Context
Follow-up from #141/#142 and #143 (browser-shaped headers). This one is narrower than #143: it's not about missing browser headers, it's that agent-slack's own code disagrees with itself about which of Origin/Referer to send.
What's inconsistent
src/slack/client.ts (browserApi, browserApiMultipart, the call path behind auth.test, message.*, search.*, drafts.*, and most other commands) sends Origin: https://app.slack.com but never sets Referer.src/slack/files.ts and src/slack/canvas.ts (file/canvas downloads) send Referer: https://app.slack.com/ but never set Origin.
A real browser fetch/XHR from app.slack.com sends both headers together, on every request, always. Having only one or the other, and having it differ depending on which agent-slack module made the call, is a stranger signal than either header being simply absent.
Proposal
Send both Origin: https://app.slack.com and Referer: https://app.slack.com/ (or a more precise https://app.slack.com/client/<team_id>/... Referer if the team_id is known at call time) on every browser-session request, across client.ts, files.ts, and canvas.ts. Ideally as a shared constant/helper so the three call sites can't drift again.
Context
Follow-up from #141/#142 and #143 (browser-shaped headers). This one is narrower than #143: it's not about missing browser headers, it's that agent-slack's own code disagrees with itself about which of
Origin/Refererto send.What's inconsistent
src/slack/client.ts(browserApi,browserApiMultipart, the call path behindauth.test,message.*,search.*,drafts.*, and most other commands) sendsOrigin: https://app.slack.combut never setsReferer.src/slack/files.tsandsrc/slack/canvas.ts(file/canvas downloads) sendReferer: https://app.slack.com/but never setOrigin.A real browser fetch/XHR from
app.slack.comsends both headers together, on every request, always. Having only one or the other, and having it differ depending on which agent-slack module made the call, is a stranger signal than either header being simply absent.Proposal
Send both
Origin: https://app.slack.comandReferer: https://app.slack.com/(or a more precisehttps://app.slack.com/client/<team_id>/...Referer if the team_id is known at call time) on every browser-session request, acrossclient.ts,files.ts, andcanvas.ts. Ideally as a shared constant/helper so the three call sites can't drift again.