v4.6.0 — Workspace profiles + Chrome extraction overhaul

Two community-driven improvements: run work and personal Slack side-by-side, and extraction that tells you why it failed.

Workspace profiles (#164)

SLACK_MCP_PROFILE=work — or --profile work on any CLI command — gives each server instance its own credential namespace: token file, metadata sidecar, write lock, and Keychain service. Two MCP client entries with different profiles run side-by-side; setup or refresh in one never touches the other.

{
  "mcpServers": {
    "slack-work":     { "command": "npx", "args": ["-y", "@jtalk22/slack-mcp"], "env": { "SLACK_MCP_PROFILE": "work" } },
    "slack-personal": { "command": "npx", "args": ["-y", "@jtalk22/slack-mcp"], "env": { "SLACK_MCP_PROFILE": "personal" } }
  }
}

Pair with SLACK_MCP_CHROME_PROFILE to point each profile's extraction at the matching Chrome profile. Invalid names fail closed at startup. Requested by @iloveitaly.

Chrome extraction overhaul (#168)

• One Keychain lookup per run — the Chrome Safe Storage key is per-machine, so it's now cached for the process (refetched once if a decrypt fails, in case Chrome re-keyed). No more password-prompt storms across profiles.
• Fatal Keychain failures abort cleanly with an actionable error (keychain_timeout, keychain_lookup_failed) instead of retrying per profile per path.
• SLACK_MCP_KEYCHAIN_TIMEOUT_MS (default 15000) replaces the hard 5s a real-world Keychain was observed to exceed at 4.9s.
• Failures name their cause — per-profile reasons (no_slack_cookie_row, cookie_decrypt_failed, no_cookie_db, …) surface in the final error instead of a generic extraction_failed_all_paths. Reason table in TROUBLESHOOTING.
• AppleScript token read runs once per extraction, not once per profile.

Tests

57 total. Chrome extraction was previously untestable without a live Chrome — the new rig builds a synthetic Chrome estate (a real SQLite cookie DB holding a genuine v10 AES-128-CBC-encrypted cookie, plus a LevelDB-style token log) and drives the actual extraction pipeline with only the Keychain lookup faked, proving single-lookup caching, fatal-abort behavior, the decrypt-retry, and the reason taxonomy.

Full changelog: https://github.com/jtalk22/slack-mcp-server/blob/main/CHANGELOG.md