slack-term 1.49.0 → 1.50.0

package/ts/identity.ts

@@ -0,0 +1,152 @@
+// `slack @<who> <command> …` — name the identity a command acts as (11-02):
+// a bot (`@deploy-bot`, `@ops-bot`) or a person (`@alice`). Replaces --as-bot /
+// --as-user and env-file juggling. The names map to WHERE a token lives (an
+// env var, optionally in an env file, or a slack-term profile) — never to the
+// token itself, which stays in the env/vault:
+//
+//   identities:                       # .slack-term/settings.yml or ~/.config/slack-term/settings.yml
+//     deploy-bot: { kind: bot,  env_file: ~/.config/slack-cli/deploy-bot.env }   # SLACK_BOT_TOKEN in it
+//     ops-bot:    { kind: bot,  env_file: ~/.config/slack-cli/ops-bot.env }
+//     alice:      { kind: user, profile: acme }                                # slack auth profile
+//
+// And the trap it closes (11-02: an agent's `slack ask` without --as-bot was
+// posted AS a person): a write that would go out as a person's session is refused
+// from inside an agent, or when several identities exist, unless it names one.
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { findScope, globalScopeDir, readSettingsFile, type Scope } from "./scope.ts";
+
+export type Identity = {
+  kind: "bot" | "user";
+  /** The env var holding the token (default SLACK_BOT_TOKEN for a bot, SLACK_TOKEN for a user). */
+  env?: string;
+  /** An env file to read that var from; else the process environment. */
+  env_file?: string;
+  /** A user: a slack-term workspace profile (`slack auth ls`). */
+  profile?: string;
+};
+
+const WHO_RE = /^@([a-z0-9][a-z0-9._-]{0,63})$/;
+
+/** `@who` as the first argument: its name and the arguments after it. */
+export function splitWho(args: string[]): { who?: string; rest: string[] } {
+  const m = WHO_RE.exec(args[0] ?? "");
+  return m ? { who: m[1]!, rest: args.slice(1) } : { rest: args };
+}
+
+function asIdentity(v: unknown): Identity | undefined {
+  const o = v as Partial<Identity> | null;
+  if (!o || typeof o !== "object" || (o.kind !== "bot" && o.kind !== "user")) return undefined;
+  const id: Identity = { kind: o.kind };
+  if (typeof o.env === "string" && /^[A-Z_][A-Z0-9_]*$/.test(o.env)) id.env = o.env;
+  if (typeof o.env_file === "string") id.env_file = o.env_file;
+  if (typeof o.profile === "string") id.profile = o.profile;
+  return id;
+}
+
+/** Identities from the nearest scope (settings.yml, then settings.local.yml
+ *  unless restricted), then the global one; nearer wins. */
+export function listIdentities(cwd = process.cwd()): Map<string, Identity> {
+  const near = findScope(cwd);
+  const scopes: Scope[] = near.global ? [near] : [{ dir: globalScopeDir(), global: true }, near];
+  const out = new Map<string, Identity>();
+  for (const s of scopes) {
+    const base = readSettingsFile(join(s.dir, "settings.yml"));
+    const files = base.restrict_to_subscriptions ? ["settings.yml"] : ["settings.yml", "settings.local.yml"];
+    for (const f of files) {
+      let raw: unknown;
+      try {
+        raw = Bun.YAML.parse(readFileSync(join(s.dir, f), "utf8"));
+      } catch { continue; }
+      const ids = (raw as { identities?: Record<string, unknown> } | null)?.identities;
+      if (!ids || typeof ids !== "object") continue;
+      for (const [name, v] of Object.entries(ids)) {
+        const id = asIdentity(v);
+        if (id && WHO_RE.test(`@${name}`)) out.set(name, id);
+      }
+    }
+  }
+  return out;
+}
+
+/** KEY=value lines (quotes stripped); `export ` prefixes allowed. */
+function readEnvFile(path: string): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const line of readFileSync(path.replace(/^~(?=\/|$)/, homedir()), "utf8").split("\n")) {
+    const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$/.exec(line);
+    if (!m) continue;
+    let v = m[2]!;
+    if (/^(["']).*\1$/.test(v)) v = v.slice(1, -1);
+    out[m[1]!] = v;
+  }
+  return out;
+}
+
+/** Point this process at identity `who`: the token goes into the env the
+ *  rest of the CLI already reads (never printed). Returns its kind, or an
+ *  error naming the known identities. */
+export function applyIdentity(who: string, env: NodeJS.ProcessEnv = process.env, ids = listIdentities()): { kind: "bot" | "user" } | { error: string } {
+  const id = ids.get(who);
+  const known = [...ids.keys()].sort().map((n) => `@${n}`).join(", ") || "(none: add `identities:` to .slack-term/settings.yml)";
+  if (!id) return { error: `unknown identity @${who}. Known: ${known}` };
+  if (id.kind === "user" && id.profile && !id.env && !id.env_file) {
+    env.SLACK_WORKSPACE = id.profile;
+    delete env.SLACK_TOKEN;
+    delete env.SLACK_BOT_TOKEN;
+    env.SLACK_TERM_IDENTITY = who;
+    return { kind: "user" };
+  }
+  const name = id.env ?? (id.kind === "bot" ? "SLACK_BOT_TOKEN" : "SLACK_TOKEN");
+  let token: string | undefined;
+  try {
+    token = id.env_file ? readEnvFile(id.env_file)[name] : env[name];
+  } catch {
+    return { error: `@${who}: cannot read ${id.env_file}` };
+  }
+  if (!token) return { error: `@${who}: no ${name}${id.env_file ? ` in ${id.env_file}` : " in the environment"}` };
+  if (id.kind === "bot" && !token.startsWith("xoxb-")) return { error: `@${who} is a bot, but ${name} is not a bot token (xoxb-)` };
+  if (id.kind === "user" && token.startsWith("xoxb-")) return { error: `@${who} is a user, but ${name} holds a bot token` };
+  if (id.kind === "bot") {
+    env.SLACK_BOT_TOKEN = token;
+    env.SLACK_TOKEN = token; // reads, too, go out as the bot
+  } else {
+    env.SLACK_TOKEN = token;
+    delete env.SLACK_BOT_TOKEN;
+  }
+  env.SLACK_TERM_IDENTITY = who;
+  return { kind: id.kind };
+}
+
+/** Set when this process runs inside an agent (ay, Claude Code, …). */
+export function inAgent(env: NodeJS.ProcessEnv = process.env): string | undefined {
+  return ["AY_AGENT_ID", "AGENT_YES_PID", "CLAUDECODE"].find((k) => env[k]);
+}
+
+/** Why a write that would post as a PERSON's session is refused, or null.
+ *  Allowed when it names an identity (`@who`), says --as-bot or --as-user, or
+ *  the active token is a bot's anyway. */
+export function userSessionRefusal(o: {
+  isWrite: boolean; who?: string | undefined; asBot: boolean; asUser: boolean; activeIsBot: boolean;
+  agent?: string | undefined; identities: string[]; cmd: string;
+}): string | null {
+  if (!o.isWrite || o.who || o.asBot || o.asUser || o.activeIsBot) return null;
+  const names = o.identities.map((n) => `@${n}`).join(" | ");
+  const pick = names ? `  Name who acts:   slack ${o.identities[0] ? `@${o.identities[0]}` : "@<who>"} ${o.cmd} …   (${names})` : "  Add identities to .slack-term/settings.yml, then: slack @<who> " + o.cmd + " …";
+  if (o.agent) {
+    return [
+      `Error: refusing to post as the user session from inside an agent (${o.agent} is set): \`${o.cmd}\` would go out as a PERSON.`,
+      pick,
+      "  As the app:      add --as-bot",
+      "  As the person, on purpose:  add --as-user",
+    ].join("\n");
+  }
+  if (o.identities.length >= 2) {
+    return [
+      `Error: several identities are configured (${names}): name the one \`${o.cmd}\` acts as.`,
+      pick,
+      "  Or: --as-bot / --as-user",
+    ].join("\n");
+  }
+  return null;
+}

package/ts/relay.ts

@@ -18,6 +18,10 @@ export type Doorbell = {
   channel: string; ts: string; thread_ts?: string;
   /** The relay app's bot user id, on that bot's own posts only. */
   self?: string;
+  /** A reaction_added on the message at channel/ts (relays from 11-02 on). */
+  kind?: "reaction";
+  /** Who reacted (reaction bells only). */
+  user?: string;
 };
 
 /** First frame of every connection. `seq` is the resume point the relay

package/ts/relayInit.ts

@@ -95,7 +95,8 @@ export function nextSteps(name: string, token?: string): string {
 4. In the Slack app -> Event Subscriptions: Enable Events, Request URL
      https://${name}.<your-subdomain>.workers.dev/slack/events
    and subscribe to bot events: message.channels, message.groups, message.im,
-   app_mention (and message.mpim if the bot has mpim:history). Save; reinstall if asked.
+   app_mention (and message.mpim if the bot has mpim:history; reaction_added,
+   with reactions:read, for \`slack stream --reactions\`). Save; reinstall if asked.
 5. Where \`slack stream\` runs:
      export SLACK_RELAY_URL=https://${name}.<your-subdomain>.workers.dev
      export SLACK_RELAY_TOKEN=${tok}

package/ts/sentlog.ts

@@ -290,7 +290,7 @@ export function recordSent(r: RecordSent): boolean {
   if (!attributionEnabled()) return false;
   const db = openSentLog();
   if (!db) {
-    console.error(`  (送信ログに記録できませんでした: ${SENT_LOG_UNAVAILABLE} — ${sentDbPath()})`);
+    console.error(`  (could not record to the sent log: ${SENT_LOG_UNAVAILABLE} — ${sentDbPath()})`);
     return false;
   }
   try {
@@ -305,7 +305,7 @@ export function recordSent(r: RecordSent): boolean {
     );
     return true;
   } catch (e: unknown) {
-    console.error(`  (送信ログに記録できませんでした: ${e instanceof Error ? e.message : String(e)})`);
+    console.error(`  (could not record to the sent log: ${e instanceof Error ? e.message : String(e)})`);
     return false;
   } finally {
     try { db.close(); } catch { /* ignore */ }
@@ -330,7 +330,7 @@ export interface SentQuery {
  *  needs bun or node ≥ 22.5 (`node:sqlite`). Surfaced by `slack sent`, which
  *  must not answer "no matches" when the truth is "no log". */
 export const SENT_LOG_UNAVAILABLE =
-  "送信ログを開けません: SQLite が使えないランタイムです (bun、または node >= 22.5 の node:sqlite が必要)";
+  "cannot open the sent log: this runtime has no SQLite (needs bun, or node >= 22.5 for node:sqlite)";
 
 /** Newest first, or `undefined` when the log cannot be opened at all. */
 export function querySent(q: SentQuery): SentRow[] | undefined {

package/ts/stream.ts

@@ -136,6 +136,10 @@ export type StreamOpts = {
   selfUsers: Set<string>;
   selfBots: Set<string>;
   json: boolean;
+  /** Print reaction bells (`slack stream --reactions`): {type: "reaction",
+   *  channel, ts, user} — the emoji itself is read with reactions.get by
+   *  whoever needs it. Without it they are dropped unread. */
+  reactions?: boolean;
   /** Also called with every emitted match and its attachment count (`slack stream --inbox`). */
   onMatch?: (rec: StreamMatch, files: number) => void;
   once: boolean;
@@ -822,6 +826,14 @@ export async function runStream(client: StreamClient, opts: StreamOpts): Promise
     /** true = resolved (emitted, or nothing to emit); false = not visible yet. */
     const handleBell = async (bell: Doorbell): Promise<boolean> => {
       if (opts.channels && !opts.channels.includes(bell.channel)) return true;
+      // A reaction bell never costs a message read: printed as it is, or dropped.
+      if (bell.kind === "reaction") {
+        if (!opts.reactions || (bell.self && opts.selfUsers.has(bell.self))) return true;
+        if (bell.user && opts.selfUsers.has(bell.user)) return true;
+        const rec = { type: "reaction" as const, channel: { id: bell.channel }, ts: bell.ts, user: { id: bell.user ?? "" } };
+        _internals.out(opts.json ? JSON.stringify(rec) : `reaction  ${bell.channel}  ${bell.ts}  by ${bell.user ?? "?"}`);
+        return true;
+      }
       let ch = channels.find((c) => c.id === bell.channel);
       if (!ch) {
         // A channel joined since the last refresh. Re-list at most once a

package/worker/src/slack.ts

@@ -12,6 +12,10 @@ export type Doorbell = {
    *  skip the Web API read the bell would cost. Nothing about any other
    *  sender is kept. */
   self?: string;
+  /** A reaction_added on the message at channel/ts, by `user` — still only
+   *  ids: which emoji is read from Slack by whoever needs it. */
+  kind?: "reaction";
+  user?: string;
 };
 
 /** Slack rejects replays older than five minutes; so do we. */
@@ -112,6 +116,14 @@ export function doorbellOf(payload: unknown, teamId?: string): Doorbell | null {
   if (p.type !== "event_callback" || !p.event || typeof p.event !== "object") return null;
   if (teamId && p.team_id !== teamId) return null;
   const e = p.event;
+  if (e.type === "reaction_added") {
+    const item = e.item as Record<string, unknown> | undefined;
+    if (!item || item.type !== "message") return null; // file / file_comment reactions have no message ts
+    const { channel, ts } = item;
+    if (typeof channel !== "string" || !CHANNEL.test(channel) || typeof ts !== "string" || !TS.test(ts)) return null;
+    const self = selfPost(p, e);
+    return { channel, ts, kind: "reaction", ...(typeof e.user === "string" && USER.test(e.user) ? { user: e.user } : {}), ...(self ? { self } : {}) };
+  }
   if (e.type !== "message" && e.type !== "app_mention") return null;
   if (typeof e.subtype === "string" && SKIP_SUBTYPES.has(e.subtype)) return null;
   if (e.hidden === true) return null;