@integrity-labs/agt-cli 0.14.12 → 0.14.15

package/mcp/slack-channel.js

@@ -2980,7 +2980,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve2.call(this, root, ref);
+      let _sch = resolve3.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -3007,7 +3007,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve2(root, ref) {
+    function resolve3(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3582,7 +3582,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve2(baseURI, relativeURI, options) {
+    function resolve3(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -3809,7 +3809,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve2,
+      resolve: resolve3,
       resolveComponent,
       equal,
       serialize,
@@ -12619,7 +12619,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve2) => setTimeout(resolve2, pollInterval));
+        await new Promise((resolve3) => setTimeout(resolve3, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error2) {
@@ -12636,7 +12636,7 @@ var Protocol = class {
    */
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       const earlyReject = (error2) => {
         reject(error2);
       };
@@ -12714,7 +12714,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve2(parseResult.data);
+            resolve3(parseResult.data);
           }
         } catch (error2) {
           reject(error2);
@@ -12975,12 +12975,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve2, interval);
+      const timeoutId = setTimeout(resolve3, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -13875,21 +13875,129 @@ var StdioServerTransport = class {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       const json = serializeMessage(message);
       if (this._stdout.write(json)) {
-        resolve2();
+        resolve3();
       } else {
-        this._stdout.once("drain", resolve2);
+        this._stdout.once("drain", resolve3);
       }
     });
   }
 };
 
 // src/slack-channel.ts
-import { readFileSync, statSync } from "fs";
-import { basename, resolve } from "path";
-import { homedir } from "os";
+import { readFileSync as readFileSync2, statSync, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, chmodSync } from "fs";
+import { basename, join as join2, resolve as resolve2 } from "path";
+import { homedir as homedir2 } from "os";
+
+// src/slack-thread-store.ts
+import { mkdirSync, readFileSync, writeFileSync } from "fs";
+import { dirname } from "path";
+var FILE_VERSION = 1;
+var DEFAULT_TTL_DAYS = 30;
+var DEFAULT_MIN_INTERVAL_MS = 1e3;
+function loadThreadStore(filePath, opts = {}) {
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const ttlDays = opts.ttlDays ?? DEFAULT_TTL_DAYS;
+  const ttlMs = ttlDays * 24 * 60 * 60 * 1e3;
+  let raw;
+  try {
+    raw = readFileSync(filePath, "utf-8");
+  } catch {
+    return { threads: /* @__PURE__ */ new Map(), pruned: 0 };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    opts.onError?.(
+      `slack-thread-store: malformed JSON at ${filePath} (${err.message}) \u2014 starting with empty tracking state`
+    );
+    return { threads: /* @__PURE__ */ new Map(), pruned: 0 };
+  }
+  if (!isThreadStoreShape(parsed)) {
+    opts.onError?.(
+      `slack-thread-store: unexpected shape at ${filePath} \u2014 starting with empty tracking state`
+    );
+    return { threads: /* @__PURE__ */ new Map(), pruned: 0 };
+  }
+  const threads = /* @__PURE__ */ new Map();
+  let pruned = 0;
+  for (const [key, entry] of Object.entries(parsed.threads)) {
+    if (!isThreadEntry(entry)) continue;
+    const seenTs = Date.parse(entry.last_seen_at);
+    if (Number.isFinite(seenTs) && now.getTime() - seenTs > ttlMs) {
+      pruned++;
+      continue;
+    }
+    threads.set(key, { involvement: entry.involvement, last_seen_at: entry.last_seen_at });
+  }
+  return { threads, pruned };
+}
+function serializeThreadStore(threads) {
+  const out = { version: FILE_VERSION, threads: {} };
+  for (const [key, entry] of threads) out.threads[key] = entry;
+  return JSON.stringify(out, null, 2);
+}
+function createThreadPersister(opts) {
+  const interval = opts.minIntervalMs ?? DEFAULT_MIN_INTERVAL_MS;
+  let lastWriteAt = 0;
+  let pendingTimer = null;
+  let pendingSnapshot = null;
+  const writeNow = (snap) => {
+    try {
+      mkdirSync(dirname(opts.filePath), { recursive: true });
+      writeFileSync(opts.filePath, serializeThreadStore(snap), "utf-8");
+      lastWriteAt = Date.now();
+    } catch (err) {
+      opts.onError?.(
+        `slack-thread-store: failed to persist ${opts.filePath}: ${err.message}`
+      );
+    }
+  };
+  return {
+    schedule(threads) {
+      pendingSnapshot = new Map(threads);
+      const sinceLast = Date.now() - lastWriteAt;
+      if (sinceLast >= interval) {
+        const snap = pendingSnapshot;
+        pendingSnapshot = null;
+        writeNow(snap);
+        return;
+      }
+      if (pendingTimer) return;
+      pendingTimer = setTimeout(() => {
+        pendingTimer = null;
+        const snap = pendingSnapshot;
+        pendingSnapshot = null;
+        if (snap) writeNow(snap);
+      }, interval - sinceLast);
+      pendingTimer.unref?.();
+    },
+    flush(threads) {
+      if (pendingTimer) {
+        clearTimeout(pendingTimer);
+        pendingTimer = null;
+        pendingSnapshot = null;
+      }
+      writeNow(new Map(threads));
+    },
+    dispose() {
+      if (pendingTimer) clearTimeout(pendingTimer);
+      pendingTimer = null;
+      pendingSnapshot = null;
+    }
+  };
+}
+function isThreadStoreShape(value) {
+  return typeof value === "object" && value !== null && "threads" in value && typeof value.threads === "object" && value.threads !== null;
+}
+function isThreadEntry(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  return (v.involvement === "started" || v.involvement === "mentioned") && typeof v.last_seen_at === "string";
+}
 
 // src/safe-async.ts
 async function runOrRetry(fn, opts) {
@@ -13908,6 +14016,102 @@ async function runOrRetry(fn, opts) {
   }
 }
 
+// src/channel-attachments.ts
+import { homedir } from "os";
+import { join, resolve, sep } from "path";
+function resolveChannelInboundDir(codeName, channelSlug) {
+  const base = join(homedir(), ".augmented");
+  const allowedSegment = /^[A-Za-z0-9_-]+$/;
+  if (!allowedSegment.test(codeName) || !allowedSegment.test(channelSlug)) {
+    throw new Error(
+      `Refusing to resolve inbound dir \u2014 invalid codeName/channelSlug (got ${JSON.stringify({ codeName, channelSlug })})`
+    );
+  }
+  const candidate = resolve(base, codeName, channelSlug);
+  if (!isPathInside(candidate, base)) {
+    throw new Error(`Refusing inbound dir outside ${base} (got ${candidate})`);
+  }
+  return candidate;
+}
+function classifyMimetype(mimetype) {
+  if (typeof mimetype === "string" && mimetype.startsWith("image/")) return "image";
+  return "attachment";
+}
+function buildSafeInboundPath(root, fileId, mimetype) {
+  const safeId = fileId.replace(/[^A-Za-z0-9_-]/g, "");
+  if (!safeId) throw new Error("Refusing to build inbound path for empty/invalid file id");
+  const ext = extensionForMimetype(mimetype);
+  const candidate = resolve(root, `${safeId}${ext}`);
+  if (!isPathInside(candidate, root)) {
+    throw new Error(`Refusing to build inbound path outside agent dir (got ${candidate})`);
+  }
+  return candidate;
+}
+function extensionForMimetype(mimetype) {
+  if (!mimetype) return ".bin";
+  switch (mimetype) {
+    // Images
+    case "image/png":
+      return ".png";
+    case "image/jpeg":
+    case "image/jpg":
+      return ".jpg";
+    case "image/gif":
+      return ".gif";
+    case "image/webp":
+      return ".webp";
+    case "image/svg+xml":
+      return ".svg";
+    // Docs
+    case "application/pdf":
+      return ".pdf";
+    case "text/plain":
+      return ".txt";
+    case "text/csv":
+      return ".csv";
+    case "application/json":
+      return ".json";
+    case "application/vnd.openxmlformats-officedocument.wordprocessingml.document":
+      return ".docx";
+    case "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet":
+      return ".xlsx";
+    // Audio (Telegram voice notes are typically audio/ogg; regular
+    // audio messages are audio/mpeg)
+    case "audio/ogg":
+      return ".ogg";
+    case "audio/mpeg":
+      return ".mp3";
+    case "audio/mp4":
+      return ".m4a";
+    // Video
+    case "video/mp4":
+      return ".mp4";
+    case "video/quicktime":
+      return ".mov";
+    default:
+      return ".bin";
+  }
+}
+function isPathInside(target, root) {
+  const normalizedRoot = resolve(root) + sep;
+  const normalizedTarget = resolve(target);
+  return normalizedTarget === resolve(root) || normalizedTarget.startsWith(normalizedRoot);
+}
+
+// src/slack-inbound-files.ts
+function classifySlackFile(file) {
+  if (!file || typeof file.id !== "string" || !file.id) return null;
+  const mimetype = typeof file.mimetype === "string" ? file.mimetype : "application/octet-stream";
+  const filename = typeof file.name === "string" && file.name ? file.name : file.id;
+  return { kind: classifyMimetype(mimetype), id: file.id, filename, mimetype };
+}
+function resolveSlackInboundDir(codeName) {
+  return resolveChannelInboundDir(codeName, "slack-inbound");
+}
+function buildSafeInboundPath2(codeName, fileId, mimetype) {
+  return buildSafeInboundPath(resolveSlackInboundDir(codeName), fileId, mimetype);
+}
+
 // src/slack-response-mode.ts
 var MODES = [
   "mention_only",
@@ -13988,6 +14192,37 @@ function clearPendingMessage(channel, threadTs) {
   }
 }
 var trackedThreads = /* @__PURE__ */ new Map();
+var THREAD_STORE_PATH = resolveThreadStorePath();
+var THREAD_STORE_TTL_DAYS = parseTtlDays(process.env.SLACK_THREAD_FOLLOW_TTL_DAYS);
+var threadPersister = null;
+function resolveThreadStorePath() {
+  if (!AGENT_CODE_NAME) return null;
+  return join2(homedir2(), ".augmented", AGENT_CODE_NAME, "slack-tracked-threads.json");
+}
+function parseTtlDays(raw) {
+  if (!raw) return void 0;
+  const n = Number(raw);
+  return Number.isFinite(n) && n > 0 ? n : void 0;
+}
+function buildThreadKey(channel, threadTs) {
+  if (!channel || !threadTs) return null;
+  return `${channel}:${threadTs}`;
+}
+function rememberThread(channel, threadTs, involvement, opts = {}) {
+  const key = buildThreadKey(channel, threadTs);
+  if (!key) return;
+  const existing = trackedThreads.get(key);
+  const next = {
+    involvement: opts.override || !existing ? involvement : existing.involvement,
+    last_seen_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  trackedThreads.set(key, next);
+  if (isShuttingDown) {
+    threadPersister?.flush(trackedThreads);
+  } else {
+    threadPersister?.schedule(trackedThreads);
+  }
+}
 if (!BOT_TOKEN || !APP_TOKEN) {
   console.error(
     "slack-channel: Missing SLACK_BOT_TOKEN or SLACK_APP_TOKEN. Cannot start."
@@ -14001,18 +14236,17 @@ var mcp = new Server(
       experimental: { "claude/channel": {} },
       tools: {}
     },
+    // NOTE: Claude Code truncates MCP server instructions at 2048 chars.
+    // Attachments rules live near the top because they get chopped otherwise
+    // and the agent silently loses attachment-handling guidance.
     instructions: [
       'Messages from Slack arrive as <channel source="slack" user="<slack-id>" user_name="<display-name>" channel="..." thread_ts="...">.',
-      "Address users by their user_name (display name), NEVER by the raw user ID.",
-      "In threads with multiple participants, the CURRENT speaker is always the one in the <channel> tag on the latest message \u2014 do not conflate them with other participants who spoke earlier.",
-      "Reply using the slack.reply tool, passing channel and thread_ts from the tag.",
-      "For threaded replies, always include thread_ts so the response appears in the same thread.",
-      "When someone @mentions you in a channel, respond helpfully in that thread.",
-      "For DMs, respond directly.",
-      "Messages with auto_followed=true are from threads you previously participated in.",
-      "For auto-followed messages, use relevance judgment: only reply if you have something useful to add.",
-      "Do NOT reply to every auto-followed message \u2014 skip if the conversation has moved on, the message is directed at someone else, or your input would not add value.",
-      "To deliver a file (PDF, image, report), save it under your project dir and call slack.upload_file with path, channel, and thread_ts."
+      "Inbound attachments: the <channel> tag's `files` attribute is a JSON-serialised array \u2014 JSON.parse it before iterating. If a file entry has a `path`, the image is ALREADY DOWNLOADED locally \u2014 Read that path directly, do NOT call slack.download_attachment. That tool is only for entries with `file_id` but NO `path` (PDF, docx, csv, etc.): pass file_id + channel verbatim (never paraphrase), then Read the returned path. Single-image messages also get a top-level `image_path` convenience attribute; multi-image messages omit it. Never tell the user about internal file-handling failures that don't affect the answer.",
+      "Reply via slack.reply passing channel and thread_ts from the tag. Always include thread_ts on threaded replies so the response lands in the same thread.",
+      "Address users by user_name, never by raw user ID. In multi-participant threads the CURRENT speaker is the one on the latest <channel> tag \u2014 don't conflate with earlier participants.",
+      "Mentioned in a channel \u2192 respond in that thread. DM \u2192 respond directly.",
+      'auto_followed="true" messages are from threads you previously joined: reply only if you have something useful to add. Skip if the conversation moved on, the message is directed at someone else, or your input would not add value.',
+      "To deliver a file, save it under your project dir and call slack.upload_file with path, channel, thread_ts."
     ].join(" ")
   }
 );
@@ -14072,6 +14306,24 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
         required: ["channel", "thread_ts"]
       }
     },
+    {
+      name: "slack.download_attachment",
+      description: "Download an inbound Slack attachment on demand. Use this for non-image files (PDFs, docx, csv, etc.) that arrived via a <channel> tag \u2014 look for `file_id` in the `files` meta. Requires the `channel` attribute from the same <channel> tag so the tool can verify the attachment was shared in the current conversation. Returns the local path where the file was written (inside ~/.augmented/<codeName>/slack-inbound/). Images are auto-downloaded on receipt and don't need this tool.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          file_id: {
+            type: "string",
+            description: "Slack file id (from the `file_id` field on the `files` meta array of the inbound <channel> tag)"
+          },
+          channel: {
+            type: "string",
+            description: "Slack channel ID from the `channel` attribute of the same inbound <channel> tag that surfaced the file. The tool only downloads attachments that were shared in this channel."
+          }
+        },
+        required: ["file_id", "channel"]
+      }
+    },
     {
       name: "slack.upload_file",
       description: "Upload a file from the agent project dir to a Slack channel or thread. Use this for PDFs, images, reports, and any binary deliverables the agent generates. Path must be inside the agent's project directory.",
@@ -14136,12 +14388,8 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
         };
       }
       if (THREAD_AUTO_FOLLOW !== "off") {
-        const trackKey = thread_ts ?? data.ts ?? "";
-        if (trackKey) {
-          if (!trackedThreads.has(trackKey)) {
-            trackedThreads.set(trackKey, thread_ts ? "mentioned" : "started");
-          }
-        }
+        const trackTs = thread_ts ?? data.ts ?? void 0;
+        rememberThread(channel, trackTs, thread_ts ? "mentioned" : "started");
       }
       return { content: [{ type: "text", text: "sent" }] };
     } catch (err) {
@@ -14248,8 +14496,8 @@ ${formatted}` : "Thread is empty or not found."
         isError: true
       };
     }
-    const allowedRoot = resolve(homedir(), ".augmented", AGENT_CODE_NAME, "project") + "/";
-    const resolvedPath = resolve(path);
+    const allowedRoot = resolve2(homedir2(), ".augmented", AGENT_CODE_NAME, "project") + "/";
+    const resolvedPath = resolve2(path);
     if (!resolvedPath.startsWith(allowedRoot)) {
       return {
         content: [{
@@ -14270,7 +14518,7 @@ ${formatted}` : "Thread is empty or not found."
         };
       }
       size = stat.size;
-      bytes = readFileSync(resolvedPath);
+      bytes = readFileSync2(resolvedPath);
     } catch (err) {
       return {
         content: [{ type: "text", text: `Failed to read file: ${err.message}` }],
@@ -14339,8 +14587,186 @@ ${formatted}` : "Thread is empty or not found."
       };
     }
   }
+  if (name === "slack.download_attachment") {
+    const { file_id, channel } = args;
+    if (typeof file_id !== "string" || !file_id.trim()) {
+      return {
+        content: [{ type: "text", text: "slack.download_attachment requires a string `file_id`." }],
+        isError: true
+      };
+    }
+    if (typeof channel !== "string" || !channel.trim()) {
+      return {
+        content: [{ type: "text", text: "slack.download_attachment requires a string `channel` (from the inbound <channel> tag)." }],
+        isError: true
+      };
+    }
+    if (!AGENT_CODE_NAME) {
+      return {
+        content: [{
+          type: "text",
+          text: "Download refused: AGT_AGENT_CODE_NAME not set in the MCP server env. Reprovision the slack channel so the download tool can scope paths."
+        }],
+        isError: true
+      };
+    }
+    const trimmedFileId = file_id.trim();
+    const trimmedChannel = channel.trim();
+    if (!isDownloadableFileId(trimmedFileId, trimmedChannel)) {
+      return {
+        content: [{
+          type: "text",
+          text: "Download refused: file_id was not surfaced in a recent inbound `files` meta entry for this channel. You can only download attachments the originating conversation has shared with you."
+        }],
+        isError: true
+      };
+    }
+    try {
+      const savedPath = await downloadSlackFile(trimmedFileId, AGENT_CODE_NAME);
+      return { content: [{ type: "text", text: `Downloaded to ${savedPath}` }] };
+    } catch (err) {
+      return {
+        content: [{
+          type: "text",
+          text: `Failed to download attachment: ${redactAugmentedPaths(err.message)}`
+        }],
+        isError: true
+      };
+    }
+  }
   throw new Error(`Unknown tool: ${name}`);
 });
+var MAX_INBOUND_FILE_BYTES = 25 * 1024 * 1024;
+var SLACK_DOWNLOAD_TIMEOUT_MS = 15e3;
+var DOWNLOAD_ALLOWLIST_TTL_MS = 60 * 60 * 1e3;
+var downloadAllowlist = /* @__PURE__ */ new Map();
+function pruneExpiredAllowlist(now) {
+  for (const [fileId, entry] of downloadAllowlist) {
+    if (now > entry.expiresAt) downloadAllowlist.delete(fileId);
+  }
+}
+function registerDownloadableFileId(fileId, channel) {
+  const now = Date.now();
+  pruneExpiredAllowlist(now);
+  downloadAllowlist.set(fileId, {
+    channel,
+    expiresAt: now + DOWNLOAD_ALLOWLIST_TTL_MS
+  });
+}
+function isDownloadableFileId(fileId, channel) {
+  const entry = downloadAllowlist.get(fileId);
+  if (!entry) return false;
+  if (Date.now() > entry.expiresAt) {
+    downloadAllowlist.delete(fileId);
+    return false;
+  }
+  return entry.channel === channel;
+}
+function redactAugmentedPaths(msg) {
+  return msg.replaceAll(
+    new RegExp(`${homedir2().replace(/[.*+?^${}()|[\\]\\\\]/g, "\\\\$&")}/\\.augmented/[^\\s'"\`]*`, "g"),
+    "<augmented-path>"
+  );
+}
+async function downloadSlackFile(fileId, codeName) {
+  const infoRes = await fetch(
+    `https://slack.com/api/files.info?file=${encodeURIComponent(fileId)}`,
+    {
+      headers: { Authorization: `Bearer ${BOT_TOKEN}` },
+      signal: AbortSignal.timeout(SLACK_DOWNLOAD_TIMEOUT_MS)
+    }
+  );
+  const infoData = await infoRes.json();
+  if (!infoData.ok || !infoData.file) {
+    throw new Error(`files.info failed: ${infoData.error ?? "unknown"}`);
+  }
+  const file = infoData.file;
+  if (typeof file.size === "number" && file.size > MAX_INBOUND_FILE_BYTES) {
+    throw new Error(
+      `file ${fileId} is ${file.size} bytes \u2014 exceeds the ${MAX_INBOUND_FILE_BYTES}-byte inbound cap`
+    );
+  }
+  const url = file.url_private_download ?? file.url_private;
+  if (!url) throw new Error(`file ${fileId} has no url_private`);
+  const res = await fetch(url, {
+    headers: { Authorization: `Bearer ${BOT_TOKEN}` },
+    signal: AbortSignal.timeout(SLACK_DOWNLOAD_TIMEOUT_MS)
+  });
+  if (!res.ok) {
+    throw new Error(`download failed: HTTP ${res.status}`);
+  }
+  const contentLengthHeader = res.headers.get("content-length");
+  if (contentLengthHeader) {
+    const contentLength = Number(contentLengthHeader);
+    if (Number.isFinite(contentLength) && contentLength > MAX_INBOUND_FILE_BYTES) {
+      throw new Error(
+        `file ${fileId} transport reports ${contentLength} bytes \u2014 exceeds the ${MAX_INBOUND_FILE_BYTES}-byte inbound cap`
+      );
+    }
+  }
+  const bytes = Buffer.from(await res.arrayBuffer());
+  if (bytes.byteLength > MAX_INBOUND_FILE_BYTES) {
+    throw new Error(
+      `file ${fileId} downloaded ${bytes.byteLength} bytes \u2014 exceeds the ${MAX_INBOUND_FILE_BYTES}-byte inbound cap`
+    );
+  }
+  const savedPath = buildSafeInboundPath2(codeName, fileId, file.mimetype);
+  const dir = resolveSlackInboundDir(codeName);
+  if (!isPathInside(savedPath, dir)) {
+    throw new Error(`refusing to write ${savedPath} outside ${dir}`);
+  }
+  mkdirSync2(dir, { recursive: true });
+  writeFileSync2(savedPath, bytes, { mode: 384 });
+  try {
+    chmodSync(savedPath, 384);
+  } catch {
+  }
+  return savedPath;
+}
+async function buildInboundFileMeta(rawFiles, codeName, channel) {
+  if (!Array.isArray(rawFiles) || rawFiles.length === 0) return [];
+  if (!channel) return [];
+  const out = [];
+  for (const raw of rawFiles) {
+    const classified = classifySlackFile(
+      raw ?? null
+    );
+    if (!classified) continue;
+    if (classified.kind === "image" && codeName) {
+      try {
+        const path = await downloadSlackFile(classified.id, codeName);
+        out.push({
+          kind: "image",
+          file_id: classified.id,
+          filename: classified.filename,
+          mimetype: classified.mimetype,
+          path
+        });
+      } catch (err) {
+        process.stderr.write(
+          `slack-channel: image auto-download failed for ${classified.id}: ${redactAugmentedPaths(err.message)}
+`
+        );
+        registerDownloadableFileId(classified.id, channel);
+        out.push({
+          kind: "attachment",
+          file_id: classified.id,
+          filename: classified.filename,
+          mimetype: classified.mimetype
+        });
+      }
+    } else {
+      registerDownloadableFileId(classified.id, channel);
+      out.push({
+        kind: "attachment",
+        file_id: classified.id,
+        filename: classified.filename,
+        mimetype: classified.mimetype
+      });
+    }
+  }
+  return out;
+}
 await mcp.connect(new StdioServerTransport());
 var botUserId = null;
 async function getBotUserId() {
@@ -14429,21 +14855,22 @@ async function connectSocketMode() {
       }
       const isDirectMessage = evt.channel?.startsWith("D");
       const isThreadReply = !!evt.thread_ts && evt.thread_ts !== evt.ts;
-      const threadKey = evt.thread_ts ?? evt.ts ?? "";
-      if (evt.type === "app_mention" && threadKey) {
-        trackedThreads.set(threadKey, trackedThreads.get(threadKey) ?? "mentioned");
+      const trackTs = evt.thread_ts ?? evt.ts ?? "";
+      const threadKey = buildThreadKey(evt.channel, trackTs);
+      if (ALLOWED_USERS.size > 0 && evt.user && !ALLOWED_USERS.has(evt.user)) return;
+      if (evt.type === "app_mention") {
+        rememberThread(evt.channel, trackTs, "mentioned");
       }
       if (evt.type === "message" && evt.channel && !isDirectMessage) {
         if (isThreadReply) {
           if (THREAD_AUTO_FOLLOW === "off") return;
-          const threadInvolvement = trackedThreads.get(threadKey);
+          const threadInvolvement = threadKey ? trackedThreads.get(threadKey)?.involvement : void 0;
           if (!threadInvolvement) return;
           if (THREAD_AUTO_FOLLOW === "started" && threadInvolvement !== "started") return;
         } else {
           if (!channelMessageShouldRespond(evt.text ?? "", CHANNEL_RESPONSE_MODE)) return;
         }
       }
-      if (ALLOWED_USERS.size > 0 && evt.user && !ALLOWED_USERS.has(evt.user)) return;
       const text = evt.text ?? "";
       const channel = evt.channel ?? "";
       const ts = evt.ts ?? "";
@@ -14460,11 +14887,16 @@ async function connectSocketMode() {
         }).catch(() => {
         });
       }
-      const isAutoFollowed = evt.type === "message" && isThreadReply && trackedThreads.has(threadKey);
+      const isAutoFollowed = evt.type === "message" && isThreadReply && !!threadKey && trackedThreads.has(threadKey);
       if (channel && ts) {
         trackPendingMessage(channel, threadTs, ts);
       }
       const userName = await resolveUserName(user);
+      const fileMeta = await buildInboundFileMeta(evt.files, AGENT_CODE_NAME, channel);
+      const downloadedImages = fileMeta.filter(
+        (f) => f.kind === "image" && typeof f.path === "string"
+      );
+      const imagePath = downloadedImages.length === 1 ? downloadedImages[0].path : void 0;
       await mcp.notification({
         method: "notifications/claude/channel",
         params: {
@@ -14475,7 +14907,11 @@ async function connectSocketMode() {
             channel,
             thread_ts: threadTs,
             event_type: evt.type,
-            ...isAutoFollowed ? { auto_followed: true } : {}
+            ...isAutoFollowed ? { auto_followed: "true" } : {},
+            // Only set these when we actually have attachments to avoid
+            // bloating every notification with empty metadata.
+            ...fileMeta.length > 0 ? { files: JSON.stringify(fileMeta) } : {},
+            ...imagePath ? { image_path: imagePath } : {}
           }
         }
       });
@@ -14498,6 +14934,14 @@ async function connectSocketMode() {
 function shutdown(reason, exitCode = 0) {
   if (isShuttingDown) return;
   isShuttingDown = true;
+  try {
+    threadPersister?.flush(trackedThreads);
+  } catch {
+  }
+  try {
+    threadPersister?.dispose();
+  } catch {
+  }
   process.stderr.write(`slack-channel: ${reason} \u2014 closing Socket Mode and exiting
 `);
   try {
@@ -14516,6 +14960,29 @@ process.on("unhandledRejection", (reason) => {
   process.stderr.write(`slack-channel: unhandledRejection (continuing): ${msg}
 `);
 });
+if (THREAD_STORE_PATH) {
+  const threadStoreLabel = "slack-tracked-threads.json";
+  const redact = (msg) => msg.replaceAll(THREAD_STORE_PATH, threadStoreLabel);
+  const { threads, pruned } = loadThreadStore(THREAD_STORE_PATH, {
+    ttlDays: THREAD_STORE_TTL_DAYS,
+    onError: (msg) => process.stderr.write(`${redact(msg)}
+`)
+  });
+  for (const [key, entry] of threads) trackedThreads.set(key, entry);
+  threadPersister = createThreadPersister({
+    filePath: THREAD_STORE_PATH,
+    onError: (msg) => process.stderr.write(`${redact(msg)}
+`)
+  });
+  process.stderr.write(
+    `slack-channel: hydrated ${trackedThreads.size} tracked thread(s)${pruned > 0 ? ` (pruned ${pruned} stale)` : ""} from ${threadStoreLabel}
+`
+  );
+} else {
+  process.stderr.write(
+    "slack-channel: AGT_AGENT_CODE_NAME not set \u2014 running without thread-follow persistence\n"
+  );
+}
 botUserId = await getBotUserId();
 process.stderr.write(`slack-channel: Bot user ID: ${botUserId}
 `);