@geminixiang/mama 0.2.0-beta.2 → 0.2.0-beta.4

package/dist/session-view/store.d.ts

@@ -0,0 +1,16 @@
+export interface SessionViewToken {
+    token: string;
+    platform: "slack" | "discord" | "telegram";
+    platformUserId: string;
+    conversationId: string;
+    sessionKey: string;
+    sessionFile: string;
+    expiresAt: number;
+}
+export declare class InMemorySessionViewTokenStore {
+    private tokens;
+    create(platform: "slack" | "discord" | "telegram", platformUserId: string, conversationId: string, sessionKey: string, sessionFile: string): SessionViewToken;
+    peek(rawToken: string): SessionViewToken | undefined;
+    purge(): void;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/session-view/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/session-view/store.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,UAAU,CAAC;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,qBAAa,6BAA6B;IACxC,OAAO,CAAC,MAAM,CAAuC;IAErD,MAAM,CACJ,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,UAAU,EAC1C,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,gBAAgB,CAYlB;IAED,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAOnD;IAED,KAAK,IAAI,IAAI,CAOZ;CACF","sourcesContent":["import { randomBytes } from \"crypto\";\n\nexport interface SessionViewToken {\n  token: string;\n  platform: \"slack\" | \"discord\" | \"telegram\";\n  platformUserId: string;\n  conversationId: string;\n  sessionKey: string;\n  sessionFile: string;\n  expiresAt: number;\n}\n\nconst TTL_MS = 24 * 60 * 60 * 1000;\n\nexport class InMemorySessionViewTokenStore {\n  private tokens = new Map<string, SessionViewToken>();\n\n  create(\n    platform: \"slack\" | \"discord\" | \"telegram\",\n    platformUserId: string,\n    conversationId: string,\n    sessionKey: string,\n    sessionFile: string,\n  ): SessionViewToken {\n    const token: SessionViewToken = {\n      token: randomBytes(16).toString(\"hex\"),\n      platform,\n      platformUserId,\n      conversationId,\n      sessionKey,\n      sessionFile,\n      expiresAt: Date.now() + TTL_MS,\n    };\n    this.tokens.set(token.token, token);\n    return token;\n  }\n\n  peek(rawToken: string): SessionViewToken | undefined {\n    const entry = this.tokens.get(rawToken);\n    if (!entry || Date.now() > entry.expiresAt) {\n      if (entry) this.tokens.delete(rawToken);\n      return undefined;\n    }\n    return entry;\n  }\n\n  purge(): void {\n    const now = Date.now();\n    for (const [key, value] of this.tokens) {\n      if (now > value.expiresAt) {\n        this.tokens.delete(key);\n      }\n    }\n  }\n}\n"]}

package/dist/session-view/store.js

@@ -0,0 +1,38 @@
+import { randomBytes } from "crypto";
+const TTL_MS = 24 * 60 * 60 * 1000;
+export class InMemorySessionViewTokenStore {
+    constructor() {
+        this.tokens = new Map();
+    }
+    create(platform, platformUserId, conversationId, sessionKey, sessionFile) {
+        const token = {
+            token: randomBytes(16).toString("hex"),
+            platform,
+            platformUserId,
+            conversationId,
+            sessionKey,
+            sessionFile,
+            expiresAt: Date.now() + TTL_MS,
+        };
+        this.tokens.set(token.token, token);
+        return token;
+    }
+    peek(rawToken) {
+        const entry = this.tokens.get(rawToken);
+        if (!entry || Date.now() > entry.expiresAt) {
+            if (entry)
+                this.tokens.delete(rawToken);
+            return undefined;
+        }
+        return entry;
+    }
+    purge() {
+        const now = Date.now();
+        for (const [key, value] of this.tokens) {
+            if (now > value.expiresAt) {
+                this.tokens.delete(key);
+            }
+        }
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/session-view/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/session-view/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAYrC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC,MAAM,OAAO,6BAA6B;IAA1C;QACU,WAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IAuCvD,CAAC;IArCC,MAAM,CACJ,QAA0C,EAC1C,cAAsB,EACtB,cAAsB,EACtB,UAAkB,EAClB,WAAmB;QAEnB,MAAM,KAAK,GAAqB;YAC9B,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtC,QAAQ;YACR,cAAc;YACd,cAAc;YACd,UAAU;YACV,WAAW;YACX,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;SAC/B,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,QAAgB;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YAC3C,IAAI,KAAK;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACxC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC1B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;CACF","sourcesContent":["import { randomBytes } from \"crypto\";\n\nexport interface SessionViewToken {\n  token: string;\n  platform: \"slack\" | \"discord\" | \"telegram\";\n  platformUserId: string;\n  conversationId: string;\n  sessionKey: string;\n  sessionFile: string;\n  expiresAt: number;\n}\n\nconst TTL_MS = 24 * 60 * 60 * 1000;\n\nexport class InMemorySessionViewTokenStore {\n  private tokens = new Map<string, SessionViewToken>();\n\n  create(\n    platform: \"slack\" | \"discord\" | \"telegram\",\n    platformUserId: string,\n    conversationId: string,\n    sessionKey: string,\n    sessionFile: string,\n  ): SessionViewToken {\n    const token: SessionViewToken = {\n      token: randomBytes(16).toString(\"hex\"),\n      platform,\n      platformUserId,\n      conversationId,\n      sessionKey,\n      sessionFile,\n      expiresAt: Date.now() + TTL_MS,\n    };\n    this.tokens.set(token.token, token);\n    return token;\n  }\n\n  peek(rawToken: string): SessionViewToken | undefined {\n    const entry = this.tokens.get(rawToken);\n    if (!entry || Date.now() > entry.expiresAt) {\n      if (entry) this.tokens.delete(rawToken);\n      return undefined;\n    }\n    return entry;\n  }\n\n  purge(): void {\n    const now = Date.now();\n    for (const [key, value] of this.tokens) {\n      if (now > value.expiresAt) {\n        this.tokens.delete(key);\n      }\n    }\n  }\n}\n"]}

package/dist/store.d.ts

@@ -20,8 +20,6 @@ export interface ChannelStoreConfig {
 export declare class ChannelStore {
     private workingDir;
     private botToken;
-    private pendingDownloads;
-    private isDownloading;
     private recentlyLogged;
     constructor(config: ChannelStoreConfig);
     /**
@@ -33,14 +31,14 @@ export declare class ChannelStore {
      */
     generateLocalFilename(originalName: string, timestamp: string): string;
     /**
-     * Process attachments from a Slack message event
-     * Returns attachment metadata and queues downloads
+     * Process attachments from a Slack message event.
+     * Downloads files before returning so callers only receive readable paths.
      */
     processAttachments(channelId: string, files: Array<{
         name?: string;
         url_private_download?: string;
         url_private?: string;
-    }>, timestamp: string): Attachment[];
+    }>, timestamp: string): Promise<Attachment[]>;
     /**
      * Log a message to the channel's log.jsonl
      * Returns false if message was already logged (duplicate)
@@ -55,7 +53,6 @@ export declare class ChannelStore {
      * Returns null if no log exists
      */
     getLastTimestamp(channelId: string): string | null;
-    private processDownloadQueue;
     private downloadAttachment;
 }
 //# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAQD,qBAAa,YAAY;IACvB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,gBAAgB,CAAyB;IACjD,OAAO,CAAC,aAAa,CAAS;IAG9B,OAAO,CAAC,cAAc,CAA6B;IAEnD,YAAY,MAAM,EAAE,kBAAkB,EAQrC;IAED;;OAEG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAMvC;IAED;;OAEG;IACH,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAMrE;IAED;;;OAGG;IACH,kBAAkB,CAChB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,EACpF,SAAS,EAAE,MAAM,GAChB,UAAU,EAAE,CA2Bd;IAED;;;OAGG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CA8B5E;IAED;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/E;IAED;;;OAGG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkBjD;YAKa,oBAAoB;YAwBpB,kBAAkB;CAsBjC","sourcesContent":["import { existsSync, mkdirSync, readFileSync } from \"fs\";\nimport { appendFile, writeFile } from \"fs/promises\";\nimport { join } from \"path\";\nimport * as log from \"./log.js\";\n\nexport interface Attachment {\n  original: string; // original filename from uploader\n  localPath: string; // path relative to working dir (e.g., \"C12345/attachments/1732531234567_file.png\")\n}\n\nexport interface LoggedMessage {\n  date: string; // ISO 8601 date (e.g., \"2025-11-26T10:44:00.000Z\") for easy grepping\n  ts: string; // slack timestamp or epoch ms\n  user: string; // user ID (or \"bot\" for bot responses)\n  userName?: string; // handle (e.g., \"mario\")\n  displayName?: string; // display name (e.g., \"Mario Zechner\")\n  text: string;\n  attachments: Attachment[];\n  isBot: boolean;\n  threadTs?: string; // slack thread timestamp (root message ts)\n}\n\nexport interface ChannelStoreConfig {\n  workingDir: string;\n  botToken: string; // needed for authenticated file downloads\n}\n\ninterface PendingDownload {\n  channelId: string;\n  localPath: string; // relative path\n  url: string;\n}\n\nexport class ChannelStore {\n  private workingDir: string;\n  private botToken: string;\n  private pendingDownloads: PendingDownload[] = [];\n  private isDownloading = false;\n  // Track recently logged message timestamps to prevent duplicates\n  // Key: \"channelId:ts\", automatically cleaned up after 60 seconds\n  private recentlyLogged = new Map<string, number>();\n\n  constructor(config: ChannelStoreConfig) {\n    this.workingDir = config.workingDir;\n    this.botToken = config.botToken;\n\n    // Ensure working directory exists\n    if (!existsSync(this.workingDir)) {\n      mkdirSync(this.workingDir, { recursive: true });\n    }\n  }\n\n  /**\n   * Get or create the directory for a channel/DM\n   */\n  getChannelDir(channelId: string): string {\n    const channelDir = join(this.workingDir, channelId);\n    if (!existsSync(channelDir)) {\n      mkdirSync(channelDir, { recursive: true });\n    }\n    return channelDir;\n  }\n\n  /**\n   * Generate a unique local filename for an attachment\n   */\n  generateLocalFilename(originalName: string, timestamp: string): string {\n    // Convert slack timestamp (1234567890.123456) to milliseconds\n    const ts = Math.floor(parseFloat(timestamp) * 1000);\n    // Sanitize original name (remove problematic characters)\n    const sanitized = originalName.replace(/[^a-zA-Z0-9._-]/g, \"_\");\n    return `${ts}_${sanitized}`;\n  }\n\n  /**\n   * Process attachments from a Slack message event\n   * Returns attachment metadata and queues downloads\n   */\n  processAttachments(\n    channelId: string,\n    files: Array<{ name?: string; url_private_download?: string; url_private?: string }>,\n    timestamp: string,\n  ): Attachment[] {\n    const attachments: Attachment[] = [];\n\n    for (const file of files) {\n      const url = file.url_private_download || file.url_private;\n      if (!url) continue;\n      if (!file.name) {\n        log.logWarning(\"Attachment missing name, skipping\", url);\n        continue;\n      }\n\n      const filename = this.generateLocalFilename(file.name, timestamp);\n      const localPath = `${channelId}/attachments/${filename}`;\n\n      attachments.push({\n        original: file.name,\n        localPath,\n      });\n\n      // Queue for background download\n      this.pendingDownloads.push({ channelId, localPath, url });\n    }\n\n    // Trigger background download\n    this.processDownloadQueue();\n\n    return attachments;\n  }\n\n  /**\n   * Log a message to the channel's log.jsonl\n   * Returns false if message was already logged (duplicate)\n   */\n  async logMessage(channelId: string, message: LoggedMessage): Promise<boolean> {\n    // Check for duplicate (same channel + timestamp)\n    const dedupeKey = `${channelId}:${message.ts}`;\n    if (this.recentlyLogged.has(dedupeKey)) {\n      return false; // Already logged\n    }\n\n    // Mark as logged and schedule cleanup after 60 seconds\n    this.recentlyLogged.set(dedupeKey, Date.now());\n    setTimeout(() => this.recentlyLogged.delete(dedupeKey), 60000);\n\n    const logPath = join(this.getChannelDir(channelId), \"log.jsonl\");\n\n    // Ensure message has a date field\n    if (!message.date) {\n      // Parse timestamp to get date\n      let date: Date;\n      if (message.ts.includes(\".\")) {\n        // Slack timestamp format (1234567890.123456)\n        date = new Date(parseFloat(message.ts) * 1000);\n      } else {\n        // Epoch milliseconds\n        date = new Date(parseInt(message.ts, 10));\n      }\n      message.date = date.toISOString();\n    }\n\n    const line = `${JSON.stringify(message)}\\n`;\n    await appendFile(logPath, line, \"utf-8\");\n    return true;\n  }\n\n  /**\n   * Log a bot response\n   */\n  async logBotResponse(channelId: string, text: string, ts: string): Promise<void> {\n    await this.logMessage(channelId, {\n      date: new Date().toISOString(),\n      ts,\n      user: \"bot\",\n      text,\n      attachments: [],\n      isBot: true,\n    });\n  }\n\n  /**\n   * Get the timestamp of the last logged message for a channel\n   * Returns null if no log exists\n   */\n  getLastTimestamp(channelId: string): string | null {\n    const logPath = join(this.workingDir, channelId, \"log.jsonl\");\n    if (!existsSync(logPath)) {\n      return null;\n    }\n\n    try {\n      const content = readFileSync(logPath, \"utf-8\");\n      const lines = content.trim().split(\"\\n\");\n      if (lines.length === 0 || lines[0] === \"\") {\n        return null;\n      }\n      const lastLine = lines[lines.length - 1];\n      const message = JSON.parse(lastLine) as LoggedMessage;\n      return message.ts;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Process the download queue in the background\n   */\n  private async processDownloadQueue(): Promise<void> {\n    if (this.isDownloading || this.pendingDownloads.length === 0) return;\n\n    this.isDownloading = true;\n\n    while (this.pendingDownloads.length > 0) {\n      const item = this.pendingDownloads.shift();\n      if (!item) break;\n\n      try {\n        await this.downloadAttachment(item.localPath, item.url);\n        // Success - could add success logging here if we have context\n      } catch (error) {\n        const errorMsg = error instanceof Error ? error.message : String(error);\n        log.logWarning(`Failed to download attachment`, `${item.localPath}: ${errorMsg}`);\n      }\n    }\n\n    this.isDownloading = false;\n  }\n\n  /**\n   * Download a single attachment\n   */\n  private async downloadAttachment(localPath: string, url: string): Promise<void> {\n    const filePath = join(this.workingDir, localPath);\n\n    // Ensure directory exists\n    const parentDir = join(this.workingDir, localPath.substring(0, localPath.lastIndexOf(\"/\")));\n    if (!existsSync(parentDir)) {\n      mkdirSync(parentDir, { recursive: true });\n    }\n\n    const response = await fetch(url, {\n      headers: {\n        Authorization: `Bearer ${this.botToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n    }\n\n    const buffer = await response.arrayBuffer();\n    await writeFile(filePath, Buffer.from(buffer));\n  }\n}\n"]}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAS;IAGzB,OAAO,CAAC,cAAc,CAA6B;IAEnD,YAAY,MAAM,EAAE,kBAAkB,EAQrC;IAED;;OAEG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAMvC;IAED;;OAEG;IACH,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAMrE;IAED;;;OAGG;IACG,kBAAkB,CACtB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,EACpF,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,EAAE,CAAC,CA+BvB;IAED;;;OAGG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CA8B5E;IAED;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/E;IAED;;;OAGG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkBjD;YAKa,kBAAkB;CAsBjC","sourcesContent":["import { existsSync, mkdirSync, readFileSync } from \"fs\";\nimport { appendFile, writeFile } from \"fs/promises\";\nimport { join } from \"path\";\nimport * as log from \"./log.js\";\n\nexport interface Attachment {\n  original: string; // original filename from uploader\n  localPath: string; // path relative to working dir (e.g., \"C12345/attachments/1732531234567_file.png\")\n}\n\nexport interface LoggedMessage {\n  date: string; // ISO 8601 date (e.g., \"2025-11-26T10:44:00.000Z\") for easy grepping\n  ts: string; // slack timestamp or epoch ms\n  user: string; // user ID (or \"bot\" for bot responses)\n  userName?: string; // handle (e.g., \"mario\")\n  displayName?: string; // display name (e.g., \"Mario Zechner\")\n  text: string;\n  attachments: Attachment[];\n  isBot: boolean;\n  threadTs?: string; // slack thread timestamp (root message ts)\n}\n\nexport interface ChannelStoreConfig {\n  workingDir: string;\n  botToken: string; // needed for authenticated file downloads\n}\n\nexport class ChannelStore {\n  private workingDir: string;\n  private botToken: string;\n  // Track recently logged message timestamps to prevent duplicates\n  // Key: \"channelId:ts\", automatically cleaned up after 60 seconds\n  private recentlyLogged = new Map<string, number>();\n\n  constructor(config: ChannelStoreConfig) {\n    this.workingDir = config.workingDir;\n    this.botToken = config.botToken;\n\n    // Ensure working directory exists\n    if (!existsSync(this.workingDir)) {\n      mkdirSync(this.workingDir, { recursive: true });\n    }\n  }\n\n  /**\n   * Get or create the directory for a channel/DM\n   */\n  getChannelDir(channelId: string): string {\n    const channelDir = join(this.workingDir, channelId);\n    if (!existsSync(channelDir)) {\n      mkdirSync(channelDir, { recursive: true });\n    }\n    return channelDir;\n  }\n\n  /**\n   * Generate a unique local filename for an attachment\n   */\n  generateLocalFilename(originalName: string, timestamp: string): string {\n    // Convert slack timestamp (1234567890.123456) to milliseconds\n    const ts = Math.floor(parseFloat(timestamp) * 1000);\n    // Sanitize original name (remove problematic characters)\n    const sanitized = originalName.replace(/[^a-zA-Z0-9._-]/g, \"_\");\n    return `${ts}_${sanitized}`;\n  }\n\n  /**\n   * Process attachments from a Slack message event.\n   * Downloads files before returning so callers only receive readable paths.\n   */\n  async processAttachments(\n    channelId: string,\n    files: Array<{ name?: string; url_private_download?: string; url_private?: string }>,\n    timestamp: string,\n  ): Promise<Attachment[]> {\n    const downloads: Array<Promise<Attachment | null>> = [];\n\n    for (const file of files) {\n      const url = file.url_private_download || file.url_private;\n      if (!url) continue;\n      if (!file.name) {\n        log.logWarning(\"Attachment missing name, skipping\", url);\n        continue;\n      }\n\n      const filename = this.generateLocalFilename(file.name, timestamp);\n      const localPath = `${channelId}/attachments/${filename}`;\n      const attachment: Attachment = {\n        original: file.name,\n        localPath,\n      };\n\n      downloads.push(\n        this.downloadAttachment(localPath, url)\n          .then(() => attachment)\n          .catch((error) => {\n            const errorMsg = error instanceof Error ? error.message : String(error);\n            log.logWarning(`Failed to download attachment`, `${localPath}: ${errorMsg}`);\n            return null;\n          }),\n      );\n    }\n\n    const attachments = await Promise.all(downloads);\n    return attachments.filter((attachment): attachment is Attachment => attachment !== null);\n  }\n\n  /**\n   * Log a message to the channel's log.jsonl\n   * Returns false if message was already logged (duplicate)\n   */\n  async logMessage(channelId: string, message: LoggedMessage): Promise<boolean> {\n    // Check for duplicate (same channel + timestamp)\n    const dedupeKey = `${channelId}:${message.ts}`;\n    if (this.recentlyLogged.has(dedupeKey)) {\n      return false; // Already logged\n    }\n\n    // Mark as logged and schedule cleanup after 60 seconds\n    this.recentlyLogged.set(dedupeKey, Date.now());\n    setTimeout(() => this.recentlyLogged.delete(dedupeKey), 60000);\n\n    const logPath = join(this.getChannelDir(channelId), \"log.jsonl\");\n\n    // Ensure message has a date field\n    if (!message.date) {\n      // Parse timestamp to get date\n      let date: Date;\n      if (message.ts.includes(\".\")) {\n        // Slack timestamp format (1234567890.123456)\n        date = new Date(parseFloat(message.ts) * 1000);\n      } else {\n        // Epoch milliseconds\n        date = new Date(parseInt(message.ts, 10));\n      }\n      message.date = date.toISOString();\n    }\n\n    const line = `${JSON.stringify(message)}\\n`;\n    await appendFile(logPath, line, \"utf-8\");\n    return true;\n  }\n\n  /**\n   * Log a bot response\n   */\n  async logBotResponse(channelId: string, text: string, ts: string): Promise<void> {\n    await this.logMessage(channelId, {\n      date: new Date().toISOString(),\n      ts,\n      user: \"bot\",\n      text,\n      attachments: [],\n      isBot: true,\n    });\n  }\n\n  /**\n   * Get the timestamp of the last logged message for a channel\n   * Returns null if no log exists\n   */\n  getLastTimestamp(channelId: string): string | null {\n    const logPath = join(this.workingDir, channelId, \"log.jsonl\");\n    if (!existsSync(logPath)) {\n      return null;\n    }\n\n    try {\n      const content = readFileSync(logPath, \"utf-8\");\n      const lines = content.trim().split(\"\\n\");\n      if (lines.length === 0 || lines[0] === \"\") {\n        return null;\n      }\n      const lastLine = lines[lines.length - 1];\n      const message = JSON.parse(lastLine) as LoggedMessage;\n      return message.ts;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Download a single attachment\n   */\n  private async downloadAttachment(localPath: string, url: string): Promise<void> {\n    const filePath = join(this.workingDir, localPath);\n\n    // Ensure directory exists\n    const parentDir = join(this.workingDir, localPath.substring(0, localPath.lastIndexOf(\"/\")));\n    if (!existsSync(parentDir)) {\n      mkdirSync(parentDir, { recursive: true });\n    }\n\n    const response = await fetch(url, {\n      headers: {\n        Authorization: `Bearer ${this.botToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n    }\n\n    const buffer = await response.arrayBuffer();\n    await writeFile(filePath, Buffer.from(buffer));\n  }\n}\n"]}

package/dist/store.js

@@ -4,8 +4,6 @@ import { join } from "path";
 import * as log from "./log.js";
 export class ChannelStore {
     constructor(config) {
-        this.pendingDownloads = [];
-        this.isDownloading = false;
         // Track recently logged message timestamps to prevent duplicates
         // Key: "channelId:ts", automatically cleaned up after 60 seconds
         this.recentlyLogged = new Map();
@@ -37,11 +35,11 @@ export class ChannelStore {
         return `${ts}_${sanitized}`;
     }
     /**
-     * Process attachments from a Slack message event
-     * Returns attachment metadata and queues downloads
+     * Process attachments from a Slack message event.
+     * Downloads files before returning so callers only receive readable paths.
      */
-    processAttachments(channelId, files, timestamp) {
-        const attachments = [];
+    async processAttachments(channelId, files, timestamp) {
+        const downloads = [];
         for (const file of files) {
             const url = file.url_private_download || file.url_private;
             if (!url)
@@ -52,16 +50,20 @@ export class ChannelStore {
             }
             const filename = this.generateLocalFilename(file.name, timestamp);
             const localPath = `${channelId}/attachments/${filename}`;
-            attachments.push({
+            const attachment = {
                 original: file.name,
                 localPath,
-            });
-            // Queue for background download
-            this.pendingDownloads.push({ channelId, localPath, url });
+            };
+            downloads.push(this.downloadAttachment(localPath, url)
+                .then(() => attachment)
+                .catch((error) => {
+                const errorMsg = error instanceof Error ? error.message : String(error);
+                log.logWarning(`Failed to download attachment`, `${localPath}: ${errorMsg}`);
+                return null;
+            }));
         }
-        // Trigger background download
-        this.processDownloadQueue();
-        return attachments;
+        const attachments = await Promise.all(downloads);
+        return attachments.filter((attachment) => attachment !== null);
     }
     /**
      * Log a message to the channel's log.jsonl
@@ -131,28 +133,6 @@ export class ChannelStore {
             return null;
         }
     }
-    /**
-     * Process the download queue in the background
-     */
-    async processDownloadQueue() {
-        if (this.isDownloading || this.pendingDownloads.length === 0)
-            return;
-        this.isDownloading = true;
-        while (this.pendingDownloads.length > 0) {
-            const item = this.pendingDownloads.shift();
-            if (!item)
-                break;
-            try {
-                await this.downloadAttachment(item.localPath, item.url);
-                // Success - could add success logging here if we have context
-            }
-            catch (error) {
-                const errorMsg = error instanceof Error ? error.message : String(error);
-                log.logWarning(`Failed to download attachment`, `${item.localPath}: ${errorMsg}`);
-            }
-        }
-        this.isDownloading = false;
-    }
     /**
      * Download a single attachment
      */

package/dist/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AA8BhC,MAAM,OAAO,YAAY;IASvB,YAAY,MAA0B;QAN9B,qBAAgB,GAAsB,EAAE,CAAC;QACzC,kBAAa,GAAG,KAAK,CAAC;QAC9B,iEAAiE;QACjE,iEAAiE;QACzD,mBAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;QAGjD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEhC,kCAAkC;QAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,SAAiB;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,YAAoB,EAAE,SAAiB;QAC3D,8DAA8D;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;QACpD,yDAAyD;QACzD,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAChE,OAAO,GAAG,EAAE,IAAI,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAChB,SAAiB,EACjB,KAAoF,EACpF,SAAiB;QAEjB,MAAM,WAAW,GAAiB,EAAE,CAAC;QAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,WAAW,CAAC;YAC1D,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACf,GAAG,CAAC,UAAU,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAClE,MAAM,SAAS,GAAG,GAAG,SAAS,gBAAgB,QAAQ,EAAE,CAAC;YAEzD,WAAW,CAAC,IAAI,CAAC;gBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,SAAS;aACV,CAAC,CAAC;YAEH,gCAAgC;YAChC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAE5B,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,OAAsB;QACxD,iDAAiD;QACjD,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC,CAAC,iBAAiB;QACjC,CAAC;QAED,uDAAuD;QACvD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/C,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC;QAEjE,kCAAkC;QAClC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,8BAA8B;YAC9B,IAAI,IAAU,CAAC;YACf,IAAI,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,6CAA6C;gBAC7C,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,qBAAqB;gBACrB,IAAI,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;QAC5C,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB,EAAE,IAAY,EAAE,EAAU;QAC9D,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE;YAC/B,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC9B,EAAE;YACF,IAAI,EAAE,KAAK;YACX,IAAI;YACJ,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,SAAiB;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAkB,CAAC;YACtD,OAAO,OAAO,CAAC,EAAE,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,oBAAoB;QAChC,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAErE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAE1B,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;YAC3C,IAAI,CAAC,IAAI;gBAAE,MAAM;YAEjB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;gBACxD,8DAA8D;YAChE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxE,GAAG,CAAC,UAAU,CAAC,+BAA+B,EAAE,GAAG,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAAC,SAAiB,EAAE,GAAW;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAElD,0BAA0B;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE;aACzC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;CACF","sourcesContent":["import { existsSync, mkdirSync, readFileSync } from \"fs\";\nimport { appendFile, writeFile } from \"fs/promises\";\nimport { join } from \"path\";\nimport * as log from \"./log.js\";\n\nexport interface Attachment {\n  original: string; // original filename from uploader\n  localPath: string; // path relative to working dir (e.g., \"C12345/attachments/1732531234567_file.png\")\n}\n\nexport interface LoggedMessage {\n  date: string; // ISO 8601 date (e.g., \"2025-11-26T10:44:00.000Z\") for easy grepping\n  ts: string; // slack timestamp or epoch ms\n  user: string; // user ID (or \"bot\" for bot responses)\n  userName?: string; // handle (e.g., \"mario\")\n  displayName?: string; // display name (e.g., \"Mario Zechner\")\n  text: string;\n  attachments: Attachment[];\n  isBot: boolean;\n  threadTs?: string; // slack thread timestamp (root message ts)\n}\n\nexport interface ChannelStoreConfig {\n  workingDir: string;\n  botToken: string; // needed for authenticated file downloads\n}\n\ninterface PendingDownload {\n  channelId: string;\n  localPath: string; // relative path\n  url: string;\n}\n\nexport class ChannelStore {\n  private workingDir: string;\n  private botToken: string;\n  private pendingDownloads: PendingDownload[] = [];\n  private isDownloading = false;\n  // Track recently logged message timestamps to prevent duplicates\n  // Key: \"channelId:ts\", automatically cleaned up after 60 seconds\n  private recentlyLogged = new Map<string, number>();\n\n  constructor(config: ChannelStoreConfig) {\n    this.workingDir = config.workingDir;\n    this.botToken = config.botToken;\n\n    // Ensure working directory exists\n    if (!existsSync(this.workingDir)) {\n      mkdirSync(this.workingDir, { recursive: true });\n    }\n  }\n\n  /**\n   * Get or create the directory for a channel/DM\n   */\n  getChannelDir(channelId: string): string {\n    const channelDir = join(this.workingDir, channelId);\n    if (!existsSync(channelDir)) {\n      mkdirSync(channelDir, { recursive: true });\n    }\n    return channelDir;\n  }\n\n  /**\n   * Generate a unique local filename for an attachment\n   */\n  generateLocalFilename(originalName: string, timestamp: string): string {\n    // Convert slack timestamp (1234567890.123456) to milliseconds\n    const ts = Math.floor(parseFloat(timestamp) * 1000);\n    // Sanitize original name (remove problematic characters)\n    const sanitized = originalName.replace(/[^a-zA-Z0-9._-]/g, \"_\");\n    return `${ts}_${sanitized}`;\n  }\n\n  /**\n   * Process attachments from a Slack message event\n   * Returns attachment metadata and queues downloads\n   */\n  processAttachments(\n    channelId: string,\n    files: Array<{ name?: string; url_private_download?: string; url_private?: string }>,\n    timestamp: string,\n  ): Attachment[] {\n    const attachments: Attachment[] = [];\n\n    for (const file of files) {\n      const url = file.url_private_download || file.url_private;\n      if (!url) continue;\n      if (!file.name) {\n        log.logWarning(\"Attachment missing name, skipping\", url);\n        continue;\n      }\n\n      const filename = this.generateLocalFilename(file.name, timestamp);\n      const localPath = `${channelId}/attachments/${filename}`;\n\n      attachments.push({\n        original: file.name,\n        localPath,\n      });\n\n      // Queue for background download\n      this.pendingDownloads.push({ channelId, localPath, url });\n    }\n\n    // Trigger background download\n    this.processDownloadQueue();\n\n    return attachments;\n  }\n\n  /**\n   * Log a message to the channel's log.jsonl\n   * Returns false if message was already logged (duplicate)\n   */\n  async logMessage(channelId: string, message: LoggedMessage): Promise<boolean> {\n    // Check for duplicate (same channel + timestamp)\n    const dedupeKey = `${channelId}:${message.ts}`;\n    if (this.recentlyLogged.has(dedupeKey)) {\n      return false; // Already logged\n    }\n\n    // Mark as logged and schedule cleanup after 60 seconds\n    this.recentlyLogged.set(dedupeKey, Date.now());\n    setTimeout(() => this.recentlyLogged.delete(dedupeKey), 60000);\n\n    const logPath = join(this.getChannelDir(channelId), \"log.jsonl\");\n\n    // Ensure message has a date field\n    if (!message.date) {\n      // Parse timestamp to get date\n      let date: Date;\n      if (message.ts.includes(\".\")) {\n        // Slack timestamp format (1234567890.123456)\n        date = new Date(parseFloat(message.ts) * 1000);\n      } else {\n        // Epoch milliseconds\n        date = new Date(parseInt(message.ts, 10));\n      }\n      message.date = date.toISOString();\n    }\n\n    const line = `${JSON.stringify(message)}\\n`;\n    await appendFile(logPath, line, \"utf-8\");\n    return true;\n  }\n\n  /**\n   * Log a bot response\n   */\n  async logBotResponse(channelId: string, text: string, ts: string): Promise<void> {\n    await this.logMessage(channelId, {\n      date: new Date().toISOString(),\n      ts,\n      user: \"bot\",\n      text,\n      attachments: [],\n      isBot: true,\n    });\n  }\n\n  /**\n   * Get the timestamp of the last logged message for a channel\n   * Returns null if no log exists\n   */\n  getLastTimestamp(channelId: string): string | null {\n    const logPath = join(this.workingDir, channelId, \"log.jsonl\");\n    if (!existsSync(logPath)) {\n      return null;\n    }\n\n    try {\n      const content = readFileSync(logPath, \"utf-8\");\n      const lines = content.trim().split(\"\\n\");\n      if (lines.length === 0 || lines[0] === \"\") {\n        return null;\n      }\n      const lastLine = lines[lines.length - 1];\n      const message = JSON.parse(lastLine) as LoggedMessage;\n      return message.ts;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Process the download queue in the background\n   */\n  private async processDownloadQueue(): Promise<void> {\n    if (this.isDownloading || this.pendingDownloads.length === 0) return;\n\n    this.isDownloading = true;\n\n    while (this.pendingDownloads.length > 0) {\n      const item = this.pendingDownloads.shift();\n      if (!item) break;\n\n      try {\n        await this.downloadAttachment(item.localPath, item.url);\n        // Success - could add success logging here if we have context\n      } catch (error) {\n        const errorMsg = error instanceof Error ? error.message : String(error);\n        log.logWarning(`Failed to download attachment`, `${item.localPath}: ${errorMsg}`);\n      }\n    }\n\n    this.isDownloading = false;\n  }\n\n  /**\n   * Download a single attachment\n   */\n  private async downloadAttachment(localPath: string, url: string): Promise<void> {\n    const filePath = join(this.workingDir, localPath);\n\n    // Ensure directory exists\n    const parentDir = join(this.workingDir, localPath.substring(0, localPath.lastIndexOf(\"/\")));\n    if (!existsSync(parentDir)) {\n      mkdirSync(parentDir, { recursive: true });\n    }\n\n    const response = await fetch(url, {\n      headers: {\n        Authorization: `Bearer ${this.botToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n    }\n\n    const buffer = await response.arrayBuffer();\n    await writeFile(filePath, Buffer.from(buffer));\n  }\n}\n"]}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAwBhC,MAAM,OAAO,YAAY;IAOvB,YAAY,MAA0B;QAJtC,iEAAiE;QACjE,iEAAiE;QACzD,mBAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;QAGjD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEhC,kCAAkC;QAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,SAAiB;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,YAAoB,EAAE,SAAiB;QAC3D,8DAA8D;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;QACpD,yDAAyD;QACzD,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAChE,OAAO,GAAG,EAAE,IAAI,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CACtB,SAAiB,EACjB,KAAoF,EACpF,SAAiB;QAEjB,MAAM,SAAS,GAAsC,EAAE,CAAC;QAExD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,WAAW,CAAC;YAC1D,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACf,GAAG,CAAC,UAAU,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAClE,MAAM,SAAS,GAAG,GAAG,SAAS,gBAAgB,QAAQ,EAAE,CAAC;YACzD,MAAM,UAAU,GAAe;gBAC7B,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,SAAS;aACV,CAAC;YAEF,SAAS,CAAC,IAAI,CACZ,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC;iBACpC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC;iBACtB,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,MAAM,QAAQ,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxE,GAAG,CAAC,UAAU,CAAC,+BAA+B,EAAE,GAAG,SAAS,KAAK,QAAQ,EAAE,CAAC,CAAC;gBAC7E,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CACL,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAA4B,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;IAC3F,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,OAAsB;QACxD,iDAAiD;QACjD,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC,CAAC,iBAAiB;QACjC,CAAC;QAED,uDAAuD;QACvD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/C,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC;QAEjE,kCAAkC;QAClC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,8BAA8B;YAC9B,IAAI,IAAU,CAAC;YACf,IAAI,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,6CAA6C;gBAC7C,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,qBAAqB;gBACrB,IAAI,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;QAC5C,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB,EAAE,IAAY,EAAE,EAAU;QAC9D,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE;YAC/B,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC9B,EAAE;YACF,IAAI,EAAE,KAAK;YACX,IAAI;YACJ,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,SAAiB;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAkB,CAAC;YACtD,OAAO,OAAO,CAAC,EAAE,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAAC,SAAiB,EAAE,GAAW;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAElD,0BAA0B;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE;aACzC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;CACF","sourcesContent":["import { existsSync, mkdirSync, readFileSync } from \"fs\";\nimport { appendFile, writeFile } from \"fs/promises\";\nimport { join } from \"path\";\nimport * as log from \"./log.js\";\n\nexport interface Attachment {\n  original: string; // original filename from uploader\n  localPath: string; // path relative to working dir (e.g., \"C12345/attachments/1732531234567_file.png\")\n}\n\nexport interface LoggedMessage {\n  date: string; // ISO 8601 date (e.g., \"2025-11-26T10:44:00.000Z\") for easy grepping\n  ts: string; // slack timestamp or epoch ms\n  user: string; // user ID (or \"bot\" for bot responses)\n  userName?: string; // handle (e.g., \"mario\")\n  displayName?: string; // display name (e.g., \"Mario Zechner\")\n  text: string;\n  attachments: Attachment[];\n  isBot: boolean;\n  threadTs?: string; // slack thread timestamp (root message ts)\n}\n\nexport interface ChannelStoreConfig {\n  workingDir: string;\n  botToken: string; // needed for authenticated file downloads\n}\n\nexport class ChannelStore {\n  private workingDir: string;\n  private botToken: string;\n  // Track recently logged message timestamps to prevent duplicates\n  // Key: \"channelId:ts\", automatically cleaned up after 60 seconds\n  private recentlyLogged = new Map<string, number>();\n\n  constructor(config: ChannelStoreConfig) {\n    this.workingDir = config.workingDir;\n    this.botToken = config.botToken;\n\n    // Ensure working directory exists\n    if (!existsSync(this.workingDir)) {\n      mkdirSync(this.workingDir, { recursive: true });\n    }\n  }\n\n  /**\n   * Get or create the directory for a channel/DM\n   */\n  getChannelDir(channelId: string): string {\n    const channelDir = join(this.workingDir, channelId);\n    if (!existsSync(channelDir)) {\n      mkdirSync(channelDir, { recursive: true });\n    }\n    return channelDir;\n  }\n\n  /**\n   * Generate a unique local filename for an attachment\n   */\n  generateLocalFilename(originalName: string, timestamp: string): string {\n    // Convert slack timestamp (1234567890.123456) to milliseconds\n    const ts = Math.floor(parseFloat(timestamp) * 1000);\n    // Sanitize original name (remove problematic characters)\n    const sanitized = originalName.replace(/[^a-zA-Z0-9._-]/g, \"_\");\n    return `${ts}_${sanitized}`;\n  }\n\n  /**\n   * Process attachments from a Slack message event.\n   * Downloads files before returning so callers only receive readable paths.\n   */\n  async processAttachments(\n    channelId: string,\n    files: Array<{ name?: string; url_private_download?: string; url_private?: string }>,\n    timestamp: string,\n  ): Promise<Attachment[]> {\n    const downloads: Array<Promise<Attachment | null>> = [];\n\n    for (const file of files) {\n      const url = file.url_private_download || file.url_private;\n      if (!url) continue;\n      if (!file.name) {\n        log.logWarning(\"Attachment missing name, skipping\", url);\n        continue;\n      }\n\n      const filename = this.generateLocalFilename(file.name, timestamp);\n      const localPath = `${channelId}/attachments/${filename}`;\n      const attachment: Attachment = {\n        original: file.name,\n        localPath,\n      };\n\n      downloads.push(\n        this.downloadAttachment(localPath, url)\n          .then(() => attachment)\n          .catch((error) => {\n            const errorMsg = error instanceof Error ? error.message : String(error);\n            log.logWarning(`Failed to download attachment`, `${localPath}: ${errorMsg}`);\n            return null;\n          }),\n      );\n    }\n\n    const attachments = await Promise.all(downloads);\n    return attachments.filter((attachment): attachment is Attachment => attachment !== null);\n  }\n\n  /**\n   * Log a message to the channel's log.jsonl\n   * Returns false if message was already logged (duplicate)\n   */\n  async logMessage(channelId: string, message: LoggedMessage): Promise<boolean> {\n    // Check for duplicate (same channel + timestamp)\n    const dedupeKey = `${channelId}:${message.ts}`;\n    if (this.recentlyLogged.has(dedupeKey)) {\n      return false; // Already logged\n    }\n\n    // Mark as logged and schedule cleanup after 60 seconds\n    this.recentlyLogged.set(dedupeKey, Date.now());\n    setTimeout(() => this.recentlyLogged.delete(dedupeKey), 60000);\n\n    const logPath = join(this.getChannelDir(channelId), \"log.jsonl\");\n\n    // Ensure message has a date field\n    if (!message.date) {\n      // Parse timestamp to get date\n      let date: Date;\n      if (message.ts.includes(\".\")) {\n        // Slack timestamp format (1234567890.123456)\n        date = new Date(parseFloat(message.ts) * 1000);\n      } else {\n        // Epoch milliseconds\n        date = new Date(parseInt(message.ts, 10));\n      }\n      message.date = date.toISOString();\n    }\n\n    const line = `${JSON.stringify(message)}\\n`;\n    await appendFile(logPath, line, \"utf-8\");\n    return true;\n  }\n\n  /**\n   * Log a bot response\n   */\n  async logBotResponse(channelId: string, text: string, ts: string): Promise<void> {\n    await this.logMessage(channelId, {\n      date: new Date().toISOString(),\n      ts,\n      user: \"bot\",\n      text,\n      attachments: [],\n      isBot: true,\n    });\n  }\n\n  /**\n   * Get the timestamp of the last logged message for a channel\n   * Returns null if no log exists\n   */\n  getLastTimestamp(channelId: string): string | null {\n    const logPath = join(this.workingDir, channelId, \"log.jsonl\");\n    if (!existsSync(logPath)) {\n      return null;\n    }\n\n    try {\n      const content = readFileSync(logPath, \"utf-8\");\n      const lines = content.trim().split(\"\\n\");\n      if (lines.length === 0 || lines[0] === \"\") {\n        return null;\n      }\n      const lastLine = lines[lines.length - 1];\n      const message = JSON.parse(lastLine) as LoggedMessage;\n      return message.ts;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Download a single attachment\n   */\n  private async downloadAttachment(localPath: string, url: string): Promise<void> {\n    const filePath = join(this.workingDir, localPath);\n\n    // Ensure directory exists\n    const parentDir = join(this.workingDir, localPath.substring(0, localPath.lastIndexOf(\"/\")));\n    if (!existsSync(parentDir)) {\n      mkdirSync(parentDir, { recursive: true });\n    }\n\n    const response = await fetch(url, {\n      headers: {\n        Authorization: `Bearer ${this.botToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n    }\n\n    const buffer = await response.arrayBuffer();\n    await writeFile(filePath, Buffer.from(buffer));\n  }\n}\n"]}

package/dist/tools/event.d.ts

@@ -13,6 +13,8 @@ interface EventToolContext {
     conversationId: string;
     conversationKind: "direct" | "shared";
     userId: string;
+    sessionKey: string;
+    threadTs?: string;
 }
 export declare function createEventTool(workspaceDir: string): {
     tool: AgentTool<typeof eventSchema>;

package/dist/tools/event.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"event.d.ts","sourceRoot":"","sources":["../../src/tools/event.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAG7D,QAAA,MAAM,WAAW;;;;;;;;EA0Bf,CAAC;AAEH,UAAU,gBAAgB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;CAChB;AAyCD,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG;IACrD,IAAI,EAAE,SAAS,CAAC,OAAO,WAAW,CAAC,CAAC;IACpC,eAAe,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,IAAI,CAAC;CACtD,CAkDA","sourcesContent":["import { mkdir, writeFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { AgentTool } from \"@mariozechner/pi-agent-core\";\nimport { Type } from \"@sinclair/typebox\";\n\nconst eventSchema = Type.Object({\n  label: Type.String({\n    description: \"Brief description of the event you're scheduling (shown to user)\",\n  }),\n  type: Type.Union([Type.Literal(\"immediate\"), Type.Literal(\"one-shot\"), Type.Literal(\"periodic\")]),\n  text: Type.String({ description: \"The reminder or event text to send when it fires\" }),\n  at: Type.Optional(\n    Type.String({\n      description: \"ISO 8601 timestamp with offset, required for one-shot events\",\n    }),\n  ),\n  schedule: Type.Optional(\n    Type.String({\n      description: \"Cron schedule, required for periodic events\",\n    }),\n  ),\n  timezone: Type.Optional(\n    Type.String({\n      description: \"IANA timezone, required for periodic events\",\n    }),\n  ),\n  filenamePrefix: Type.Optional(\n    Type.String({\n      description: \"Optional filename prefix for the event file\",\n    }),\n  ),\n});\n\ninterface EventToolContext {\n  platform: string;\n  conversationId: string;\n  conversationKind: \"direct\" | \"shared\";\n  userId: string;\n}\n\ntype EventToolParams = {\n  label: string;\n  type: \"immediate\" | \"one-shot\" | \"periodic\";\n  text: string;\n  at?: string;\n  schedule?: string;\n  timezone?: string;\n  filenamePrefix?: string;\n};\n\ntype EventPayload =\n  | {\n      type: \"immediate\";\n      platform: string;\n      conversationId: string;\n      conversationKind: \"direct\" | \"shared\";\n      userId: string;\n      text: string;\n    }\n  | {\n      type: \"one-shot\";\n      platform: string;\n      conversationId: string;\n      conversationKind: \"direct\" | \"shared\";\n      userId: string;\n      text: string;\n      at: string;\n    }\n  | {\n      type: \"periodic\";\n      platform: string;\n      conversationId: string;\n      conversationKind: \"direct\" | \"shared\";\n      userId: string;\n      text: string;\n      schedule: string;\n      timezone: string;\n    };\n\nexport function createEventTool(workspaceDir: string): {\n  tool: AgentTool<typeof eventSchema>;\n  setEventContext: (context: EventToolContext) => void;\n} {\n  let eventContext: EventToolContext | null = null;\n\n  const tool: AgentTool<typeof eventSchema> = {\n    name: \"event\",\n    label: \"event\",\n    description:\n      \"Schedule an immediate, one-shot, or periodic event for the current conversation. This automatically writes to the correct events directory and fills the current platform, conversation, conversation kind, and requester userId.\",\n    parameters: eventSchema,\n    execute: async (_toolCallId: string, params: EventToolParams, signal?: AbortSignal) => {\n      if (signal?.aborted) {\n        throw new Error(\"Operation aborted\");\n      }\n\n      if (!eventContext) {\n        throw new Error(\"Event context not configured\");\n      }\n\n      const payload = buildEventPayload(params, eventContext);\n      const eventsDir = join(workspaceDir, \"events\");\n      await mkdir(eventsDir, { recursive: true });\n\n      const prefix = sanitizeFileSegment(params.filenamePrefix || payload.type || \"event\");\n      const filename = `${prefix}-${Date.now()}.json`;\n      const filePath = join(eventsDir, filename);\n      await writeFile(filePath, JSON.stringify(payload) + \"\\n\", \"utf-8\");\n\n      return {\n        content: [\n          {\n            type: \"text\",\n            text:\n              payload.type === \"periodic\"\n                ? `Scheduled periodic event ${filename} for ${payload.platform}/${payload.conversationId} (${payload.schedule} ${payload.timezone})`\n                : payload.type === \"one-shot\"\n                  ? `Scheduled one-shot event ${filename} for ${payload.platform}/${payload.conversationId} at ${payload.at}`\n                  : `Queued immediate event ${filename} for ${payload.platform}/${payload.conversationId}`,\n          },\n        ],\n        details: undefined,\n      };\n    },\n  };\n\n  return {\n    tool,\n    setEventContext: (context: EventToolContext) => {\n      eventContext = context;\n    },\n  };\n}\n\nfunction buildEventPayload(params: EventToolParams, context: EventToolContext): EventPayload {\n  const base = {\n    platform: context.platform,\n    conversationId: context.conversationId,\n    conversationKind: context.conversationKind,\n    userId: context.userId,\n    text: params.text,\n  };\n\n  if (params.type === \"immediate\") {\n    return { ...base, type: \"immediate\" };\n  }\n\n  if (params.type === \"one-shot\") {\n    if (!params.at) {\n      throw new Error(\"`at` is required for one-shot events\");\n    }\n    return { ...base, type: \"one-shot\", at: params.at };\n  }\n\n  if (!params.schedule) {\n    throw new Error(\"`schedule` is required for periodic events\");\n  }\n  if (!params.timezone) {\n    throw new Error(\"`timezone` is required for periodic events\");\n  }\n  return {\n    ...base,\n    type: \"periodic\",\n    schedule: params.schedule,\n    timezone: params.timezone,\n  };\n}\n\nfunction sanitizeFileSegment(value: string): string {\n  const sanitized = value\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9._-]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return sanitized || \"event\";\n}\n"]}
+{"version":3,"file":"event.d.ts","sourceRoot":"","sources":["../../src/tools/event.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAI7D,QAAA,MAAM,WAAW;;;;;;;;EA0Bf,CAAC;AAEH,UAAU,gBAAgB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA4CD,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG;IACrD,IAAI,EAAE,SAAS,CAAC,OAAO,WAAW,CAAC,CAAC;IACpC,eAAe,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,IAAI,CAAC;CACtD,CAgEA","sourcesContent":["import { mkdir, stat, writeFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { AgentTool } from \"@mariozechner/pi-agent-core\";\nimport { Type } from \"@sinclair/typebox\";\nimport * as log from \"../log.js\";\n\nconst eventSchema = Type.Object({\n  label: Type.String({\n    description: \"Brief description of the event you're scheduling (shown to user)\",\n  }),\n  type: Type.Union([Type.Literal(\"immediate\"), Type.Literal(\"one-shot\"), Type.Literal(\"periodic\")]),\n  text: Type.String({ description: \"The reminder or event text to send when it fires\" }),\n  at: Type.Optional(\n    Type.String({\n      description: \"ISO 8601 timestamp with offset, required for one-shot events\",\n    }),\n  ),\n  schedule: Type.Optional(\n    Type.String({\n      description: \"Cron schedule, required for periodic events\",\n    }),\n  ),\n  timezone: Type.Optional(\n    Type.String({\n      description: \"IANA timezone, required for periodic events\",\n    }),\n  ),\n  filenamePrefix: Type.Optional(\n    Type.String({\n      description: \"Optional filename prefix for the event file\",\n    }),\n  ),\n});\n\ninterface EventToolContext {\n  platform: string;\n  conversationId: string;\n  conversationKind: \"direct\" | \"shared\";\n  userId: string;\n  sessionKey: string;\n  threadTs?: string;\n}\n\ntype EventToolParams = {\n  label: string;\n  type: \"immediate\" | \"one-shot\" | \"periodic\";\n  text: string;\n  at?: string;\n  schedule?: string;\n  timezone?: string;\n  filenamePrefix?: string;\n};\n\ntype EventPayload =\n  | {\n      type: \"immediate\";\n      platform: string;\n      conversationId: string;\n      conversationKind: \"direct\" | \"shared\";\n      userId: string;\n      text: string;\n      sessionKey?: string;\n      threadTs?: string;\n    }\n  | {\n      type: \"one-shot\";\n      platform: string;\n      conversationId: string;\n      conversationKind: \"direct\" | \"shared\";\n      userId: string;\n      text: string;\n      at: string;\n    }\n  | {\n      type: \"periodic\";\n      platform: string;\n      conversationId: string;\n      conversationKind: \"direct\" | \"shared\";\n      userId: string;\n      text: string;\n      schedule: string;\n      timezone: string;\n      sessionKey?: string;\n    };\n\nexport function createEventTool(workspaceDir: string): {\n  tool: AgentTool<typeof eventSchema>;\n  setEventContext: (context: EventToolContext) => void;\n} {\n  let eventContext: EventToolContext | null = null;\n\n  const tool: AgentTool<typeof eventSchema> = {\n    name: \"event\",\n    label: \"event\",\n    description:\n      \"Schedule an immediate, one-shot, or periodic event for the current conversation. This automatically writes to the correct events directory and fills the current platform, conversation, conversation kind, and requester userId.\",\n    parameters: eventSchema,\n    execute: async (_toolCallId: string, params: EventToolParams, signal?: AbortSignal) => {\n      if (signal?.aborted) {\n        throw new Error(\"Operation aborted\");\n      }\n\n      if (!eventContext) {\n        throw new Error(\"Event context not configured\");\n      }\n\n      const payload = buildEventPayload(params, eventContext);\n      const eventsDir = join(workspaceDir, \"events\");\n      await mkdir(eventsDir, { recursive: true });\n\n      const prefix = sanitizeFileSegment(params.filenamePrefix || payload.type || \"event\");\n      const filename = `${prefix}-${Date.now()}.json`;\n      const filePath = join(eventsDir, filename);\n      const content = JSON.stringify(payload) + \"\\n\";\n\n      log.logInfo(\n        `Writing event file: ${filePath} (type=${payload.type}, platform=${payload.platform}, conversation=${payload.conversationId})`,\n      );\n      await writeFile(filePath, content, \"utf-8\");\n\n      try {\n        const fileStat = await stat(filePath);\n        log.logInfo(\n          `Wrote event file: ${filePath} (${fileStat.size} bytes, mtime=${fileStat.mtime.toISOString()})`,\n        );\n      } catch (err) {\n        log.logWarning(`Event file missing immediately after write: ${filePath}`, String(err));\n      }\n\n      return {\n        content: [\n          {\n            type: \"text\",\n            text:\n              payload.type === \"periodic\"\n                ? `Scheduled periodic event ${filename} for ${payload.platform}/${payload.conversationId} (${payload.schedule} ${payload.timezone})`\n                : payload.type === \"one-shot\"\n                  ? `Scheduled one-shot event ${filename} for ${payload.platform}/${payload.conversationId} at ${payload.at}`\n                  : `Queued immediate event ${filename} for ${payload.platform}/${payload.conversationId}`,\n          },\n        ],\n        details: undefined,\n      };\n    },\n  };\n\n  return {\n    tool,\n    setEventContext: (context: EventToolContext) => {\n      eventContext = context;\n    },\n  };\n}\n\nfunction buildEventPayload(params: EventToolParams, context: EventToolContext): EventPayload {\n  const base = {\n    platform: context.platform,\n    conversationId: context.conversationId,\n    conversationKind: context.conversationKind,\n    userId: context.userId,\n    text: params.text,\n  };\n\n  if (params.type === \"immediate\") {\n    return {\n      ...base,\n      type: \"immediate\",\n      sessionKey: context.sessionKey,\n      ...(context.threadTs ? { threadTs: context.threadTs } : {}),\n    };\n  }\n\n  if (params.type === \"one-shot\") {\n    if (!params.at) {\n      throw new Error(\"`at` is required for one-shot events\");\n    }\n    // No sessionKey or threadTs: reminders should fire as top-level messages, not buried in old threads\n    return { ...base, type: \"one-shot\", at: params.at };\n  }\n\n  if (!params.schedule) {\n    throw new Error(\"`schedule` is required for periodic events\");\n  }\n  if (!params.timezone) {\n    throw new Error(\"`timezone` is required for periodic events\");\n  }\n  // No threadTs: periodic events should always be top-level; keep sessionKey for task context\n  return {\n    ...base,\n    type: \"periodic\",\n    schedule: params.schedule,\n    timezone: params.timezone,\n    sessionKey: context.sessionKey,\n  };\n}\n\nfunction sanitizeFileSegment(value: string): string {\n  const sanitized = value\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9._-]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return sanitized || \"event\";\n}\n"]}

package/dist/tools/event.js

@@ -1,6 +1,7 @@
-import { mkdir, writeFile } from "node:fs/promises";
+import { mkdir, stat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { Type } from "@sinclair/typebox";
+import * as log from "../log.js";
 const eventSchema = Type.Object({
     label: Type.String({
         description: "Brief description of the event you're scheduling (shown to user)",
@@ -40,7 +41,16 @@ export function createEventTool(workspaceDir) {
             const prefix = sanitizeFileSegment(params.filenamePrefix || payload.type || "event");
             const filename = `${prefix}-${Date.now()}.json`;
             const filePath = join(eventsDir, filename);
-            await writeFile(filePath, JSON.stringify(payload) + "\n", "utf-8");
+            const content = JSON.stringify(payload) + "\n";
+            log.logInfo(`Writing event file: ${filePath} (type=${payload.type}, platform=${payload.platform}, conversation=${payload.conversationId})`);
+            await writeFile(filePath, content, "utf-8");
+            try {
+                const fileStat = await stat(filePath);
+                log.logInfo(`Wrote event file: ${filePath} (${fileStat.size} bytes, mtime=${fileStat.mtime.toISOString()})`);
+            }
+            catch (err) {
+                log.logWarning(`Event file missing immediately after write: ${filePath}`, String(err));
+            }
             return {
                 content: [
                     {
@@ -72,12 +82,18 @@ function buildEventPayload(params, context) {
         text: params.text,
     };
     if (params.type === "immediate") {
-        return { ...base, type: "immediate" };
+        return {
+            ...base,
+            type: "immediate",
+            sessionKey: context.sessionKey,
+            ...(context.threadTs ? { threadTs: context.threadTs } : {}),
+        };
     }
     if (params.type === "one-shot") {
         if (!params.at) {
             throw new Error("`at` is required for one-shot events");
         }
+        // No sessionKey or threadTs: reminders should fire as top-level messages, not buried in old threads
         return { ...base, type: "one-shot", at: params.at };
     }
     if (!params.schedule) {
@@ -86,11 +102,13 @@ function buildEventPayload(params, context) {
     if (!params.timezone) {
         throw new Error("`timezone` is required for periodic events");
     }
+    // No threadTs: periodic events should always be top-level; keep sessionKey for task context
     return {
         ...base,
         type: "periodic",
         schedule: params.schedule,
         timezone: params.timezone,
+        sessionKey: context.sessionKey,
     };
 }
 function sanitizeFileSegment(value) {

package/dist/tools/event.js.map

@@ -1 +1 @@
-{"version":3,"file":"event.js","sourceRoot":"","sources":["../../src/tools/event.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAEzC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;QACjB,WAAW,EAAE,kEAAkE;KAChF,CAAC;IACF,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACjG,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;IACtF,EAAE,EAAE,IAAI,CAAC,QAAQ,CACf,IAAI,CAAC,MAAM,CAAC;QACV,WAAW,EAAE,8DAA8D;KAC5E,CAAC,CACH;IACD,QAAQ,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACV,WAAW,EAAE,6CAA6C;KAC3D,CAAC,CACH;IACD,QAAQ,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACV,WAAW,EAAE,6CAA6C;KAC3D,CAAC,CACH;IACD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAC3B,IAAI,CAAC,MAAM,CAAC;QACV,WAAW,EAAE,6CAA6C;KAC3D,CAAC,CACH;CACF,CAAC,CAAC;AAgDH,MAAM,UAAU,eAAe,CAAC,YAAoB;IAIlD,IAAI,YAAY,GAA4B,IAAI,CAAC;IAEjD,MAAM,IAAI,GAAkC;QAC1C,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,OAAO;QACd,WAAW,EACT,mOAAmO;QACrO,UAAU,EAAE,WAAW;QACvB,OAAO,EAAE,KAAK,EAAE,WAAmB,EAAE,MAAuB,EAAE,MAAoB,EAAE,EAAE;YACpF,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;YAED,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC;YAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC/C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE5C,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC;YACrF,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;YAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC3C,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;YAEnE,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EACF,OAAO,CAAC,IAAI,KAAK,UAAU;4BACzB,CAAC,CAAC,4BAA4B,QAAQ,QAAQ,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,cAAc,KAAK,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,GAAG;4BACpI,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;gCAC3B,CAAC,CAAC,4BAA4B,QAAQ,QAAQ,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,cAAc,OAAO,OAAO,CAAC,EAAE,EAAE;gCAC3G,CAAC,CAAC,0BAA0B,QAAQ,QAAQ,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,cAAc,EAAE;qBAC/F;iBACF;gBACD,OAAO,EAAE,SAAS;aACnB,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,eAAe,EAAE,CAAC,OAAyB,EAAE,EAAE;YAC7C,YAAY,GAAG,OAAO,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAuB,EAAE,OAAyB;IAC3E,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,SAAS,GAAG,KAAK;SACpB,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,SAAS,IAAI,OAAO,CAAC;AAC9B,CAAC","sourcesContent":["import { mkdir, writeFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { AgentTool } from \"@mariozechner/pi-agent-core\";\nimport { Type } from \"@sinclair/typebox\";\n\nconst eventSchema = Type.Object({\n  label: Type.String({\n    description: \"Brief description of the event you're scheduling (shown to user)\",\n  }),\n  type: Type.Union([Type.Literal(\"immediate\"), Type.Literal(\"one-shot\"), Type.Literal(\"periodic\")]),\n  text: Type.String({ description: \"The reminder or event text to send when it fires\" }),\n  at: Type.Optional(\n    Type.String({\n      description: \"ISO 8601 timestamp with offset, required for one-shot events\",\n    }),\n  ),\n  schedule: Type.Optional(\n    Type.String({\n      description: \"Cron schedule, required for periodic events\",\n    }),\n  ),\n  timezone: Type.Optional(\n    Type.String({\n      description: \"IANA timezone, required for periodic events\",\n    }),\n  ),\n  filenamePrefix: Type.Optional(\n    Type.String({\n      description: \"Optional filename prefix for the event file\",\n    }),\n  ),\n});\n\ninterface EventToolContext {\n  platform: string;\n  conversationId: string;\n  conversationKind: \"direct\" | \"shared\";\n  userId: string;\n}\n\ntype EventToolParams = {\n  label: string;\n  type: \"immediate\" | \"one-shot\" | \"periodic\";\n  text: string;\n  at?: string;\n  schedule?: string;\n  timezone?: string;\n  filenamePrefix?: string;\n};\n\ntype EventPayload =\n  | {\n      type: \"immediate\";\n      platform: string;\n      conversationId: string;\n      conversationKind: \"direct\" | \"shared\";\n      userId: string;\n      text: string;\n    }\n  | {\n      type: \"one-shot\";\n      platform: string;\n      conversationId: string;\n      conversationKind: \"direct\" | \"shared\";\n      userId: string;\n      text: string;\n      at: string;\n    }\n  | {\n      type: \"periodic\";\n      platform: string;\n      conversationId: string;\n      conversationKind: \"direct\" | \"shared\";\n      userId: string;\n      text: string;\n      schedule: string;\n      timezone: string;\n    };\n\nexport function createEventTool(workspaceDir: string): {\n  tool: AgentTool<typeof eventSchema>;\n  setEventContext: (context: EventToolContext) => void;\n} {\n  let eventContext: EventToolContext | null = null;\n\n  const tool: AgentTool<typeof eventSchema> = {\n    name: \"event\",\n    label: \"event\",\n    description:\n      \"Schedule an immediate, one-shot, or periodic event for the current conversation. This automatically writes to the correct events directory and fills the current platform, conversation, conversation kind, and requester userId.\",\n    parameters: eventSchema,\n    execute: async (_toolCallId: string, params: EventToolParams, signal?: AbortSignal) => {\n      if (signal?.aborted) {\n        throw new Error(\"Operation aborted\");\n      }\n\n      if (!eventContext) {\n        throw new Error(\"Event context not configured\");\n      }\n\n      const payload = buildEventPayload(params, eventContext);\n      const eventsDir = join(workspaceDir, \"events\");\n      await mkdir(eventsDir, { recursive: true });\n\n      const prefix = sanitizeFileSegment(params.filenamePrefix || payload.type || \"event\");\n      const filename = `${prefix}-${Date.now()}.json`;\n      const filePath = join(eventsDir, filename);\n      await writeFile(filePath, JSON.stringify(payload) + \"\\n\", \"utf-8\");\n\n      return {\n        content: [\n          {\n            type: \"text\",\n            text:\n              payload.type === \"periodic\"\n                ? `Scheduled periodic event ${filename} for ${payload.platform}/${payload.conversationId} (${payload.schedule} ${payload.timezone})`\n                : payload.type === \"one-shot\"\n                  ? `Scheduled one-shot event ${filename} for ${payload.platform}/${payload.conversationId} at ${payload.at}`\n                  : `Queued immediate event ${filename} for ${payload.platform}/${payload.conversationId}`,\n          },\n        ],\n        details: undefined,\n      };\n    },\n  };\n\n  return {\n    tool,\n    setEventContext: (context: EventToolContext) => {\n      eventContext = context;\n    },\n  };\n}\n\nfunction buildEventPayload(params: EventToolParams, context: EventToolContext): EventPayload {\n  const base = {\n    platform: context.platform,\n    conversationId: context.conversationId,\n    conversationKind: context.conversationKind,\n    userId: context.userId,\n    text: params.text,\n  };\n\n  if (params.type === \"immediate\") {\n    return { ...base, type: \"immediate\" };\n  }\n\n  if (params.type === \"one-shot\") {\n    if (!params.at) {\n      throw new Error(\"`at` is required for one-shot events\");\n    }\n    return { ...base, type: \"one-shot\", at: params.at };\n  }\n\n  if (!params.schedule) {\n    throw new Error(\"`schedule` is required for periodic events\");\n  }\n  if (!params.timezone) {\n    throw new Error(\"`timezone` is required for periodic events\");\n  }\n  return {\n    ...base,\n    type: \"periodic\",\n    schedule: params.schedule,\n    timezone: params.timezone,\n  };\n}\n\nfunction sanitizeFileSegment(value: string): string {\n  const sanitized = value\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9._-]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return sanitized || \"event\";\n}\n"]}
+{"version":3,"file":"event.js","sourceRoot":"","sources":["../../src/tools/event.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAEjC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;QACjB,WAAW,EAAE,kEAAkE;KAChF,CAAC;IACF,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACjG,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;IACtF,EAAE,EAAE,IAAI,CAAC,QAAQ,CACf,IAAI,CAAC,MAAM,CAAC;QACV,WAAW,EAAE,8DAA8D;KAC5E,CAAC,CACH;IACD,QAAQ,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACV,WAAW,EAAE,6CAA6C;KAC3D,CAAC,CACH;IACD,QAAQ,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACV,WAAW,EAAE,6CAA6C;KAC3D,CAAC,CACH;IACD,cAAc,EAAE,IAAI,CAAC,QAAQ,CAC3B,IAAI,CAAC,MAAM,CAAC;QACV,WAAW,EAAE,6CAA6C;KAC3D,CAAC,CACH;CACF,CAAC,CAAC;AAqDH,MAAM,UAAU,eAAe,CAAC,YAAoB;IAIlD,IAAI,YAAY,GAA4B,IAAI,CAAC;IAEjD,MAAM,IAAI,GAAkC;QAC1C,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,OAAO;QACd,WAAW,EACT,mOAAmO;QACrO,UAAU,EAAE,WAAW;QACvB,OAAO,EAAE,KAAK,EAAE,WAAmB,EAAE,MAAuB,EAAE,MAAoB,EAAE,EAAE;YACpF,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;YAED,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,CAAC;YAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC/C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE5C,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC;YACrF,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;YAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;YAE/C,GAAG,CAAC,OAAO,CACT,uBAAuB,QAAQ,UAAU,OAAO,CAAC,IAAI,cAAc,OAAO,CAAC,QAAQ,kBAAkB,OAAO,CAAC,cAAc,GAAG,CAC/H,CAAC;YACF,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAE5C,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACtC,GAAG,CAAC,OAAO,CACT,qBAAqB,QAAQ,KAAK,QAAQ,CAAC,IAAI,iBAAiB,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAChG,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,UAAU,CAAC,+CAA+C,QAAQ,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACzF,CAAC;YAED,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EACF,OAAO,CAAC,IAAI,KAAK,UAAU;4BACzB,CAAC,CAAC,4BAA4B,QAAQ,QAAQ,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,cAAc,KAAK,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,GAAG;4BACpI,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;gCAC3B,CAAC,CAAC,4BAA4B,QAAQ,QAAQ,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,cAAc,OAAO,OAAO,CAAC,EAAE,EAAE;gCAC3G,CAAC,CAAC,0BAA0B,QAAQ,QAAQ,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,cAAc,EAAE;qBAC/F;iBACF;gBACD,OAAO,EAAE,SAAS;aACnB,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,eAAe,EAAE,CAAC,OAAyB,EAAE,EAAE;YAC7C,YAAY,GAAG,OAAO,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAuB,EAAE,OAAyB;IAC3E,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,OAAO;YACL,GAAG,IAAI;YACP,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,oGAAoG;QACpG,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,4FAA4F;IAC5F,OAAO;QACL,GAAG,IAAI;QACP,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,SAAS,GAAG,KAAK;SACpB,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,SAAS,IAAI,OAAO,CAAC;AAC9B,CAAC","sourcesContent":["import { mkdir, stat, writeFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { AgentTool } from \"@mariozechner/pi-agent-core\";\nimport { Type } from \"@sinclair/typebox\";\nimport * as log from \"../log.js\";\n\nconst eventSchema = Type.Object({\n  label: Type.String({\n    description: \"Brief description of the event you're scheduling (shown to user)\",\n  }),\n  type: Type.Union([Type.Literal(\"immediate\"), Type.Literal(\"one-shot\"), Type.Literal(\"periodic\")]),\n  text: Type.String({ description: \"The reminder or event text to send when it fires\" }),\n  at: Type.Optional(\n    Type.String({\n      description: \"ISO 8601 timestamp with offset, required for one-shot events\",\n    }),\n  ),\n  schedule: Type.Optional(\n    Type.String({\n      description: \"Cron schedule, required for periodic events\",\n    }),\n  ),\n  timezone: Type.Optional(\n    Type.String({\n      description: \"IANA timezone, required for periodic events\",\n    }),\n  ),\n  filenamePrefix: Type.Optional(\n    Type.String({\n      description: \"Optional filename prefix for the event file\",\n    }),\n  ),\n});\n\ninterface EventToolContext {\n  platform: string;\n  conversationId: string;\n  conversationKind: \"direct\" | \"shared\";\n  userId: string;\n  sessionKey: string;\n  threadTs?: string;\n}\n\ntype EventToolParams = {\n  label: string;\n  type: \"immediate\" | \"one-shot\" | \"periodic\";\n  text: string;\n  at?: string;\n  schedule?: string;\n  timezone?: string;\n  filenamePrefix?: string;\n};\n\ntype EventPayload =\n  | {\n      type: \"immediate\";\n      platform: string;\n      conversationId: string;\n      conversationKind: \"direct\" | \"shared\";\n      userId: string;\n      text: string;\n      sessionKey?: string;\n      threadTs?: string;\n    }\n  | {\n      type: \"one-shot\";\n      platform: string;\n      conversationId: string;\n      conversationKind: \"direct\" | \"shared\";\n      userId: string;\n      text: string;\n      at: string;\n    }\n  | {\n      type: \"periodic\";\n      platform: string;\n      conversationId: string;\n      conversationKind: \"direct\" | \"shared\";\n      userId: string;\n      text: string;\n      schedule: string;\n      timezone: string;\n      sessionKey?: string;\n    };\n\nexport function createEventTool(workspaceDir: string): {\n  tool: AgentTool<typeof eventSchema>;\n  setEventContext: (context: EventToolContext) => void;\n} {\n  let eventContext: EventToolContext | null = null;\n\n  const tool: AgentTool<typeof eventSchema> = {\n    name: \"event\",\n    label: \"event\",\n    description:\n      \"Schedule an immediate, one-shot, or periodic event for the current conversation. This automatically writes to the correct events directory and fills the current platform, conversation, conversation kind, and requester userId.\",\n    parameters: eventSchema,\n    execute: async (_toolCallId: string, params: EventToolParams, signal?: AbortSignal) => {\n      if (signal?.aborted) {\n        throw new Error(\"Operation aborted\");\n      }\n\n      if (!eventContext) {\n        throw new Error(\"Event context not configured\");\n      }\n\n      const payload = buildEventPayload(params, eventContext);\n      const eventsDir = join(workspaceDir, \"events\");\n      await mkdir(eventsDir, { recursive: true });\n\n      const prefix = sanitizeFileSegment(params.filenamePrefix || payload.type || \"event\");\n      const filename = `${prefix}-${Date.now()}.json`;\n      const filePath = join(eventsDir, filename);\n      const content = JSON.stringify(payload) + \"\\n\";\n\n      log.logInfo(\n        `Writing event file: ${filePath} (type=${payload.type}, platform=${payload.platform}, conversation=${payload.conversationId})`,\n      );\n      await writeFile(filePath, content, \"utf-8\");\n\n      try {\n        const fileStat = await stat(filePath);\n        log.logInfo(\n          `Wrote event file: ${filePath} (${fileStat.size} bytes, mtime=${fileStat.mtime.toISOString()})`,\n        );\n      } catch (err) {\n        log.logWarning(`Event file missing immediately after write: ${filePath}`, String(err));\n      }\n\n      return {\n        content: [\n          {\n            type: \"text\",\n            text:\n              payload.type === \"periodic\"\n                ? `Scheduled periodic event ${filename} for ${payload.platform}/${payload.conversationId} (${payload.schedule} ${payload.timezone})`\n                : payload.type === \"one-shot\"\n                  ? `Scheduled one-shot event ${filename} for ${payload.platform}/${payload.conversationId} at ${payload.at}`\n                  : `Queued immediate event ${filename} for ${payload.platform}/${payload.conversationId}`,\n          },\n        ],\n        details: undefined,\n      };\n    },\n  };\n\n  return {\n    tool,\n    setEventContext: (context: EventToolContext) => {\n      eventContext = context;\n    },\n  };\n}\n\nfunction buildEventPayload(params: EventToolParams, context: EventToolContext): EventPayload {\n  const base = {\n    platform: context.platform,\n    conversationId: context.conversationId,\n    conversationKind: context.conversationKind,\n    userId: context.userId,\n    text: params.text,\n  };\n\n  if (params.type === \"immediate\") {\n    return {\n      ...base,\n      type: \"immediate\",\n      sessionKey: context.sessionKey,\n      ...(context.threadTs ? { threadTs: context.threadTs } : {}),\n    };\n  }\n\n  if (params.type === \"one-shot\") {\n    if (!params.at) {\n      throw new Error(\"`at` is required for one-shot events\");\n    }\n    // No sessionKey or threadTs: reminders should fire as top-level messages, not buried in old threads\n    return { ...base, type: \"one-shot\", at: params.at };\n  }\n\n  if (!params.schedule) {\n    throw new Error(\"`schedule` is required for periodic events\");\n  }\n  if (!params.timezone) {\n    throw new Error(\"`timezone` is required for periodic events\");\n  }\n  // No threadTs: periodic events should always be top-level; keep sessionKey for task context\n  return {\n    ...base,\n    type: \"periodic\",\n    schedule: params.schedule,\n    timezone: params.timezone,\n    sessionKey: context.sessionKey,\n  };\n}\n\nfunction sanitizeFileSegment(value: string): string {\n  const sanitized = value\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9._-]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return sanitized || \"event\";\n}\n"]}

package/dist/tools/index.d.ts

@@ -8,6 +8,8 @@ export declare function createMamaTools(executor: Executor, workspaceDir: string
         conversationId: string;
         conversationKind: "direct" | "shared";
         userId: string;
+        sessionKey: string;
+        threadTs?: string;
     }) => void;
 };
 //# sourceMappingURL=index.d.ts.map

package/dist/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAO9C,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,QAAQ,EAClB,YAAY,EAAE,MAAM,GACnB;IACD,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;IACxB,iBAAiB,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IACrF,eAAe,EAAE,CAAC,OAAO,EAAE;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,EAAE,QAAQ,GAAG,QAAQ,CAAC;QACtC,MAAM,EAAE,MAAM,CAAC;KAChB,KAAK,IAAI,CAAC;CACZ,CAeA","sourcesContent":["import type { AgentTool } from \"@mariozechner/pi-agent-core\";\nimport { createAttachTool } from \"../adapters/slack/tools/attach.js\";\nimport type { Executor } from \"../sandbox.js\";\nimport { createBashTool } from \"./bash.js\";\nimport { createEditTool } from \"./edit.js\";\nimport { createEventTool } from \"./event.js\";\nimport { createReadTool } from \"./read.js\";\nimport { createWriteTool } from \"./write.js\";\n\nexport function createMamaTools(\n  executor: Executor,\n  workspaceDir: string,\n): {\n  tools: AgentTool<any>[];\n  setUploadFunction: (fn: (filePath: string, title?: string) => Promise<void>) => void;\n  setEventContext: (context: {\n    platform: string;\n    conversationId: string;\n    conversationKind: \"direct\" | \"shared\";\n    userId: string;\n  }) => void;\n} {\n  const { tool: attachTool, setUploadFunction } = createAttachTool();\n  const { tool: eventTool, setEventContext } = createEventTool(workspaceDir);\n  return {\n    tools: [\n      createReadTool(executor),\n      createBashTool(executor),\n      createEditTool(executor),\n      createWriteTool(executor),\n      eventTool,\n      attachTool,\n    ],\n    setUploadFunction,\n    setEventContext,\n  };\n}\n"]}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAO9C,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,QAAQ,EAClB,YAAY,EAAE,MAAM,GACnB;IACD,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;IACxB,iBAAiB,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IACrF,eAAe,EAAE,CAAC,OAAO,EAAE;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,EAAE,QAAQ,GAAG,QAAQ,CAAC;QACtC,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,KAAK,IAAI,CAAC;CACZ,CAeA","sourcesContent":["import type { AgentTool } from \"@mariozechner/pi-agent-core\";\nimport { createAttachTool } from \"../adapters/slack/tools/attach.js\";\nimport type { Executor } from \"../sandbox.js\";\nimport { createBashTool } from \"./bash.js\";\nimport { createEditTool } from \"./edit.js\";\nimport { createEventTool } from \"./event.js\";\nimport { createReadTool } from \"./read.js\";\nimport { createWriteTool } from \"./write.js\";\n\nexport function createMamaTools(\n  executor: Executor,\n  workspaceDir: string,\n): {\n  tools: AgentTool<any>[];\n  setUploadFunction: (fn: (filePath: string, title?: string) => Promise<void>) => void;\n  setEventContext: (context: {\n    platform: string;\n    conversationId: string;\n    conversationKind: \"direct\" | \"shared\";\n    userId: string;\n    sessionKey: string;\n    threadTs?: string;\n  }) => void;\n} {\n  const { tool: attachTool, setUploadFunction } = createAttachTool();\n  const { tool: eventTool, setEventContext } = createEventTool(workspaceDir);\n  return {\n    tools: [\n      createReadTool(executor),\n      createBashTool(executor),\n      createEditTool(executor),\n      createWriteTool(executor),\n      eventTool,\n      attachTool,\n    ],\n    setUploadFunction,\n    setEventContext,\n  };\n}\n"]}

package/dist/tools/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAErE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,UAAU,eAAe,CAC7B,QAAkB,EAClB,YAAoB;IAWpB,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,EAAE,CAAC;IACnE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IAC3E,OAAO;QACL,KAAK,EAAE;YACL,cAAc,CAAC,QAAQ,CAAC;YACxB,cAAc,CAAC,QAAQ,CAAC;YACxB,cAAc,CAAC,QAAQ,CAAC;YACxB,eAAe,CAAC,QAAQ,CAAC;YACzB,SAAS;YACT,UAAU;SACX;QACD,iBAAiB;QACjB,eAAe;KAChB,CAAC;AACJ,CAAC","sourcesContent":["import type { AgentTool } from \"@mariozechner/pi-agent-core\";\nimport { createAttachTool } from \"../adapters/slack/tools/attach.js\";\nimport type { Executor } from \"../sandbox.js\";\nimport { createBashTool } from \"./bash.js\";\nimport { createEditTool } from \"./edit.js\";\nimport { createEventTool } from \"./event.js\";\nimport { createReadTool } from \"./read.js\";\nimport { createWriteTool } from \"./write.js\";\n\nexport function createMamaTools(\n  executor: Executor,\n  workspaceDir: string,\n): {\n  tools: AgentTool<any>[];\n  setUploadFunction: (fn: (filePath: string, title?: string) => Promise<void>) => void;\n  setEventContext: (context: {\n    platform: string;\n    conversationId: string;\n    conversationKind: \"direct\" | \"shared\";\n    userId: string;\n  }) => void;\n} {\n  const { tool: attachTool, setUploadFunction } = createAttachTool();\n  const { tool: eventTool, setEventContext } = createEventTool(workspaceDir);\n  return {\n    tools: [\n      createReadTool(executor),\n      createBashTool(executor),\n      createEditTool(executor),\n      createWriteTool(executor),\n      eventTool,\n      attachTool,\n    ],\n    setUploadFunction,\n    setEventContext,\n  };\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAErE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,UAAU,eAAe,CAC7B,QAAkB,EAClB,YAAoB;IAapB,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,EAAE,CAAC;IACnE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IAC3E,OAAO;QACL,KAAK,EAAE;YACL,cAAc,CAAC,QAAQ,CAAC;YACxB,cAAc,CAAC,QAAQ,CAAC;YACxB,cAAc,CAAC,QAAQ,CAAC;YACxB,eAAe,CAAC,QAAQ,CAAC;YACzB,SAAS;YACT,UAAU;SACX;QACD,iBAAiB;QACjB,eAAe;KAChB,CAAC;AACJ,CAAC","sourcesContent":["import type { AgentTool } from \"@mariozechner/pi-agent-core\";\nimport { createAttachTool } from \"../adapters/slack/tools/attach.js\";\nimport type { Executor } from \"../sandbox.js\";\nimport { createBashTool } from \"./bash.js\";\nimport { createEditTool } from \"./edit.js\";\nimport { createEventTool } from \"./event.js\";\nimport { createReadTool } from \"./read.js\";\nimport { createWriteTool } from \"./write.js\";\n\nexport function createMamaTools(\n  executor: Executor,\n  workspaceDir: string,\n): {\n  tools: AgentTool<any>[];\n  setUploadFunction: (fn: (filePath: string, title?: string) => Promise<void>) => void;\n  setEventContext: (context: {\n    platform: string;\n    conversationId: string;\n    conversationKind: \"direct\" | \"shared\";\n    userId: string;\n    sessionKey: string;\n    threadTs?: string;\n  }) => void;\n} {\n  const { tool: attachTool, setUploadFunction } = createAttachTool();\n  const { tool: eventTool, setEventContext } = createEventTool(workspaceDir);\n  return {\n    tools: [\n      createReadTool(executor),\n      createBashTool(executor),\n      createEditTool(executor),\n      createWriteTool(executor),\n      eventTool,\n      attachTool,\n    ],\n    setUploadFunction,\n    setEventContext,\n  };\n}\n"]}

package/dist/vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAOlD,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACpC;AAED,+CAA+C;AAC/C,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,yCAAyC;AACzC,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,UAAU,CAAC;IAC5C,2FAA2F;IAC3F,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;IACzC,2FAA2F;IAC3F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uCAAuC;IACvC,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;QACjE,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,eAAe,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,wEAAwE;IACxE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;IACnD,8DAA8D;IAC9D,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,GAAG,aAAa,CAAC;IAC3E,iCAAiC;IACjC,IAAI,IAAI,aAAa,EAAE,CAAC;IACxB,yCAAyC;IACzC,MAAM,IAAI,IAAI,CAAC;IACf,2DAA2D;IAC3D,SAAS,IAAI,OAAO,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/C;;;OAGG;IACH,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9D,kFAAkF;IAClF,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC1D,yFAAyF;IACzF,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3F;AAID;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA4BpE;AAID,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,YAAY,QAAQ,EAAE,MAAM,EAI3B;IAED,MAAM,IAAI,IAAI,CA2Bb;IAED,sFAAsF;IACtF,OAAO,CAAC,2BAA2B;IAkBnC,SAAS,IAAI,OAAO,CAEnB;IAED,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7B;IAED,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAIjD;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,GAAG,aAAa,CAkDzE;IAED,IAAI,IAAI,aAAa,EAAE,CAQtB;IAED,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAQ7C;IAED,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CA8C5D;IAED,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAexD;IAED,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAgBxF;IAID,OAAO,CAAC,aAAa;IAmBrB,OAAO,CAAC,kBAAkB;IAkB1B,OAAO,CAAC,gBAAgB;IAwBxB,OAAO,CAAC,aAAa;IA2BrB,OAAO,CAAC,iBAAiB;CAsB1B;AAyED,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAGnE","sourcesContent":["import {\n  chmodSync,\n  closeSync,\n  constants as fsConstants,\n  existsSync,\n  mkdirSync,\n  openSync,\n  readFileSync,\n  renameSync,\n  unlinkSync,\n  writeSync,\n} from \"fs\";\nimport { randomBytes } from \"crypto\";\nimport { basename, dirname, isAbsolute, join, normalize, sep } from \"path\";\nimport type { SandboxConfig } from \"./sandbox.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\n\n// ── Types ──────────────────────────────────────────────────────────────────────\n\n/** Shape of workspace/vaults/vault.json */\nexport interface VaultConfig {\n  vaults: Record<string, VaultEntry>;\n}\n\n/** Per-user vault mount entry in vault.json */\nexport interface VaultMountEntry {\n  source: string;\n  target?: string;\n}\n\n/** Per-user vault entry in vault.json */\nexport interface VaultEntry {\n  displayName: string;\n  platform?: \"slack\" | \"discord\" | \"telegram\";\n  /** Subdirs/files in vault dir to mount into sandbox (e.g. [\".gcloud\", \".ssh\", \".kube\"]) */\n  mounts?: Array<string | VaultMountEntry>;\n  /** Whether to load env file as environment variables (default: true if env file exists) */\n  envFile?: boolean;\n  /** Per-user sandbox config override */\n  sandbox?: {\n    type?: \"image\" | \"firecracker\" | \"host\" | \"container\" | \"docker\";\n    container?: string;\n    image?: string;\n    vmId?: string;\n    sshUser?: string;\n    sshPort?: number;\n  };\n}\n\nexport interface ResolvedVaultMount {\n  source: string;\n  target: string;\n}\n\n/** Resolved vault ready for use at runtime */\nexport interface ResolvedVault {\n  userId: string;\n  displayName: string;\n  /** Absolute path to vault directory */\n  dir: string;\n  /** Absolute mount specs */\n  mounts: ResolvedVaultMount[];\n  /** Parsed from env file */\n  env: Record<string, string>;\n  sandboxOverride?: VaultEntry[\"sandbox\"];\n}\n\nexport interface VaultManager {\n  /** Return true when vault.json contains this exact key. */\n  hasEntry(key: string): boolean;\n  /** Resolve vault for a user; returns undefined when no entry exists. */\n  resolve(userId: string): ResolvedVault | undefined;\n  /** Get sandbox config with credential injection for a user */\n  getSandboxConfig(userId: string, baseConfig: SandboxConfig): SandboxConfig;\n  /** List all configured vaults */\n  list(): ResolvedVault[];\n  /** Re-read vault.json without restart */\n  reload(): void;\n  /** Check if vault system is enabled (vault.json exists) */\n  isEnabled(): boolean;\n  /**\n   * Add a vault entry and persist to disk.\n   * No-op if the key already exists (idempotent).\n   */\n  addEntry(key: string, entry: VaultEntry): void;\n  /**\n   * Ensure a vault entry has image sandbox metadata.\n   * Creates the entry when missing and upgrades existing entries that lack sandbox.type.\n   */\n  ensureImageSandboxEntry(key: string, entry: VaultEntry): void;\n  /** Merge environment variables into vaults/<key>/env and persist them to disk. */\n  upsertEnv(key: string, env: Record<string, string>): void;\n  /** Write a private file into vaults/<key>/ and ensure it is mounted into the sandbox. */\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void;\n}\n\n// ── parseEnvFile ───────────────────────────────────────────────────────────────\n\n/**\n * Parse a KEY=VALUE env file. Supports:\n * - Lines starting with # are comments\n * - Empty lines are skipped\n * - Values can be quoted with single or double quotes (quotes are stripped)\n * - No variable expansion\n * - The value is everything after the first `=` to end of line (no inline comments)\n */\nexport function parseEnvFile(content: string): Record<string, string> {\n  const env: Record<string, string> = {};\n  const lines = content.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\").split(\"\\n\");\n\n  for (const line of lines) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) continue;\n\n    const eqIndex = trimmed.indexOf(\"=\");\n    if (eqIndex === -1) continue;\n\n    const key = trimmed.slice(0, eqIndex).trim();\n    if (!key) continue;\n\n    let value = trimmed.slice(eqIndex + 1);\n\n    // Strip matching quotes\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n\n    env[key] = value;\n  }\n\n  return env;\n}\n\n// ── FileVaultManager ───────────────────────────────────────────────────────────\n\nexport class FileVaultManager implements VaultManager {\n  private config: VaultConfig | null = null;\n  private readonly vaultsDir: string;\n  private readonly configPath: string;\n\n  constructor(stateDir: string) {\n    this.vaultsDir = join(stateDir, \"vaults\");\n    this.configPath = join(this.vaultsDir, \"vault.json\");\n    this.reload();\n  }\n\n  reload(): void {\n    if (!existsSync(this.configPath)) {\n      this.config = null;\n      return;\n    }\n\n    try {\n      const raw = readFileSync(this.configPath, \"utf-8\");\n      const parsed = JSON.parse(raw);\n\n      if (\n        !parsed ||\n        typeof parsed !== \"object\" ||\n        !parsed.vaults ||\n        typeof parsed.vaults !== \"object\"\n      ) {\n        console.error(`vault: malformed vault.json — expected { vaults: { ... } }`);\n        this.config = null;\n        return;\n      }\n\n      this.config = parsed as VaultConfig;\n      this.warnUnsupportedSandboxTypes();\n    } catch (err) {\n      console.error(`vault: failed to read ${this.configPath}:`, err);\n      this.config = null;\n    }\n  }\n\n  /** Warn for legacy or insecure vault sandbox overrides that are no longer allowed. */\n  private warnUnsupportedSandboxTypes(): void {\n    if (!this.config) return;\n    for (const [key, entry] of Object.entries(this.config.vaults)) {\n      if (entry.sandbox?.type === \"host\") {\n        console.error(\n          `vault: \"${key}\" uses sandbox.type=host, which is blocked for credential isolation. ` +\n            \"Use sandbox.type=image or sandbox.type=firecracker.\",\n        );\n      }\n      if (entry.sandbox?.type === \"container\" || entry.sandbox?.type === \"docker\") {\n        console.error(\n          `vault: \"${key}\" uses sandbox.type=${entry.sandbox.type}, which is blocked for credential isolation. ` +\n            \"Use sandbox.type=image for per-user containers or sandbox.type=firecracker.\",\n        );\n      }\n    }\n  }\n\n  isEnabled(): boolean {\n    return this.config !== null;\n  }\n\n  hasEntry(key: string): boolean {\n    return !!this.config?.vaults[key];\n  }\n\n  resolve(userId: string): ResolvedVault | undefined {\n    const entry = this.config?.vaults[userId];\n    if (!entry) return undefined;\n    return this.buildResolved(userId, entry);\n  }\n\n  getSandboxConfig(userId: string, baseConfig: SandboxConfig): SandboxConfig {\n    const vault = this.resolve(userId);\n    if (!vault?.sandboxOverride) return baseConfig;\n\n    const override = vault.sandboxOverride;\n\n    if (override.type === \"image\") {\n      if (baseConfig.type !== \"image\") {\n        throw new Error(\n          `vault \"${userId}\" sets sandbox.type=image, but base sandbox is \"${baseConfig.type}\". ` +\n            \"Use --sandbox=image:<image> to enable per-user managed containers.\",\n        );\n      }\n      const container = override.container || `mama-sandbox-${userId}`;\n      return { type: \"container\", container };\n    }\n\n    if (override.type === \"firecracker\") {\n      if (!override.vmId) return baseConfig;\n      if (baseConfig.type !== \"firecracker\") {\n        throw new Error(\n          `vault \"${userId}\" sets sandbox.type=firecracker, but base sandbox is \"${baseConfig.type}\". ` +\n            \"Use --sandbox=firecracker:<vm-id>:<host-path> so /workspace stays mapped to the real workspace.\",\n        );\n      }\n      return {\n        type: \"firecracker\",\n        vmId: override.vmId,\n        hostPath: baseConfig.hostPath,\n        sshUser: override.sshUser,\n        sshPort: override.sshPort,\n      };\n    }\n\n    if (override.type === \"host\") {\n      throw new Error(\n        `vault \"${userId}\" uses sandbox.type=host, which is blocked for credential isolation. ` +\n          \"Use sandbox.type=image or sandbox.type=firecracker.\",\n      );\n    }\n\n    if (override.type === \"container\" || override.type === \"docker\") {\n      throw new Error(\n        `vault \"${userId}\" uses sandbox.type=${override.type}, which is blocked for credential isolation. ` +\n          \"Use sandbox.type=image for per-user containers or sandbox.type=firecracker.\",\n      );\n    }\n\n    // No type override — return base config unchanged\n    return baseConfig;\n  }\n\n  list(): ResolvedVault[] {\n    if (!this.config) return [];\n\n    const results: ResolvedVault[] = [];\n    for (const [key, entry] of Object.entries(this.config.vaults)) {\n      results.push(this.buildResolved(key, entry));\n    }\n    return results;\n  }\n\n  addEntry(key: string, entry: VaultEntry): void {\n    if (!this.config) {\n      this.config = { vaults: {} };\n    }\n    // Idempotent: skip if already exists\n    if (this.config.vaults[key]) return;\n    this.config.vaults[key] = entry;\n    this.persistConfig();\n  }\n\n  ensureImageSandboxEntry(key: string, entry: VaultEntry): void {\n    if (entry.sandbox?.type !== \"image\") {\n      throw new Error(`vault: ensureImageSandboxEntry requires sandbox.type=image for \"${key}\"`);\n    }\n\n    if (!this.config) {\n      this.config = { vaults: {} };\n    }\n\n    const existing = this.config.vaults[key];\n    if (!existing) {\n      this.config.vaults[key] = entry;\n      this.persistConfig();\n      return;\n    }\n\n    let nextEntry = existing;\n    let changed = false;\n\n    if (!existing.platform && entry.platform) {\n      nextEntry = { ...nextEntry, platform: entry.platform };\n      changed = true;\n    }\n\n    const existingSandbox = existing.sandbox;\n    if (!existingSandbox?.type) {\n      nextEntry = { ...nextEntry, sandbox: entry.sandbox };\n      changed = true;\n    } else if (\n      existingSandbox.type === \"image\" &&\n      !existingSandbox.container &&\n      entry.sandbox.container\n    ) {\n      nextEntry = {\n        ...nextEntry,\n        sandbox: { ...existingSandbox, container: entry.sandbox.container },\n      };\n      changed = true;\n    }\n\n    if (!changed) {\n      return;\n    }\n\n    this.config.vaults[key] = nextEntry;\n    this.persistConfig();\n  }\n\n  upsertEnv(key: string, env: Record<string, string>): void {\n    const dir = join(this.vaultsDir, key);\n    const envPath = join(dir, \"env\");\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const existing = existsSync(envPath)\n      ? parseEnvFile(readFileSync(envPath, \"utf-8\"))\n      : ({} as Record<string, string>);\n    const merged = { ...existing, ...env };\n    const content =\n      Object.entries(merged)\n        .sort(([left], [right]) => left.localeCompare(right))\n        .map(([envKey, value]) => `${envKey}=${value}`)\n        .join(\"\\n\") + \"\\n\";\n    atomicWritePrivateFile(envPath, content);\n  }\n\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void {\n    const normalizedPath = normalizeVaultRelativePath(relativePath);\n    const normalizedTarget = normalizeVaultTargetPath(targetPath);\n    if (!normalizedPath || (targetPath !== undefined && !normalizedTarget)) {\n      throw new Error(`vault: invalid relative secret file path for \"${key}\": ${relativePath}`);\n    }\n\n    const dir = join(this.vaultsDir, key);\n    const filePath = join(dir, normalizedPath);\n\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const parentDir = dirname(filePath);\n    if (parentDir !== dir) ensurePrivateDir(parentDir);\n    atomicWritePrivateFile(filePath, content);\n    this.ensureMountEntry(key, normalizedPath, normalizedTarget);\n  }\n\n  // ── private ────────────────────────────────────────────────────────────────\n\n  private persistConfig(): void {\n    ensurePrivateDir(this.vaultsDir);\n\n    // Preserve concurrent external edits: pull in any entries that appear on\n    // disk but not in our in-memory view, so a background edit (e.g. another\n    // admin adding a user) is not silently dropped by the next upsert here.\n    // Individual field edits still follow last-writer-wins per key.\n    const onDisk = this.readConfigFromDisk();\n    if (onDisk && this.config) {\n      for (const [key, entry] of Object.entries(onDisk.vaults)) {\n        if (!(key in this.config.vaults)) {\n          this.config.vaults[key] = entry;\n        }\n      }\n    }\n\n    atomicWritePrivateFile(this.configPath, JSON.stringify(this.config, null, 2) + \"\\n\");\n  }\n\n  private readConfigFromDisk(): VaultConfig | null {\n    if (!existsSync(this.configPath)) return null;\n    try {\n      const parsed = JSON.parse(readFileSync(this.configPath, \"utf-8\"));\n      if (\n        !parsed ||\n        typeof parsed !== \"object\" ||\n        !parsed.vaults ||\n        typeof parsed.vaults !== \"object\"\n      ) {\n        return null;\n      }\n      return parsed as VaultConfig;\n    } catch {\n      return null;\n    }\n  }\n\n  private ensureMountEntry(key: string, relativePath: string, targetPath?: string): void {\n    if (!this.config?.vaults[key]) {\n      throw new Error(`vault: cannot add mount \"${relativePath}\" for missing entry \"${key}\"`);\n    }\n\n    const existing = this.config.vaults[key];\n    const mounts = existing.mounts ?? [];\n    if (\n      mounts.some((mount) =>\n        typeof mount === \"string\"\n          ? mount === relativePath && !targetPath\n          : mount.source === relativePath && mount.target === targetPath,\n      )\n    ) {\n      return;\n    }\n\n    this.config.vaults[key] = {\n      ...existing,\n      mounts: [...mounts, targetPath ? { source: relativePath, target: targetPath } : relativePath],\n    };\n    this.persistConfig();\n  }\n\n  private buildResolved(key: string, entry: VaultEntry): ResolvedVault {\n    const dir = join(this.vaultsDir, key);\n\n    const mounts = (entry.mounts ?? [])\n      .map((mount) => this.resolveMountEntry(dir, mount))\n      .filter((mount): mount is ResolvedVaultMount => mount !== undefined);\n\n    let env: Record<string, string> = {};\n    const envPath = join(dir, \"env\");\n    if (entry.envFile !== false && existsSync(envPath)) {\n      try {\n        env = parseEnvFile(readFileSync(envPath, \"utf-8\"));\n      } catch (err) {\n        console.error(`vault: failed to parse env file for \"${key}\":`, err);\n      }\n    }\n\n    return {\n      userId: key,\n      displayName: entry.displayName,\n      dir,\n      mounts,\n      env,\n      sandboxOverride: entry.sandbox,\n    };\n  }\n\n  private resolveMountEntry(\n    dir: string,\n    mount: string | VaultMountEntry,\n  ): ResolvedVaultMount | undefined {\n    if (typeof mount === \"string\") {\n      const normalizedSource = normalizeVaultRelativePath(mount);\n      if (!normalizedSource) return undefined;\n      return {\n        source: join(dir, normalizedSource),\n        target: defaultVaultTargetPath(normalizedSource),\n      };\n    }\n\n    if (!mount || typeof mount !== \"object\") return undefined;\n    const normalizedSource = normalizeVaultRelativePath(mount.source);\n    if (!normalizedSource) return undefined;\n    const normalizedTarget = normalizeVaultTargetPath(mount.target);\n    return {\n      source: join(dir, normalizedSource),\n      target: normalizedTarget ?? defaultVaultTargetPath(normalizedSource),\n    };\n  }\n}\n\nfunction ensurePrivateDir(path: string): void {\n  mkdirSync(path, { recursive: true, mode: PRIVATE_DIR_MODE });\n  chmodSync(path, PRIVATE_DIR_MODE);\n}\n\n/**\n * Write `content` to `targetPath` with mode 0600, even when `targetPath`\n * already exists. Uses O_CREAT|O_EXCL on a temp sibling (so the kernel\n * guarantees permissions at creation, not after a racy chmod) and then\n * rename(2) into place for atomicity. Readers never see a torn write.\n */\nfunction atomicWritePrivateFile(targetPath: string, content: string): void {\n  const dir = dirname(targetPath);\n  const tmpPath = join(\n    dir,\n    `.${basename(targetPath)}.${process.pid}.${randomBytes(8).toString(\"hex\")}.tmp`,\n  );\n  const fd = openSync(\n    tmpPath,\n    fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL,\n    PRIVATE_FILE_MODE,\n  );\n  try {\n    writeSync(fd, content);\n  } catch (err) {\n    try {\n      unlinkSync(tmpPath);\n    } catch {\n      // ignore — original error is more informative\n    }\n    throw err;\n  } finally {\n    closeSync(fd);\n  }\n  try {\n    renameSync(tmpPath, targetPath);\n  } catch (err) {\n    try {\n      unlinkSync(tmpPath);\n    } catch {\n      // ignore\n    }\n    throw err;\n  }\n}\n\nfunction normalizeVaultRelativePath(relativePath: string): string | undefined {\n  const trimmed = relativePath.trim();\n  if (!trimmed || isAbsolute(trimmed)) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  if (!normalized || normalized === \".\" || normalized === \"..\" || normalized.startsWith(\"../\")) {\n    return undefined;\n  }\n  return normalized;\n}\n\nfunction normalizeVaultTargetPath(targetPath?: string): string | undefined {\n  if (targetPath === undefined) {\n    return undefined;\n  }\n\n  const trimmed = targetPath.trim();\n  if (!trimmed || !trimmed.startsWith(\"/\")) {\n    return undefined;\n  }\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  return normalized.startsWith(\"/\") ? normalized : undefined;\n}\n\nexport function defaultVaultTargetPath(relativePath: string): string {\n  const normalized = normalizeVaultRelativePath(relativePath) ?? relativePath.replace(/^\\/+/, \"\");\n  return `/root/${normalized}`;\n}\n"]}
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAOlD,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACpC;AAED,+CAA+C;AAC/C,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,yCAAyC;AACzC,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,UAAU,CAAC;IAC5C,2FAA2F;IAC3F,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;IACzC,2FAA2F;IAC3F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uCAAuC;IACvC,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,EAAE,OAAO,GAAG,aAAa,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;QACjE,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,eAAe,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,wEAAwE;IACxE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;IACnD,8DAA8D;IAC9D,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,GAAG,aAAa,CAAC;IAC3E,iCAAiC;IACjC,IAAI,IAAI,aAAa,EAAE,CAAC;IACxB,yCAAyC;IACzC,MAAM,IAAI,IAAI,CAAC;IACf,2DAA2D;IAC3D,SAAS,IAAI,OAAO,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/C;;;OAGG;IACH,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9D,kFAAkF;IAClF,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC1D,yFAAyF;IACzF,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3F;AAID;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA4BpE;AAID,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC,YAAY,QAAQ,EAAE,MAAM,EAI3B;IAED,MAAM,IAAI,IAAI,CA2Bb;IAED,sFAAsF;IACtF,OAAO,CAAC,2BAA2B;IAkBnC,SAAS,IAAI,OAAO,CAEnB;IAED,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7B;IAED,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAIjD;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,GAAG,aAAa,CAkDzE;IAED,IAAI,IAAI,aAAa,EAAE,CAQtB;IAED,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAM7C;IAED,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAyC5D;IAED,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAexD;IAED,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAgBxF;IAID,OAAO,CAAC,aAAa;IAmBrB,OAAO,CAAC,kBAAkB;IAkB1B,OAAO,CAAC,gBAAgB;IAwBxB,OAAO,CAAC,aAAa;IA2BrB,OAAO,CAAC,iBAAiB;CAsB1B;AAgCD,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAGnE","sourcesContent":["import { chmodSync, existsSync, mkdirSync, readFileSync } from \"fs\";\nimport { dirname, isAbsolute, join, normalize, sep } from \"path\";\nimport type { SandboxConfig } from \"./sandbox.js\";\nimport { atomicWritePrivateFile } from \"./fs-atomic.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\n\n// ── Types ──────────────────────────────────────────────────────────────────────\n\n/** Shape of workspace/vaults/vault.json */\nexport interface VaultConfig {\n  vaults: Record<string, VaultEntry>;\n}\n\n/** Per-user vault mount entry in vault.json */\nexport interface VaultMountEntry {\n  source: string;\n  target?: string;\n}\n\n/** Per-user vault entry in vault.json */\nexport interface VaultEntry {\n  displayName: string;\n  platform?: \"slack\" | \"discord\" | \"telegram\";\n  /** Subdirs/files in vault dir to mount into sandbox (e.g. [\".gcloud\", \".ssh\", \".kube\"]) */\n  mounts?: Array<string | VaultMountEntry>;\n  /** Whether to load env file as environment variables (default: true if env file exists) */\n  envFile?: boolean;\n  /** Per-user sandbox config override */\n  sandbox?: {\n    type?: \"image\" | \"firecracker\" | \"host\" | \"container\" | \"docker\";\n    container?: string;\n    image?: string;\n    vmId?: string;\n    sshUser?: string;\n    sshPort?: number;\n  };\n}\n\nexport interface ResolvedVaultMount {\n  source: string;\n  target: string;\n}\n\n/** Resolved vault ready for use at runtime */\nexport interface ResolvedVault {\n  userId: string;\n  displayName: string;\n  /** Absolute path to vault directory */\n  dir: string;\n  /** Absolute mount specs */\n  mounts: ResolvedVaultMount[];\n  /** Parsed from env file */\n  env: Record<string, string>;\n  sandboxOverride?: VaultEntry[\"sandbox\"];\n}\n\nexport interface VaultManager {\n  /** Return true when vault.json contains this exact key. */\n  hasEntry(key: string): boolean;\n  /** Resolve vault for a user; returns undefined when no entry exists. */\n  resolve(userId: string): ResolvedVault | undefined;\n  /** Get sandbox config with credential injection for a user */\n  getSandboxConfig(userId: string, baseConfig: SandboxConfig): SandboxConfig;\n  /** List all configured vaults */\n  list(): ResolvedVault[];\n  /** Re-read vault.json without restart */\n  reload(): void;\n  /** Check if vault system is enabled (vault.json exists) */\n  isEnabled(): boolean;\n  /**\n   * Add a vault entry and persist to disk.\n   * No-op if the key already exists (idempotent).\n   */\n  addEntry(key: string, entry: VaultEntry): void;\n  /**\n   * Ensure a vault entry has image sandbox metadata.\n   * Creates the entry when missing and upgrades existing entries that lack sandbox.type.\n   */\n  ensureImageSandboxEntry(key: string, entry: VaultEntry): void;\n  /** Merge environment variables into vaults/<key>/env and persist them to disk. */\n  upsertEnv(key: string, env: Record<string, string>): void;\n  /** Write a private file into vaults/<key>/ and ensure it is mounted into the sandbox. */\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void;\n}\n\n// ── parseEnvFile ───────────────────────────────────────────────────────────────\n\n/**\n * Parse a KEY=VALUE env file. Supports:\n * - Lines starting with # are comments\n * - Empty lines are skipped\n * - Values can be quoted with single or double quotes (quotes are stripped)\n * - No variable expansion\n * - The value is everything after the first `=` to end of line (no inline comments)\n */\nexport function parseEnvFile(content: string): Record<string, string> {\n  const env: Record<string, string> = {};\n  const lines = content.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\").split(\"\\n\");\n\n  for (const line of lines) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) continue;\n\n    const eqIndex = trimmed.indexOf(\"=\");\n    if (eqIndex === -1) continue;\n\n    const key = trimmed.slice(0, eqIndex).trim();\n    if (!key) continue;\n\n    let value = trimmed.slice(eqIndex + 1);\n\n    // Strip matching quotes\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n\n    env[key] = value;\n  }\n\n  return env;\n}\n\n// ── FileVaultManager ───────────────────────────────────────────────────────────\n\nexport class FileVaultManager implements VaultManager {\n  private config: VaultConfig | null = null;\n  private readonly vaultsDir: string;\n  private readonly configPath: string;\n\n  constructor(stateDir: string) {\n    this.vaultsDir = join(stateDir, \"vaults\");\n    this.configPath = join(this.vaultsDir, \"vault.json\");\n    this.reload();\n  }\n\n  reload(): void {\n    if (!existsSync(this.configPath)) {\n      this.config = null;\n      return;\n    }\n\n    try {\n      const raw = readFileSync(this.configPath, \"utf-8\");\n      const parsed = JSON.parse(raw);\n\n      if (\n        !parsed ||\n        typeof parsed !== \"object\" ||\n        !parsed.vaults ||\n        typeof parsed.vaults !== \"object\"\n      ) {\n        console.error(`vault: malformed vault.json — expected { vaults: { ... } }`);\n        this.config = null;\n        return;\n      }\n\n      this.config = parsed as VaultConfig;\n      this.warnUnsupportedSandboxTypes();\n    } catch (err) {\n      console.error(`vault: failed to read ${this.configPath}:`, err);\n      this.config = null;\n    }\n  }\n\n  /** Warn for legacy or insecure vault sandbox overrides that are no longer allowed. */\n  private warnUnsupportedSandboxTypes(): void {\n    if (!this.config) return;\n    for (const [key, entry] of Object.entries(this.config.vaults)) {\n      if (entry.sandbox?.type === \"host\") {\n        console.error(\n          `vault: \"${key}\" uses sandbox.type=host, which is blocked for credential isolation. ` +\n            \"Use sandbox.type=image or sandbox.type=firecracker.\",\n        );\n      }\n      if (entry.sandbox?.type === \"container\" || entry.sandbox?.type === \"docker\") {\n        console.error(\n          `vault: \"${key}\" uses sandbox.type=${entry.sandbox.type}, which is blocked for credential isolation. ` +\n            \"Use sandbox.type=image for per-user containers or sandbox.type=firecracker.\",\n        );\n      }\n    }\n  }\n\n  isEnabled(): boolean {\n    return this.config !== null;\n  }\n\n  hasEntry(key: string): boolean {\n    return !!this.config?.vaults[key];\n  }\n\n  resolve(userId: string): ResolvedVault | undefined {\n    const entry = this.config?.vaults[userId];\n    if (!entry) return undefined;\n    return this.buildResolved(userId, entry);\n  }\n\n  getSandboxConfig(userId: string, baseConfig: SandboxConfig): SandboxConfig {\n    const vault = this.resolve(userId);\n    if (!vault?.sandboxOverride) return baseConfig;\n\n    const override = vault.sandboxOverride;\n\n    if (override.type === \"image\") {\n      if (baseConfig.type !== \"image\") {\n        throw new Error(\n          `vault \"${userId}\" sets sandbox.type=image, but base sandbox is \"${baseConfig.type}\". ` +\n            \"Use --sandbox=image:<image> to enable per-user managed containers.\",\n        );\n      }\n      const container = override.container || `mama-sandbox-${userId}`;\n      return { type: \"container\", container };\n    }\n\n    if (override.type === \"firecracker\") {\n      if (!override.vmId) return baseConfig;\n      if (baseConfig.type !== \"firecracker\") {\n        throw new Error(\n          `vault \"${userId}\" sets sandbox.type=firecracker, but base sandbox is \"${baseConfig.type}\". ` +\n            \"Use --sandbox=firecracker:<vm-id>:<host-path> so /workspace stays mapped to the real workspace.\",\n        );\n      }\n      return {\n        type: \"firecracker\",\n        vmId: override.vmId,\n        hostPath: baseConfig.hostPath,\n        sshUser: override.sshUser,\n        sshPort: override.sshPort,\n      };\n    }\n\n    if (override.type === \"host\") {\n      throw new Error(\n        `vault \"${userId}\" uses sandbox.type=host, which is blocked for credential isolation. ` +\n          \"Use sandbox.type=image or sandbox.type=firecracker.\",\n      );\n    }\n\n    if (override.type === \"container\" || override.type === \"docker\") {\n      throw new Error(\n        `vault \"${userId}\" uses sandbox.type=${override.type}, which is blocked for credential isolation. ` +\n          \"Use sandbox.type=image for per-user containers or sandbox.type=firecracker.\",\n      );\n    }\n\n    // No type override — return base config unchanged\n    return baseConfig;\n  }\n\n  list(): ResolvedVault[] {\n    if (!this.config) return [];\n\n    const results: ResolvedVault[] = [];\n    for (const [key, entry] of Object.entries(this.config.vaults)) {\n      results.push(this.buildResolved(key, entry));\n    }\n    return results;\n  }\n\n  addEntry(key: string, entry: VaultEntry): void {\n    const cfg = (this.config ??= { vaults: {} });\n    // Idempotent: skip if already exists\n    if (cfg.vaults[key]) return;\n    cfg.vaults[key] = entry;\n    this.persistConfig();\n  }\n\n  ensureImageSandboxEntry(key: string, entry: VaultEntry): void {\n    if (entry.sandbox?.type !== \"image\") {\n      throw new Error(`vault: ensureImageSandboxEntry requires sandbox.type=image for \"${key}\"`);\n    }\n\n    const cfg = (this.config ??= { vaults: {} });\n    const existing = cfg.vaults[key];\n    if (!existing) {\n      cfg.vaults[key] = entry;\n      this.persistConfig();\n      return;\n    }\n\n    let nextEntry = existing;\n    let changed = false;\n\n    if (!existing.platform && entry.platform) {\n      nextEntry = { ...nextEntry, platform: entry.platform };\n      changed = true;\n    }\n\n    const existingSandbox = existing.sandbox;\n    if (!existingSandbox?.type) {\n      nextEntry = { ...nextEntry, sandbox: entry.sandbox };\n      changed = true;\n    } else if (\n      existingSandbox.type === \"image\" &&\n      !existingSandbox.container &&\n      entry.sandbox.container\n    ) {\n      nextEntry = {\n        ...nextEntry,\n        sandbox: { ...existingSandbox, container: entry.sandbox.container },\n      };\n      changed = true;\n    }\n\n    if (!changed) return;\n\n    cfg.vaults[key] = nextEntry;\n    this.persistConfig();\n  }\n\n  upsertEnv(key: string, env: Record<string, string>): void {\n    const dir = join(this.vaultsDir, key);\n    const envPath = join(dir, \"env\");\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const existing = existsSync(envPath)\n      ? parseEnvFile(readFileSync(envPath, \"utf-8\"))\n      : ({} as Record<string, string>);\n    const merged = { ...existing, ...env };\n    const content =\n      Object.entries(merged)\n        .sort(([left], [right]) => left.localeCompare(right))\n        .map(([envKey, value]) => `${envKey}=${value}`)\n        .join(\"\\n\") + \"\\n\";\n    atomicWritePrivateFile(envPath, content);\n  }\n\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void {\n    const normalizedPath = normalizeVaultRelativePath(relativePath);\n    const normalizedTarget = normalizeVaultTargetPath(targetPath);\n    if (!normalizedPath || (targetPath !== undefined && !normalizedTarget)) {\n      throw new Error(`vault: invalid relative secret file path for \"${key}\": ${relativePath}`);\n    }\n\n    const dir = join(this.vaultsDir, key);\n    const filePath = join(dir, normalizedPath);\n\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const parentDir = dirname(filePath);\n    if (parentDir !== dir) ensurePrivateDir(parentDir);\n    atomicWritePrivateFile(filePath, content);\n    this.ensureMountEntry(key, normalizedPath, normalizedTarget);\n  }\n\n  // ── private ────────────────────────────────────────────────────────────────\n\n  private persistConfig(): void {\n    ensurePrivateDir(this.vaultsDir);\n\n    // Preserve concurrent external edits: pull in any entries that appear on\n    // disk but not in our in-memory view, so a background edit (e.g. another\n    // admin adding a user) is not silently dropped by the next upsert here.\n    // Individual field edits still follow last-writer-wins per key.\n    const onDisk = this.readConfigFromDisk();\n    if (onDisk && this.config) {\n      for (const [key, entry] of Object.entries(onDisk.vaults)) {\n        if (!(key in this.config.vaults)) {\n          this.config.vaults[key] = entry;\n        }\n      }\n    }\n\n    atomicWritePrivateFile(this.configPath, JSON.stringify(this.config, null, 2) + \"\\n\");\n  }\n\n  private readConfigFromDisk(): VaultConfig | null {\n    if (!existsSync(this.configPath)) return null;\n    try {\n      const parsed = JSON.parse(readFileSync(this.configPath, \"utf-8\"));\n      if (\n        !parsed ||\n        typeof parsed !== \"object\" ||\n        !parsed.vaults ||\n        typeof parsed.vaults !== \"object\"\n      ) {\n        return null;\n      }\n      return parsed as VaultConfig;\n    } catch {\n      return null;\n    }\n  }\n\n  private ensureMountEntry(key: string, relativePath: string, targetPath?: string): void {\n    if (!this.config?.vaults[key]) {\n      throw new Error(`vault: cannot add mount \"${relativePath}\" for missing entry \"${key}\"`);\n    }\n\n    const existing = this.config.vaults[key];\n    const mounts = existing.mounts ?? [];\n    if (\n      mounts.some((mount) =>\n        typeof mount === \"string\"\n          ? mount === relativePath && !targetPath\n          : mount.source === relativePath && mount.target === targetPath,\n      )\n    ) {\n      return;\n    }\n\n    this.config.vaults[key] = {\n      ...existing,\n      mounts: [...mounts, targetPath ? { source: relativePath, target: targetPath } : relativePath],\n    };\n    this.persistConfig();\n  }\n\n  private buildResolved(key: string, entry: VaultEntry): ResolvedVault {\n    const dir = join(this.vaultsDir, key);\n\n    const mounts = (entry.mounts ?? [])\n      .map((mount) => this.resolveMountEntry(dir, mount))\n      .filter((mount): mount is ResolvedVaultMount => mount !== undefined);\n\n    let env: Record<string, string> = {};\n    const envPath = join(dir, \"env\");\n    if (entry.envFile !== false && existsSync(envPath)) {\n      try {\n        env = parseEnvFile(readFileSync(envPath, \"utf-8\"));\n      } catch (err) {\n        console.error(`vault: failed to parse env file for \"${key}\":`, err);\n      }\n    }\n\n    return {\n      userId: key,\n      displayName: entry.displayName,\n      dir,\n      mounts,\n      env,\n      sandboxOverride: entry.sandbox,\n    };\n  }\n\n  private resolveMountEntry(\n    dir: string,\n    mount: string | VaultMountEntry,\n  ): ResolvedVaultMount | undefined {\n    if (typeof mount === \"string\") {\n      const normalizedSource = normalizeVaultRelativePath(mount);\n      if (!normalizedSource) return undefined;\n      return {\n        source: join(dir, normalizedSource),\n        target: defaultVaultTargetPath(normalizedSource),\n      };\n    }\n\n    if (!mount || typeof mount !== \"object\") return undefined;\n    const normalizedSource = normalizeVaultRelativePath(mount.source);\n    if (!normalizedSource) return undefined;\n    const normalizedTarget = normalizeVaultTargetPath(mount.target);\n    return {\n      source: join(dir, normalizedSource),\n      target: normalizedTarget ?? defaultVaultTargetPath(normalizedSource),\n    };\n  }\n}\n\nfunction ensurePrivateDir(path: string): void {\n  mkdirSync(path, { recursive: true, mode: PRIVATE_DIR_MODE });\n  chmodSync(path, PRIVATE_DIR_MODE);\n}\n\nfunction normalizeVaultRelativePath(relativePath: string): string | undefined {\n  const trimmed = relativePath.trim();\n  if (!trimmed || isAbsolute(trimmed)) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  if (!normalized || normalized === \".\" || normalized === \"..\" || normalized.startsWith(\"../\")) {\n    return undefined;\n  }\n  return normalized;\n}\n\nfunction normalizeVaultTargetPath(targetPath?: string): string | undefined {\n  if (targetPath === undefined) {\n    return undefined;\n  }\n\n  const trimmed = targetPath.trim();\n  if (!trimmed || !trimmed.startsWith(\"/\")) {\n    return undefined;\n  }\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  return normalized.startsWith(\"/\") ? normalized : undefined;\n}\n\nexport function defaultVaultTargetPath(relativePath: string): string {\n  const normalized = normalizeVaultRelativePath(relativePath) ?? relativePath.replace(/^\\/+/, \"\");\n  return `/root/${normalized}`;\n}\n"]}