Fix Slack auth reporting invalid when cookie is stale

[devxoul]

Summary

• slack auth status reports valid: false even though the Slack desktop app works fine. The root cause is stale cookies in stored credentials — the token is valid but the cookie has expired, causing auth.test to fail with invalid_auth.
• Auth status and ensureSlackAuth now validate stored credentials and attempt a cookie refresh before reporting invalid or falling back to full extraction.
• LevelDB token extraction uses ClassicLevel on a temporary copy to avoid prefix-compression artifacts that corrupt tokens when reading raw .ldb files.

Changes

src/platforms/slack/token-extractor.ts

• Add extractCookie() method for standalone cookie refresh without full token extraction.
• extractFromLevelDB() prefers ClassicLevel on a temp copy to avoid prefix-compression corruption, with fallback to raw .ldb scan and direct ClassicLevel.
• Add parseTokenValue(), parseTeamsObject(), parseSingleToken() for structured token parsing. Handles localConfig_v2 teams object format.
• Strip leading control bytes (e.g. 0x01) from LevelDB values before JSON parsing.

src/platforms/slack/commands/auth.ts

• statusAction retries with a fresh cookie via tryRefreshCookie() before marking auth as invalid.
• tryRefreshCookie() extracts a fresh cookie, validates it against the API, and updates all stored workspaces.

src/platforms/slack/ensure-auth.ts

• Validate existing stored credentials with auth.test API call on startup.
• Attempt cookie refresh via refreshCookie() before falling back to full extraction.

src/platforms/slack/ensure-auth.test.ts

• Test that valid stored credentials skip extraction.
• Test that stale cookies trigger refresh and update stored credentials.
• Test that failed cookie refresh falls through to full extraction.

Verified

• bun typecheck — clean.
• bun test — 868 pass, 0 fail.
• Manual CLI: slack auth extract returns 4 workspaces, slack auth status returns valid: true.

---

Summary by cubic

Fixes Slack auth showing invalid when the cookie is stale. Adds a cookie refresh flow and makes token extraction from LevelDB more reliable.

• Bug Fixes

  • ensureSlackAuth validates stored credentials with auth.test; on failure it refreshes the cookie and only then falls back to full extraction.
  • slack auth status retries with a fresh cookie and re-validates; on success it updates the cookie for all stored workspaces.
  • Tests cover valid creds skipping extraction, stale-cookie refresh, and fallback when refresh fails.

• Refactors

  • Added TokenExtractor.extractCookie for standalone cookie refresh from SQLite.
  • LevelDB extraction now prefers ClassicLevel on a temporary copy, with fallbacks to raw .ldb scan and direct ClassicLevel.
  • Structured parsing for localConfig_v2 teams and single tokens; strips leading control bytes before JSON parsing.

^{Written for commit 619aa48. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
agent-messenger	Ignored		Mar 5, 2026 1:17pm

[cubic-dev-ai]

1 issue found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/platforms/slack/ensure-auth.ts">

<violation number="1" location="src/platforms/slack/ensure-auth.ts:47">
P2: `refreshCookie` duplicates existing cookie-refresh logic from `auth.ts`; this should be centralized to avoid behavior drift between auth paths.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: refreshCookie duplicates existing cookie-refresh logic from auth.ts; this should be centralized to avoid behavior drift between auth paths.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/platforms/slack/ensure-auth.ts, line 47:

<comment>`refreshCookie` duplicates existing cookie-refresh logic from `auth.ts`; this should be centralized to avoid behavior drift between auth paths.</comment>

<file context>
@@ -32,6 +41,24 @@ export async function ensureSlackAuth(): Promise<void> {
+  }
+}
+
+async function refreshCookie(token: string, credManager: CredentialManager): Promise<boolean> {
+  try {
+    const extractor = new TokenExtractor()
</file context>