@pinet/slack-bridge 0.1.0 → 0.2.0

package/skills/slack-bridge/SKILL.md

@@ -50,7 +50,7 @@ should use the colon form.
 
 - Thread/channel messaging: `post_channel`, `read`, `read_channel`, `export`
 - Lightweight acknowledgement: `react`
-- Files/snippets: `upload`
+- Files/snippets: `upload`, `file`; `slack_send.files` and `post_channel.files` for text plus attachments in one message
 - Time-based follow-up: `schedule`
 - People/timing: `presence`
 - Durable channel affordances: `pin`, `bookmark`
@@ -144,6 +144,65 @@ snippets:
 ]
 ````
 
+## File workflows
+
+For outbound local files, attach them to the message-posting surface you are
+already using. Use `slack_send.files` for owned assistant-thread replies, and
+`slack` action `post_channel` with `args.files` for explicit channel/thread
+posts. Both use the same file object shape and send text plus files in one Slack
+message:
+
+```json
+{
+  "text": "Here is the report and the raw capture.",
+  "thread_ts": "1712345678.000100",
+  "files": [
+    { "path": "./out/report.pdf", "title": "Report" },
+    { "path": "/tmp/capture.bin", "filename": "capture.bin" }
+  ]
+}
+```
+
+```json
+{
+  "action": "post_channel",
+  "args": {
+    "channel": "#deployments",
+    "text": "Here is the deploy evidence.",
+    "files": [{ "path": "/tmp/evidence.png", "filename": "evidence.png" }]
+  }
+}
+```
+
+Local path guardrails still apply: paths must resolve inside the current working
+directory or the system temp directory. Binary files are supported.
+
+For inbound Slack-hosted files, `slack` action `read` downloads attached files to
+the local temp cache by default and returns safe descriptors alongside the
+message metadata. Use `args.download_files=false` when you only need message text
+and file metadata.
+
+Use the explicit `file` action when you have a specific file ID to retry,
+validate, or fetch outside a normal read flow:
+
+```json
+{
+  "action": "file",
+  "args": {
+    "op": "download",
+    "file_id": "F0123456789",
+    "thread_ts": "1712345678.000100",
+    "message_ts": "1712345678.000200"
+  }
+}
+```
+
+Both read-time downloads and the explicit file action download Slack-hosted user
+content into the local temp cache and return safe descriptors: file ID,
+filename/type, local temp path, size, SHA-256, cache directory, expiry, and
+residual risk notes. They must not print private Slack download URLs or raw file
+contents.
+
 ## Modal patterns
 
 Modal actions require a fresh Slack `trigger_id` from a recent interaction. The