jeo-code 0.12.7 → 0.12.8

package/CHANGELOG.md

@@ -9,6 +9,10 @@ The README mirrors the latest 5 entries — regenerate with `bun run changelog:s
 
 ## [Unreleased]
 
+### Added
+- **Discord session files and control** — local opt-in enables authorized Discord prompts to use host session tools and exchange staged attachments; see the [Discord guide](docs/integrations/discord.md) for limits, public visibility, and revocation boundaries.
+- **Discord messenger gateway** — guided `jeo messenger setup`, local configuration checking, and a separate gateway with per-conversation persisted sessions, opt-in host tools, threaded replies, and optional bounded attachments. See the [messenger guide](docs/integrations/messenger.md).
+
 ## [0.12.7] - 2026-10-18
 _Repair desktop screenshot vision feedback, macOS scrolling, complete drag gestures, and keyboard normalization._
 

package/README.ja.md

@@ -30,6 +30,8 @@
 
 ## ドキュメント
 
+- [双方向メッセンジャーゲートウェイ (Discord, Telegram, Slack)](docs/integrations/messenger.md)
+
 📖 **[使い方ガイド](docs/usage-guide.md)** — インストール、TUI操作（↑履歴、Ctrl+O、`!`シェル）、スラッシュコマンド、`/resume`、スペックファーストワークフローをデモ動画付きで解説。
 
 <video src="https://raw.githubusercontent.com/akillness/jeo-code/main/docs/jeo-code-promo.mp4" controls muted playsinline width="100%"></video>

package/README.ko.md

@@ -30,6 +30,8 @@
 
 ## 문서
 
+- [양방향 메신저 게이트웨이 (Discord, Telegram, Slack)](docs/integrations/messenger.md)
+
 📖 **[사용 가이드](docs/usage-guide.md)** — 설치, TUI 조작(↑ 이전 쿼리, Ctrl+O, `!` 셸), 슬래시 명령, `/resume`, 스펙 우선 워크플로를 데모 영상과 함께 설명합니다.
 
 <video src="https://raw.githubusercontent.com/akillness/jeo-code/main/docs/jeo-code-promo.mp4" controls muted playsinline width="100%"></video>

package/README.md

@@ -32,6 +32,8 @@ Run `jeo` inside a repository and it reads files, edits them, runs commands, and
 
 ## Documentation
 
+- [Bidirectional messenger gateway (Discord, Telegram, Slack)](docs/integrations/messenger.md)
+
 📖 **[Usage guide](docs/usage-guide.md)** — install, TUI controls (↑ recall, Ctrl+O, `!` shell), slash commands, `/resume`, and the spec-first workflow, with a demo video.
 
 <video src="https://raw.githubusercontent.com/akillness/jeo-code/main/docs/jeo-code-promo.mp4" controls muted playsinline width="100%"></video>
@@ -258,7 +260,7 @@ jeo daemon start|stop|status|reload   # the shared daemon has no provider select
 | Destination | private chat via challenge pairing (send the displayed `/start jeo_<code>` to the bot within 120 s) or explicit `--chat-id`; groups need `--allowed-user-ids` | explicit `--channel-id` (text channel, DM, announcement, or an existing thread) | explicit `--channel-id` (`C…`) the bot has joined; workspace is pinned to the token's team |
 | Allowlist | optional for a private chat, required for groups | required (human user IDs; bots are ignored) | required (human user IDs) |
 | Transport | direct Bot API `getUpdates` long-poll, one poll owner per bot token | REST for sends, Gateway WebSocket for inbound | Web API for sends, Socket Mode WebSocket for inbound |
-| Extras | forum topics, inline cancel buttons, image attachments, optional per-session topics (`notifications.telegram.perSessionTopics`, private chat with Threaded Mode only) | reply to a session notification to send that session text (24 h) | reply in a session notification's thread to send that session text (24 h); registered Slack slash commands or `@bot /command` both work |
+| Extras | forum topics, inline cancel buttons, image attachments, optional per-session topics (`notifications.telegram.perSessionTopics`, private chat with Threaded Mode only) | session replies, public channel reply threads, and staged attachments; see the [Discord guide](docs/integrations/discord.md) for limits and local control | reply in a session notification's thread to send that session text (24 h); registered Slack slash commands or `@bot /command` both work |
 | Commands | `/subagents` `/steer <session> <subagent> <msg>` `/cancel <session> <subagent>` `/help` | `/sessions` `/subagents` `/send <session> <text>` `/steer …` `/cancel …` `/help` | same as Discord |
 
 What the words mean, because they are not interchangeable:
@@ -266,7 +268,7 @@ What the words mean, because they are not interchangeable:
 - **Setup** validates bot identity and destination access with the official API (Telegram `getMe`, Discord bot + channel lookup, Slack `auth.test`/`bots.info`/`conversations.info` and a Socket Mode URL) and stores the result in `~/.jeo/config.json` under `notifications.<provider>` — **plaintext**; keep that file private. It does not send a message and does not open a socket.
 - **`initialized`** (`jeo daemon status`) means the daemon process owns its lock and has started its transports; it is not proof of a successful Telegram poll, Discord Gateway handshake, or Slack Socket Mode connection. Use `notify health` / `notify test` for that.
 - **Changing a token or destination** resets the allowlist for Discord and Slack (you must pass `--allowed-user-ids` again) and the per-session topic map for Telegram; re-running setup with the exact same credentials and destination keeps them.
-- **Remote commands are literal text** (`/subagents`, …) authorized to the configured chat/channel and allowlist; Slack additionally accepts the same names as registered slash commands. Allowlisted operators effectively hold the local agent's capabilities — treat the list as a trust boundary.
+- **Remote commands are literal text** (`/subagents`, …) authorized to the configured chat/channel and allowlist; Slack additionally accepts the same names as registered slash commands. Discord session control defaults off and requires the host operator to submit `/discord control on --allow-full-control` locally; `/discord control off` revokes it. Authorized users can exercise the host session's tool permissions; this is not a sandbox. See the [Discord guide](docs/integrations/discord.md) for file handling and revocation limits. Never put credentials in chat.
 - **Retries are bounded per provider**: Telegram honours a 429 `retry_after` cooldown (clamped 1 s–1 h) with separate poll backoff; Discord and Slack retry at most 3 times on 429 using the server's `Retry-After`, and never re-send a POST whose outcome is unknown (the platform may already have it).
 - **Orphan recovery**: if a daemon crashes, its lock becomes `stale`; the next `jeo daemon start` reclaims it. `jeo daemon stop` refuses to signal a recycled PID when the host can report process start times, and says so when it cannot.
 - **Verified so far**: Telegram end to end (real send, polling, clean shutdown). Discord and Slack are implemented behind the same daemon with offline transport/wiring tests and code, security, and type reviews; live connectivity has not been exercised against real bot/app credentials.

package/README.zh.md

@@ -30,6 +30,8 @@
 
 ## 文档
 
+- [双向消息网关（Discord、Telegram、Slack）](docs/integrations/messenger.md)
+
 📖 **[使用指南](docs/usage-guide.md)** — 安装、TUI 操作（↑ 历史、Ctrl+O、`!` shell）、斜杠命令、`/resume`、规格优先工作流，附演示视频。
 
 <video src="https://raw.githubusercontent.com/akillness/jeo-code/main/docs/jeo-code-promo.mp4" controls muted playsinline width="100%"></video>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.12.7",
+  "version": "0.12.8",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/agent/compaction.ts

@@ -315,7 +315,8 @@ export function extractTouchedFiles(messages: Message[], max = 20): string[] {
 
 export async function maybeCompact(
   history: Message[],
-  opts: CompactionOptions = {}
+  opts: CompactionOptions = {},
+  summarize: typeof callLlm = callLlm,
 ): Promise<CompactionResult> {
   const maxMessages = opts.maxMessages ?? (opts.force ? 1 : 40);
   
@@ -396,7 +397,7 @@ export async function maybeCompact(
       break;
     }
     try {
-      summary = await callLlm(
+      summary = await summarize(
         [
           { role: "user", content: olderFormatted }
         ],
@@ -417,6 +418,9 @@ export async function maybeCompact(
     }
   }
 
+  // A provider can resolve after cancellation; never mutate the cancelled turn's history.
+  if (opts.signal?.aborted) return { compacted: false, removed: 0 };
+
   if (summary !== undefined) {
     // Rung 1 success: behave exactly as before — summary message + bounded recent.
     const systemMessages = hasSystem ? [history[0]] : [];
@@ -452,11 +456,6 @@ export async function maybeCompact(
     };
   }
 
-  // Aborted (user cancelled the turn): do NOT mutate history as a side effect of a
-  // cancelled compaction — leave it untouched and report no compaction.
-  if (opts.signal?.aborted) {
-    return { compacted: false, removed: 0 };
-  }
 
   // Rung 2: KEEP-RECENT fallback. The summarizer persistently failed, so rather than inject
   // a placeholder the model could mistake for real conversation, keep the N most-recent

package/src/agent/notify/discord-api.ts

@@ -30,48 +30,87 @@ function delay(ms: number, signal: AbortSignal): Promise<void> {
   return promise;
 }
 
+const DISCORD_WHITESPACE = /^[\s\u0085\u001c-\u001f]$/u;
+const DISCORD_BOUNDARY_GUARD = "\u200b";
+
+function splitDiscordText(text: string): { chunks: string[]; needsAttachment: boolean } {
+  const chunks: string[] = [];
+  let needsAttachment = false;
+  for (let start = 0; start < text.length;) {
+    const leading = DISCORD_WHITESPACE.test(text[start]!) ? DISCORD_BOUNDARY_GUARD : "";
+    let fallback = 0;
+    let end = Math.min(start + 2000 - leading.length, text.length);
+    for (; end > start; end--) {
+      const last = text.charCodeAt(end - 1);
+      if (end < text.length && last >= 0xd800 && last <= 0xdbff && text.charCodeAt(end) >= 0xdc00 && text.charCodeAt(end) <= 0xdfff) continue;
+      const trailing = DISCORD_WHITESPACE.test(text[end - 1]!);
+      if (end - start + leading.length + Number(trailing) > 2000) continue;
+      if (!fallback) fallback = end;
+      if (end === text.length || (!trailing && !DISCORD_WHITESPACE.test(text[end]!))) break;
+    }
+    if (end === start) end = fallback;
+    const chunk = text.slice(start, end);
+    const trailing = DISCORD_WHITESPACE.test(chunk[chunk.length - 1]!) ? DISCORD_BOUNDARY_GUARD : "";
+    if (leading || trailing) needsAttachment = true;
+    chunks.push(`${leading}${chunk}${trailing}`);
+    start = end;
+  }
+  return { chunks, needsAttachment };
+}
+
 export class DiscordApi {
   private readonly controller = new AbortController();
   private cooldownUntil = 0;
+  private reactionCooldownUntil = 0;
+  private globalCooldownUntil = 0;
   private fatalStatus: number | undefined;
   private queue = Promise.resolve();
   private queued = 0;
+  private reactionQueue = Promise.resolve();
+  private reactionsQueued = 0;
+  private sendQueue = Promise.resolve();
 
   constructor(private readonly token: string, private readonly options: DiscordApiOptions = {}) {}
 
   stop(): void { this.controller.abort(); }
 
-  private request<T>(route: string, body?: unknown): Promise<T> {
+  private request<T>(route: string, body?: unknown, method = body === undefined ? "GET" : "POST", eligible?: () => boolean): Promise<T> {
     if (this.queued >= 128) return Promise.reject(new DiscordApiError("Discord request queue full"));
     this.queued++;
-    const result = this.queue.then(() => this.perform<T>(route, body));
+    const result = this.queue.then(() => this.perform<T>(route, body, method, eligible));
     this.queue = result.then(() => {}, () => {}).finally(() => { this.queued--; });
     return result;
   }
 
-  private async perform<T>(route: string, body?: unknown): Promise<T> {
+  private async perform<T>(route: string, body: unknown, method: string, eligible?: () => boolean, reaction = false): Promise<T> {
     const now = this.options.now ?? Date.now;
     const retries = Math.max(0, Math.min(this.options.maxRetries ?? 2, 3));
     for (let attempt = 0; attempt <= retries; attempt++) {
       if (this.controller.signal.aborted) throw new DiscordApiError("Discord request stopped");
       if (this.fatalStatus) throw new DiscordApiError("Discord authentication or permission denied", this.fatalStatus);
-      const wait = this.cooldownUntil - now();
-      if (wait > 30_000) throw new DiscordApiError("Discord rate limit cooldown active", 429, wait);
-      if (wait > 0) await (this.options.sleep ?? delay)(wait, this.controller.signal);
+      for (;;) {
+        const wait = Math.max(this.globalCooldownUntil, reaction ? this.reactionCooldownUntil : this.cooldownUntil) - now();
+        if (wait > 30_000) throw new DiscordApiError("Discord rate limit cooldown active", 429, wait);
+        if (wait <= 0) break;
+        await (this.options.sleep ?? delay)(wait, this.controller.signal);
+        if (this.controller.signal.aborted) throw new DiscordApiError("Discord request stopped");
+      }
       if (this.controller.signal.aborted) throw new DiscordApiError("Discord request stopped");
-      const timeout = AbortSignal.timeout(Math.max(1, Math.min(this.options.requestTimeoutMs ?? 10_000, 30_000)));
+      if (this.fatalStatus) throw new DiscordApiError("Discord authentication or permission denied", this.fatalStatus);
+      if (eligible && !eligible()) throw new DiscordApiError("Discord delivery no longer eligible");
+      const timeout = AbortSignal.timeout(Math.max(1, Math.min(this.options.requestTimeoutMs ?? (reaction ? 2000 : 10_000), reaction ? 2000 : 30_000)));
       let response: Response;
       let data: unknown;
       try {
         response = await (this.options.fetchImpl ?? fetch)(`https://discord.com/api/v10${route}`, {
-          method: body === undefined ? "GET" : "POST",
-          headers: { Authorization: `Bot ${this.token}`, "Content-Type": "application/json", "User-Agent": `DiscordBot (https://github.com/akillness/jeo-code, ${version})` },
-          body: body === undefined ? undefined : JSON.stringify(body),
+          method,
+          headers: { Authorization: `Bot ${this.token}`, ...(body === undefined || body instanceof FormData ? {} : { "Content-Type": "application/json" }), "User-Agent": `DiscordBot (https://github.com/akillness/jeo-code, ${version})` },
+          body: body === undefined ? undefined : body instanceof FormData ? body : JSON.stringify(body),
           signal: AbortSignal.any([this.controller.signal, timeout]),
           redirect: "error",
         });
-        if (response.status === 401 || response.status === 403) this.fatalStatus = response.status;
-        data = await response.json().catch(error => {
+        if (response.status === 401) this.fatalStatus = response.status;
+        data = response.status === 204 ? null : await response.json().catch(error => {
           if (response.ok) throw error;
           return null; // HTTP denial/cooldown headers remain authoritative without a JSON body.
         });
@@ -86,11 +125,18 @@ export class DiscordApi {
           ? record.retry_after ?? response.headers.get("Retry-After")
           : response.headers.get("X-RateLimit-Reset-After"));
         const ms = Number.isFinite(raw) && raw > 0 ? raw * 1000 : 30_000;
-        // One serialized bot lane conservatively honors both route and global cooldowns.
-        this.cooldownUntil = Math.max(this.cooldownUntil, now() + ms);
+        const until = now() + ms;
+        if (response.status === 429 && (record.global === true || response.headers.get("X-RateLimit-Global") === "true" || response.headers.get("X-RateLimit-Scope") === "global")) {
+          this.globalCooldownUntil = Math.max(this.globalCooldownUntil, until);
+        } else if (reaction) {
+          this.reactionCooldownUntil = Math.max(this.reactionCooldownUntil, until);
+        } else {
+          this.cooldownUntil = Math.max(this.cooldownUntil, until);
+        }
       }
       if (response.status === 429 && attempt < retries) continue;
-      if (!response.ok) throw new DiscordApiError(`Discord HTTP ${response.status}`, response.status, Math.max(0, this.cooldownUntil - now()));
+      if (!response.ok) throw new DiscordApiError(`Discord HTTP ${response.status}`, response.status, Math.max(0, Math.max(this.globalCooldownUntil, reaction ? this.reactionCooldownUntil : this.cooldownUntil) - now()));
+      if (response.status === 204) return undefined as T;
       if (!data || typeof data !== "object" || Array.isArray(data)) throw new DiscordApiError("Invalid Discord response");
       return data as T;
     }
@@ -105,9 +151,9 @@ export class DiscordApi {
     return me;
   }
 
-  async getChannel(channelId: string): Promise<{ id: string; type: number }> {
+  async getChannel(channelId: string): Promise<{ id: string; type: number; parent_id?: string | null; owner_id?: string | null }> {
     this.checkId(channelId);
-    const channel = await this.request<{ id: string; type: number }>(`/channels/${channelId}`);
+    const channel = await this.request<{ id: string; type: number; parent_id?: string | null; owner_id?: string | null }>(`/channels/${channelId}`);
     if (channel.id !== channelId || !Number.isInteger(channel.type)) throw new DiscordApiError("Invalid Discord channel");
     return channel;
   }
@@ -121,27 +167,78 @@ export class DiscordApi {
     return gateway;
   }
 
-  async sendMessage(channelId: string, content: string): Promise<{ id: string }[]> {
+  sendMessage(channelId: string, content: string, eligible?: () => boolean): Promise<{ id: string }[]> {
     this.checkId(channelId);
-    if (!content.trim()) return [];
-    if (content.length > 256_000) throw new DiscordApiError("Discord message exceeds relay limit");
+    const result = this.sendQueue.then(() => this.sendMessageOrdered(channelId, content, eligible));
+    this.sendQueue = result.then(() => {}, () => {});
+    return result;
+  }
+
+  sendFile(channelId: string, name: string, data: Uint8Array, eligible?: () => boolean): Promise<{ id: string }[]> {
+    this.checkId(channelId);
+    if (!name || name.startsWith(".") || /[\/\\\x00-\x1f\x7f]/.test(name) || data.byteLength > 8 * 1024 * 1024) throw new DiscordApiError("Invalid Discord attachment");
+    const result = this.sendQueue.then(async () => {
+      const form = new FormData();
+      form.append("payload_json", JSON.stringify({ allowed_mentions: { parse: [], replied_user: false } }));
+      form.append("files[0]", new Blob([new Uint8Array(data)], { type: "application/octet-stream" }), name);
+      const message = await this.request<{ id: string }>(`/channels/${channelId}/messages`, form, "POST", eligible);
+      if (!message || typeof message.id !== "string" || !/^\d{1,20}$/.test(message.id)) throw new DiscordApiError("Invalid Discord message ID");
+      return [message];
+    });
+    this.sendQueue = result.then(() => {}, () => {});
+    return result;
+  }
+
+  private async sendMessageOrdered(channelId: string, content: string, eligible?: () => boolean): Promise<{ id: string }[]> {
+    const { chunks, needsAttachment } = splitDiscordText(content);
     const messages: { id: string }[] = [];
-    for (let offset = 0; offset < content.length;) {
-      let end = Math.min(offset + 2000, content.length);
-      if (end < content.length && /[\uD800-\uDBFF]/.test(content[end - 1]!)) end--;
-      const message = await this.request<{ id: string }>(`/channels/${channelId}/messages`, {
-        content: content.slice(offset, end), allowed_mentions: { parse: [], replied_user: false },
-      }).catch(error => {
+    for (let index = 0; index < chunks.length + Number(needsAttachment); index++) {
+      let body: unknown = { content: chunks[index], allowed_mentions: { parse: [], replied_user: false } };
+      if (index === chunks.length) {
+        const form = new FormData();
+        form.append("payload_json", JSON.stringify({ allowed_mentions: { parse: [], replied_user: false } }));
+        form.append("files[0]", new Blob([content], { type: "text/plain; charset=utf-8" }), "response.txt");
+        body = form;
+      }
+      const message = await this.request<{ id: string }>(`/channels/${channelId}/messages`, body, "POST", eligible).catch(error => {
         if (error instanceof DiscordApiError) throw new DiscordApiError(error.message, error.status, error.retryAfterMs, messages);
         throw new DiscordApiError("Discord delivery failed", undefined, undefined, messages);
       });
-      if (typeof message.id !== "string" || !/^\d+$/.test(message.id)) throw new DiscordApiError("Invalid Discord message ID", undefined, undefined, messages);
+      if (!message || typeof message.id !== "string" || !/^\d{1,20}$/.test(message.id)) throw new DiscordApiError("Invalid Discord message ID", undefined, undefined, messages);
       messages.push(message);
-      offset = end;
     }
     return messages;
   }
 
+  async createThread(channelId: string, messageId: string, name: string): Promise<{ id: string }> {
+    this.checkId(channelId);
+    this.checkId(messageId);
+    if (typeof name !== "string" || name.length < 1 || name.length > 100) throw new DiscordApiError("Invalid Discord thread name");
+    const thread = await this.request<{ id: string }>(`/channels/${channelId}/messages/${messageId}/threads`, { name });
+    if (!thread) throw new DiscordApiError("Invalid Discord thread response");
+    this.checkId(thread.id);
+    return thread;
+  }
+
+  async addReaction(channelId: string, messageId: string, emoji: string): Promise<void> {
+    await this.reaction(channelId, messageId, emoji, "PUT");
+  }
+
+  async removeReaction(channelId: string, messageId: string, emoji: string): Promise<void> {
+    await this.reaction(channelId, messageId, emoji, "DELETE");
+  }
+
+  private async reaction(channelId: string, messageId: string, emoji: string, method: "PUT" | "DELETE"): Promise<void> {
+    this.checkId(channelId);
+    this.checkId(messageId);
+    if (typeof emoji !== "string" || !emoji || emoji.length > 128 || !emoji.isWellFormed()) throw new DiscordApiError("Invalid Discord emoji");
+    if (this.reactionsQueued >= 128) throw new DiscordApiError("Discord reaction queue full");
+    this.reactionsQueued++;
+    const result = this.reactionQueue.then(() => this.perform<void>(`/channels/${channelId}/messages/${messageId}/reactions/${encodeURIComponent(emoji)}/@me`, undefined, method, undefined, true));
+    this.reactionQueue = result.then(() => {}, () => {}).finally(() => { this.reactionsQueued--; });
+    await result;
+  }
+
   private checkId(id: string): void {
     if (typeof id !== "string" || !/^\d{1,20}$/.test(id)) throw new DiscordApiError("Invalid Discord ID");
   }

package/src/agent/notify/discord-artifacts.ts

@@ -0,0 +1,126 @@
+import * as fs from "node:fs/promises";
+import { constants } from "node:fs";
+import { notifySessionsDir } from "./paths";
+import * as path from "node:path";
+
+const MAX_FILES = 4;
+const MAX_BYTES = 8 * 1024 * 1024;
+
+const SESSION_ID = /^[A-Za-z0-9_-]{1,128}$/;
+const REQUEST_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+
+async function privateDirectory(directory: string): Promise<void> {
+  const info = await fs.lstat(directory);
+  if (!info.isDirectory() || (info.mode & 0o077) !== 0 || (typeof process.getuid === "function" && info.uid !== process.getuid())) throw new Error("Invalid private artifact directory");
+  if (await fs.realpath(directory) !== directory) throw new Error("Artifact directory contains a link");
+}
+
+export async function prepareDiscordArtifactRoot(sessionId: string): Promise<string> {
+  if (!SESSION_ID.test(sessionId)) throw new Error("Invalid session ID");
+  await fs.mkdir(notifySessionsDir(), { recursive: true, mode: 0o700 });
+  const sessions = await fs.realpath(notifySessionsDir());
+  const base = path.join(sessions, "discord-artifacts");
+  await fs.mkdir(base, { mode: 0o700 }).catch((error: NodeJS.ErrnoException) => { if (error.code !== "EEXIST") throw error; });
+  await privateDirectory(base);
+  const root = path.join(base, sessionId);
+  await fs.mkdir(root, { mode: 0o700 }).catch((error: NodeJS.ErrnoException) => { if (error.code !== "EEXIST") throw error; });
+  await privateDirectory(root);
+  return root;
+}
+
+export interface DiscordArtifactPaths { output: string; input?: string }
+
+export async function resolveDiscordArtifactStage(sessionId: string, requestId: string): Promise<DiscordArtifactPaths> {
+  if (!SESSION_ID.test(sessionId) || !REQUEST_ID.test(requestId)) throw new Error("Invalid artifact request ID");
+  const sessions = await fs.realpath(notifySessionsDir());
+  const base = path.join(sessions, "discord-artifacts");
+  const root = path.join(base, sessionId);
+  const request = path.join(root, requestId);
+  const output = path.join(request, "output");
+  for (const directory of [base, root, request, output]) await privateDirectory(directory);
+  const input = path.join(request, "input");
+  try { await privateDirectory(input); }
+  catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") return { output }; throw error; }
+  const names = await fs.readdir(input);
+  if (names.length > 10) throw new Error("Too many input files");
+  let total = 0;
+  for (const name of names) {
+    if (name.startsWith(".") || /[\x00-\x1f\x7f]/.test(name)) throw new Error("Invalid input filename");
+    const info = await fs.lstat(path.join(input, name));
+    if (!info.isFile() || info.nlink !== 1 || info.size > 25 * 1024 * 1024) throw new Error("Invalid input file");
+    total += info.size;
+    if (total > 50 * 1024 * 1024) throw new Error("Input files exceed size limit");
+  }
+  return { output, input };
+}
+
+export interface DiscordArtifactStage {
+  directory: string;
+  requestDirectory: string;
+  collect(): Promise<Array<{ name: string; data: Uint8Array }>>;
+  cleanup(): Promise<void>;
+}
+
+/** A private, per-request output directory; never upload arbitrary session paths. */
+export async function createDiscordArtifactStage(sessionId: string, requestId: string): Promise<DiscordArtifactStage> {
+  if (!REQUEST_ID.test(requestId)) throw new Error("Invalid artifact request ID");
+  const root = await prepareDiscordArtifactRoot(sessionId);
+  const requestDirectory = path.join(root, requestId);
+  await fs.mkdir(requestDirectory, { mode: 0o700 });
+  const requestInitial = await fs.lstat(requestDirectory);
+  const directory = path.join(requestDirectory, "output");
+  try { await fs.mkdir(directory, { mode: 0o700 }); }
+  catch (error) { await fs.rm(requestDirectory, { recursive: true, force: true }); throw error; }
+  const initial = await fs.lstat(directory);
+  async function checkDirectory(): Promise<void> {
+    if ((await resolveDiscordArtifactStage(sessionId, requestId)).output !== directory) throw new Error("Artifact staging path changed");
+    const current = await fs.lstat(directory);
+    if (!current.isDirectory() || current.dev !== initial.dev || current.ino !== initial.ino) throw new Error("Artifact staging directory changed");
+  }
+  return {
+    directory,
+    requestDirectory,
+    async collect() {
+      await checkDirectory();
+      const names = await fs.readdir(directory);
+      if (names.length > MAX_FILES) throw new Error("Too many output files (maximum 4)");
+      const result: Array<{ name: string; data: Uint8Array }> = [];
+      let total = 0;
+      for (const name of names) {
+        if (name.startsWith(".") || /[\x00-\x1f\x7f]/.test(name)) throw new Error("Invalid output filename");
+        await checkDirectory();
+        const file = path.join(directory, name);
+        const before = await fs.lstat(file);
+        if (!before.isFile() || before.nlink !== 1) throw new Error("Output must be a regular file, not a link or directory");
+        if (before.size > MAX_BYTES - total) throw new Error("Output files exceed 8 MiB total");
+        const handle = await fs.open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+          const opened = await handle.stat();
+          if (!opened.isFile() || opened.nlink !== 1 || opened.dev !== before.dev || opened.ino !== before.ino || opened.size !== before.size) throw new Error("Output file changed during collection");
+          const data = new Uint8Array(opened.size);
+          let offset = 0;
+          while (offset < data.length) {
+            const { bytesRead } = await handle.read(data, offset, data.length - offset, offset);
+            if (!bytesRead) throw new Error("Output file changed during collection");
+            offset += bytesRead;
+          }
+          const after = await handle.stat();
+          if (after.size !== opened.size || after.mtimeMs !== opened.mtimeMs || after.nlink !== 1) throw new Error("Output file changed during collection");
+          await checkDirectory();
+          total += data.length;
+          result.push({ name, data });
+        } finally {
+          await handle.close();
+        }
+      }
+      return result;
+    },
+    async cleanup() {
+      await privateDirectory(root);
+      await privateDirectory(requestDirectory);
+      const current = await fs.lstat(requestDirectory);
+      if (current.dev !== requestInitial.dev || current.ino !== requestInitial.ino) throw new Error("Artifact request directory changed");
+      await fs.rm(requestDirectory, { recursive: true, force: true });
+    },
+  };
+}

package/src/agent/notify/discord-attachments.ts

@@ -0,0 +1,116 @@
+import { lstat, mkdir, open, realpath, rm } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+
+const MAX_FILES = 10;
+const MAX_FILE_BYTES = 25 * 1024 * 1024;
+const MAX_TOTAL_BYTES = 50 * 1024 * 1024;
+const CDN_HOSTS = ["cdn.discordapp.com", "media.discordapp.net"];
+
+interface Attachment {
+  filename: string;
+  url: string;
+  size: number;
+}
+
+export interface DiscordAttachmentOptions {
+  directory: string;
+  signal?: AbortSignal;
+  fetchImpl?: typeof fetch;
+}
+
+export interface DiscordAttachmentStage {
+  files: string[];
+  cleanup: () => Promise<void>;
+}
+
+/** Staged files are private and must be removed with cleanup after the request finishes. */
+export async function stageDiscordAttachments(
+  attachments: unknown[],
+  options: DiscordAttachmentOptions,
+): Promise<DiscordAttachmentStage> {
+  if (!Array.isArray(attachments) || attachments.length > MAX_FILES) throw new Error("Invalid Discord attachment count");
+  const validated: Attachment[] = [];
+  let declaredTotal = 0;
+  for (const value of attachments) {
+    if (!value || typeof value !== "object") throw new Error("Invalid Discord attachment");
+    const item = value as Record<string, unknown>;
+    if (typeof item.filename !== "string" || !item.filename || typeof item.url !== "string" ||
+        !Number.isSafeInteger(item.size) || (item.size as number) < 0 || (item.size as number) > MAX_FILE_BYTES) {
+      throw new Error("Invalid Discord attachment metadata");
+    }
+    let url: URL;
+    try { url = new URL(item.url); } catch { throw new Error("Invalid Discord attachment URL"); }
+    if (url.protocol !== "https:" || !CDN_HOSTS.includes(url.hostname) || url.username || url.password || url.port) {
+      throw new Error("Untrusted Discord attachment URL");
+    }
+    declaredTotal += item.size as number;
+    if (declaredTotal > MAX_TOTAL_BYTES) throw new Error("Discord attachments exceed total size limit");
+    validated.push({ filename: item.filename, url: url.href, size: item.size as number });
+  }
+  if (options.signal?.aborted) throw new Error("Discord attachment download aborted");
+  const directory = options.directory;
+  if (typeof directory !== "string" || !isAbsolute(directory) || resolve(directory) !== directory || basename(directory) !== "input") {
+    throw new Error("Invalid Discord attachment staging directory");
+  }
+  const parent = dirname(directory);
+  const info = await lstat(parent);
+  if (!info.isDirectory() || (info.mode & 0o077) !== 0 ||
+      (typeof process.getuid === "function" && info.uid !== process.getuid()) || await realpath(parent) !== parent) {
+    throw new Error("Untrusted Discord attachment staging directory");
+  }
+  await mkdir(directory, { mode: 0o700 });
+  const cleanup = () => rm(directory, { recursive: true, force: true });
+  try {
+    const files: string[] = [];
+    let total = 0;
+    for (const [index, item] of validated.entries()) {
+      const name = item.filename.replace(/[^a-zA-Z0-9._-]/g, "_").replace(/^\.+/, "_").slice(0, 180) || "attachment";
+      const path = join(directory, `${index + 1}-${name}`);
+      const signal = AbortSignal.any([...(options.signal ? [options.signal] : []), AbortSignal.timeout(30_000)]);
+      let response: Response;
+      try {
+        response = await (options.fetchImpl ?? fetch)(item.url, { redirect: "error", signal });
+      } catch {
+        throw new Error("Discord attachment download failed or aborted");
+      }
+      if (!response.ok || !response.body) {
+        await response.body?.cancel().catch(() => {});
+        throw new Error("Discord attachment download failed");
+      }
+      const file = await open(path, "wx", 0o600).catch(async () => {
+        await response.body?.cancel().catch(() => {});
+        throw new Error("Discord attachment staging failed");
+      });
+      const reader = response.body.getReader();
+      let size = 0;
+      try {
+        for (;;) {
+          if (signal.aborted) throw new Error("Discord attachment download aborted");
+          const { done, value } = await reader.read().catch(() => { throw new Error("Discord attachment download failed or aborted"); });
+          if (signal.aborted) throw new Error("Discord attachment download aborted");
+          if (done) break;
+          size += value.byteLength;
+          total += value.byteLength;
+          if (size > MAX_FILE_BYTES || size > item.size || total > MAX_TOTAL_BYTES) throw new Error("Discord attachment exceeds size limit");
+          let offset = 0;
+          while (offset < value.byteLength) {
+            if (signal.aborted) throw new Error("Discord attachment download aborted");
+            const { bytesWritten } = await file.write(value, offset, value.byteLength - offset);
+            if (!bytesWritten) throw new Error("Discord attachment write failed");
+            offset += bytesWritten;
+          }
+        }
+        if (size !== item.size) throw new Error("Discord attachment size mismatch");
+      } finally {
+        await reader.cancel().catch(() => {});
+        await file.close();
+      }
+      files.push(path);
+    }
+    if (options.signal?.aborted) throw new Error("Discord attachment download aborted");
+    return { files, cleanup };
+  } catch (error) {
+    await cleanup();
+    throw error;
+  }
+}