@misterhuydo/sentinel 1.0.77 → 1.0.82

package/python/sentinel/slack_bot.py

@@ -1,384 +1,427 @@
-"""
-slack_bot.py — Slack integration for Sentinel Boss.
-
-One DevOps member is handled at a time per Sentinel instance.
-Others are queued and notified of their position. When the current
-session finishes, the next person is picked up automatically.
-
-Setup (api.slack.com):
-  1. Create a Slack App → Enable Socket Mode → copy App-Level Token (xapp-...)
-  2. Add Bot Token Scopes: app_mentions:read, chat:write, im:history,
-     channels:history, users:read
-  3. Enable Events: app_mention, message.im, message.channels
-  4. Install to workspace → copy Bot Token (xoxb-...)
-  5. Add to sentinel.properties:
-       SLACK_BOT_TOKEN=xoxb-...
-       SLACK_APP_TOKEN=xapp-...
-"""
-
-import asyncio
-import logging
-from dataclasses import dataclass, field
-from typing import Optional
-
-from .sentinel_boss import handle_message
-
-logger = logging.getLogger(__name__)
-
-
-# ── Session and Queue ─────────────────────────────────────────────────────────
-
-@dataclass
-class _Session:
-    user_id:   str
-    user_name: str
-    channel:   str
-    history:   list = field(default_factory=list)
-
-
-class _Queue:
-    """
-    Global sequential queue for a Sentinel instance.
-    One member at a time; others wait.
-    """
-
-    def __init__(self):
-        self._lock:    asyncio.Lock          = asyncio.Lock()
-        self._active:  Optional[_Session]    = None
-        self._waiting: list[tuple[_Session, str]] = []   # (session, first_message)
-
-    async def try_activate(
-        self, user_id: str, user_name: str, channel: str
-    ) -> tuple[str, int, Optional[_Session]]:
-        """
-        Returns:
-          ('active',     0,   session)  — slot is free, session started
-          ('continuing', 0,   session)  — same user already has the slot
-          ('queued',     pos, None)     — added to wait queue at position pos
-        """
-        async with self._lock:
-            if self._active is None:
-                self._active = _Session(user_id, user_name, channel)
-                return "active", 0, self._active
-
-            if self._active.user_id == user_id:
-                return "continuing", 0, self._active
-
-            # Deduplicate — don't queue the same user twice
-            if not any(s.user_id == user_id for s, _ in self._waiting):
-                self._waiting.append((_Session(user_id, user_name, channel), ""))
-
-            pos = next(
-                i + 1
-                for i, (s, _) in enumerate(self._waiting)
-                if s.user_id == user_id
-            )
-            return "queued", pos, None
-
-    async def update_waiting_message(self, user_id: str, message: str):
-        """Overwrite the first message for a queued user (they may rephrase while waiting)."""
-        async with self._lock:
-            for i, (s, _) in enumerate(self._waiting):
-                if s.user_id == user_id:
-                    self._waiting[i] = (s, message)
-                    return
-
-    async def complete(self) -> Optional[tuple[_Session, str]]:
-        """Release the active slot. Returns (next_session, first_message) or None."""
-        async with self._lock:
-            prev = self._active
-            self._active = None
-            if self._waiting:
-                session, msg = self._waiting.pop(0)
-                self._active = session
-                return session, msg
-            return None
-
-    def active_user_name(self) -> Optional[str]:
-        return self._active.user_name if self._active else None
-
-
-_queue = _Queue()
-
-
-# ── Slack bot ─────────────────────────────────────────────────────────────────
-
-async def run_slack_bot(cfg_loader, store) -> None:
-    """
-    Start Slack Bolt in Socket Mode as an asyncio background task.
-    Exits silently if tokens are missing or slack-bolt is not installed.
-    """
-    try:
-        from slack_bolt.async_app import AsyncApp
-        from slack_bolt.adapter.socket_mode.async_handler import AsyncSocketModeHandler
-    except ImportError:
-        logger.warning(
-            "slack-bolt not installed — Slack bot disabled. "
-            "Run: pip install slack-bolt"
-        )
-        return
-
-    cfg = cfg_loader.sentinel
-    if not cfg.slack_bot_token or not cfg.slack_app_token:
-        logger.info("SLACK_BOT_TOKEN / SLACK_APP_TOKEN not set — Slack bot disabled")
-        return
-
-    if cfg.slack_channel:
-        logger.info("Sentinel Boss restricted to channel: %s", cfg.slack_channel)
-
-    app = AsyncApp(token=cfg.slack_bot_token)
-
-    # ── Channel resolver — converts #name to ID lazily on first event ─────────
-    _allowed_id: list = []   # single-element list used as mutable cell
-
-    async def _resolve_allowed(client):
-        raw = cfg.slack_channel.lstrip("#")
-        if not raw:
-            return
-        # Already a Slack channel ID (e.g. C01AB2CD3EF)
-        if raw.upper().startswith("C") and len(raw) >= 9:
-            _allowed_id.append(raw.upper())
-            return
-        try:
-            resp = await client.conversations_list(
-                types="public_channel,private_channel", limit=1000
-            )
-            for ch in (resp.get("channels") or []):
-                if ch.get("name") == raw:
-                    _allowed_id.append(ch["id"])
-                    logger.info("Boss channel resolved: #%s → %s", raw, ch["id"])
-                    return
-            logger.warning("SLACK_CHANNEL '%s' not found — responding everywhere", cfg.slack_channel)
-        except Exception as e:
-            logger.warning("Could not resolve SLACK_CHANNEL '%s': %s", cfg.slack_channel, e)
-
-    def _allowed(channel: str) -> bool:
-        return not _allowed_id or channel in _allowed_id
-
-    # ── Event handlers ────────────────────────────────────────────────────────
-
-    @app.event("app_mention")
-    async def on_mention(event, client):
-        if cfg.slack_channel and not _allowed_id:
-            await _resolve_allowed(client)
-        if _allowed(event.get("channel", "")):
-            await _dispatch(event, client, cfg_loader, store)
-
-    # ── Passive bot watcher — seed DB from config on startup ─────────────────
-    for bot_id_cfg in cfg.slack_watch_bot_ids:
-        if bot_id_cfg and not store.is_watched_bot(bot_id_cfg):
-            store.add_watched_bot(bot_id_cfg, bot_id_cfg, added_by="config")
-            logger.info("Seeded watched bot from config: %s", bot_id_cfg)
-
-    @app.event("message")
-    async def on_message(event, client):
-        # DMs from humans → Boss conversation
-        if event.get("channel_type") == "im" and not event.get("bot_id"):
-            await _dispatch(event, client, cfg_loader, store)
-            return
-
-        # Passive bot watcher — bot messages from DB-registered bots
-        bot_id = event.get("bot_id", "")
-        if bot_id and event.get("channel") and store.is_watched_bot(bot_id):
-            await _handle_bot_message(event, client, cfg_loader, store)
-
-    # ── Start ─────────────────────────────────────────────────────────────────
-
-    handler = AsyncSocketModeHandler(app, cfg.slack_app_token)
-    logger.info("Sentinel Boss connected to Slack (Socket Mode)")
-    watched = store.get_watched_bots()
-    if watched:
-        logger.info("Sentinel passively watching %d bot(s): %s",
-                    len(watched), [b["bot_name"] for b in watched])
-    await handler.start_async()
-
-
-# ── Bot-message watcher ───────────────────────────────────────────────────────
-
-import uuid as _uuid
-from pathlib import Path as _Path
-
-
-async def _handle_bot_message(event: dict, client, cfg_loader, store) -> None:
-    """
-    Called when a watched bot posts a message.
-    Queues the message as an issue in the bot's registered project directory.
-    All messages from watched bots are queued — no error pre-filtering.
-    """
-    bot_id  = event.get("bot_id", "")
-    channel = event.get("channel", "")
-    ts      = event.get("ts", "")
-
-    # Avoid duplicate issues
-    dedup_key = f"slack-watch:{channel}:{ts}"
-    if store.is_seen_dedup(dedup_key):
-        return
-    store.mark_seen_dedup(dedup_key)
-
-    # Flatten text (handle block-kit attachments too)
-    text = event.get("text", "")
-    for att in event.get("attachments", []):
-        text += "\n" + att.get("text", "") + "\n" + att.get("fallback", "")
-    text = text.strip()
-    if not text:
-        return
-
-    # Find the project this bot is registered to
-    bots = store.get_watched_bots()
-    bot_info = next((b for b in bots if b["bot_id"] == bot_id), None)
-    project_name = (bot_info or {}).get("project_name") or ""
-
-    # Resolve the project issues directory
-    workspace = _Path(cfg_loader.sentinel.workspace_dir).parent
-    if project_name:
-        # workspace_dir is <sentinel_root>/workspace, project dirs are siblings
-        project_dirs = [
-            d for d in workspace.iterdir()
-            if d.is_dir() and d.name != "workspace"
-            and (d / "config" / "sentinel.properties").exists()
-        ]
-        matched = next(
-            (d for d in project_dirs
-             if d.name == project_name or
-             _read_project_name_from_dir(d) == project_name),
-            None,
-        )
-        issues_dir = (matched / "issues") if matched else (_Path(".") / "issues")
-    else:
-        issues_dir = _Path(".") / "issues"
-
-    issues_dir.mkdir(parents=True, exist_ok=True)
-
-    uid = _uuid.uuid4().hex[:8]
-    fname = f"bot-{project_name or 'unknown'}-{uid}.txt"
-    content = (
-        f"SOURCE: Slack bot {bot_id} in channel {channel}\n"
-        f"SLACK_TS: {ts}\n\n"
-        f"{text}"
-    )
-    (issues_dir / fname).write_text(content, encoding="utf-8")
-    _Path("SENTINEL_POLL_NOW").touch()
-    logger.info("Bot watcher queued issue from %s → %s/%s", bot_id, issues_dir, fname)
-
-    # React with 👀 so the team knows Sentinel noticed it
-    if ts:
-        try:
-            await client.reactions_add(channel=channel, timestamp=ts, name="eyes")
-        except Exception:
-            pass  # reactions:write scope may not be granted — non-fatal
-
-
-def _read_project_name_from_dir(project_dir: _Path) -> str:
-    """Read PROJECT_NAME from a project's sentinel.properties, or return dir name."""
-    props = project_dir / "config" / "sentinel.properties"
-    if not props.exists():
-        return project_dir.name
-    try:
-        for line in props.read_text(encoding="utf-8").splitlines():
-            line = line.strip()
-            if line.upper().startswith("PROJECT_NAME="):
-                return line.split("=", 1)[1].partition("#")[0].strip()
-    except OSError:
-        pass
-    return project_dir.name
-
-
-# ── Dispatcher ────────────────────────────────────────────────────────────────
-
-async def _dispatch(event: dict, client, cfg_loader, store) -> None:
-    user_id = event.get("user", "")
-    channel = event.get("channel", "")
-    text    = _strip_mention(event.get("text", "")).strip()
-
-    if not text:
-        text = "hello"
-
-    # Allowlist check — if SLACK_ALLOWED_USERS is configured, silently ignore everyone else
-    allowed = cfg_loader.sentinel.slack_allowed_users
-    if allowed and user_id not in allowed:
-        logger.warning("Boss: ignoring message from unauthorised user %s", user_id)
-        return
-
-    user_name = await _resolve_name(client, user_id)
-
-    status, pos, session = await _queue.try_activate(user_id, user_name, channel)
-
-    if status == "queued":
-        await _queue.update_waiting_message(user_id, text)
-        active = _queue.active_user_name() or "someone"
-        await _post(client, channel,
-            f"I'm working with *{active}* right now. "
-            f"You're *#{pos}* in the queue — I'll come to you when done. :hourglass_flowing_sand:"
-        )
-        return
-
-    # Active or continuing — process the turn
-    await _run_turn(session, text, client, cfg_loader, store)
-
-
-# ── Turn processor ────────────────────────────────────────────────────────────
-
-_MAX_HISTORY_TURNS = 20   # keep last 20 exchanges (~40 messages) to stay well within context limits
-
-async def _run_turn(session: _Session, message: str, client, cfg_loader, store) -> None:
-    channel = session.channel
-
-    # Trim history to avoid context overflow on long conversations
-    if len(session.history) > _MAX_HISTORY_TURNS * 2:
-        session.history = session.history[-(_MAX_HISTORY_TURNS * 2):]
-
-    # Typing indicator
-    await _post(client, channel, "_thinking..._")
-
-    reply = ""
-    is_done = True
-    try:
-        reply, is_done = await handle_message(
-            message, session.history, cfg_loader, store,
-            slack_client=client,
-            user_name=session.user_name,
-        )
-    except Exception as e:
-        logger.exception("Sentinel Boss error: %s", e)
-        reply = f":warning: Unhandled error: {e}"
-
-    await _post(client, channel, reply)
-
-    if is_done:
-        next_item = await _queue.complete()
-        if next_item:
-            next_session, first_msg = next_item
-            await _post(
-                client, channel,
-                f":white_check_mark: Done with *{session.user_name}*. "
-                f"<@{next_session.user_id}> — you're up!"
-            )
-            if first_msg:
-                # Process their first message immediately
-                await _run_turn(next_session, first_msg, client, cfg_loader, store)
-
-
-# ── Helpers ───────────────────────────────────────────────────────────────────
-
-async def _post(client, channel: str, text: str) -> None:
-    if not text:
-        return
-    try:
-        await client.chat_postMessage(channel=channel, text=text)
-    except Exception as e:
-        logger.warning("Slack post failed: %s", e)
-
-
-async def _resolve_name(client, user_id: str) -> str:
-    try:
-        info = await client.users_info(user=user_id)
-        profile = info["user"]["profile"]
-        return profile.get("display_name") or profile.get("real_name") or user_id
-    except Exception:
-        return user_id
-
-
-def _strip_mention(text: str) -> str:
-    """Remove leading <@BOTID> mention from message text."""
-    import re
-    return re.sub(r"^<@[A-Z0-9]+>\s*", "", text)
+"""
+slack_bot.py — Slack integration for Sentinel Boss.
+
+Each user gets their own independent session — no global queue.
+Multiple team members can chat with Sentinel at the same time.
+
+Setup (api.slack.com):
+  1. Create a Slack App → Enable Socket Mode → copy App-Level Token (xapp-...)
+  2. Add Bot Token Scopes: app_mentions:read, chat:write, im:history,
+     channels:history, users:read, files:read
+  3. Enable Events: app_mention, message.im, message.channels
+  4. Install to workspace → copy Bot Token (xoxb-...)
+  5. Add to sentinel.properties:
+       SLACK_BOT_TOKEN=xoxb-...
+       SLACK_APP_TOKEN=xapp-...
+"""
+
+import asyncio
+import base64
+import logging
+import mimetypes
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Optional
+
+from .sentinel_boss import handle_message
+
+logger = logging.getLogger(__name__)
+
+
+# ── Per-user sessions ────────────────────────────────────────────────────────
+#
+# Each user gets their own independent session — no global queue.
+# Multiple team members can talk to Sentinel simultaneously.
+
+@dataclass
+class _Session:
+    user_id:        str
+    user_name:      str
+    channel:        str
+    history:        list = field(default_factory=list)
+    history_loaded: bool = False
+    busy:           bool = False   # True while a turn is being processed
+
+
+_sessions: dict[str, _Session] = {}
+_sessions_lock = asyncio.Lock()
+
+
+async def _get_or_create_session(user_id: str, user_name: str, channel: str) -> _Session:
+    async with _sessions_lock:
+        if user_id not in _sessions:
+            _sessions[user_id] = _Session(user_id, user_name, channel)
+        return _sessions[user_id]
+
+
+# ── Slack bot ─────────────────────────────────────────────────────────────────
+
+async def run_slack_bot(cfg_loader, store) -> None:
+    """
+    Start Slack Bolt in Socket Mode as an asyncio background task.
+    Exits silently if tokens are missing or slack-bolt is not installed.
+    """
+    try:
+        from slack_bolt.async_app import AsyncApp
+        from slack_bolt.adapter.socket_mode.async_handler import AsyncSocketModeHandler
+    except ImportError:
+        logger.warning(
+            "slack-bolt not installed — Slack bot disabled. "
+            "Run: pip install slack-bolt"
+        )
+        return
+
+    cfg = cfg_loader.sentinel
+    if not cfg.slack_bot_token or not cfg.slack_app_token:
+        logger.info("SLACK_BOT_TOKEN / SLACK_APP_TOKEN not set — Slack bot disabled")
+        return
+
+    if cfg.slack_channel:
+        logger.info("Sentinel Boss restricted to channel: %s", cfg.slack_channel)
+
+    app = AsyncApp(token=cfg.slack_bot_token)
+
+    # ── Channel resolver — converts #name to ID lazily on first event ─────────
+    _allowed_id: list = []   # single-element list used as mutable cell
+
+    async def _resolve_allowed(client):
+        raw = cfg.slack_channel.lstrip("#")
+        if not raw:
+            return
+        # Already a Slack channel ID (e.g. C01AB2CD3EF)
+        if raw.upper().startswith("C") and len(raw) >= 9:
+            _allowed_id.append(raw.upper())
+            return
+        try:
+            resp = await client.conversations_list(
+                types="public_channel,private_channel", limit=1000
+            )
+            for ch in (resp.get("channels") or []):
+                if ch.get("name") == raw:
+                    _allowed_id.append(ch["id"])
+                    logger.info("Boss channel resolved: #%s → %s", raw, ch["id"])
+                    return
+            logger.warning("SLACK_CHANNEL '%s' not found — responding everywhere", cfg.slack_channel)
+        except Exception as e:
+            logger.warning("Could not resolve SLACK_CHANNEL '%s': %s", cfg.slack_channel, e)
+
+    def _allowed(channel: str) -> bool:
+        return not _allowed_id or channel in _allowed_id
+
+    # ── Event handlers ────────────────────────────────────────────────────────
+
+    @app.event("app_mention")
+    async def on_mention(event, client):
+        if cfg.slack_channel and not _allowed_id:
+            await _resolve_allowed(client)
+        if _allowed(event.get("channel", "")):
+            await _dispatch(event, client, cfg_loader, store)
+
+    # ── Passive bot watcher — seed DB from config on startup ─────────────────
+    for bot_id_cfg in cfg.slack_watch_bot_ids:
+        if bot_id_cfg and not store.is_watched_bot(bot_id_cfg):
+            store.add_watched_bot(bot_id_cfg, bot_id_cfg, added_by="config")
+            logger.info("Seeded watched bot from config: %s", bot_id_cfg)
+
+    @app.event("message")
+    async def on_message(event, client):
+        # DMs from humans → Boss conversation
+        if event.get("channel_type") == "im" and not event.get("bot_id"):
+            await _dispatch(event, client, cfg_loader, store)
+            return
+
+        # Passive bot watcher — bot messages from DB-registered bots
+        bot_id = event.get("bot_id", "")
+        if bot_id and event.get("channel") and store.is_watched_bot(bot_id):
+            await _handle_bot_message(event, client, cfg_loader, store)
+
+    # ── Start ─────────────────────────────────────────────────────────────────
+
+    handler = AsyncSocketModeHandler(app, cfg.slack_app_token)
+    logger.info("Sentinel Boss connected to Slack (Socket Mode)")
+    watched = store.get_watched_bots()
+    if watched:
+        logger.info("Sentinel passively watching %d bot(s): %s",
+                    len(watched), [b["bot_name"] for b in watched])
+    await handler.start_async()
+
+
+# ── Bot-message watcher ───────────────────────────────────────────────────────
+
+import uuid as _uuid
+from pathlib import Path as _Path
+
+
+async def _handle_bot_message(event: dict, client, cfg_loader, store) -> None:
+    """
+    Called when a watched bot posts a message.
+    Queues the message as an issue in the bot's registered project directory.
+    All messages from watched bots are queued — no error pre-filtering.
+    """
+    bot_id  = event.get("bot_id", "")
+    channel = event.get("channel", "")
+    ts      = event.get("ts", "")
+
+    # Avoid duplicate issues
+    dedup_key = f"slack-watch:{channel}:{ts}"
+    if store.is_seen_dedup(dedup_key):
+        return
+    store.mark_seen_dedup(dedup_key)
+
+    # Flatten text (handle block-kit attachments too)
+    text = event.get("text", "")
+    for att in event.get("attachments", []):
+        text += "\n" + att.get("text", "") + "\n" + att.get("fallback", "")
+    text = text.strip()
+    if not text:
+        return
+
+    # Find the project this bot is registered to
+    bots = store.get_watched_bots()
+    bot_info = next((b for b in bots if b["bot_id"] == bot_id), None)
+    project_name = (bot_info or {}).get("project_name") or ""
+
+    # Resolve the project issues directory
+    workspace = _Path(cfg_loader.sentinel.workspace_dir).parent
+    if project_name:
+        # workspace_dir is <sentinel_root>/workspace, project dirs are siblings
+        project_dirs = [
+            d for d in workspace.iterdir()
+            if d.is_dir() and d.name != "workspace"
+            and (d / "config" / "sentinel.properties").exists()
+        ]
+        matched = next(
+            (d for d in project_dirs
+             if d.name == project_name or
+             _read_project_name_from_dir(d) == project_name),
+            None,
+        )
+        issues_dir = (matched / "issues") if matched else (_Path(".") / "issues")
+    else:
+        issues_dir = _Path(".") / "issues"
+
+    issues_dir.mkdir(parents=True, exist_ok=True)
+
+    uid = _uuid.uuid4().hex[:8]
+    fname = f"bot-{project_name or 'unknown'}-{uid}.txt"
+    content = (
+        f"SOURCE: Slack bot {bot_id} in channel {channel}\n"
+        f"SLACK_TS: {ts}\n\n"
+        f"{text}"
+    )
+    (issues_dir / fname).write_text(content, encoding="utf-8")
+    _Path("SENTINEL_POLL_NOW").touch()
+    logger.info("Bot watcher queued issue from %s → %s/%s", bot_id, issues_dir, fname)
+
+    # React with 👀 so the team knows Sentinel noticed it
+    if ts:
+        try:
+            await client.reactions_add(channel=channel, timestamp=ts, name="eyes")
+        except Exception:
+            pass  # reactions:write scope may not be granted — non-fatal
+
+
+def _read_project_name_from_dir(project_dir: _Path) -> str:
+    """Read PROJECT_NAME from a project's sentinel.properties, or return dir name."""
+    props = project_dir / "config" / "sentinel.properties"
+    if not props.exists():
+        return project_dir.name
+    try:
+        for line in props.read_text(encoding="utf-8").splitlines():
+            line = line.strip()
+            if line.upper().startswith("PROJECT_NAME="):
+                return line.split("=", 1)[1].partition("#")[0].strip()
+    except OSError:
+        pass
+    return project_dir.name
+
+
+# ── File-attachment handling ─────────────────────────────────────────────────
+
+_TEXT_MIMETYPES = {
+    "text/plain", "text/csv", "text/html", "application/json",
+    "application/xml", "text/xml", "text/markdown",
+}
+_TEXT_EXTENSIONS = {
+    ".txt", ".log", ".json", ".csv", ".md", ".yaml", ".yml",
+    ".properties", ".sh", ".py", ".java", ".kt", ".js", ".ts",
+}
+_IMAGE_MIMETYPES = {"image/png", "image/jpeg", "image/gif", "image/webp"}
+_MAX_TEXT_BYTES  = 8_000   # max chars to inline per text file
+
+
+async def _fetch_attachments(event: dict, client, workspace_dir: str) -> list[dict]:
+    """
+    Download files attached to a Slack message and classify them.
+
+    Returns list of dicts:
+      type    : "text" | "image" | "file"
+      name    : original filename
+      content : text (for text), base64 bytes (for image), "" (for other)
+      path    : saved local path
+      mime    : mimetype string
+    """
+    files = event.get("files", [])
+    if not files:
+        return []
+
+    import aiohttp
+
+    attach_dir = Path(workspace_dir) / "attachments"
+    attach_dir.mkdir(parents=True, exist_ok=True)
+    token = getattr(client, "token", "")
+
+    results = []
+    async with aiohttp.ClientSession() as http:
+        for file_info in files[:5]:   # cap at 5 attachments per message
+            url  = file_info.get("url_private_download") or file_info.get("url_private", "")
+            name = file_info.get("name") or file_info.get("title") or "attachment"
+            mime = file_info.get("mimetype", "")
+            if not url:
+                continue
+            try:
+                async with http.get(url, headers={"Authorization": f"Bearer {token}"}) as resp:
+                    if resp.status != 200:
+                        logger.warning("Boss: cannot download %s (HTTP %d)", name, resp.status)
+                        continue
+                    data = await resp.read()
+            except Exception as exc:
+                logger.warning("Boss: download error for %s: %s", name, exc)
+                continue
+
+            ext  = Path(name).suffix.lower()
+            dest = attach_dir / name
+
+            if mime in _IMAGE_MIMETYPES or ext in {".png", ".jpg", ".jpeg", ".gif", ".webp"}:
+                dest.write_bytes(data)
+                results.append({
+                    "type":    "image",
+                    "name":    name,
+                    "mime":    mime or mimetypes.guess_type(name)[0] or "image/png",
+                    "content": base64.b64encode(data).decode(),
+                    "path":    str(dest),
+                })
+            elif mime in _TEXT_MIMETYPES or ext in _TEXT_EXTENSIONS:
+                text = data.decode("utf-8", errors="replace")[:_MAX_TEXT_BYTES]
+                dest.write_text(text, encoding="utf-8")
+                results.append({
+                    "type":    "text",
+                    "name":    name,
+                    "mime":    mime,
+                    "content": text,
+                    "path":    str(dest),
+                })
+            else:
+                dest.write_bytes(data)
+                results.append({
+                    "type":    "file",
+                    "name":    name,
+                    "mime":    mime,
+                    "content": "",
+                    "path":    str(dest),
+                })
+            logger.info("Boss: downloaded attachment %s (%s, %d bytes)", name, mime, len(data))
+
+    return results
+
+
+# ── Dispatcher ────────────────────────────────────────────────────────────────
+
+async def _dispatch(event: dict, client, cfg_loader, store) -> None:
+    user_id = event.get("user", "")
+    channel = event.get("channel", "")
+    text    = _strip_mention(event.get("text", "")).strip()
+
+    if not text:
+        text = "hello"
+
+    # Allowlist check — if SLACK_ALLOWED_USERS is configured, silently ignore everyone else
+    allowed = cfg_loader.sentinel.slack_allowed_users
+    if allowed and user_id not in allowed:
+        logger.warning("Boss: ignoring message from unauthorised user %s", user_id)
+        return
+
+    user_name = await _resolve_name(client, user_id)
+    session   = await _get_or_create_session(user_id, user_name, channel)
+
+    if session.busy:
+        # Still processing a previous turn from this user — drop the duplicate
+        logger.info("Boss: %s sent a message while still processing, ignoring", user_id)
+        await _post(client, channel, "_Still thinking — one moment..._")
+        return
+
+    # Fetch any attached files (screenshots, logs, docs)
+    attachments: list[dict] = []
+    if event.get("files"):
+        attachments = await _fetch_attachments(event, client, cfg_loader.sentinel.workspace_dir)
+        if attachments:
+            logger.info("Boss: %d attachment(s) from %s", len(attachments), user_id)
+
+    await _run_turn(session, text, client, cfg_loader, store, attachments=attachments)
+
+
+# ── Turn processor ────────────────────────────────────────────────────────────
+
+_MAX_HISTORY_TURNS = 20   # keep last 20 exchanges (~40 messages) to stay well within context limits
+
+async def _run_turn(session: _Session, message: str, client, cfg_loader, store, attachments: list | None = None) -> None:
+    channel = session.channel
+
+    # Load persisted history from DB on the first turn of a new session
+    if not session.history_loaded:
+        session.history = store.load_conversation(session.user_id)
+        session.history_loaded = True
+
+    # Trim history to avoid context overflow on long conversations
+    if len(session.history) > _MAX_HISTORY_TURNS * 2:
+        session.history = session.history[-(_MAX_HISTORY_TURNS * 2):]
+
+    # Typing indicator
+    session.busy = True
+    await _post(client, channel, "_thinking..._")
+
+    reply = ""
+    is_done = True
+    try:
+        reply, is_done = await handle_message(
+            message, session.history, cfg_loader, store,
+            slack_client=client,
+            user_name=session.user_name,
+            user_id=session.user_id,
+            attachments=attachments or [],
+        )
+    except Exception as e:
+        logger.exception("Sentinel Boss error: %s", e)
+        reply = f":warning: Unhandled error: {e}"
+    finally:
+        session.busy = False
+
+    await _post(client, channel, reply)
+    # If session ended, save current history; if history was just cleared it will already be [] in DB
+    store.save_conversation(session.user_id, session.history)
+
+
+# ── Helpers ───────────────────────────────────────────────────────────────────
+
+async def _post(client, channel: str, text: str) -> None:
+    if not text:
+        return
+    try:
+        await client.chat_postMessage(channel=channel, text=text)
+    except Exception as e:
+        logger.warning("Slack post failed: %s", e)
+
+
+async def _resolve_name(client, user_id: str) -> str:
+    try:
+        info = await client.users_info(user=user_id)
+        profile = info["user"]["profile"]
+        return profile.get("display_name") or profile.get("real_name") or user_id
+    except Exception:
+        return user_id
+
+
+def _strip_mention(text: str) -> str:
+    """Remove leading <@BOTID> mention from message text."""
+    import re
+    return re.sub(r"^<@[A-Z0-9]+>\s*", "", text)