@stratusagent/channel-slack 0.11.10 → 0.12.1

package/README.md

@@ -2,7 +2,7 @@
 
 Slack adapter for Stratus agents. **One Slack app per agent** — Slack has no way to give a single bot several identities with real avatars, presence, and DMs, so each agent gets its own app, and the adapter runs one Socket Mode connection per agent (no public ingress needed; Mac Minis behind NAT are fine).
 
-- **Resumable conversations**: session keys are `slack:<agent>:<team>:<channel>:<thread_ts ?? ts>` (DMs: the DM channel id) — a thread is a conversation, it survives daemon restarts, and two agents sharing a thread keep fully separate sessions. A turn parked on a human when the daemon died is re-asked after the restart, and a turn that was still running is continued from where it got to (unless the agent runs on a harness — `codex` or a Claude subscription — where it is failed instead, since the harness may already have acted on it); either way, when it finishes its reply is posted into the thread as a fresh message — the placeholder it would have edited belonged to the old process.
+- **Resumable conversations**: session keys are `slack:<agent>:<team>:<channel>:<thread_ts ?? ts>` (a DM's top level: the DM channel id alone; a thread in a DM adds its `thread_ts`) — a thread is a conversation, it survives daemon restarts, and two agents sharing a thread keep fully separate sessions. A turn parked on a human when the daemon died is re-asked after the restart, and a turn that was still running is continued from where it got to (unless the agent runs on a harness — `codex` or a Claude subscription — where it is failed instead, since the harness may already have acted on it); either way, when it finishes its reply is posted into the thread as a fresh message — the placeholder it would have edited belonged to the old process.
 - **Replies post when they are ready**: by default each message is posted once, finished: what the agent writes before starting a tool is posted as the tool starts, and the reply follows, with Slack's loading status (`assistant.threads.setStatus` — "is thinking…", "is running shell.run…") shown while the turn works, so the notification carries the answer. The `stream` reply mode (`slack.replies` in the [config](../../docs/guides/slack.md#how-replies-appear)) keeps the placeholder-and-edit rendering instead: post `…`, edit as deltas arrive (throttled for `chat.update` limits), show `⚙ tool…` status lines, finalize with the full reply. Either way a reply that outgrows one message is split across several.
 - **Markdown is translated to Slack's mrkdwn** on the way out — `**bold**` to `*bold*`, `*italic*` to `_italic_`, `~~struck~~` to `~struck~`, `[text](https://…)` to `<https://…|text>`, and a `#` heading to a bold line, since mrkdwn has no headings. A bare address is sent as `<https://…>`, Slack's own link markup, so emphasis around it (`**https://…**`) cannot be read as part of it, and a `*`, `_`, or `~` inside one is part of the address rather than a marker. Trailing punctuation (`.`, `,`, `**`) and a `)` the address never opened belong to the sentence, as in GFM autolinks, so `…/wiki/Function_(mathematics)` stays whole. A bare address is sent as `<https://…>`, Slack's own link markup, so emphasis around it (`**https://…**`) cannot be read as part of it, and the `*`, `_`, or `~` inside one is part of the address rather than a marker; trailing punctuation (`.`, `,`, `**`) is the sentence's, as in GFM autolinks. The reply is read once into tokens and written back from those, so what counts as code is decided one time rather than by each rule in turn. Three things follow from that. **A code run is one token**: nothing reads or rewrites inside it, an unclosed fence included, and the newlines in a fence are not line breaks — so a `#` on a line of somebody's shell script is not a heading. A run of N backticks opens code and only a run of exactly N closes it, which is what lets ``a span with a ` in it`` and a ````-fence holding a ```-fence work; one or two unmatched backticks are text, as they are in Markdown, but a pair is a span however far apart, because Slack pairs them too. **A delimiter is matched to its partner**, across whatever sits between — ``**the `fs.read` tool**`` is bold around a snippet, not four literal asterisks — though never across a line, so a marker still being streamed stays literal until its closing half arrives. A run is spent rather than matched whole, so the three asterisks ending `**bold and *italic***` close the italic with one and the bold with two; what no pair spends stays on the line as text, and what a run cannot buy — the third tilde of `~~~struck~~~`, a style that does not exist — is never charged for. **A wrapper is only written where its own character is not already loose** in what it wraps: Slack has one delimiter per style and no way to nest it, so a heading that already contains bold keeps the bold it has rather than gaining a second pair that would print instead of render, and `# glob *.ts` keeps an asterisk that was never a marker. A heading sheds its hashes and its trailing spaces from the prose that holds them, never from a snippet. Anything whose spelling already matches — lists, block quotes, inline code — is untouched. **A pipe table**, which mrkdwn has no syntax for, becomes a code block with its columns padded to line up (alignment colons respected, `**`/`` ` `` markers dropped from cells, since nothing renders inside code); a grid wider than 60 characters — past what a phone shows unwrapped — or one with a link in it (a link inside a code block is not clickable) becomes one line per row, `*Header*: value · *Header*: value`. A one-column table has nothing to line up and becomes a bulleted list under its bold header. A table inside a fence is somebody's text and stays as written, and a grid longer than one message is split like any code block, closed at the cut and reopened in the next, with its header and rule repeated so every part names its columns.
 - **Mention to start, then it stays in the thread.** A mention opens a conversation; every reply in that thread reaches the agent without tagging it again, and free-form DMs are unchanged. A mention partway into an existing thread opens the conversation with what was said before it: the thread's parent and its newest 39 earlier messages. A mention at the top of a channel opens with the channel's 20 most recent messages instead, which is where a channel per client or per project keeps its context. Either way each message keeps its own speaker and its own trust, so a principal's mention does not carry a stranger's earlier words in under the principal's label (other bots count as `unknown`, and under `admit: "principals"` unlisted senders are left out). This needs the history scopes below; without them the agent sees only the message that named it, and the adapter logs a warning. Who an untagged reply is for is decided by [Who a message is for](#who-a-message-is-for). Inbound mentions of other users are humanized to `@Display Name` for the model; redeliveries are deduped so a slow turn never runs twice — in memory while the process remembers them, and after a restart by the gateway: each message is dispatched with its own key (`idempotencyKey`), a repeat runs no second turn, and the adapter posts that message's own reply and files (a file changed since that turn is skipped, since the path may now hold another file), or its failure if the turn failed — once more, if the process died after posting it, which beats a reply never posted.
@@ -146,8 +146,17 @@ message after what was said, between `[Attached: plan.md. Its contents
 follow.]` and `[End of plan.md]`. A text file dropped in alone is a
 question, like a screenshot. One file may be 100 KB and one message's text
 files 200 KB together, since read text joins the conversation and is sent
-again every turn; a larger one is never downloaded, and `stratus serve`
-warns with the file's name. A file that is not UTF-8, or that comes back as
+again every turn. A larger one, up to 10 MB, is saved under the agent's
+workspace (`attachments/slack/<stamp>-<file id>-<name>`, `0600`) when the
+host passes `attachmentStore`, and the message says `[Attached: spec.md,
+251 KB, too large to include here. It is saved in full at <path>. …]`. The
+path is recorded in the tainted-write ledger at the sender's label before
+the bytes are written, so `fs.read` of it carries that label. One agent's
+saved attachments are bounded together (`attachmentStore.maxBytes`, 256 MB
+by default, and 1,000 files): past it a save is refused, the file reaches the turn as a
+name, and the warning names the directory to clear. Nothing is deleted. `stratus
+serve` passes it; a host that does not, or a file over 10 MB, gets the name
+only, and `stratus serve` warns with the file's name. A file that is not UTF-8, or that comes back as
 Slack's sign-in page because the scope is missing, is treated as unreadable
 and the warning names the scope. Text files share the message's 30-second
 download deadline with its images.
@@ -187,7 +196,7 @@ untagged reply in it, including the ones meant for somebody else. Give the
 side conversation its own thread. It can now *hear* a thread it is not
 answering; teaching it to choose — to answer only when it has something to
 add, and to let "thanks, we've got it" be a sentence it read — is the rest
-of [roadmap step 31](../../docs/roadmap/31-reading-the-room.md).
+of the reading-the-room work.
 
 ### What the agent is told about the room
 

package/dist/index.d.ts

@@ -1,3 +1,4 @@
+import { type AgentWorkspaces, type TrustLevel } from '@stratusagent/core';
 import { type AdmitPolicy, type ChannelAdapter } from '@stratusagent/channels';
 /** One agent's Slack identity: its own app (avatar, presence) and tokens. */
 export interface SlackAgentConfig {
@@ -45,6 +46,12 @@ export interface SlackAgentConfig {
      * a `…` placeholder at once and edits it as the reply is written.
      */
     replies?: 'final' | 'stream';
+    /**
+     * `false` posts this agent's messages without link and media previews
+     * (Slack's `unfurl_links`/`unfurl_media`). Absent or `true` leaves
+     * Slack's default, which previews them.
+     */
+    linkPreviews?: boolean;
     /**
      * Channel ids where a new top-level message from an admitted sender is
      * this agent's to answer without a mention: the channel people come to
@@ -255,6 +262,8 @@ export interface SlackWebLike {
             text: string;
             thread_ts?: string;
             blocks?: SlackBlock[];
+            unfurl_links?: boolean;
+            unfurl_media?: boolean;
         }): Promise<{
             ts?: string;
             channel?: string;
@@ -409,6 +418,31 @@ export interface SlackAdapterOptions {
      * Defaults to `DEFAULT_FILE_DOWNLOAD_TIMEOUT_MS`.
      */
     fileDownloadTimeoutMs?: number;
+    /**
+     * Where a text attachment too large to read into the message is saved
+     * instead, so the turn can be told a path rather than only a name.
+     *
+     * Both halves or neither: the file holds what a Slack member sent, and
+     * read back through `fs.read` without a ledger record it would arrive as
+     * the agent's own notes — the laundering the ledger exists to stop. So the
+     * path is recorded at the sender's label before the bytes land, as
+     * `plugin-mcp` does for a server's files. Without this option such a file
+     * reaches the turn as a name only, as before.
+     */
+    attachmentStore?: {
+        workspaces: AgentWorkspaces;
+        /** The host's tainted-write ledger, the one `tool-fs` reads. */
+        ledger: {
+            recordWrite(agentId: string, absolutePath: string, trust: TrustLevel): Promise<void>;
+        };
+        /**
+         * The most one agent's saved attachments may weigh together, so anyone
+         * admitted to talk to the agent cannot fill the host's disk. A save that
+         * would pass it is refused (the file is a name-only note and the log
+         * says where to make room); nothing is deleted. Defaults to 256 MB.
+         */
+        maxBytes?: number;
+    };
     /**
      * Test injection: the clock, in milliseconds, that an upload's place in
      * the thread is read from (`ReplyOutcome.spokeAt`) when the upload's
@@ -416,6 +450,13 @@ export interface SlackAdapterOptions {
      */
     now?: () => number;
 }
+/**
+ * A client whose every post goes out without link or media previews, for
+ * an agent configured with `linkPreviews: false`. Applied once around the
+ * client, so no post site can forget it. `chat.update` takes no unfurl
+ * flags; an edited placeholder keeps the post's own setting.
+ */
+export declare const withoutLinkPreviews: (web: SlackWebLike) => SlackWebLike;
 /**
  * The default fetcher over a `fetch`. Exported as a factory so the bounded
  * read can be tested against a fake `fetch` with a body that never ends;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAqCA,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,cAAc,EAUpB,MAAM,wBAAwB,CAAC;AAyFhC,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC7B;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAKD,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,gHAAgH;QAChH,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,uFAAuF;QACvF,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,yFAAyF;QACzF,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,oFAAoF;QACpF,IAAI,CAAC,EAAE;YACL,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAC1B,KAAK,CAAC,EAAE;gBAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;oBAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;iBAAE,CAAC,CAAC,CAAA;aAAE,CAAC;SAChF,CAAC;QACF,0EAA0E;QAC1E,IAAI,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACvB,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC;QAC7B,OAAO,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1B;;;;;WAKG;QACH,OAAO,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAA;SAAE,CAAC;KACtE,CAAC;IACF,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6EAA6E;AAC7E,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEjD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAC5B;AAED,sEAAsE;AACtE,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAoBrD,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEpI,MAAM,WAAW,eAAe;IAC9B,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,OAAO,GAAG,IAAI,CAAC;IAC/E,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,MAAM,CAAC,EAAE;YACP,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;gBAAE,EAAE,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC,CAAC;YAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;gBAAE,EAAE,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC,CAAC;SAClD,CAAC;KACH,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChC,YAAY,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iBAAiB,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9C;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QAAE,IAAI,IAAI,OAAO,CAAC;YAAE,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,iBAAiB,CAAC,EAAE;gBAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;aAAE,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAC7G,IAAI,EAAE;QACJ,WAAW,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,EAAE,CAAC,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC5I,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACrG;;;;WAIG;QACH,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChE;;;WAGG;QACH,aAAa,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAC5G,CAAC;IACF;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE;YACP,SAAS,CAAC,IAAI,EAAE;gBAAE,UAAU,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAC;gBAAC,MAAM,EAAE,MAAM,CAAA;aAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;SAC9F,CAAC;KACH,CAAC;IACF,KAAK,EAAE;QAGL,QAAQ,CAAC,IAAI,EAAE;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;KACzI,CAAC;IACF,aAAa,EAAE;QACb;;;;;WAKG;QACH,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC;YACtE,OAAO,CAAC,EAAE;gBACR,EAAE,CAAC,EAAE,MAAM,CAAC;gBACZ,IAAI,CAAC,EAAE,MAAM,CAAC;gBACd,SAAS,CAAC,EAAE,OAAO,CAAC;gBACpB,KAAK,CAAC,EAAE,OAAO,CAAC;gBAChB,UAAU,CAAC,EAAE,OAAO,CAAC;gBACrB,OAAO,CAAC,EAAE,OAAO,CAAC;gBAClB,WAAW,CAAC,EAAE,MAAM,CAAC;gBACrB,8DAA8D;gBAC9D,aAAa,CAAC,EAAE,OAAO,CAAC;gBACxB,mEAAmE;gBACnE,aAAa,CAAC,EAAE,OAAO,CAAC;aACzB,CAAC;SACH,CAAC,CAAC;QACH;;;;WAIG;QACH,OAAO,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC;YAC3E,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;YACnB,iBAAiB,CAAC,EAAE;gBAAE,WAAW,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC;SAC9C,CAAC,CAAC;QACH;;;;;WAKG;QACH,OAAO,CAAC,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC5D,0EAA0E;QAC1E,OAAO,CAAC,CAAC,IAAI,EAAE,gBAAgB,GAAG;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;KAC9E,CAAC;IACF,KAAK,EAAE;QACL,IAAI,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,IAAI,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,OAAO,CAAC,EAAE;oBAAE,YAAY,CAAC,EAAE,MAAM,CAAC;oBAAC,SAAS,CAAC,EAAE,MAAM,CAAA;iBAAE,CAAA;aAAE,CAAA;SAAE,CAAC,CAAC;KAC9H,CAAC;IACF;;;;;OAKG;IACH,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,IAAI,EAAE;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,UAAU,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACxE,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,iFAAiF;IACjF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,eAAe,CAAC;IAC3D,8DAA8D;IAC9D,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,YAAY,CAAC;IACrD;;;;OAIG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAuDD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GAAI,WAAW,OAAO,KAAK,KAAG,gBAgChE,CAAC;AA0+DF,eAAO,MAAM,yBAAyB,GAAI,SAAS,mBAAmB,KAAG,cA6kGxE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAyBL,KAAK,eAAe,EAMpB,KAAK,UAAU,EAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,cAAc,EAUpB,MAAM,wBAAwB,CAAC;AAyFhC,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC7B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAKD,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,gHAAgH;QAChH,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,uFAAuF;QACvF,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,yFAAyF;QACzF,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,oFAAoF;QACpF,IAAI,CAAC,EAAE;YACL,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAC1B,KAAK,CAAC,EAAE;gBAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;oBAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;iBAAE,CAAC,CAAC,CAAA;aAAE,CAAC;SAChF,CAAC;QACF,0EAA0E;QAC1E,IAAI,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACvB,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC;QAC7B,OAAO,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1B;;;;;WAKG;QACH,OAAO,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAA;SAAE,CAAC;KACtE,CAAC;IACF,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6EAA6E;AAC7E,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEjD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAC5B;AAED,sEAAsE;AACtE,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAoBrD,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEpI,MAAM,WAAW,eAAe;IAC9B,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,OAAO,GAAG,IAAI,CAAC;IAC/E,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,MAAM,CAAC,EAAE;YACP,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;gBAAE,EAAE,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC,CAAC;YAChD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;gBAAE,EAAE,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC,CAAC;SAClD,CAAC;KACH,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChC,YAAY,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iBAAiB,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9C;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QAAE,IAAI,IAAI,OAAO,CAAC;YAAE,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,iBAAiB,CAAC,EAAE;gBAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;aAAE,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAC7G,IAAI,EAAE;QACJ,WAAW,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;YAAC,YAAY,CAAC,EAAE,OAAO,CAAC;YAAC,YAAY,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,EAAE,CAAC,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC5L,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACrG;;;;WAIG;QACH,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChE;;;WAGG;QACH,aAAa,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAC5G,CAAC;IACF;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE;YACP,SAAS,CAAC,IAAI,EAAE;gBAAE,UAAU,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAC;gBAAC,MAAM,EAAE,MAAM,CAAA;aAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;SAC9F,CAAC;KACH,CAAC;IACF,KAAK,EAAE;QAGL,QAAQ,CAAC,IAAI,EAAE;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;KACzI,CAAC;IACF,aAAa,EAAE;QACb;;;;;WAKG;QACH,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC;YACtE,OAAO,CAAC,EAAE;gBACR,EAAE,CAAC,EAAE,MAAM,CAAC;gBACZ,IAAI,CAAC,EAAE,MAAM,CAAC;gBACd,SAAS,CAAC,EAAE,OAAO,CAAC;gBACpB,KAAK,CAAC,EAAE,OAAO,CAAC;gBAChB,UAAU,CAAC,EAAE,OAAO,CAAC;gBACrB,OAAO,CAAC,EAAE,OAAO,CAAC;gBAClB,WAAW,CAAC,EAAE,MAAM,CAAC;gBACrB,8DAA8D;gBAC9D,aAAa,CAAC,EAAE,OAAO,CAAC;gBACxB,mEAAmE;gBACnE,aAAa,CAAC,EAAE,OAAO,CAAC;aACzB,CAAC;SACH,CAAC,CAAC;QACH;;;;WAIG;QACH,OAAO,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC;YAC3E,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;YACnB,iBAAiB,CAAC,EAAE;gBAAE,WAAW,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC;SAC9C,CAAC,CAAC;QACH;;;;;WAKG;QACH,OAAO,CAAC,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC5D,0EAA0E;QAC1E,OAAO,CAAC,CAAC,IAAI,EAAE,gBAAgB,GAAG;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;KAC9E,CAAC;IACF,KAAK,EAAE;QACL,IAAI,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC;YAAE,IAAI,CAAC,EAAE;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,OAAO,CAAC,EAAE;oBAAE,YAAY,CAAC,EAAE,MAAM,CAAC;oBAAC,SAAS,CAAC,EAAE,MAAM,CAAA;iBAAE,CAAA;aAAE,CAAA;SAAE,CAAC,CAAC;KAC9H,CAAC;IACF;;;;;OAKG;IACH,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,IAAI,EAAE;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,UAAU,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACxE,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,iFAAiF;IACjF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,eAAe,CAAC;IAC3D,8DAA8D;IAC9D,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,YAAY,CAAC;IACrD;;;;OAIG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE;QAChB,UAAU,EAAE,eAAe,CAAC;QAC5B,gEAAgE;QAChE,MAAM,EAAE;YAAE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;SAAE,CAAC;QACjG;;;;;WAKG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAkDD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,YAAY,KAAG,YAQvD,CAAC;AAOF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GAAI,WAAW,OAAO,KAAK,KAAG,gBAgChE,CAAC;AAmpEF,eAAO,MAAM,yBAAyB,GAAI,SAAS,mBAAmB,KAAG,cA6nGxE,CAAC"}

package/dist/index.js

@@ -1,5 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
-import { lstat, open, readFile } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, readdir, readFile, realpath } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import path from 'node:path';
 import { filePathsOf, isLatestTurn, latestTurnReply, MAX_IDEMPOTENCY_KEY_LENGTH, turnFailureFor, turnFilesFor, turnReplyFor, CONVERSATION_METADATA_KEY, SENDER_TRUST_METADATA_KEY, sessionWriteTrust, imageDimensions, isImageAttachmentMediaType, IMAGE_ATTACHMENT_MAX_BYTES, IMAGE_ATTACHMENT_MAX_DIMENSION, IMAGE_ATTACHMENTS_MAX_TOTAL_BYTES, escapeControlCharacters, leastTrusted, sessionTrustOf, SESSION_TRUST_METADATA_KEY, } from '@stratusagent/core';
@@ -138,6 +139,21 @@ const checkBotScopes = (agentId, granted, warn) => {
         + 'Without them, some features (thread follow-through, image viewing, '
         + 'channel history) will silently fail.');
 };
+/**
+ * A client whose every post goes out without link or media previews, for
+ * an agent configured with `linkPreviews: false`. Applied once around the
+ * client, so no post site can forget it. `chat.update` takes no unfurl
+ * flags; an edited placeholder keeps the post's own setting.
+ */
+export const withoutLinkPreviews = (web) => {
+    // Delegating objects, not copies: everything else on the client (and a
+    // method replaced on it later) is still reached through the original.
+    const chat = Object.create(web.chat);
+    chat.postMessage = (args) => web.chat.postMessage({ ...args, unfurl_links: false, unfurl_media: false });
+    const wrapped = Object.create(web);
+    wrapped.chat = chat;
+    return wrapped;
+};
 const defaultWebClient = (botToken) => {
     const { WebClient } = requireModule('@slack/web-api');
     return new WebClient(botToken);
@@ -1631,6 +1647,136 @@ const TEXT_ATTACHMENT_MAX_BYTES = 100 * 1024;
  * is a cost decision as much as a context one.
  */
 const TEXT_ATTACHMENTS_MAX_TOTAL_BYTES = 200 * 1024;
+/**
+ * The most a text attachment may weigh to be saved to the agent's
+ * workspace when it is too large to read into the message. A 251 KB
+ * Markdown spec reached an agent as a filename and it had no way to open
+ * it; saved, the agent reads it with its file tools, in parts.
+ */
+const TEXT_ATTACHMENT_SAVE_MAX_BYTES = 10 * 1024 * 1024;
+/** The default bound on one agent's saved attachments, all together. */
+const SAVED_ATTACHMENTS_MAX_BYTES = 256 * 1024 * 1024;
+/**
+ * The most saved attachments one agent keeps, whatever they weigh. A file
+ * crowded out of a full message is saved however small it is, and each save
+ * is a ledger record, so the count is bounded as well as the bytes.
+ */
+const SAVED_ATTACHMENTS_MAX_FILES = 1_000;
+/** Under the agent's workspace, where saved attachments go. */
+const SAVED_ATTACHMENTS_DIR = path.join('attachments', 'slack');
+/**
+ * A file name safe to join under a directory: Slack's name is whatever the
+ * uploader's client sent, so separators, `..`, and control characters are
+ * replaced rather than trusted. Stamped, so the same file shared twice is
+ * two saves rather than a name already taken.
+ */
+const savedAttachmentName = (file, now) => {
+    const base = ((file.name ?? file.title ?? '').split(/[\\/]/).pop() ?? '').replace(/[^A-Za-z0-9._-]+/g, '_').replace(/^[._]+/, '').slice(0, 120);
+    const id = (file.id ?? '').replace(/[^A-Za-z0-9]+/g, '').slice(0, 32);
+    return [now.toString(36), ...(id.length > 0 ? [id] : []), base.length > 0 ? base : 'attachment'].join('-');
+};
+/**
+ * Refuses a save that would take the directory's regular files past
+ * `maxBytes` together, or its entries past `SAVED_ATTACHMENTS_MAX_FILES`. Refused rather than making room: deleting on a
+ * Slack member's say is a worse failure than a full directory, and with
+ * nothing removed every ledger record still names a file that exists.
+ */
+const ensureRoom = async (dir, incoming, maxBytes) => {
+    let total = 0;
+    const names = await readdir(dir);
+    for (const name of names) {
+        const info = await lstat(path.join(dir, name)).catch(() => undefined);
+        total += info?.isFile() ? info.size : 0;
+    }
+    if (names.length >= SAVED_ATTACHMENTS_MAX_FILES) {
+        throw new Error(`${dir} already holds ${SAVED_ATTACHMENTS_MAX_FILES} saved attachments; remove files there to save more`);
+    }
+    if (total + incoming > maxBytes) {
+        throw new Error(`saved attachments in ${dir} would pass their ${maxBytes}-byte bound; remove files there to save more`);
+    }
+};
+/**
+ * One save at a time per directory, across messages and sessions: two
+ * concurrent saves would each measure the same free space and both write.
+ */
+const saveChains = new Map();
+const serialized = (key, run) => {
+    const previous = saveChains.get(key) ?? Promise.resolve();
+    const next = previous.catch(() => undefined).then(run);
+    const settled = next.catch(() => undefined);
+    saveChains.set(key, settled);
+    void settled.then(() => {
+        if (saveChains.get(key) === settled) {
+            saveChains.delete(key);
+        }
+    });
+    return next;
+};
+/**
+ * The saver for one agent and one sender. The directory is canonical
+ * because the ledger is keyed the way `fs.read` looks a path up, through
+ * `realpath`. The path is recorded before the bytes land, so a crash
+ * between the two leaves a labelled path with no file, never a file with
+ * no label; and the file is created exclusively, so a link planted at the
+ * name fails the save rather than carrying the bytes somewhere the ledger
+ * never saw.
+ */
+const createAttachmentSaver = (store, agentId, trust, now) => async (file, body) => {
+    const workspace = store.workspaces.prepare(agentId);
+    const lexical = path.join(workspace, SAVED_ATTACHMENTS_DIR);
+    // One component at a time, never through a link: a recursive mkdir would
+    // follow a link planted at `attachments` and create `slack` wherever it
+    // points before the check below could refuse it.
+    await mkdir(workspace, { recursive: true, mode: 0o700 });
+    let at = workspace;
+    for (const part of SAVED_ATTACHMENTS_DIR.split(path.sep)) {
+        at = path.join(at, part);
+        await mkdir(at, { mode: 0o700 }).catch((error) => {
+            if (error.code !== 'EEXIST') {
+                throw error;
+            }
+        });
+        const info = await lstat(at);
+        if (!info.isDirectory()) {
+            throw new Error(`${at} is not a directory of the workspace's own`);
+        }
+    }
+    // The directory must be exactly where the workspace says, through no link
+    // of its own: one already planted at `attachments` or `attachments/slack`
+    // would put the file outside the workspace, where the agent's file tools
+    // cannot read it and nothing should be written on a Slack member's say.
+    const dir = await realpath(lexical);
+    if (dir !== path.join(await realpath(workspace), SAVED_ATTACHMENTS_DIR)) {
+        throw new Error(`${lexical} is a link, not the workspace's own directory`);
+    }
+    return serialized(dir, async () => {
+        await ensureRoom(dir, body.length, store.maxBytes ?? SAVED_ATTACHMENTS_MAX_BYTES);
+        const target = path.join(dir, savedAttachmentName(file, now()));
+        await store.ledger.recordWrite(agentId, target, trust);
+        // O_EXCL and O_NOFOLLOW guard only the last component. A directory on the
+        // way swapped for a link after the record would send the create somewhere
+        // else, so the open file is checked against the recorded name before a
+        // byte is written (the same check as the plugins package's
+        // `nameIdentifiesHandle`). A refused save leaves the empty file rather
+        // than unlinking through a name that just proved it can move.
+        const handle = await open(target, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 0o600);
+        try {
+            const [canonical, atName, held] = await Promise.all([
+                realpath(target).catch(() => undefined),
+                lstat(target).catch(() => undefined),
+                handle.stat(),
+            ]);
+            if (canonical !== target || atName === undefined || atName.dev !== held.dev || atName.ino !== held.ino) {
+                throw new Error(`${target} moved between its provenance record and its write`);
+            }
+            await handle.writeFile(body);
+        }
+        finally {
+            await handle.close();
+        }
+        return target;
+    });
+};
 const TEXT_APPLICATION_TYPES = new Set([
     'application/json',
     'application/xml',
@@ -1668,8 +1814,9 @@ const isTextAttachment = (file) => {
  * caps, or comes back as a page stays in `unread` and is named in the
  * note, exactly as before; the warning says why.
  */
-const readTextAttachments = async (files, botToken, fetchFile, timeoutMs, deadline, warn, reasons) => {
+const readTextAttachments = async (files, botToken, fetchFile, timeoutMs, deadline, warn, reasons, save) => {
     const texts = [];
+    const saved = [];
     const unread = [];
     const skip = (file, reason) => {
         unread.push(file);
@@ -1691,8 +1838,13 @@ const readTextAttachments = async (files, botToken, fetchFile, timeoutMs, deadli
             continue;
         }
         const maxBytes = Math.min(TEXT_ATTACHMENT_MAX_BYTES, TEXT_ATTACHMENTS_MAX_TOTAL_BYTES - total);
-        if (file.size !== undefined && file.size > maxBytes) {
-            warn(`slack: ${fileLabel(file)} is ${file.size} bytes, over the ${maxBytes} bytes of text this message could still take; the turn is told it cannot be read. Paste the part that matters, or split the file.`);
+        // Over the inline cap, a file is still downloaded when it can be saved
+        // to the workspace instead; only over that cap too is it a name.
+        const limit = save === undefined ? maxBytes : Math.max(maxBytes, TEXT_ATTACHMENT_SAVE_MAX_BYTES);
+        if (file.size !== undefined && file.size > limit) {
+            warn(save === undefined
+                ? `slack: ${fileLabel(file)} is ${file.size} bytes, over the ${maxBytes} bytes of text this message could still take; the turn is told it cannot be read. Paste the part that matters, or split the file.`
+                : `slack: ${fileLabel(file)} is ${file.size} bytes, over the ${limit} bytes a text attachment may be saved at; the turn is told it cannot be read. Paste the part that matters, or split the file.`);
             skip(file, 'too-large');
             continue;
         }
@@ -1703,7 +1855,7 @@ const readTextAttachments = async (files, botToken, fetchFile, timeoutMs, deadli
         }
         let download;
         try {
-            download = await fetchFile(url, botToken, deadline, maxBytes);
+            download = await fetchFile(url, botToken, deadline, limit);
         }
         catch (error) {
             const reason = error instanceof Error && error.name === 'TimeoutError'
@@ -1722,8 +1874,8 @@ const readTextAttachments = async (files, botToken, fetchFile, timeoutMs, deadli
             skip(file, 'failed');
             continue;
         }
-        if (download.truncated === true || download.body.length > maxBytes) {
-            warn(`slack: ${fileLabel(file)} is larger than the ${maxBytes} bytes of text this message could still take; the download was abandoned and the turn is told it cannot be read.`);
+        if (download.truncated === true || download.body.length > limit) {
+            warn(`slack: ${fileLabel(file)} is larger than the ${limit} bytes ${save === undefined ? 'of text this message could still take' : 'a text attachment may be saved at'}; the download was abandoned and the turn is told it cannot be read.`);
             skip(file, 'too-large');
             continue;
         }
@@ -1736,11 +1888,24 @@ const readTextAttachments = async (files, botToken, fetchFile, timeoutMs, deadli
             skip(file, 'unreadable');
             continue;
         }
+        if (download.body.length > maxBytes) {
+            // Only reachable with a saver: `limit` is `maxBytes` without one.
+            try {
+                saved.push({ name: fileLabel(file), path: await save(file, download.body), bytes: download.body.length });
+            }
+            catch (error) {
+                warn(`slack: could not save ${fileLabel(file)} to the agent's workspace: ${error instanceof Error ? error.message : String(error)}. The turn is told it cannot be read.`);
+                skip(file, 'too-large');
+            }
+            continue;
+        }
         total += download.body.length;
         texts.push({ name: fileLabel(file), text });
     }
-    return { texts, unread };
+    return { texts, saved, unread };
 };
+/** Saved attachments, named with where each is, after what was said. */
+const savedAttachmentBlocks = (saved) => saved.map(({ name, path: at, bytes }) => `\n[Attached: ${name}, ${Math.ceil(bytes / 1024)} KB, too large to include here. It is saved in full at ${at}. Read it with your file tools, in parts if it is long.]`).join('');
 /** Read text attachments, set into the message after what was said. */
 const textAttachmentBlocks = (texts) => texts.map(({ name, text }) => `\n[Attached: ${name}. Its contents follow.]\n${text.replace(/\s+$/, '')}\n[End of ${name}]`).join('');
 /**
@@ -2065,6 +2230,12 @@ export const createSlackChannelAdapter = (options) => {
     const botIdentities = new Map();
     // Rendered approval requests, keyed by the gateway's request id — the
     // same id the buttons carry back.
+    //
+    // In memory only, and that is an open gap: a prompt posted by a process
+    // that died is never retracted unless someone clicks it (a click on a
+    // prompt this process never posted rewrites it from the click's own
+    // coordinates). Retracting the ones nobody clicks needs a durable index
+    // of these posts that survives the process that made them.
     const approvalPosts = new Map();
     // Credential requests whose post is in flight: Slack can show the message,
     // and take a click on it, before postMessage resolves here. The same
@@ -2953,7 +3124,16 @@ export const createSlackChannelAdapter = (options) => {
         if (!gateway) {
             return;
         }
-        const connection = connectionFor(event.agentId);
+        // A delegated call is asked where the work was asked for: the
+        // delegating conversation, through the app and approvers of the agent
+        // at the root of the chain. The agent doing the work may have no
+        // connection here at all, and its sub-session has no conversation of
+        // its own — asked the old way, nobody saw it and the turn sat out the
+        // whole timeout. The gateway makes such a call one-shot, so routing it
+        // through another agent's approvers never grants anything standing.
+        const origin = event.delegatedFrom;
+        const viaOrigin = origin ? connectionFor(origin.agentId) : undefined;
+        const connection = viaOrigin ?? connectionFor(event.agentId);
         if (!connection) {
             // Two different situations, and only one of them is this adapter's
             // to answer.
@@ -2968,14 +3148,14 @@ export const createSlackChannelAdapter = (options) => {
             // agent — denying here would let Slack refuse a question somebody
             // else was going to ask. `stratus serve` reports agents that no
             // channel can ask for, at startup, where the whole roster is visible.
-            if (configuredAgents.has(event.agentId)) {
-                warn(`slack: ${event.agentId} has no live connection; denying ${event.call.toolName}`);
+            if (configuredAgents.has(event.agentId) || (origin && configuredAgents.has(origin.agentId))) {
+                warn(`slack: ${origin?.agentId ?? event.agentId} has no live connection; denying ${event.call.toolName}`);
                 gateway.resolveApproval({ requestId: event.requestId, answer: 'deny', reason: 'undeliverable' });
             }
             return;
         }
         const approvers = new Set((connection.config.approvers ?? []).filter((id) => id.length > 0));
-        const metadata = event.metadata ?? {};
+        const metadata = (viaOrigin ? origin?.metadata : event.metadata) ?? {};
         const sameChannel = metadata.channel === 'slack' && typeof metadata.slackChannel === 'string'
             ? metadata.slackChannel
             : undefined;
@@ -2989,14 +3169,19 @@ export const createSlackChannelAdapter = (options) => {
             gateway.resolveApproval({ requestId: event.requestId, answer: 'deny', reason: 'undeliverable' });
         };
         if (approvers.size === 0) {
-            decline(`no approvers configured for ${event.agentId}`);
+            decline(`no approvers configured for ${connection.config.agentId}`);
             return;
         }
         if (!channel) {
-            decline(`no conversation to ask in for ${event.agentId}`);
+            decline(`no conversation to ask in for ${connection.config.agentId}`);
             return;
         }
-        const agentName = gateway.agents().find((agent) => agent.id === event.agentId)?.name ?? event.agentId;
+        const nameOf = (agentId) => gateway.agents().find((agent) => agent.id === agentId)?.name ?? agentId;
+        // "Quinn (for Nova)": the approver is being asked about Quinn's call,
+        // by Nova's app, in Nova's conversation, and should be told both.
+        const agentName = viaOrigin && origin && origin.agentId !== event.agentId
+            ? `${nameOf(event.agentId)} (for ${nameOf(origin.agentId)})`
+            : nameOf(event.agentId);
         // The notification preview is all some approvers see before deciding
         // whether to open the thread, so it carries the arguments too — just
         // the short form.
@@ -3277,7 +3462,8 @@ export const createSlackChannelAdapter = (options) => {
             // "Said nothing" as the session can tell it: no reply saved for the
             // turn. A line the old process had streamed into a placeholder and
             // never saved is invisible here — the session records what was
-            // said, not what Slack took (roadmap 31's open item) — so such a
+            // said, not what Slack took (the open delivery-record item at the
+            // gateway's lastSpokeAt) — so such a
             // turn is failed without a note under that line. Taken over the
             // alternative on purpose: a note for every judged turn a restart
             // caught turns a silent turn, the common case, into the
@@ -3345,9 +3531,13 @@ export const createSlackChannelAdapter = (options) => {
             return { said: routing.unaddressed === true, landed };
         }
         // A reply the thread's other agents hear like any other, taking their
-        // place for it before the post, as `handleInbound` does.
+        // place for it before the post, as `handleInbound` does. A DM thread
+        // has nobody else in it to hear, as on the live path.
         const published = postAheadOf(behind, connection, channel, thread, posting, uploads);
-        const heard = routing.reply !== undefined && thread !== undefined
+        const conversation = metadata[CONVERSATION_METADATA_KEY];
+        const isDm = typeof conversation === 'object' && conversation !== null && !Array.isArray(conversation)
+            && conversation.kind === 'direct';
+        const heard = routing.reply !== undefined && thread !== undefined && !isDm
             ? overhearReply(connection, channel, thread, routing.reply, routing, published)
             : undefined;
         const delivered = await published;
@@ -4046,9 +4236,10 @@ export const createSlackChannelAdapter = (options) => {
         const isDm = event.channel_type === 'im';
         const team = args.body?.team_id ?? connection.teamId;
         // A top-level mention has no thread_ts; its own ts roots the reply
-        // thread that becomes the conversation. DMs are one conversation per
-        // peer, unkeyed by thread.
-        const thread = isDm ? undefined : event.thread_ts ?? event.ts;
+        // thread that becomes the conversation. A DM's top level is one
+        // conversation per peer, unkeyed by thread; a thread inside the DM is a
+        // conversation of its own, answered in that thread.
+        const thread = isDm ? event.thread_ts : event.thread_ts ?? event.ts;
         // Threads only: a DM has one agent by construction.
         const threadKey = thread !== undefined && !isDm
             ? threadKeyFor({ team, conversation: event.channel, thread })
@@ -4371,20 +4562,22 @@ export const createSlackChannelAdapter = (options) => {
             const { images, unread: notImages } = overhear || judged
                 ? { images: [], unread: event.files ?? [] }
                 : await readImageAttachments(event.files ?? [], connection.config.botToken, fetchFile, fileDownloadTimeoutMs, warn, reasons, deadline);
-            const { texts, unread } = overhear || judged
-                ? { texts: [], unread: notImages }
-                : await readTextAttachments(notImages, connection.config.botToken, fetchFile, fileDownloadTimeoutMs, deadline, warn, reasons);
+            const { texts, saved, unread } = overhear || judged
+                ? { texts: [], saved: [], unread: notImages }
+                : await readTextAttachments(notImages, connection.config.botToken, fetchFile, fileDownloadTimeoutMs, deadline, warn, reasons, options.attachmentStore
+                    ? createAttachmentSaver(options.attachmentStore, connection.config.agentId, senderTrustFor(connection.config, userId), options.now ?? Date.now)
+                    : undefined);
             // An image or a document with nothing said is still a question
             // ("what's this?"); a file the turn could not open with nothing said
             // is not one, and gets no reply.
-            if (cleaned.length === 0 && images.length === 0 && texts.length === 0) {
+            if (cleaned.length === 0 && images.length === 0 && texts.length === 0 && saved.length === 0) {
                 return undefined;
             }
             const author = await authorFor(connection, userId);
             // In shared channels the model should know who is speaking; a DM is
             // unambiguous. A bare image in a channel still says who sent it.
             const spoken = isDm ? cleaned : (cleaned.length > 0 ? `${author}: ${cleaned}` : `${author}:`);
-            const userMessage = `${spoken}${textAttachmentBlocks(texts)}${attachmentNote(unread, reasons)}`;
+            const userMessage = `${spoken}${textAttachmentBlocks(texts)}${savedAttachmentBlocks(saved)}${attachmentNote(unread, reasons)}`;
             // Who sent this, judged against the operator's list — per message,
             // never remembered from the first one in the thread. A DM proves
             // nothing about who is typing, so a DM from an unlisted member is
@@ -4403,7 +4596,9 @@ export const createSlackChannelAdapter = (options) => {
                 : {
                     ...room,
                     ...(room.kind === 'direct' && senderTrust === 'user' ? { with: author } : {}),
-                    ...(thread !== undefined && room.kind !== 'direct' ? { thread: true } : {}),
+                    // A DM thread is a thread too, with its own session; core takes
+                    // no root for a direct room, since nothing posts to one by id.
+                    ...(thread !== undefined ? { thread: true, ...(room.kind !== 'direct' ? { threadRoot: thread } : {}) } : {}),
                     // People outside this workspace read a Slack Connect channel, and
                     // the event says so itself, even when the lookup failed.
                     ...(room.kind !== 'direct' && args.body?.is_ext_shared_channel === true ? { shared: true } : {}),
@@ -4449,7 +4644,7 @@ export const createSlackChannelAdapter = (options) => {
             // said before this. Inside the chain, before the placeholder, so the
             // read cannot reorder this message against the next one.
             let earlier = [];
-            if (!isDm && thread !== undefined) {
+            if (thread !== undefined) {
                 // A top-level mention roots its own session, so it is new but for
                 // a redelivery, which the gateway answers without reading this.
                 let exists = false;
@@ -4483,7 +4678,8 @@ export const createSlackChannelAdapter = (options) => {
                 // while the tool it preceded is still running. Under the session's
                 // label as stored, lowered by anything that tainted it during this
                 // turn, and the least trusted label where it cannot be read.
-                ...(thread !== undefined
+                // A DM thread has nobody else in it to hear.
+                ...(thread !== undefined && !isDm
                     ? {
                         onInterim: (heard, landed) => {
                             // Tracked, so a shutdown drains it like any other reaction:
@@ -4664,7 +4860,7 @@ export const createSlackChannelAdapter = (options) => {
                 replyLanded = outcome.published;
                 return true;
             }, () => true);
-            const heard = thread !== undefined
+            const heard = thread !== undefined && !isDm
                 ? overhearReply(connection, event.channel, thread, () => renderer.spokenText(replyLanded ? reply ?? '' : ''), session, settled)
                 : undefined;
             const { spoke, spokeAt } = await finalized;
@@ -4689,7 +4885,14 @@ export const createSlackChannelAdapter = (options) => {
             await heard;
         }
         else {
-            const { spoke, spokeAt } = await renderer.fail(failure instanceof Error ? failure.message : String(failure));
+            // A paused daemon's refusal is its answer, said as it is: the
+            // operator wrote that sentence for the person reading it, and it is
+            // not a failure of the agent. Matched by name, as this package does
+            // not import the gateway. A turn nobody asked for stays silent.
+            const pausedReply = failure instanceof Error && failure.name === 'IntakePausedError';
+            const { spoke, spokeAt } = pausedReply
+                ? await renderer.finalize(renderer.lazy ? '' : failure.message)
+                : await renderer.fail(failure instanceof Error ? failure.message : String(failure));
             if (spoke && threadKey !== undefined) {
                 // A file it posted before breaking is still the last thing said.
                 rememberAddressee(threadKey, connection.config.agentId, spokeAt ?? event.ts);
@@ -4831,7 +5034,8 @@ export const createSlackChannelAdapter = (options) => {
                     continue;
                 }
                 try {
-                    const web = createWeb(config.botToken);
+                    const created = createWeb(config.botToken);
+                    const web = config.linkPreviews === false ? withoutLinkPreviews(created) : created;
                     const auth = await web.auth.test();
                     const botUserId = auth.user_id ?? '';
                     const teamId = auth.team_id ?? '';