agent-messenger 2.32.0 → 2.32.1

package/skills/agent-teams/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-teams
 description: Interact with Microsoft Teams - send messages, read channels, manage reactions
-version: 2.32.0
+version: 2.32.1
 allowed-tools: Bash(agent-teams:*)
 metadata:
   openclaw:

package/skills/agent-telegram/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-telegram
 description: Interact with Telegram through TDLib - authenticate, inspect chats, and send messages
-version: 2.32.0
+version: 2.32.1
 allowed-tools: Bash(agent-telegram:*)
 ---
 

package/skills/agent-telegrambot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-telegrambot
 description: Interact with Telegram using bot tokens - send messages, read chats, manage reactions
-version: 2.32.0
+version: 2.32.1
 allowed-tools: Bash(agent-telegrambot:*)
 metadata:
   openclaw:

package/skills/agent-webex/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-webex
 description: Interact with Cisco Webex - send messages, read spaces, manage memberships
-version: 2.32.0
+version: 2.32.1
 allowed-tools: Bash(agent-webex:*)
 metadata:
   openclaw:

package/skills/agent-webexbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-webexbot
 description: Interact with Cisco Webex using bot tokens - send messages, reply in threads, upload and download files, look up people, read spaces, manage memberships, stream real-time events
-version: 2.32.0
+version: 2.32.1
 allowed-tools: Bash(agent-webexbot:*)
 metadata:
   openclaw:

package/skills/agent-wechatbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-wechatbot
 description: Interact with WeChat Official Account using API credentials - send messages, manage templates, list followers
-version: 2.32.0
+version: 2.32.1
 allowed-tools: Bash(agent-wechatbot:*)
 metadata:
   openclaw:

package/skills/agent-whatsapp/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-whatsapp
 description: Interact with WhatsApp - send messages, read chats, manage conversations
-version: 2.32.0
+version: 2.32.1
 allowed-tools: Bash(agent-whatsapp:*)
 metadata:
   openclaw:

package/skills/agent-whatsappbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-whatsappbot
 description: Interact with WhatsApp using Cloud API credentials - send messages, manage templates
-version: 2.32.0
+version: 2.32.1
 allowed-tools: Bash(agent-whatsappbot:*)
 metadata:
   openclaw:

package/src/platforms/channeltalk/token-extractor.test.ts

@@ -18,10 +18,60 @@ describe('ChannelTokenExtractor', () => {
   })
 
   describe('getAppDataDir', () => {
+    const originalAppData = process.env.APPDATA
+
+    afterEach(() => {
+      if (originalAppData === undefined) delete process.env.APPDATA
+      else process.env.APPDATA = originalAppData
+    })
+
     it('returns null for unsupported platform', () => {
       const extractor = new ChannelTokenExtractor('freebsd' as NodeJS.Platform)
       expect(extractor.getAppDataDir()).toBeNull()
     })
+
+    it('resolves the rebranded Channel Works directory', () => {
+      // given
+      const tempDir = mkdtempSync(join(tmpdir(), 'channel-appdata-'))
+      tempDirs.push(tempDir)
+      mkdirSync(join(tempDir, 'Channel Works'), { recursive: true })
+      process.env.APPDATA = tempDir
+
+      // when
+      const extractor = new ChannelTokenExtractor('win32')
+
+      // then
+      expect(extractor.getAppDataDir()).toBe(join(tempDir, 'Channel Works'))
+    })
+
+    it('falls back to the legacy Channel Talk directory', () => {
+      // given
+      const tempDir = mkdtempSync(join(tmpdir(), 'channel-appdata-'))
+      tempDirs.push(tempDir)
+      mkdirSync(join(tempDir, 'Channel Talk'), { recursive: true })
+      process.env.APPDATA = tempDir
+
+      // when
+      const extractor = new ChannelTokenExtractor('win32')
+
+      // then
+      expect(extractor.getAppDataDir()).toBe(join(tempDir, 'Channel Talk'))
+    })
+
+    it('prefers Channel Works when an upgraded install keeps both directories', () => {
+      // given
+      const tempDir = mkdtempSync(join(tmpdir(), 'channel-appdata-'))
+      tempDirs.push(tempDir)
+      mkdirSync(join(tempDir, 'Channel Talk'), { recursive: true })
+      mkdirSync(join(tempDir, 'Channel Works'), { recursive: true })
+      process.env.APPDATA = tempDir
+
+      // when
+      const extractor = new ChannelTokenExtractor('win32')
+
+      // then
+      expect(extractor.getAppDataDir()).toBe(join(tempDir, 'Channel Works'))
+    })
   })
 
   describe('getCookiesPath', () => {
@@ -173,6 +223,191 @@ describe('ChannelTokenExtractor', () => {
       ])
     })
 
+    it('ignores look-alike hosts that merely contain a channel domain', async () => {
+      const tempDir = mkdtempSync(join(tmpdir(), 'channel-cookie-db-'))
+      tempDirs.push(tempDir)
+      const dbPath = join(tempDir, 'Cookies')
+      // These hosts all contain a channel domain as a substring but are not the domain nor a
+      // subdomain of it, so nobody who controls one may speak for Channel. They are inserted
+      // first so a substring match would let them shadow the real cookies below.
+      await createCookieDatabase(dbPath, [
+        {
+          name: 'x-account',
+          value: 'imposter-account',
+          encrypted_value: Buffer.alloc(0),
+          host_key: '.channel.works.example.com',
+        },
+        {
+          name: 'ch-session-1',
+          value: 'imposter-session',
+          encrypted_value: Buffer.alloc(0),
+          host_key: '.channel.works.example.com',
+        },
+        { name: 'x-account', value: 'imposter-io', encrypted_value: Buffer.alloc(0), host_key: '.channel.io.evil.net' },
+        { name: 'x-account', value: 'real-account', encrypted_value: Buffer.alloc(0), host_key: '.channel.works' },
+        { name: 'ch-session-1', value: 'real-session', encrypted_value: Buffer.alloc(0), host_key: '.channel.works' },
+      ])
+
+      class TestExtractor extends ChannelTokenExtractor {
+        constructor(private dbPath: string) {
+          super('darwin')
+        }
+
+        override getCookiesPath(): string | null {
+          return this.dbPath
+        }
+      }
+
+      const extractor = new TestExtractor(dbPath)
+      const browserSpy = spyOn(extractor as any, 'extractAllFromBrowserPaths').mockResolvedValue([])
+
+      expect(await extractor.extract()).toEqual([
+        {
+          accountCookie: 'real-account',
+          sessionCookie: 'real-session',
+        },
+      ])
+
+      browserSpy.mockRestore()
+    })
+
+    it('extracts cookies from a subdomain of a channel domain', async () => {
+      const tempDir = mkdtempSync(join(tmpdir(), 'channel-cookie-db-'))
+      tempDirs.push(tempDir)
+      const dbPath = join(tempDir, 'Cookies')
+      // The boundary check must not be so strict that it drops legitimate subdomains.
+      await createCookieDatabase(dbPath, [
+        { name: 'x-account', value: 'account-jwt', encrypted_value: Buffer.alloc(0), host_key: '.desk.channel.works' },
+        { name: 'ch-session-1', value: 'session-jwt', encrypted_value: Buffer.alloc(0), host_key: 'channel.works' },
+      ])
+
+      class TestExtractor extends ChannelTokenExtractor {
+        constructor(private dbPath: string) {
+          super('darwin')
+        }
+
+        override getCookiesPath(): string | null {
+          return this.dbPath
+        }
+      }
+
+      const extractor = new TestExtractor(dbPath)
+      const browserSpy = spyOn(extractor as any, 'extractAllFromBrowserPaths').mockResolvedValue([])
+
+      expect(await extractor.extract()).toEqual([
+        {
+          accountCookie: 'account-jwt',
+          sessionCookie: 'session-jwt',
+        },
+      ])
+
+      browserSpy.mockRestore()
+    })
+
+    it('prefers channel.works cookies over stale legacy channel.io cookies', async () => {
+      const tempDir = mkdtempSync(join(tmpdir(), 'channel-cookie-db-'))
+      tempDirs.push(tempDir)
+      const dbPath = join(tempDir, 'Cookies')
+      // Legacy rows are inserted first so they win a naive find() that ignores the domain.
+      await createCookieDatabase(dbPath, [
+        { name: 'x-account', value: 'stale-account', encrypted_value: Buffer.alloc(0), host_key: '.channel.io' },
+        { name: 'ch-session-1', value: 'stale-session', encrypted_value: Buffer.alloc(0), host_key: '.channel.io' },
+        { name: 'x-account', value: 'live-account', encrypted_value: Buffer.alloc(0), host_key: '.channel.works' },
+        { name: 'ch-session-1', value: 'live-session', encrypted_value: Buffer.alloc(0), host_key: '.channel.works' },
+      ])
+
+      class TestExtractor extends ChannelTokenExtractor {
+        constructor(private dbPath: string) {
+          super('darwin')
+        }
+
+        override getCookiesPath(): string | null {
+          return this.dbPath
+        }
+      }
+
+      const extractor = new TestExtractor(dbPath)
+      const browserSpy = spyOn(extractor as any, 'extractAllFromBrowserPaths').mockResolvedValue([])
+
+      expect(await extractor.extract()).toEqual([
+        {
+          accountCookie: 'live-account',
+          sessionCookie: 'live-session',
+        },
+      ])
+
+      browserSpy.mockRestore()
+    })
+
+    it('never pairs an x-account with a session cookie from the other domain', async () => {
+      const tempDir = mkdtempSync(join(tmpdir(), 'channel-cookie-db-'))
+      tempDirs.push(tempDir)
+      const dbPath = join(tempDir, 'Cookies')
+      // channel.works holds an identity but no session; the only session belongs to channel.io.
+      // The live identity must be returned session-less rather than borrowing the legacy session,
+      // which belongs to a different domain and would not authenticate it.
+      await createCookieDatabase(dbPath, [
+        { name: 'x-account', value: 'works-account', encrypted_value: Buffer.alloc(0), host_key: '.channel.works' },
+        { name: 'x-account', value: 'io-account', encrypted_value: Buffer.alloc(0), host_key: '.channel.io' },
+        { name: 'ch-session-1', value: 'io-session', encrypted_value: Buffer.alloc(0), host_key: '.channel.io' },
+      ])
+
+      class TestExtractor extends ChannelTokenExtractor {
+        constructor(private dbPath: string) {
+          super('darwin')
+        }
+
+        override getCookiesPath(): string | null {
+          return this.dbPath
+        }
+      }
+
+      const extractor = new TestExtractor(dbPath)
+      const browserSpy = spyOn(extractor as any, 'extractAllFromBrowserPaths').mockResolvedValue([])
+
+      expect(await extractor.extract()).toEqual([
+        {
+          accountCookie: 'works-account',
+          sessionCookie: undefined,
+        },
+      ])
+
+      browserSpy.mockRestore()
+    })
+
+    it('extracts cookies stored on the rebranded channel.works domain', async () => {
+      const tempDir = mkdtempSync(join(tmpdir(), 'channel-cookie-db-'))
+      tempDirs.push(tempDir)
+      const dbPath = join(tempDir, 'Cookies')
+      await createCookieDatabase(dbPath, [
+        { name: 'x-account', value: 'account-jwt', encrypted_value: Buffer.alloc(0), host_key: '.channel.works' },
+        { name: 'ch-session-1', value: 'session-jwt', encrypted_value: Buffer.alloc(0), host_key: '.channel.works' },
+      ])
+
+      class TestExtractor extends ChannelTokenExtractor {
+        constructor(private dbPath: string) {
+          super('darwin')
+        }
+
+        override getCookiesPath(): string | null {
+          return this.dbPath
+        }
+      }
+
+      const extractor = new TestExtractor(dbPath)
+      // Browser profiles are stubbed out so a real logged-in browser on the host cannot leak in.
+      const browserSpy = spyOn(extractor as any, 'extractAllFromBrowserPaths').mockResolvedValue([])
+
+      expect(await extractor.extract()).toEqual([
+        {
+          accountCookie: 'account-jwt',
+          sessionCookie: 'session-jwt',
+        },
+      ])
+
+      browserSpy.mockRestore()
+    })
+
     it('returns token with undefined sessionCookie when only x-account is present', async () => {
       const tempDir = mkdtempSync(join(tmpdir(), 'channel-cookie-db-'))
       tempDirs.push(tempDir)

package/src/platforms/channeltalk/token-extractor.ts

@@ -18,14 +18,66 @@ import type { KeychainVariant } from '@/shared/chromium'
 
 import type { ExtractedChannelToken } from './types'
 
-type CookieRow = { name: string; value: string; encrypted_value: Uint8Array | Buffer }
+type CookieRow = { name: string; value: string; encrypted_value: Uint8Array | Buffer; host_key: string }
+
+// Channel Talk was rebranded to Channel Works: the desktop app now stores its cookies under a
+// "Channel Works" directory. Both names are probed, newest first, so upgraded and legacy
+// installs (which keep the old directory around) both resolve.
+const APP_DIR_NAMES = ['Channel Works', 'Channel Talk']
+
+// Cookies for the rebranded channel.works domain and the legacy channel.io domain can coexist in
+// one profile, most likely on a browser that was signed in before and after the rebrand.
+const COOKIE_DOMAINS = ['channel.works', 'channel.io']
+
+/**
+ * Match a cookie's host key against a domain on an exact label boundary: the domain itself, or a
+ * subdomain of it.
+ *
+ * Substring matching is not good enough here. `host_key LIKE '%.channel.works%'` also admits an
+ * unrelated host such as `.channel.works.example.com`, so a cookie planted by anyone who controls
+ * a name of that shape could shadow the real one and be sent to the Channel API as our identity.
+ */
+function hostMatchesDomain(hostKey: string, domain: string): boolean {
+  const host = hostKey.startsWith('.') ? hostKey.slice(1) : hostKey
+  return host === domain || host.endsWith(`.${domain}`)
+}
+
+// Mirrors hostMatchesDomain in SQL so the database does the same boundary-aware narrowing. The
+// domains are hardcoded constants, never caller input, so interpolating them is safe.
+const COOKIE_HOST_FILTER = COOKIE_DOMAINS.map((domain) => `host_key = '${domain}' OR host_key LIKE '%.${domain}'`).join(
+  ' OR ',
+)
 
 const COOKIE_QUERY = `
-  SELECT name, value, encrypted_value FROM cookies
+  SELECT name, value, encrypted_value, host_key FROM cookies
   WHERE name IN ('x-account', 'ch-session-1', 'ch-session')
-  AND host_key LIKE '%.channel.io%'
+  AND (${COOKIE_HOST_FILTER})
 `
 
+function findExistingAppDir(bases: string[]): string | null {
+  for (const base of bases) {
+    for (const name of APP_DIR_NAMES) {
+      const appDir = join(base, name)
+      if (existsSync(appDir)) return appDir
+    }
+  }
+  return null
+}
+
+/**
+ * Split cookie rows into one group per domain, newest domain first, dropping domains with no rows.
+ *
+ * Callers resolve a credential pair from a single group rather than from all rows at once. That
+ * keeps `x-account` and its session cookie from being read off different domains, which would pair
+ * an identity with a session that does not belong to it, and it stops a leftover legacy cookie from
+ * shadowing a live channel.works one.
+ */
+function groupRowsByDomain(rows: CookieRow[]): CookieRow[][] {
+  return COOKIE_DOMAINS.map((domain) => rows.filter((row) => hostMatchesDomain(row.host_key, domain))).filter(
+    (group) => group.length > 0,
+  )
+}
+
 export class ChannelTokenExtractor {
   private platform: NodeJS.Platform
   private decryptor: ChromiumCookieDecryptor
@@ -42,7 +94,7 @@ export class ChannelTokenExtractor {
   getAppDataDir(): string | null {
     switch (this.platform) {
       case 'darwin': {
-        const sandboxedPath = join(
+        const sandboxedBase = join(
           homedir(),
           'Library',
           'Containers',
@@ -50,18 +102,13 @@ export class ChannelTokenExtractor {
           'Data',
           'Library',
           'Application Support',
-          'Channel Talk',
         )
-        if (existsSync(sandboxedPath)) {
-          return sandboxedPath
-        }
-        const directPath = join(homedir(), 'Library', 'Application Support', 'Channel Talk')
-        return existsSync(directPath) ? directPath : null
+        const directBase = join(homedir(), 'Library', 'Application Support')
+        return findExistingAppDir([sandboxedBase, directBase])
       }
       case 'win32': {
         const appdata = process.env.APPDATA || join(homedir(), 'AppData', 'Roaming')
-        const appDir = join(appdata, 'Channel Talk')
-        return existsSync(appDir) ? appDir : null
+        return findExistingAppDir([appdata])
       }
       default:
         return null
@@ -221,12 +268,18 @@ export class ChannelTokenExtractor {
     if (rows.length === 0) return null
 
     const localStatePath = this.getLocalStatePath() ?? undefined
-    const accountCookie = this.getDesktopCookieValue(rows, 'x-account', localStatePath)
-    const sessionCookie =
-      this.getDesktopCookieValue(rows, 'ch-session-1', localStatePath) ??
-      this.getDesktopCookieValue(rows, 'ch-session', localStatePath)
+    for (const group of groupRowsByDomain(rows)) {
+      const accountCookie = this.getDesktopCookieValue(group, 'x-account', localStatePath)
+      if (!accountCookie) continue
 
-    return accountCookie ? { accountCookie, sessionCookie } : null
+      const sessionCookie =
+        this.getDesktopCookieValue(group, 'ch-session-1', localStatePath) ??
+        this.getDesktopCookieValue(group, 'ch-session', localStatePath)
+
+      return { accountCookie, sessionCookie }
+    }
+
+    return null
   }
 
   private async extractFromBrowserCookiePath(cookiePath: string): Promise<ExtractedChannelToken | null> {
@@ -234,12 +287,18 @@ export class ChannelTokenExtractor {
     if (rows.length === 0) return null
 
     const localStatePath = findLocalStatePath(cookiePath) ?? undefined
-    const accountCookie = this.getBrowserCookieValue(rows, 'x-account', localStatePath)
-    const sessionCookie =
-      this.getBrowserCookieValue(rows, 'ch-session-1', localStatePath) ??
-      this.getBrowserCookieValue(rows, 'ch-session', localStatePath)
+    for (const group of groupRowsByDomain(rows)) {
+      const accountCookie = this.getBrowserCookieValue(group, 'x-account', localStatePath)
+      if (!accountCookie) continue
 
-    return accountCookie ? { accountCookie, sessionCookie } : null
+      const sessionCookie =
+        this.getBrowserCookieValue(group, 'ch-session-1', localStatePath) ??
+        this.getBrowserCookieValue(group, 'ch-session', localStatePath)
+
+      return { accountCookie, sessionCookie }
+    }
+
+    return null
   }
 
   private getDesktopCookieValue(rows: CookieRow[], name: string, localStatePath?: string): string | undefined {

package/src/platforms/discord/commands/channel.test.ts

@@ -1,7 +1,8 @@
-import { afterEach, beforeEach, expect, spyOn, it } from 'bun:test'
+import { afterEach, beforeEach, expect, mock, spyOn, it } from 'bun:test'
 
 import { DiscordClient } from '../client'
 import { DiscordCredentialManager } from '../credential-manager'
+import { listAction } from './channel'
 
 let clientListChannelsSpy: ReturnType<typeof spyOn>
 let clientGetChannelSpy: ReturnType<typeof spyOn>
@@ -12,8 +13,10 @@ beforeEach(() => {
   // Spy on DiscordClient.prototype methods
   clientListChannelsSpy = spyOn(DiscordClient.prototype, 'listChannels').mockResolvedValue([
     { id: 'ch-1', guild_id: 'guild-1', name: 'general', type: 0, topic: 'General discussion' },
-    { id: 'ch-2', guild_id: 'guild-1', name: 'announcements', type: 0, topic: 'Announcements' },
+    { id: 'ch-2', guild_id: 'guild-1', name: 'announcements', type: 5, topic: 'Announcements' },
     { id: 'ch-3', guild_id: 'guild-1', name: 'voice-channel', type: 2, topic: undefined },
+    { id: 'ch-4', guild_id: 'guild-1', name: 'Text Channels', type: 4, topic: undefined },
+    { id: 'ch-5', guild_id: 'guild-1', name: 'a-thread', type: 11, topic: undefined },
   ])
 
   clientGetChannelSpy = spyOn(DiscordClient.prototype, 'getChannel').mockImplementation(async (channelId: string) => {
@@ -72,30 +75,37 @@ afterEach(() => {
   credManagerLoadSpy?.mockRestore()
 })
 
-it('list: returns text channels (type=0) from server', async () => {
-  // given: discord client with channels
-  const client = await new DiscordClient().login({ token: 'test-token' })
-  const channels = await client.listChannels('server-1')
-
-  // when: filtering text channels
-  const textChannels = channels.filter((ch) => ch.type === 0)
-
-  // then: only text channels are returned
-  expect(textChannels).toHaveLength(2)
-  expect(textChannels[0].name).toBe('general')
-  expect(textChannels[1].name).toBe('announcements')
+it('list: includes text, announcement, and voice channels but excludes categories and threads', async () => {
+  // given: a server with mixed channel types
+  const consoleSpy = mock(() => {})
+  const originalLog = console.log
+  console.log = consoleSpy
+
+  // when: listing channels
+  await listAction({ pretty: false })
+  console.log = originalLog
+
+  // then: only listable channels are output
+  const output = JSON.parse(consoleSpy.mock.calls[0][0] as string) as Array<{ name: string; type: number }>
+  const names = output.map((ch) => ch.name)
+  expect(names).toEqual(['general', 'announcements', 'voice-channel'])
+  expect(names).not.toContain('Text Channels')
+  expect(names).not.toContain('a-thread')
 })
 
 it('list: includes channel metadata', async () => {
-  // given: discord client with channels
-  const client = await new DiscordClient().login({ token: 'test-token' })
-  const channels = await client.listChannels('server-1')
-  const textChannels = channels.filter((ch) => ch.type === 0)
-
-  // when: checking channel properties
-  const channel = textChannels[0]
-
-  // then: channel has id, name, type, topic
+  // given: a server with channels
+  const consoleSpy = mock(() => {})
+  const originalLog = console.log
+  console.log = consoleSpy
+
+  // when: listing channels
+  await listAction({ pretty: false })
+  console.log = originalLog
+
+  // then: each channel carries id, name, type, parent_id, topic
+  const output = JSON.parse(consoleSpy.mock.calls[0][0] as string) as Array<Record<string, unknown>>
+  const channel = output[0]
   expect(channel.id).toBeDefined()
   expect(channel.name).toBeDefined()
   expect(channel.type).toBe(0)

package/src/platforms/discord/commands/channel.ts

@@ -5,6 +5,7 @@ import { formatOutput } from '@/shared/utils/output'
 
 import { DiscordClient } from '../client'
 import { DiscordCredentialManager } from '../credential-manager'
+import { isListableChannel } from '../types'
 
 export async function listAction(options: { pretty?: boolean }): Promise<void> {
   try {
@@ -19,9 +20,9 @@ export async function listAction(options: { pretty?: boolean }): Promise<void> {
     const client = await new DiscordClient().login({ token: config.token })
     const channels = await client.listChannels(config.current_server)
 
-    const textChannels = channels.filter((ch) => ch.type === 0)
+    const listableChannels = channels.filter(isListableChannel)
 
-    const output = textChannels.map((ch) => ({
+    const output = listableChannels.map((ch) => ({
       id: ch.id,
       name: ch.name,
       type: ch.type,

package/src/platforms/discord/commands/snapshot.test.ts

@@ -1,6 +1,84 @@
-import { expect, it } from 'bun:test'
+import { afterEach, beforeEach, expect, spyOn, it } from 'bun:test'
 
-import { snapshotCommand } from './snapshot'
+import { DiscordClient } from '../client'
+import { DiscordCredentialManager } from '../credential-manager'
+import { DiscordChannelType } from '../types'
+import { snapshotAction, snapshotCommand } from './snapshot'
+
+let listChannelsSpy: ReturnType<typeof spyOn>
+let getMessagesSpy: ReturnType<typeof spyOn>
+let getServerSpy: ReturnType<typeof spyOn>
+let listUsersSpy: ReturnType<typeof spyOn>
+let credManagerLoadSpy: ReturnType<typeof spyOn>
+
+const mixedChannels = [
+  { id: 'text', guild_id: 'g1', name: 'general', type: DiscordChannelType.GUILD_TEXT },
+  { id: 'announce', guild_id: 'g1', name: 'news', type: DiscordChannelType.GUILD_ANNOUNCEMENT },
+  { id: 'voice', guild_id: 'g1', name: 'lounge', type: DiscordChannelType.GUILD_VOICE },
+  { id: 'forum', guild_id: 'g1', name: 'help', type: DiscordChannelType.GUILD_FORUM },
+  { id: 'directory', guild_id: 'g1', name: 'hub', type: DiscordChannelType.GUILD_DIRECTORY },
+  { id: 'category', guild_id: 'g1', name: 'Section', type: DiscordChannelType.GUILD_CATEGORY },
+  { id: 'thread', guild_id: 'g1', name: 'a-thread', type: DiscordChannelType.PUBLIC_THREAD },
+]
+
+function parseSnapshot(consoleSpy: ReturnType<typeof spyOn>): Record<string, any> {
+  const lastCall = consoleSpy.mock.calls.at(-1)
+  return JSON.parse(lastCall![0] as string)
+}
+
+beforeEach(() => {
+  listChannelsSpy = spyOn(DiscordClient.prototype, 'listChannels').mockResolvedValue(mixedChannels)
+  getMessagesSpy = spyOn(DiscordClient.prototype, 'getMessages').mockResolvedValue([])
+  getServerSpy = spyOn(DiscordClient.prototype, 'getServer').mockResolvedValue({ id: 'g1', name: 'Guild One' })
+  listUsersSpy = spyOn(DiscordClient.prototype, 'listUsers').mockResolvedValue([])
+  credManagerLoadSpy = spyOn(DiscordCredentialManager.prototype, 'load').mockResolvedValue({
+    token: 'test-token',
+    current_server: 'g1',
+    servers: { g1: { server_id: 'g1', server_name: 'Guild One' } },
+  })
+})
+
+afterEach(() => {
+  listChannelsSpy?.mockRestore()
+  getMessagesSpy?.mockRestore()
+  getServerSpy?.mockRestore()
+  listUsersSpy?.mockRestore()
+  credManagerLoadSpy?.mockRestore()
+})
+
+it('snapshot brief: lists listable channels and excludes categories and threads', async () => {
+  // given: a server with mixed channel types
+  const consoleSpy = spyOn(console, 'log').mockImplementation(() => {})
+
+  // when: running a brief snapshot
+  await snapshotAction({ pretty: false })
+  const snapshot = parseSnapshot(consoleSpy)
+  consoleSpy.mockRestore()
+
+  // then: only listable channels appear, no messages are fetched
+  const names = snapshot.channels.map((ch: { name: string }) => ch.name)
+  expect(names).toEqual(['general', 'news', 'lounge', 'help', 'hub'])
+  expect(getMessagesSpy).not.toHaveBeenCalled()
+})
+
+it('snapshot full: fetches messages only from message-readable channels', async () => {
+  // given: a server with mixed channel types
+  const consoleSpy = spyOn(console, 'log').mockImplementation(() => {})
+
+  // when: running a full snapshot
+  await snapshotAction({ full: true, pretty: false })
+  const snapshot = parseSnapshot(consoleSpy)
+  consoleSpy.mockRestore()
+
+  // then: listing includes containers but getMessages is called only for readable IDs
+  const listedNames = snapshot.channels.map((ch: { name: string }) => ch.name)
+  expect(listedNames).toEqual(['general', 'news', 'lounge', 'help', 'hub'])
+
+  const fetchedIds = getMessagesSpy.mock.calls.map((call) => call[0])
+  expect(fetchedIds.sort()).toEqual(['announce', 'text', 'voice'])
+  expect(fetchedIds).not.toContain('forum')
+  expect(fetchedIds).not.toContain('directory')
+})
 
 it('snapshot: command is defined', () => {
   expect(snapshotCommand).toBeDefined()