slack-term 1.7.0

package/ts/format.ts

@@ -0,0 +1,77 @@
+// Text-formatting helpers: mention/date-markup resolution, day grouping.
+
+import { userName } from "./slack.ts";
+
+export async function resolveMentions(
+  token: string,
+  text: string,
+  cache: Map<string, string>,
+): Promise<string> {
+  let result = text;
+  const ids: string[] = [];
+  let search = result;
+  let searchOffset = 0;
+  while (true) {
+    const pos = search.indexOf("<@U", searchOffset);
+    if (pos === -1) break;
+    const rest = search.slice(pos + 2);
+    const endIdx = rest.search(/[>|]/);
+    const uid = endIdx === -1 ? rest : rest.slice(0, endIdx);
+    if (uid.length >= 9) ids.push(uid);
+    searchOffset = pos + 1;
+  }
+  for (const uid of ids) {
+    if (!cache.has(uid)) cache.set(uid, await userName(token, uid));
+    const display = cache.get(uid) ?? uid;
+    result = result.replaceAll(`<@${uid}>`, `@${display}`);
+    // Handle <@UID|label> form — drop label.
+    result = result.replace(new RegExp(`<@${uid}\\|[^>]*>`, "g"), `@${display}`);
+  }
+  return result;
+}
+
+export function resolveDateMarkup(text: string): string {
+  // <!date^EPOCH^{format}|fallback>  →  formatted date (or fallback)
+  return text.replace(/<!date\^(\d+)\^[^|>]*(?:\|([^>]*))?>/g, (_m, epochStr, fallback) => {
+    const epoch = Number(epochStr);
+    if (!Number.isFinite(epoch)) return fallback ?? "date";
+    const d = new Date(epoch * 1000);
+    if (Number.isNaN(d.getTime())) return fallback ?? "date";
+    const days = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
+    const months = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+    const dayName = days[d.getUTCDay()] ?? "";
+    const mon = months[d.getUTCMonth()] ?? "";
+    return `${dayName}, ${mon} ${String(d.getUTCDate()).padStart(2, "0")}, ${d.getUTCFullYear()}`;
+  });
+}
+
+export function dayLabel(epochSec: number, now: Date = new Date()): string {
+  const d = new Date(epochSec * 1000);
+  const today = dateKey(now);
+  const yesterday = dateKey(new Date(now.getTime() - 86400_000));
+  const key = dateKey(d);
+  if (key === today) return "Today";
+  if (key === yesterday) return "Yesterday";
+  const weekday = d.toLocaleDateString("en-US", { weekday: "long" });
+  const month = d.toLocaleDateString("en-US", { month: "short" });
+  return `${weekday}, ${month} ${String(d.getDate()).padStart(2, "0")}`;
+}
+
+function dateKey(d: Date): string {
+  return `${d.getFullYear()}-${d.getMonth()}-${d.getDate()}`;
+}
+
+export function formatHm(epochSec: number): string {
+  const d = new Date(epochSec * 1000);
+  return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
+}
+
+export function formatYmdHm(epochSec: number): string {
+  const d = new Date(epochSec * 1000);
+  const y = d.getFullYear();
+  const mo = String(d.getMonth() + 1).padStart(2, "0");
+  const da = String(d.getDate()).padStart(2, "0");
+  const h = String(d.getHours()).padStart(2, "0");
+  const mi = String(d.getMinutes()).padStart(2, "0");
+  return `${y}-${mo}-${da} ${h}:${mi}`;
+}

package/ts/profiles.ts

@@ -0,0 +1,190 @@
+// Multi-workspace profile management.
+// Profiles are stored in ~/.config/slack-cli/profiles.json.
+//
+// Workspace selection uses lockfiles:
+//   Local (cwd):  .slack-cli/workspace   — set with: slack workspace use <name>
+//   Global (home): ~/.slack-cli/workspace — set with: slack workspace use -g <name>
+//
+// Resolution order:
+//   1. --workspace=<name> flag or SLACK_WORKSPACE env var
+//   2. Local lockfile  (.slack-cli/workspace in cwd)
+//   3. Global lockfile (~/.slack-cli/workspace)
+//   4. No profiles → fall back to SLACK_MCP_XOXP_TOKEN
+//   5. Otherwise → throw (no silent defaults)
+
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, dirname } from "node:path";
+
+export type Profile = {
+  token: string;
+  team: string;
+  teamId: string;
+  url: string;
+  user: string;
+  cookie?: string; // xoxd session cookie for internal APIs (drafts, etc.)
+};
+
+type ProfileStore = {
+  profiles: Record<string, Profile>;
+};
+
+function profilesPath(): string {
+  return join(homedir(), ".config", "slack-cli", "profiles.json");
+}
+
+function localLockfilePath(): string {
+  return join(process.cwd(), ".slack-cli", "workspace");
+}
+
+function globalLockfilePath(): string {
+  return join(homedir(), ".slack-cli", "workspace");
+}
+
+function load(): ProfileStore {
+  const path = profilesPath();
+  if (!existsSync(path)) return { profiles: {} };
+  return JSON.parse(readFileSync(path, "utf8")) as ProfileStore;
+}
+
+function save(store: ProfileStore): void {
+  const path = profilesPath();
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, JSON.stringify(store, null, 2) + "\n");
+}
+
+function readLockfile(path: string): string | undefined {
+  if (!existsSync(path)) return undefined;
+  return readFileSync(path, "utf8").trim() || undefined;
+}
+
+function writeLockfile(path: string, name: string): void {
+  const dir = dirname(path);
+  mkdirSync(dir, { recursive: true });
+  // Protect the directory from accidental git commits.
+  const gi = join(dir, ".gitignore");
+  if (!existsSync(gi)) writeFileSync(gi, "*\n");
+  writeFileSync(path, name + "\n");
+}
+
+export function listProfiles(): { name: string; profile: Profile; current: boolean }[] {
+  const store = load();
+  const local = readLockfile(localLockfilePath());
+  const global_ = readLockfile(globalLockfilePath());
+  const current = local ?? global_;
+  return Object.entries(store.profiles).map(([name, profile]) => ({
+    name,
+    profile,
+    current: name === current,
+  }));
+}
+
+export function addProfile(name: string, profile: Profile): void {
+  const store = load();
+  store.profiles[name] = profile;
+  save(store);
+}
+
+export function setCookie(name: string, cookie: string): void {
+  const store = load();
+  if (!(name in store.profiles)) throw new Error(`Profile not found: ${name}`);
+  store.profiles[name]!.cookie = cookie;
+  save(store);
+}
+
+export function removeProfile(name: string): void {
+  const store = load();
+  if (!(name in store.profiles)) throw new Error(`Profile not found: ${name}`);
+  delete store.profiles[name];
+  save(store);
+}
+
+export function useProfile(name: string, global = false): void {
+  const store = load();
+  if (!(name in store.profiles)) throw new Error(`Profile not found: ${name}`);
+  if (global) {
+    writeLockfile(globalLockfilePath(), name);
+  } else {
+    writeLockfile(localLockfilePath(), name);
+  }
+}
+
+export function resolveToken(workspaceFlag?: string): string {
+  const store = load();
+  const profiles = store.profiles;
+  const names = Object.keys(profiles);
+  const envToken = process.env.SLACK_MCP_XOXP_TOKEN;
+
+  // Conflict: env token and profiles are mutually exclusive
+  if (envToken && names.length > 0) {
+    throw new Error(
+      "Both SLACK_MCP_XOXP_TOKEN and workspace profiles are configured — keep only one.\n" +
+      "  • Unset SLACK_MCP_XOXP_TOKEN to use profiles\n" +
+      "  • Or remove all profiles: slack workspace remove <name>",
+    );
+  }
+
+  // Env token only (no profiles) — highest priority when unambiguous
+  if (envToken) return envToken;
+
+  // Explicit per-command selection
+  const selected = workspaceFlag ?? process.env.SLACK_WORKSPACE;
+  if (selected) {
+    const profile = profiles[selected];
+    if (!profile) {
+      throw new Error(
+        `Workspace "${selected}" not found. Available: ${names.join(", ") || "(none)"}`,
+      );
+    }
+    return profile.token;
+  }
+
+  // Local lockfile (cwd)
+  const localName = readLockfile(localLockfilePath());
+  if (localName) {
+    const profile = profiles[localName];
+    if (!profile) throw new Error(`Workspace "${localName}" (from .slack-cli/workspace) not found in profiles.`);
+    return profile.token;
+  }
+
+  // Global lockfile (~/.slack-cli/workspace)
+  const globalName = readLockfile(globalLockfilePath());
+  if (globalName) {
+    const profile = profiles[globalName];
+    if (!profile) throw new Error(`Workspace "${globalName}" (from ~/.slack-cli/workspace) not found in profiles.`);
+    return profile.token;
+  }
+
+  // No profiles and no env token
+  if (names.length === 0) {
+    throw new Error("No profiles configured. Run: slack workspace add <name> <token>  — or set SLACK_MCP_XOXP_TOKEN");
+  }
+
+  // Profiles exist but none selected — never silently pick one
+  throw new Error(
+    `Workspace not selected (${names.join(", ")} available).\n` +
+    `  Select locally:  slack workspace use <name>          (writes .slack-cli/workspace)\n` +
+    `  Select globally: slack workspace use -g <name>       (writes ~/.slack-cli/workspace)`,
+  );
+}
+
+/** Resolve the xoxd session cookie for the active workspace (best-effort). */
+export function resolveCookie(workspaceFlag?: string): string | undefined {
+  const store = load();
+  const profiles = store.profiles;
+  const envToken = process.env.SLACK_MCP_XOXP_TOKEN;
+
+  // Env-only mode has no stored cookie
+  if (envToken) return process.env.SLACK_MCP_XOXD_COOKIE;
+
+  const selected = workspaceFlag ?? process.env.SLACK_WORKSPACE;
+  if (selected) return profiles[selected]?.cookie;
+
+  const localName = readLockfile(localLockfilePath());
+  if (localName) return profiles[localName]?.cookie;
+
+  const globalName = readLockfile(globalLockfilePath());
+  if (globalName) return profiles[globalName]?.cookie;
+
+  return undefined;
+}

package/ts/slack-app.ts

@@ -0,0 +1,243 @@
+// Extract xoxc- tokens from the Slack desktop app's LevelDB (macOS/Linux/Windows).
+// Reads raw .ldb/.log files with regex — works even while Slack is running (no exclusive lock).
+// Also extracts the xoxd session cookie from the Slack Cookies SQLite database (macOS only).
+
+import { readdirSync, readFileSync, existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { pbkdf2Sync, createDecipheriv } from "node:crypto";
+import { execSync } from "node:child_process";
+
+export type SlackAppSession = {
+  token: string;   // xoxc-...
+  cookie?: string; // xoxd-... (macOS only, from Cookies SQLite)
+  teamId: string;
+  teamName?: string;
+  url?: string;
+};
+
+function leveldbPath(): string {
+  const home = homedir();
+  if (process.platform === "darwin") {
+    return join(home, "Library", "Application Support", "Slack", "Local Storage", "leveldb");
+  }
+  if (process.platform === "linux") {
+    return join(home, ".config", "Slack", "Local Storage", "leveldb");
+  }
+  if (process.platform === "win32") {
+    const appData = process.env.APPDATA ?? join(home, "AppData", "Roaming");
+    return join(appData, "Slack", "Local Storage", "leveldb");
+  }
+  throw new Error(`Unsupported platform: ${process.platform}`);
+}
+
+function cookiesDbPath(): string {
+  const home = homedir();
+  if (process.platform === "darwin") {
+    return join(home, "Library", "Application Support", "Slack", "Cookies");
+  }
+  // Linux/Windows: cookie extraction not implemented
+  return "";
+}
+
+// Encrypted cookie format (macOS Electron/Chromium v10):
+//   bytes [0..3)   = "v10"
+//   bytes [3..19)  = 16-byte prefix (version/key-id, shared across all cookies)
+//   bytes [19..35) = 16-byte IV (shared across all cookies in this profile)
+//   bytes [35..)   = AES-128-CBC ciphertext
+// Key = PBKDF2(keychain_password, "saltysalt", 1003, 16, SHA1)
+function decryptChromeCookie(encryptedValue: Buffer, key: Buffer): string {
+  if (encryptedValue.length < 35 || encryptedValue.slice(0, 3).toString() !== "v10") {
+    throw new Error("Not a v10 encrypted cookie");
+  }
+  const iv = encryptedValue.slice(19, 35);
+  const ciphertext = encryptedValue.slice(35);
+  const decipher = createDecipheriv("aes-128-cbc", key, iv);
+  decipher.setAutoPadding(true);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+}
+
+/** Extract the xoxd session cookie from Slack's Cookies SQLite (macOS only).
+ *  Returns undefined if unavailable or decryption fails. */
+export function extractXoxd(): string | undefined {
+  if (process.platform !== "darwin") return undefined;
+
+  const dbPath = cookiesDbPath();
+  if (!existsSync(dbPath)) return undefined;
+
+  let keychainPw: string;
+  try {
+    keychainPw = execSync(
+      `security find-generic-password -w -s "Slack Safe Storage" -a "Slack Key"`,
+      { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] },
+    ).trimEnd();
+  } catch {
+    return undefined;
+  }
+  const aesKey = pbkdf2Sync(keychainPw, "saltysalt", 1003, 16, "sha1");
+
+  try {
+    // Use dynamic import so bun:sqlite doesn't break on non-bun runtimes
+    const { default: Database } = require("bun:sqlite") as typeof import("bun:sqlite");
+    const db = new Database(dbPath, { readonly: true });
+    const row = db
+      .prepare("SELECT encrypted_value FROM cookies WHERE name='d' AND host_key LIKE '%slack%'")
+      .get() as { encrypted_value: Uint8Array } | null;
+    db.close();
+    if (!row) return undefined;
+    return decryptChromeCookie(Buffer.from(row.encrypted_value), aesKey);
+  } catch {
+    return undefined;
+  }
+}
+
+// Scan raw LevelDB files for xoxc- tokens without opening the DB exclusively.
+// Works while Slack is running.
+//
+// Strategy:
+//  1. .log files (write-ahead log): values are stored as readable JSON strings.
+//     Scan for "token":"xoxc-..." to get complete, clean tokens + workspace URL.
+//  2. .ldb files (sorted tables): values are length-prefixed with binary framing
+//     bytes that can split the token mid-segment. Use gap-bridging as fallback.
+export async function extractSessions(): Promise<SlackAppSession[]> {
+  const dbPath = leveldbPath();
+  if (!existsSync(dbPath)) {
+    throw new Error(
+      `Slack desktop app LevelDB not found at:\n  ${dbPath}\nIs Slack installed and opened at least once?`,
+    );
+  }
+
+  const files = readdirSync(dbPath).filter((f) => f.endsWith(".ldb") || f.endsWith(".log"));
+  if (files.length === 0) throw new Error(`No LevelDB data files found in ${dbPath}`);
+
+  const sessions = new Map<string, SlackAppSession>();
+
+  for (const file of files) {
+    let content: string;
+    try {
+      content = readFileSync(join(dbPath, file), "latin1");
+    } catch {
+      continue;
+    }
+
+    if (file.endsWith(".log")) {
+      // .log files store JSON values verbatim — extract complete token + URL + name in one pass.
+      for (const m of content.matchAll(/"token":"(xoxc-[^"]+)"/g)) {
+        const token = m[1]!;
+        const teamId = token.split("-")[1] ?? "";
+        if (!teamId || token.length < 40) continue;
+
+        // Look for workspace metadata near this token (within ±2KB)
+        const start = Math.max(0, m.index! - 2000);
+        const end = Math.min(content.length, m.index! + 2000);
+        const ctx = content.slice(start, end);
+        const urlMatch = ctx.match(/"url":"(https:\/\/[a-z0-9-]+\.slack\.com\/)"/);
+        const nameMatch = ctx.match(/"(?:team_name|name)":"([^"]{2,60})"/);
+
+        const existing = sessions.get(teamId);
+        if (!existing || token.length > existing.token.length) {
+          const entry: SlackAppSession = { token, teamId };
+          const url = urlMatch?.[1] ?? existing?.url;
+          const teamName = nameMatch?.[1] ?? existing?.teamName;
+          if (url) entry.url = url;
+          if (teamName) entry.teamName = teamName;
+          sessions.set(teamId, entry);
+        }
+      }
+    } else {
+      // .ldb files: binary framing bytes split the token mid-segment.
+      // Match the first 3 numeric segments, then bridge over binary bytes to find the rest.
+      for (const m of content.matchAll(/xoxc-(\d+)-(\d+)-(\d+)/g)) {
+        const teamId = m[1]!;
+        // Skip if already found in a .log file (prefer clean .log data)
+        if (sessions.has(teamId)) continue;
+
+        let i = m.index! + m[0].length;
+        const limit = Math.min(i + 10, content.length);
+        while (i < limit && (content.charCodeAt(i) < 0x30 || content.charCodeAt(i) > 0x39)) i++;
+
+        let seg3tail = "";
+        while (i < content.length && content.charCodeAt(i) >= 0x30 && content.charCodeAt(i) <= 0x39) {
+          seg3tail += content[i++];
+        }
+        if (content[i] !== "-") continue;
+        i++;
+        let hex = "";
+        while (i < content.length) {
+          const code = content.charCodeAt(i);
+          if ((code >= 0x30 && code <= 0x39) || (code >= 0x61 && code <= 0x66)) {
+            hex += content[i++];
+          } else break;
+        }
+        if (hex.length < 20) continue;
+
+        const token = `${m[0]}${seg3tail}-${hex}`;
+        sessions.set(teamId, { token, teamId });
+      }
+    }
+  }
+
+  // Second pass: for sessions still missing a name, search all file content
+  // (printable-transformed) for team_name/name near the numeric team ID, then
+  // fall back to a title-cased URL slug.
+  const allFiles = readdirSync(dbPath).filter((f) => f.endsWith(".ldb") || f.endsWith(".log"));
+  const allContent = allFiles
+    .map((f) => {
+      try {
+        // Replace non-printable bytes with spaces to expose readable text in binary ldb frames.
+        return readFileSync(join(dbPath, f), "latin1").replace(/[^\x20-\x7e]/g, " ");
+      } catch {
+        return "";
+      }
+    })
+    .join(" ");
+
+  for (const session of sessions.values()) {
+    if (session.teamName) continue;
+
+    // Strategy 1: search for "team_name":"..." or "name":"..." near the numeric team ID.
+    const idIdx = allContent.indexOf(session.teamId);
+    if (idIdx !== -1) {
+      const start = Math.max(0, idIdx - 500);
+      const end = Math.min(allContent.length, idIdx + 500);
+      const ctx = allContent.slice(start, end);
+      const nameMatch = ctx.match(/"(?:team_name|name)":"([^"]{2,60})"/);
+      if (nameMatch?.[1]) {
+        session.teamName = nameMatch[1];
+        continue;
+      }
+    }
+
+    // Strategy 2: search for the workspace URL slug and look for "name":"..." near it.
+    if (!session.teamName && session.url) {
+      const slug = session.url.match(/https:\/\/([a-z0-9-]+)\.slack\.com\//)?.[1];
+      if (slug) {
+        const slugIdx = allContent.indexOf(slug);
+        if (slugIdx !== -1) {
+          const start = Math.max(0, slugIdx - 500);
+          const end = Math.min(allContent.length, slugIdx + 500);
+          const ctx = allContent.slice(start, end);
+          const nameMatch = ctx.match(/"(?:team_name|name)":"([^"]{2,60})"/);
+          if (nameMatch?.[1]) {
+            session.teamName = nameMatch[1];
+            continue;
+          }
+        }
+
+        // Strategy 3: title-case the slug as a last resort.
+        session.teamName = slug
+          .split("-")
+          .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
+          .join(" ");
+      }
+    }
+  }
+
+  // Attach xoxd cookie to all sessions (shared — one Slack desktop app, one cookie jar)
+  const xoxd = extractXoxd();
+  const result = [...sessions.values()];
+  if (xoxd) {
+    for (const s of result) s.cookie = xoxd;
+  }
+  return result;
+}