clearclaw 0.2.0 → 0.4.0

package/dist/channel/telegram.js

@@ -4,37 +4,61 @@ import log from "../logger.js";
 export class TelegramChannel extends EventEmitter {
     name = "telegram";
     bot;
+    botToken;
     allowedUserIds;
     typingIntervals = new Map();
+    statusHandles = new Map(); // chatId → message handle for pinned status
     // Pending interactive responses: callbackId → resolve function
     pendingCallbacks = new Map();
     // Pending text input: chatId → resolve function (for requestText follow-ups)
     pendingTextResolvers = new Map();
     constructor(botToken, allowedUserIds) {
         super();
+        this.botToken = botToken;
         this.allowedUserIds = allowedUserIds;
         this.bot = new Bot(botToken);
     }
     async connect() {
-        // Auth check: only respond to allowed user
         this.bot.on("message:text", (ctx) => {
-            if (!ctx.from?.id || !this.allowedUserIds.has(`tg:${ctx.from.id}`))
+            const sender = this.extractSender(ctx);
+            if (!sender)
                 return;
-            const chatId = `tg:${ctx.chat.id}`;
             // Intercept for requestText follow-ups before emitting as a new message
-            const textResolver = this.pendingTextResolvers.get(chatId);
+            const textResolver = this.pendingTextResolvers.get(sender.chatId);
             if (textResolver) {
-                this.pendingTextResolvers.delete(chatId);
+                this.pendingTextResolvers.delete(sender.chatId);
                 textResolver(ctx.message.text);
                 return;
             }
-            const user = {
-                id: `tg:${ctx.from.id}`,
-                name: [ctx.from.first_name, ctx.from.last_name].filter(Boolean).join(" "),
-                ...(ctx.from.username && { handle: ctx.from.username }),
-            };
-            this.emit("message", { chatId, user, text: ctx.message.text });
+            this.emit("message", { ...sender, text: ctx.message.text });
+        });
+        // Photos: Telegram sends each photo as an array of PhotoSize objects
+        // (same image at different resolutions, sorted smallest → largest).
+        // We grab the last element for the highest resolution version.
+        this.bot.on("message:photo", async (ctx) => {
+            const photo = ctx.message.photo;
+            const largest = photo[photo.length - 1];
+            await this.handleMediaMessage(ctx, largest.file_id, "image/jpeg", undefined, ctx.message.caption);
         });
+        // Documents: download with original MIME + filename
+        this.bot.on("message:document", async (ctx) => {
+            const doc = ctx.message.document;
+            await this.handleMediaMessage(ctx, doc.file_id, doc.mime_type ?? "application/octet-stream", doc.file_name, ctx.message.caption);
+        });
+        // Placeholder handlers for unsupported media types
+        for (const [filter, label] of [
+            ["message:voice", "Voice message"],
+            ["message:audio", "Audio message"],
+            ["message:video", "Video"],
+            ["message:sticker", "Sticker"],
+        ]) {
+            this.bot.on(filter, (ctx) => {
+                const sender = this.extractSender(ctx);
+                if (!sender)
+                    return;
+                this.emit("message", { ...sender, text: `[${label} — not supported]` });
+            });
+        }
         // Handle inline keyboard button presses
         this.bot.on("callback_query:data", async (ctx) => {
             const data = ctx.callbackQuery.data;
@@ -62,6 +86,7 @@ export class TelegramChannel extends EventEmitter {
             clearInterval(interval);
         }
         this.typingIntervals.clear();
+        this.statusHandles.clear();
         await this.bot.stop();
     }
     ownsId(chatId) {
@@ -70,64 +95,99 @@ export class TelegramChannel extends EventEmitter {
     async sendMessage(chatId, text, opts) {
         const numId = this.numericId(chatId);
         const chunks = splitMessage(text);
+        const handles = [];
         for (const chunk of chunks) {
             try {
-                await this.bot.api.sendMessage(numId, chunk, {
+                const sent = await this.bot.api.sendMessage(numId, chunk, {
                     parse_mode: opts?.parseMode,
                 });
+                handles.push(String(sent.message_id));
             }
             catch (err) {
                 if (opts?.parseMode) {
                     log.warn("[channel] sendMessage failed with %s, retrying as plain text", opts.parseMode);
-                    await this.bot.api.sendMessage(numId, chunk);
+                    const sent = await this.bot.api.sendMessage(numId, chunk);
+                    handles.push(String(sent.message_id));
                 }
                 else {
                     throw err;
                 }
             }
         }
+        return handles;
     }
     async sendInteractive(chatId, text, buttons) {
         const numId = this.numericId(chatId);
         const callbackId = crypto.randomUUID().slice(0, 8);
-        // Pre-compute callback data keys (use index to avoid collisions when buttons share values)
-        const cbEntries = buttons.map((btn, i) => ({
-            btn,
-            cbData: `${callbackId}:${i}`,
-        }));
-        // Build inline keyboard
+        // Pre-compute callback data keys (use flat index to avoid collisions when buttons share values)
+        const cbEntries = [];
+        let idx = 0;
+        for (const row of buttons) {
+            for (const btn of row) {
+                cbEntries.push({ btn, cbData: `${callbackId}:${idx++}` });
+            }
+        }
+        // Build inline keyboard — each inner array is a row
         const keyboard = new InlineKeyboard();
-        for (const { btn, cbData } of cbEntries) {
-            keyboard.text(btn.label, cbData);
+        let flatIdx = 0;
+        for (const row of buttons) {
+            for (const _btn of row) {
+                const { cbData } = cbEntries[flatIdx++];
+                keyboard.text(_btn.label, cbData);
+            }
+            keyboard.row();
+        }
+        // Convert universal markdown to MarkdownV2, fall back to plain text on failure
+        const mdv2Text = convertToMarkdownV2(text);
+        let sent;
+        try {
+            sent = await this.bot.api.sendMessage(numId, mdv2Text, {
+                reply_markup: keyboard,
+                parse_mode: "MarkdownV2",
+            });
+        }
+        catch {
+            log.warn("[channel] sendInteractive failed with MarkdownV2, retrying as plain text");
+            sent = await this.bot.api.sendMessage(numId, text, {
+                reply_markup: keyboard,
+            });
         }
-        await this.bot.api.sendMessage(numId, text, {
-            reply_markup: keyboard,
-        });
         const cleanupAll = () => {
             for (const { cbData } of cbEntries) {
                 this.pendingCallbacks.delete(cbData);
             }
         };
-        // Wait for button press or timeout (30 minutes)
+        // Wait for button press (no timeout — matches CLI behavior)
         const pressed = await new Promise((resolve) => {
-            const timeout = setTimeout(() => {
-                cleanupAll();
-                resolve(null);
-            }, 30 * 60 * 1000);
             for (const { btn, cbData } of cbEntries) {
                 this.pendingCallbacks.set(cbData, () => {
-                    clearTimeout(timeout);
                     cleanupAll();
                     resolve(btn);
                 });
             }
         });
-        if (!pressed)
-            return { value: "" };
+        // Update keyboard to highlight the selected button (others become inert — no callbacks)
+        const feedbackKeyboard = new InlineKeyboard();
+        let entryIndex = 0;
+        for (const row of buttons) {
+            for (const button of row) {
+                const entry = cbEntries[entryIndex++];
+                const label = button === pressed ? `✅ ${button.label}` : button.label;
+                feedbackKeyboard.text(label, entry.cbData);
+            }
+            feedbackKeyboard.row();
+        }
+        try {
+            await this.bot.api.editMessageReplyMarkup(numId, sent.message_id, {
+                reply_markup: feedbackKeyboard,
+            });
+        }
+        catch { /* best-effort */ }
         // If the button requests text, prompt for follow-up input
         if (pressed.requestText) {
-            await this.bot.api.sendMessage(numId, "Type your note:", {
+            await this.bot.api.sendMessage(numId, "Add your feedback:", {
                 reply_markup: { force_reply: true },
+                reply_parameters: { message_id: sent.message_id },
             });
             const followUpText = await new Promise((resolve) => {
                 this.pendingTextResolvers.set(chatId, resolve);
@@ -136,6 +196,57 @@ export class TelegramChannel extends EventEmitter {
         }
         return { value: pressed.value };
     }
+    async editMessage(chatId, handle, text) {
+        const numId = this.numericId(chatId);
+        await this.bot.api.editMessageText(numId, Number(handle), text);
+    }
+    async deleteMessage(chatId, handle) {
+        const numId = this.numericId(chatId);
+        await this.bot.api.deleteMessage(numId, Number(handle));
+    }
+    async pinMessage(chatId, handle) {
+        const numId = this.numericId(chatId);
+        await this.bot.api.pinChatMessage(numId, Number(handle), {
+            disable_notification: true,
+        });
+    }
+    async unpinAllMessages(chatId) {
+        const numId = this.numericId(chatId);
+        await this.bot.api.unpinAllChatMessages(numId);
+    }
+    async updateStatus(chatId, text) {
+        const existing = this.statusHandles.get(chatId);
+        if (existing) {
+            try {
+                await this.editMessage(chatId, existing, text);
+                return;
+            }
+            catch (err) {
+                if (!(err instanceof Error && err.message.includes("message is not modified"))) {
+                    // Edit failed for a real reason — fall through to create new
+                    log.warn("[channel] failed to edit status message, will recreate: %s", err instanceof Error ? err.message : String(err));
+                    this.statusHandles.delete(chatId);
+                }
+                else {
+                    return; // text unchanged, nothing to do
+                }
+            }
+        }
+        // No existing handle, or edit failed — create new pinned message
+        try {
+            await this.unpinAllMessages(chatId);
+        }
+        catch { /* not admin */ }
+        const handles = await this.sendMessage(chatId, text);
+        const handle = handles[0];
+        this.statusHandles.set(chatId, handle);
+        try {
+            await this.pinMessage(chatId, handle);
+        }
+        catch (err) {
+            log.warn("[channel] failed to pin status message (bot may not be admin): %s", err instanceof Error ? err.message : String(err));
+        }
+    }
     async setTyping(chatId, isTyping) {
         if (isTyping) {
             if (this.typingIntervals.has(chatId))
@@ -158,10 +269,89 @@ export class TelegramChannel extends EventEmitter {
             }
         }
     }
+    /** Extract auth-checked sender info from a grammY context. Returns null if unauthorized. */
+    extractSender(ctx) {
+        if (!ctx.from?.id || !ctx.chat?.id || !this.allowedUserIds.has(`tg:${ctx.from.id}`))
+            return null;
+        return {
+            chatId: `tg:${ctx.chat.id}`,
+            user: {
+                id: `tg:${ctx.from.id}`,
+                name: [ctx.from.first_name, ctx.from.last_name].filter(Boolean).join(" "),
+                ...(ctx.from.username && { handle: ctx.from.username }),
+            },
+        };
+    }
+    /** Shared handler for photo/document messages: download, emit attachment or fallback. */
+    async handleMediaMessage(ctx, fileId, mimeType, filename, caption) {
+        const sender = this.extractSender(ctx);
+        if (!sender)
+            return;
+        try {
+            const buffer = await this.downloadFile(fileId);
+            this.emit("message", {
+                ...sender,
+                text: caption ?? "",
+                attachments: [{ buffer, mimeType, filename }],
+            });
+        }
+        catch (err) {
+            log.warn({ err }, "[channel] failed to download file %s", filename ?? fileId);
+            this.emit("message", {
+                ...sender,
+                text: caption
+                    ? `${caption}\n[File download failed: ${filename ?? mimeType}]`
+                    : `[File download failed: ${filename ?? mimeType}]`,
+            });
+        }
+    }
+    /** Download a Telegram file by file_id, returning the raw buffer. */
+    async downloadFile(fileId) {
+        const file = await this.bot.api.getFile(fileId);
+        if (!file.file_path)
+            throw new Error("Telegram returned no file_path");
+        const url = `https://api.telegram.org/file/bot${this.botToken}/${file.file_path}`;
+        const resp = await fetch(url);
+        if (!resp.ok)
+            throw new Error(`File download failed: ${resp.status}`);
+        return Buffer.from(await resp.arrayBuffer());
+    }
     numericId(chatId) {
         return Number(chatId.replace(/^tg:/, ""));
     }
 }
+/**
+ * Escape for Telegram MarkdownV2.
+ * Outside code blocks: all special chars. Inside: only backtick and backslash.
+ */
+function escapeMarkdownV2(text, codeBlock = false) {
+    const pattern = codeBlock ? /[`\\]/g : /[_*\[\]()~`>#+\-=|{}.!\\]/g;
+    return text.replace(pattern, "\\$&");
+}
+/**
+ * Convert universal markdown (with code fences) to Telegram MarkdownV2.
+ * Handles code blocks specially: fence markers stay literal, inner content
+ * only escapes ` and \, outer text gets full MarkdownV2 escaping.
+ */
+function convertToMarkdownV2(markdown) {
+    const result = [];
+    let pos = 0;
+    const fenceRegex = /```(\w*)\n([\s\S]*?)```/g;
+    let match;
+    while ((match = fenceRegex.exec(markdown)) !== null) {
+        if (match.index > pos) {
+            result.push(escapeMarkdownV2(markdown.slice(pos, match.index)));
+        }
+        result.push("```" + match[1] + "\n");
+        result.push(escapeMarkdownV2(match[2], true));
+        result.push("```");
+        pos = match.index + match[0].length;
+    }
+    if (pos < markdown.length) {
+        result.push(escapeMarkdownV2(markdown.slice(pos)));
+    }
+    return result.join("");
+}
 const MAX_MSG_LEN = 4096;
 /** Split text into ≤4096-char chunks, preferring newline boundaries. */
 function splitMessage(text) {

package/dist/config.d.ts

@@ -1,11 +1,21 @@
 import type { PermissionMode } from "./types.js";
-export interface Config {
+export interface TelegramConfig {
+    type: "telegram";
+    botToken: string;
+}
+export interface SlackConfig {
+    type: "slack";
     botToken: string;
+    appToken: string;
+}
+export type ChannelConfig = TelegramConfig | SlackConfig;
+export interface Config {
+    channel: ChannelConfig;
     allowedUserIds: Set<string>;
     permissionMode: PermissionMode;
-    dataDir: string;
     defaultPromptPath: string;
-    workspacesPath: string;
+    workspaceStorePath: string;
+    filesPath: string;
     logPath: string;
 }
 export declare function loadConfig(): Config;

package/dist/config.js

@@ -4,7 +4,21 @@ import path from "node:path";
 export function loadConfig() {
     const dataDir = process.env.CLEARCLAW_HOME ?? path.join(os.homedir(), ".clearclaw");
     fs.mkdirSync(dataDir, { recursive: true });
-    const botToken = requireEnv("TELEGRAM_BOT_TOKEN");
+    fs.mkdirSync(path.join(dataDir, "files"), { recursive: true });
+    // Channel config: Slack takes priority if both SLACK_BOT_TOKEN and SLACK_APP_TOKEN are set
+    const slackBotToken = process.env.SLACK_BOT_TOKEN;
+    const slackAppToken = process.env.SLACK_APP_TOKEN;
+    const telegramBotToken = process.env.TELEGRAM_BOT_TOKEN;
+    let channel;
+    if (slackBotToken && slackAppToken) {
+        channel = { type: "slack", botToken: slackBotToken, appToken: slackAppToken };
+    }
+    else if (telegramBotToken) {
+        channel = { type: "telegram", botToken: telegramBotToken };
+    }
+    else {
+        throw new Error("Missing channel config: set TELEGRAM_BOT_TOKEN or both SLACK_BOT_TOKEN + SLACK_APP_TOKEN");
+    }
     const rawIds = process.env.ALLOWED_USER_IDS ?? process.env.ALLOWED_USER_ID;
     if (!rawIds)
         throw new Error("Missing required env var: ALLOWED_USER_IDS");
@@ -21,12 +35,12 @@ export function loadConfig() {
         throw new Error(`PERMISSION_MODE must be one of: ${valid.join(", ")}`);
     }
     return {
-        botToken,
+        channel,
         allowedUserIds,
         permissionMode,
-        dataDir,
         defaultPromptPath: path.join(dataDir, "workspace", "CLAUDE.md"),
-        workspacesPath: path.join(dataDir, "workspaces.json"),
+        workspaceStorePath: path.join(dataDir, "workspaces.json"),
+        filesPath: path.join(dataDir, "files"),
         logPath: path.join(dataDir, "clearclaw.log"),
     };
 }

package/dist/engine/claude-code.d.ts

@@ -1,5 +1,6 @@
-import type { Engine, EngineEvent, RunTurnOpts } from "../types.js";
+import type { Engine, EngineEvent, RunTurnOpts, SessionInfo } from "../types.js";
 export declare class ClaudeCodeEngine implements Engine {
     name: string;
+    listSessions(cwd: string): Promise<SessionInfo[]>;
     runTurn(opts: RunTurnOpts): AsyncIterable<EngineEvent>;
 }

package/dist/engine/claude-code.js

@@ -1,10 +1,21 @@
-import { query, } from "@anthropic-ai/claude-agent-sdk";
+import { query, listSessions, } from "@anthropic-ai/claude-agent-sdk";
 import log from "../logger.js";
 import { formatToolDescription } from "../format.js";
 export class ClaudeCodeEngine {
     name = "claude-code";
+    async listSessions(cwd) {
+        const sessions = await listSessions({ dir: cwd, limit: 10 });
+        return sessions
+            .sort((a, b) => b.lastModified - a.lastModified)
+            .map((s) => ({
+            sessionId: s.sessionId,
+            summary: s.summary,
+            lastModified: s.lastModified,
+            gitBranch: s.gitBranch,
+        }));
+    }
     async *runTurn(opts) {
-        const { sessionId, cwd, prompt, permissionMode, onPermissionRequest, appendSystemPrompt, signal, } = opts;
+        const { sessionId, cwd, prompt: textPrompt, attachments, permissionMode, onPermissionRequest, appendSystemPrompt, signal, } = opts;
         const abortController = new AbortController();
         // Wire external signal to our abort controller
         if (signal) {
@@ -22,6 +33,7 @@ export class ClaudeCodeEngine {
                 input,
                 description,
                 reason: options.decisionReason,
+                toolUseId: options.toolUseID,
             });
             if (resp.decision === "allow") {
                 return { behavior: "allow", updatedInput: input };
@@ -40,6 +52,10 @@ export class ClaudeCodeEngine {
                 interrupt: !resp.message,
             };
         };
+        // Plain string when no attachments, content blocks when attachments present
+        const prompt = attachments?.length
+            ? buildAttachmentPrompt(textPrompt, attachments)
+            : textPrompt;
         const q = query({
             prompt,
             options: {
@@ -62,6 +78,8 @@ export class ClaudeCodeEngine {
             },
         });
         let resultSessionId;
+        let turnStats;
+        let lastInputTokens = 0;
         const toolUseIdToName = new Map();
         try {
             for await (const msg of q) {
@@ -71,17 +89,28 @@ export class ClaudeCodeEngine {
                 }
                 // Extract text and tool_use from assistant messages
                 if (msg.type === "assistant") {
-                    const { content } = msg.message;
+                    // BetaMessage type isn't directly importable (@anthropic-ai/sdk not installed);
+                    // .message is typed as `any` so property access works without casting.
+                    const betaMsg = msg.message;
+                    if (betaMsg.usage) {
+                        const u = betaMsg.usage;
+                        lastInputTokens = (u.input_tokens ?? 0)
+                            + (u.cache_read_input_tokens ?? 0)
+                            + (u.cache_creation_input_tokens ?? 0);
+                    }
+                    const { content } = betaMsg;
                     for (const block of content) {
                         if (block.type === "text" && block.text) {
                             yield { type: "text", text: block.text };
                         }
                         if (block.type === "tool_use") {
-                            toolUseIdToName.set(block.id, block.name);
+                            const toolUseId = block.id;
+                            toolUseIdToName.set(toolUseId, block.name);
                             yield {
                                 type: "tool_use",
                                 toolName: block.name,
                                 input: block.input,
+                                toolUseId,
                             };
                         }
                     }
@@ -91,15 +120,12 @@ export class ClaudeCodeEngine {
                     const content = msg.message.content;
                     if (Array.isArray(content)) {
                         for (const block of content) {
-                            const b = block;
-                            if (b.type === "tool_result" &&
-                                typeof b.tool_use_id === "string") {
-                                const toolName = toolUseIdToName.get(b.tool_use_id) ?? "unknown";
-                                const output = extractToolResultText(b.content);
+                            if (block.type === "tool_result") {
+                                const toolName = toolUseIdToName.get(block.tool_use_id) ?? "unknown";
+                                const output = extractToolResultText(block.content);
                                 if (output) {
                                     yield { type: "tool_result", toolName, output };
                                 }
-                                toolUseIdToName.delete(b.tool_use_id);
                             }
                         }
                     }
@@ -122,10 +148,26 @@ export class ClaudeCodeEngine {
                         yield { type: "text", text: cmdOut.content };
                     }
                 }
-                // Capture result
+                // Capture result and build turn stats
                 if (msg.type === "result") {
                     const result = msg;
                     resultSessionId = result.session_id;
+                    const models = Object.keys(result.modelUsage);
+                    if (models.length > 0) {
+                        const model = models[0];
+                        const mu = result.modelUsage[model];
+                        // Build per-tool call counts from accumulated map
+                        const toolCalls = {};
+                        for (const name of toolUseIdToName.values()) {
+                            toolCalls[name] = (toolCalls[name] ?? 0) + 1;
+                        }
+                        turnStats = {
+                            model,
+                            contextUsed: lastInputTokens,
+                            contextWindow: mu.contextWindow,
+                            toolCalls,
+                        };
+                    }
                     if (result.subtype !== "success" && result.errors.length) {
                         yield { type: "error", message: result.errors.join("\n") };
                     }
@@ -144,10 +186,67 @@ export class ClaudeCodeEngine {
             }
         }
         if (resultSessionId) {
-            yield { type: "done", sessionId: resultSessionId };
+            yield { type: "done", sessionId: resultSessionId, stats: turnStats };
         }
     }
 }
+/**
+ * Build an AsyncIterable<SDKUserMessage> that yields a single user message
+ * with content blocks for attachments + text.
+ */
+function buildAttachmentPrompt(text, attachments) {
+    const contentBlocks = attachments.map(encodeAttachment);
+    // Text prompt always comes last
+    if (text) {
+        contentBlocks.push({ type: "text", text });
+    }
+    const message = { role: "user", content: contentBlocks };
+    // SDKUserMessage requires these fields for type satisfaction, but they're
+    // not semantically meaningful here — we're injecting a top-level prompt,
+    // not replaying a conversation. Session management is handled by the
+    // `resume` option passed to query().
+    const msg = {
+        type: "user",
+        message,
+        parent_tool_use_id: null,
+        session_id: "",
+    };
+    return (async function* () {
+        yield msg;
+    })();
+}
+const SUPPORTED_IMAGE_TYPES = new Set([
+    "image/jpeg", "image/png", "image/gif", "image/webp",
+]);
+/** Encode an attachment as an SDK content block using its in-memory buffer. */
+function encodeAttachment(att) {
+    const data = att.buffer.toString("base64");
+    if (SUPPORTED_IMAGE_TYPES.has(att.mimeType)) {
+        return {
+            type: "image",
+            source: {
+                type: "base64",
+                media_type: att.mimeType,
+                data,
+            },
+        };
+    }
+    if (att.mimeType === "application/pdf") {
+        return {
+            type: "document",
+            source: { type: "base64", media_type: "application/pdf", data },
+        };
+    }
+    if (att.mimeType.startsWith("text/")) {
+        const content = att.buffer.toString("utf-8");
+        const header = att.filename ? `--- ${att.filename} ---\n` : "";
+        return { type: "text", text: `${header}${content}` };
+    }
+    // Unsupported (includes non-standard image types like svg, bmp, tiff)
+    const name = att.filename ?? att.mimeType;
+    log.warn("[engine] unsupported attachment type: %s", att.mimeType);
+    return { type: "text", text: `[Unsupported file: ${name}]` };
+}
 /** Pull plain text out of a tool_result content block. */
 function extractToolResultText(content) {
     if (typeof content === "string")

package/dist/files.d.ts

@@ -0,0 +1,3 @@
+import type { Attachment } from "./types.js";
+/** Save an attachment to disk for audit logging. Returns the saved file path. */
+export declare function saveFile(att: Attachment, workspace: string, filesPath: string): Promise<string>;

package/dist/files.js

@@ -0,0 +1,33 @@
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+/** Map common MIME types to file extensions. */
+const MIME_TO_EXT = {
+    "image/jpeg": ".jpg",
+    "image/png": ".png",
+    "image/gif": ".gif",
+    "image/webp": ".webp",
+    "application/pdf": ".pdf",
+    "text/plain": ".txt",
+    "text/csv": ".csv",
+};
+/** Save an attachment to disk for audit logging. Returns the saved file path. */
+export async function saveFile(att, workspace, filesPath) {
+    const epoch = Math.floor(Date.now() / 1000);
+    const hex = crypto.randomBytes(2).toString("hex");
+    const name = att.filename
+        ? sanitizeFilename(att.filename)
+        : `file${MIME_TO_EXT[att.mimeType] ?? ""}`;
+    const filename = `${workspace}-${epoch}-${hex}-${name}`;
+    const filePath = path.join(filesPath, filename);
+    await fs.writeFile(filePath, att.buffer);
+    return filePath;
+}
+/** Strip path separators and null bytes, collapse whitespace. */
+function sanitizeFilename(name) {
+    return name
+        .replace(/[/\\\0]/g, "_")
+        .replace(/\s+/g, "_")
+        .slice(0, 200);
+}
+//# sourceMappingURL=files.js.map