slack-term 1.41.0 → 1.41.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "slack-term",
-  "version": "1.41.0",
+  "version": "1.41.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/snomiao/slack-term.git"

package/ts/botIntent.ts

@@ -0,0 +1,68 @@
+// Refuse to act as the USER when the caller clearly meant the BOT.
+//
+// SLACK_BOT_TOKEN is only ever used by `--as-bot`: its documented home is the
+// global ~/.config/slack-cli/.env, where it sits for `slack ask` and friends,
+// and it must not turn every post into a bot post. But a lane that EXPORTS it
+// (or puts it in its project's .env) without SLACK_TOKEN is saying "I am the
+// bot" — and without --as-bot every write still went out under the logged-in
+// person's session, silently (reported 2026-10-26: a lane posted a pinlog as
+// the user). In that case writes are refused until the caller picks a side.
+
+/** Write commands, as `argv._` spells them (aliases included). Read-only
+ *  commands are never refused — reading as the user impersonates no one. */
+const WRITES = new Set([
+  "send", "ask", "poll", "vote", "edit", "delete", "react", "upload",
+  "schedule send", "schedule rm",
+  "pinlog new", "pinlog set", "pinlog note", "pinlog pin",
+  "todo set", "todo flag",
+  "lists create", "lists add", "lists set", "lists share",
+  "drafts new", "drafts save", "drafts edit", "drafts update", "drafts delete", "drafts rm",
+  "channel create", "channel new", "channel rename", "channel mv",
+]);
+
+/** `argv._` holds what was TYPED, so top-level aliases must be folded first. */
+const TOP_ALIAS: Record<string, string> = { channels: "channel", ch: "channel" };
+
+export function isWriteCommand(path: (string | number)[]): boolean {
+  const [raw = "", b = ""] = path.map(String);
+  const a = TOP_ALIAS[raw] ?? raw;
+  return WRITES.has(a) || WRITES.has(`${a} ${b}`);
+}
+
+/** Read-only modes of a write command. `ask --ls` only reads the local
+ *  sent-log and the questions' live state. (`ask --waitFor` and
+ *  `poll --results` are NOT here: both can edit the posted message.) */
+function isReadMode(path: (string | number)[], argv: Record<string, unknown>): boolean {
+  return String(path[0] ?? "") === "ask" && argv.ls === true;
+}
+
+export type BotIntent = {
+  /** Where SLACK_BOT_TOKEN (an xoxb-) came from: "shell", a dotenv path, or undefined when unset. */
+  botTokenSource: string | undefined;
+  /** dotenv paths that are the bot token's GLOBAL home — not a statement of intent. */
+  globalPaths: string[];
+  slackTokenSet: boolean;
+  /** The token this command would act with is itself the bot token (no profiles). */
+  activeTokenIsBot: boolean;
+};
+
+/** A refusal message, or null when the write may proceed. */
+export function botIntentRefusal(
+  cmd: (string | number)[],
+  argv: Record<string, unknown>,
+  intent: BotIntent,
+): string | null {
+  const src = intent.botTokenSource;
+  if (!src || intent.globalPaths.includes(src)) return null;
+  if (intent.slackTokenSet || intent.activeTokenIsBot) return null;
+  if (!isWriteCommand(cmd) || isReadMode(cmd, argv) || argv["as-bot"] === true) return null;
+  const from = src === "shell" ? "exported in the environment" : `set in ${src}`;
+  const canBot = "as-bot" in argv;
+  return [
+    `Error: refusing to act as YOU — SLACK_BOT_TOKEN is ${from}, but \`${cmd.slice(0, 2).join(" ")}\` would use your user session, not the bot.`,
+    canBot
+      ? "  As the app:   add --as-bot"
+      : "  This command has no --as-bot: it can only act as a user.",
+    "  As yourself:  set SLACK_TOKEN, or clear the bot token for this run (SLACK_BOT_TOKEN= slack ...)",
+  ].join("\n");
+}

package/ts/cli.ts

@@ -130,11 +130,21 @@ import {
 import { setCacheEnabled } from "./cache.ts";
 import { escapeArg, unescapeArg } from "./escapes.ts";
 import { attachmentLines, parseAttachments } from "./attachments.ts";
+import { botIntentRefusal } from "./botIntent.ts";
 import { dayLabel, encodeMentions, encodeMentionsDetailed, findUntaggedMentions, formatYmdHm, maskSecrets, mentionWarnings, resolveDateMarkup, resolveMentions, type MentionEncodeResult } from "./format.ts";
 import { quietHoursNotice } from "./quietHours.ts";
 import { installSyncConsole } from "./stdout.ts";
 import { LockBusyError, PINLOG_MARKER, acquireLock, composeHead, formatJst, headUpdatedAt, isPinlogHead, parsePinlogId, pinlogId, stripPinlogFooter } from "./pinlog.ts";
 
+// Which dotenv file supplied each variable (absent = the shell's own env).
+const dotenvSource = new Map<string, string>();
+// Every value a GLOBAL dotenv holds, even when the shell already had the key.
+// A child of `slack agent` (or any process the CLI spawned) inherits the
+// global SLACK_BOT_TOKEN as a plain env var; matching it back to its global
+// file keeps that inherited copy from reading as an explicit export.
+const globalDotenvValue = new Map<string, { path: string; val: string }[]>();
+const GLOBAL_DOTENVS = [join(homedir(), ".slack-cli", ".env.local"), join(homedir(), ".config/slack-cli", ".env")];
+
 function loadDotenv(path: string): void {
   if (!existsSync(path)) return;
   const text = readFileSync(path, "utf8");
@@ -148,7 +158,13 @@ function loadDotenv(path: string): void {
     if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) {
       val = val.slice(1, -1);
     }
-    if (!(key in process.env)) process.env[key] = val;
+    if (GLOBAL_DOTENVS.includes(path)) {
+      globalDotenvValue.set(key, [...(globalDotenvValue.get(key) ?? []), { path, val }]);
+    }
+    if (!(key in process.env)) {
+      process.env[key] = val;
+      dotenvSource.set(key, path);
+    }
   }
 }
 
@@ -160,8 +176,7 @@ function ensureSlackCliDir(dir: string): void {
 
 function loadDotenvFiles(): void {
   // Global home config
-  loadDotenv(join(homedir(), ".slack-cli", ".env.local"));
-  loadDotenv(join(homedir(), ".config/slack-cli", ".env"));
+  for (const p of GLOBAL_DOTENVS) loadDotenv(p);
   // Local project overrides (highest priority — loaded last so they win)
   loadDotenv(join(process.cwd(), ".slack-cli", ".env.local"));
   loadDotenv(join(process.cwd(), ".env.local"));
@@ -4965,7 +4980,22 @@ async function main(): Promise<void> {
       // `sent` reads only the local log — no token, no network.
       if (!cmd || cmd === "auth" || cmd === "login" || cmd === "agent" || cmd === "sent") return;
       try {
-        resolveToken((argv as W).workspace);
+        const active = resolveToken((argv as W).workspace);
+        const bot = resolveBotToken();
+        const refusal = botIntentRefusal(argv._ ?? [], argv as Record<string, unknown>, {
+          botTokenSource: bot
+            ? dotenvSource.get("SLACK_BOT_TOKEN")
+              ?? globalDotenvValue.get("SLACK_BOT_TOKEN")?.find((g) => g.val === bot)?.path
+              ?? "shell"
+            : undefined,
+          globalPaths: GLOBAL_DOTENVS,
+          slackTokenSet: !!process.env.SLACK_TOKEN,
+          activeTokenIsBot: !!bot && active === bot,
+        });
+        if (refusal) {
+          console.error(refusal);
+          process.exit(2);
+        }
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
         if (msg.startsWith("No profiles configured")) {