith("xoxb-"),
+  );
+  if (legacyUserToken && names.length > 0) {
     // Warn only when the token differs from what's in .env.local (same value = not a real conflict)
     const envFileToken = walkDirEnv(process.cwd(), ["SLACK_BOT_TOKEN", "SLACK_MCP_XOXP_TOKEN"]);
-    if (legacyEnvToken !== envFileToken) {
+    if (legacyUserToken !== envFileToken) {
       if (!(globalThis as Record<string, unknown>).__slackEnvWarnShown) {
         (globalThis as Record<string, unknown>).__slackEnvWarnShown = true;
         console.error(
@@ -274,11 +328,11 @@ export function resolveToken(workspaceFlag?: string): string {
   throw new Error(
     "No Slack token found.\n" +
     "  Run one of:\n" +
-    "    slack auth login    — interactive wizard (desktop session, token, or new app)\n" +
-    "    slack auth token    — print the active token, or save one with --token\n" +
-    "    slack auth chrome   — import the xoxd cookie from Chrome (macOS/Linux)\n" +
-    "    slack auth firefox  — import the xoxd cookie from Firefox (all platforms)\n" +
-    "    slack auth app      — guided Slack app creation\n" +
+    "    slack auth login          — interactive wizard (desktop / browser / token / new app)\n" +
+    "    slack auth login chrome   — import workspaces from Chrome (all platforms)\n" +
+    "    slack auth cookie         — attach the xoxd cookie from Chrome (macOS/Windows)\n" +
+    "    slack auth firefox        — attach the xoxd cookie from Firefox (all platforms)\n" +
+    "    slack auth token --token xoxp-...   — paste an existing token\n" +
     "  Or set SLACK_TOKEN=xoxp-... in .slack-term/.env.local",
   );
 }
@@ -300,7 +354,7 @@ export function resolveCookie(workspaceFlag?: string): string | undefined {
   const profiles = store.profiles;
 
   // --workspace flag: skip env-file walk, go straight to profiles.json
-  if (workspaceFlag) return profiles[workspaceFlag]?.cookie;
+  if (workspaceFlag) return cookieFor(store, workspaceFlag);
 
   // process.env: SLACK_COOKIE (official extension), legacy SLACK_MCP_XOXD_COOKIE
   if (process.env.SLACK_COOKIE) return process.env.SLACK_COOKIE;
@@ -318,13 +372,13 @@ export function resolveCookie(workspaceFlag?: string): string | undefined {
 
   // profiles.json via SLACK_WORKSPACE env var or lockfiles
   const selected = process.env.SLACK_WORKSPACE;
-  if (selected) return profiles[selected]?.cookie;
+  if (selected) return cookieFor(store, selected);
 
   const localName = readLockfile(localLockfilePath());
-  if (localName) return profiles[localName]?.cookie;
+  if (localName) return cookieFor(store, localName);
 
   const globalName = readLockfile(globalLockfilePath());
-  if (globalName) return profiles[globalName]?.cookie;
+  if (globalName) return cookieFor(store, globalName);
 
   return undefined;
 }

package/ts/slack-app.ts

@@ -7,6 +7,7 @@ import { homedir, tmpdir } from "node:os";
 import { join, dirname } from "node:path";
 import { pbkdf2Sync, createDecipheriv, createHash, timingSafeEqual } from "node:crypto";
 import { execSync, execFileSync } from "node:child_process";
+import { ldbDecompressedBytes } from "./leveldb.ts";
 
 export type SlackAppSession = {
   token: string;   // xoxc-...
@@ -95,88 +96,61 @@ export function extractXoxd(): string | undefined {
   }
 }
 
-// Scan raw LevelDB files for xoxc- tokens without opening the DB exclusively.
-// Works while Slack is running.
-//
-// Strategy:
-//  1. .log files (write-ahead log): values are stored as readable JSON strings.
-//     Scan for "token":"xoxc-..." to get complete, clean tokens + workspace URL.
-//  2. .ldb files (sorted tables): values are length-prefixed with binary framing
-//     bytes that can split the token mid-segment. Use gap-bridging as fallback.
-export async function extractSessions(leveldbOverride?: string): Promise<SlackAppSession[]> {
-  const dbPath = leveldbOverride ?? leveldbPaths().find(existsSync);
-  if (!dbPath) {
-    throw new Error(
-      `Slack desktop app LevelDB not found at:\n  ${leveldbPaths().join("\n  ")}\nIs Slack installed and opened at least once?`,
-    );
-  }
+// Scan a LevelDB directory for xoxc- tokens without opening the DB exclusively
+// (works while the owning app is running). Reads the raw .log/.ldb files, then
+// pulls "token":"xoxc-…" plus nearby workspace url/name out of the values. .ldb
+// data blocks are Snappy-compressed, so they are decompressed first.
+function scanLevelDbSessions(dbPath: string): SlackAppSession[] {
+  if (!existsSync(dbPath)) return [];
 
   const files = readdirSync(dbPath).filter((f) => f.endsWith(".ldb") || f.endsWith(".log"));
-  if (files.length === 0) throw new Error(`No LevelDB data files found in ${dbPath}`);
-
-  const sessions = new Map<string, SlackAppSession>();
-
-  for (const file of files) {
-    let content: string;
+  if (files.length === 0) return [];
+
+  // Readable text per file: .ldb data blocks are Snappy-compressed (a copy-op can
+  // split "token":"xoxc-…" apart), so decompress them; .log (write-ahead log) values
+  // are already plaintext JSON. Memoized — both passes below reuse it.
+  const textCache = new Map<string, string>();
+  const fileText = (file: string): string => {
+    const cached = textCache.get(file);
+    if (cached !== undefined) return cached;
+    let text = "";
     try {
-      content = readFileSync(join(dbPath, file), "latin1");
+      const raw = readFileSync(join(dbPath, file));
+      text = file.endsWith(".ldb")
+        ? (ldbDecompressedBytes(raw).toString("latin1") || raw.toString("latin1"))
+        : raw.toString("latin1");
     } catch {
-      continue;
+      text = "";
     }
+    textCache.set(file, text);
+    return text;
+  };
 
-    if (file.endsWith(".log")) {
-      // .log files store JSON values verbatim — extract complete token + URL + name in one pass.
-      for (const m of content.matchAll(/"token":"(xoxc-[^"]+)"/g)) {
-        const token = m[1]!;
-        const teamId = token.split("-")[1] ?? "";
-        if (!teamId || token.length < 40) continue;
-
-        // Look for workspace metadata near this token (within ±2KB)
-        const start = Math.max(0, m.index! - 2000);
-        const end = Math.min(content.length, m.index! + 2000);
-        const ctx = content.slice(start, end);
-        const urlMatch = ctx.match(/"url":"(https:\/\/[a-z0-9-]+\.slack\.com\/)"/);
-        const nameMatch = ctx.match(/"(?:team_name|name)":"([^"]{2,60})"/);
-
-        const existing = sessions.get(teamId);
-        if (!existing || token.length > existing.token.length) {
-          const entry: SlackAppSession = { token, teamId };
-          const url = urlMatch?.[1] ?? existing?.url;
-          const teamName = nameMatch?.[1] ?? existing?.teamName;
-          if (url) entry.url = url;
-          if (teamName) entry.teamName = teamName;
-          sessions.set(teamId, entry);
-        }
-      }
-    } else {
-      // .ldb files: binary framing bytes split the token mid-segment.
-      // Match the first 3 numeric segments, then bridge over binary bytes to find the rest.
-      for (const m of content.matchAll(/xoxc-(\d+)-(\d+)-(\d+)/g)) {
-        const teamId = m[1]!;
-        // Skip if already found in a .log file (prefer clean .log data)
-        if (sessions.has(teamId)) continue;
-
-        let i = m.index! + m[0].length;
-        const limit = Math.min(i + 10, content.length);
-        while (i < limit && (content.charCodeAt(i) < 0x30 || content.charCodeAt(i) > 0x39)) i++;
-
-        let seg3tail = "";
-        while (i < content.length && content.charCodeAt(i) >= 0x30 && content.charCodeAt(i) <= 0x39) {
-          seg3tail += content[i++];
-        }
-        if (content[i] !== "-") continue;
-        i++;
-        let hex = "";
-        while (i < content.length) {
-          const code = content.charCodeAt(i);
-          if ((code >= 0x30 && code <= 0x39) || (code >= 0x61 && code <= 0x66)) {
-            hex += content[i++];
-          } else break;
-        }
-        if (hex.length < 20) continue;
+  const sessions = new Map<string, SlackAppSession>();
+
+  for (const file of files) {
+    const content = fileText(file);
+    // Values are verbatim JSON (after decompression) — extract token + URL + name in one pass.
+    for (const m of content.matchAll(/"token":"(xoxc-[^"]+)"/g)) {
+      const token = m[1]!;
+      const teamId = token.split("-")[1] ?? "";
+      if (!teamId || token.length < 40) continue;
+
+      // Look for workspace metadata near this token (within ±2KB)
+      const start = Math.max(0, m.index! - 2000);
+      const end = Math.min(content.length, m.index! + 2000);
+      const ctx = content.slice(start, end);
+      const urlMatch = ctx.match(/"url":"(https:\/\/[a-z0-9-]+\.slack\.com\/)"/);
+      const nameMatch = ctx.match(/"(?:team_name|name)":"([^"]{2,60})"/);
 
-        const token = `${m[0]}${seg3tail}-${hex}`;
-        sessions.set(teamId, { token, teamId });
+      const existing = sessions.get(teamId);
+      if (!existing || token.length > existing.token.length) {
+        const entry: SlackAppSession = { token, teamId };
+        const url = urlMatch?.[1] ?? existing?.url;
+        const teamName = nameMatch?.[1] ?? existing?.teamName;
+        if (url) entry.url = url;
+        if (teamName) entry.teamName = teamName;
+        sessions.set(teamId, entry);
       }
     }
   }
@@ -184,17 +158,7 @@ export async function extractSessions(leveldbOverride?: string): Promise<SlackAp
   // Second pass: for sessions still missing a name, search all file content
   // (printable-transformed) for team_name/name near the numeric team ID, then
   // fall back to a title-cased URL slug.
-  const allFiles = readdirSync(dbPath).filter((f) => f.endsWith(".ldb") || f.endsWith(".log"));
-  const allContent = allFiles
-    .map((f) => {
-      try {
-        // Replace non-printable bytes with spaces to expose readable text in binary ldb frames.
-        return readFileSync(join(dbPath, f), "latin1").replace(/[^\x20-\x7e]/g, " ");
-      } catch {
-        return "";
-      }
-    })
-    .join(" ");
+  const allContent = files.map((f) => fileText(f).replace(/[^\x20-\x7e]/g, " ")).join(" ");
 
   for (const session of sessions.values()) {
     if (session.teamName) continue;
@@ -237,15 +201,75 @@ export async function extractSessions(leveldbOverride?: string): Promise<SlackAp
     }
   }
 
+  return [...sessions.values()];
+}
+
+/**
+ * Import sessions from a LevelDB store. Defaults to the Slack desktop app (all
+ * platforms for the xoxc token; the shared xoxd cookie is attached on macOS only).
+ * `leveldbOverride` points it at another store (e.g. a Chrome profile's LocalStorage,
+ * used by extractChromeSessions) — no desktop xoxd cookie is attached in that case.
+ * .ldb data blocks are Snappy-compressed, so scanLevelDbSessions decompresses them.
+ */
+export async function extractSessions(leveldbOverride?: string): Promise<SlackAppSession[]> {
+  const dbPath = leveldbOverride ?? leveldbPaths().find(existsSync);
+  if (!dbPath) {
+    throw new Error(
+      `Slack desktop app LevelDB not found at:\n  ${leveldbPaths().join("\n  ")}\nIs Slack installed and opened at least once?`,
+    );
+  }
+  const result = scanLevelDbSessions(dbPath);
   // Attach xoxd cookie to all sessions (shared — one Slack desktop app, one cookie jar)
   const xoxd = leveldbOverride ? undefined : extractXoxd();
-  const result = [...sessions.values()];
   if (xoxd) {
     for (const s of result) s.cookie = xoxd;
   }
   return result;
 }
 
+/** Account email for a Chrome profile from Local State → info_cache (never the gaia real name). */
+function chromeProfileEmail(userDataDir: string, profileDir: string): string | undefined {
+  try {
+    const localState = JSON.parse(
+      readFileSync(join(userDataDir, "Local State"), "utf8"),
+    ) as { profile?: { info_cache?: Record<string, { user_name?: string }> } };
+    const email = localState.profile?.info_cache?.[profileDir]?.user_name;
+    return email || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export type ChromeSessionProfile = {
+  profileDir: string;         // "Default", "Profile 3", …
+  email?: string;             // account email from Local State, if known
+  label: string;              // display name (nickname + email)
+  sessions: SlackAppSession[]; // xoxc tokens found in this profile's LocalStorage (no cookie)
+};
+
+/**
+ * Discover Slack web sessions in Chrome by scanning each profile's LocalStorage
+ * LevelDB for xoxc- tokens. LocalStorage is plaintext, so this works on all
+ * platforms and needs no keychain/DPAPI access — it yields tokens only. The
+ * xoxd cookie is fetched separately (macOS at-rest via discoverChromeCookies,
+ * or a live CDP read on other platforms).
+ */
+export function discoverChromeSessions(): ChromeSessionProfile[] {
+  const userDataDir = chromeUserDataDir();
+  if (!userDataDir || !existsSync(userDataDir)) return [];
+
+  const profileDirs = ["Default", ...readdirSync(userDataDir).filter((d) => d.startsWith("Profile "))];
+  const out: ChromeSessionProfile[] = [];
+  for (const profileDir of profileDirs) {
+    const dbPath = join(userDataDir, profileDir, "Local Storage", "leveldb");
+    const sessions = scanLevelDbSessions(dbPath);
+    if (sessions.length === 0) continue;
+    const email = chromeProfileEmail(userDataDir, profileDir);
+    out.push({ profileDir, ...(email ? { email } : {}), label: chromeProfileName(userDataDir, profileDir), sessions });
+  }
+  return out;
+}
+
 /**
  * Try both AES-128-CBC layouts for a versioned Chromium cookie.
  * Returns the decrypted string if it starts with "xoxd-", otherwise undefined.