tide-commander 1.62.0 → 1.63.0

package/dist/assets/{web-BGvcteqx.js → web-BYu5GvMD.js}

@@ -1 +1 @@
-import{bH as a}from"./main-DxFgIntP.js";import{ImpactStyle as i,NotificationType as r}from"./index-BS2yVyno.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class h extends a{constructor(){super(...arguments),this.selectionStarted=!1}async impact(t){const e=this.patternForImpact(t==null?void 0:t.style);this.vibrateWithPattern(e)}async notification(t){const e=this.patternForNotification(t==null?void 0:t.type);this.vibrateWithPattern(e)}async vibrate(t){const e=(t==null?void 0:t.duration)||300;this.vibrateWithPattern([e])}async selectionStart(){this.selectionStarted=!0}async selectionChanged(){this.selectionStarted&&this.vibrateWithPattern([70])}async selectionEnd(){this.selectionStarted=!1}patternForImpact(t=i.Heavy){return t===i.Medium?[43]:t===i.Light?[20]:[61]}patternForNotification(t=r.Success){return t===r.Warning?[30,40,30,50,60]:t===r.Error?[27,45,50]:[35,65,21]}vibrateWithPattern(t){if(navigator.vibrate)navigator.vibrate(t);else throw this.unavailable("Browser does not support the vibrate API")}}export{h as HapticsWeb};
+import{bH as a}from"./main-5l14ueeE.js";import{ImpactStyle as i,NotificationType as r}from"./index-DoOLLVEG.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class h extends a{constructor(){super(...arguments),this.selectionStarted=!1}async impact(t){const e=this.patternForImpact(t==null?void 0:t.style);this.vibrateWithPattern(e)}async notification(t){const e=this.patternForNotification(t==null?void 0:t.type);this.vibrateWithPattern(e)}async vibrate(t){const e=(t==null?void 0:t.duration)||300;this.vibrateWithPattern([e])}async selectionStart(){this.selectionStarted=!0}async selectionChanged(){this.selectionStarted&&this.vibrateWithPattern([70])}async selectionEnd(){this.selectionStarted=!1}patternForImpact(t=i.Heavy){return t===i.Medium?[43]:t===i.Light?[20]:[61]}patternForNotification(t=r.Success){return t===r.Warning?[30,40,30,50,60]:t===r.Error?[27,45,50]:[35,65,21]}vibrateWithPattern(t){if(navigator.vibrate)navigator.vibrate(t);else throw this.unavailable("Browser does not support the vibrate API")}}export{h as HapticsWeb};

package/dist/assets/{web-DBp9A4mr.js → web-BsMMNK0E.js}

@@ -1 +1 @@
-import{bH as s}from"./main-DxFgIntP.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class l extends s{constructor(){super(...arguments),this.pending=[],this.deliveredNotifications=[],this.hasNotificationSupport=()=>{if(!("Notification"in window)||!Notification.requestPermission)return!1;if(Notification.permission!=="granted")try{new Notification("")}catch(i){if(i instanceof Error&&i.name==="TypeError")return!1}return!0}}async getDeliveredNotifications(){const i=[];for(const t of this.deliveredNotifications){const e={title:t.title,id:parseInt(t.tag),body:t.body};i.push(e)}return{notifications:i}}async removeDeliveredNotifications(i){for(const t of i.notifications){const e=this.deliveredNotifications.find(n=>n.tag===String(t.id));e==null||e.close(),this.deliveredNotifications=this.deliveredNotifications.filter(()=>!e)}}async removeAllDeliveredNotifications(){for(const i of this.deliveredNotifications)i.close();this.deliveredNotifications=[]}async createChannel(){throw this.unimplemented("Not implemented on web.")}async deleteChannel(){throw this.unimplemented("Not implemented on web.")}async listChannels(){throw this.unimplemented("Not implemented on web.")}async schedule(i){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");for(const t of i.notifications)this.sendNotification(t);return{notifications:i.notifications.map(t=>({id:t.id}))}}async getPending(){return{notifications:this.pending}}async registerActionTypes(){throw this.unimplemented("Not implemented on web.")}async cancel(i){this.pending=this.pending.filter(t=>!i.notifications.find(e=>e.id===t.id))}async areEnabled(){const{display:i}=await this.checkPermissions();return{value:i==="granted"}}async changeExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async checkExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async requestPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(await Notification.requestPermission())}}async checkPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(Notification.permission)}}transformNotificationPermission(i){switch(i){case"granted":return"granted";case"denied":return"denied";default:return"prompt"}}sendPending(){var i;const t=[],e=new Date().getTime();for(const n of this.pending)!((i=n.schedule)===null||i===void 0)&&i.at&&n.schedule.at.getTime()<=e&&(this.buildNotification(n),t.push(n));this.pending=this.pending.filter(n=>!t.find(o=>o===n))}sendNotification(i){var t;if(!((t=i.schedule)===null||t===void 0)&&t.at){const e=i.schedule.at.getTime()-new Date().getTime();this.pending.push(i),setTimeout(()=>{this.sendPending()},e);return}this.buildNotification(i)}buildNotification(i){const t=new Notification(i.title,{body:i.body,tag:String(i.id)});return t.addEventListener("click",this.onClick.bind(this,i),!1),t.addEventListener("show",this.onShow.bind(this,i),!1),t.addEventListener("close",()=>{this.deliveredNotifications=this.deliveredNotifications.filter(()=>!this)},!1),this.deliveredNotifications.push(t),t}onClick(i){const t={actionId:"tap",notification:i};this.notifyListeners("localNotificationActionPerformed",t)}onShow(i){this.notifyListeners("localNotificationReceived",i)}}export{l as LocalNotificationsWeb};
+import{bH as s}from"./main-5l14ueeE.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class l extends s{constructor(){super(...arguments),this.pending=[],this.deliveredNotifications=[],this.hasNotificationSupport=()=>{if(!("Notification"in window)||!Notification.requestPermission)return!1;if(Notification.permission!=="granted")try{new Notification("")}catch(i){if(i instanceof Error&&i.name==="TypeError")return!1}return!0}}async getDeliveredNotifications(){const i=[];for(const t of this.deliveredNotifications){const e={title:t.title,id:parseInt(t.tag),body:t.body};i.push(e)}return{notifications:i}}async removeDeliveredNotifications(i){for(const t of i.notifications){const e=this.deliveredNotifications.find(n=>n.tag===String(t.id));e==null||e.close(),this.deliveredNotifications=this.deliveredNotifications.filter(()=>!e)}}async removeAllDeliveredNotifications(){for(const i of this.deliveredNotifications)i.close();this.deliveredNotifications=[]}async createChannel(){throw this.unimplemented("Not implemented on web.")}async deleteChannel(){throw this.unimplemented("Not implemented on web.")}async listChannels(){throw this.unimplemented("Not implemented on web.")}async schedule(i){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");for(const t of i.notifications)this.sendNotification(t);return{notifications:i.notifications.map(t=>({id:t.id}))}}async getPending(){return{notifications:this.pending}}async registerActionTypes(){throw this.unimplemented("Not implemented on web.")}async cancel(i){this.pending=this.pending.filter(t=>!i.notifications.find(e=>e.id===t.id))}async areEnabled(){const{display:i}=await this.checkPermissions();return{value:i==="granted"}}async changeExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async checkExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async requestPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(await Notification.requestPermission())}}async checkPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(Notification.permission)}}transformNotificationPermission(i){switch(i){case"granted":return"granted";case"denied":return"denied";default:return"prompt"}}sendPending(){var i;const t=[],e=new Date().getTime();for(const n of this.pending)!((i=n.schedule)===null||i===void 0)&&i.at&&n.schedule.at.getTime()<=e&&(this.buildNotification(n),t.push(n));this.pending=this.pending.filter(n=>!t.find(o=>o===n))}sendNotification(i){var t;if(!((t=i.schedule)===null||t===void 0)&&t.at){const e=i.schedule.at.getTime()-new Date().getTime();this.pending.push(i),setTimeout(()=>{this.sendPending()},e);return}this.buildNotification(i)}buildNotification(i){const t=new Notification(i.title,{body:i.body,tag:String(i.id)});return t.addEventListener("click",this.onClick.bind(this,i),!1),t.addEventListener("show",this.onShow.bind(this,i),!1),t.addEventListener("close",()=>{this.deliveredNotifications=this.deliveredNotifications.filter(()=>!this)},!1),this.deliveredNotifications.push(t),t}onClick(i){const t={actionId:"tap",notification:i};this.notifyListeners("localNotificationActionPerformed",t)}onShow(i){this.notifyListeners("localNotificationReceived",i)}}export{l as LocalNotificationsWeb};

package/dist/index.html

@@ -22,7 +22,7 @@
     <link rel="icon" type="image/png" sizes="16x16" href="/assets/icons/favicon-16x16.png" />
     <link rel="apple-touch-icon" sizes="180x180" href="/assets/icons/apple-touch-icon.png" />
     <title>Tide Commander</title>
-    <script type="module" crossorigin src="/assets/main-DxFgIntP.js"></script>
+    <script type="module" crossorigin src="/assets/main-5l14ueeE.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/vendor-react--Eh9ivFN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-three-Chj50gSY.js">
     <link rel="stylesheet" crossorigin href="/assets/main-a5zo94fK.css">

package/dist/src/packages/server/integrations/jira/jira-client.js

@@ -3,6 +3,8 @@
  * REST API v3 wrapper using raw fetch (no extra dependencies).
  * Authentication: Basic (email:apiToken) for Atlassian Cloud.
  */
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
 import { parseCustomFieldMappings } from './jira-config.js';
 // ─── Client ───
 export class JiraClient {
@@ -141,6 +143,136 @@ export class JiraClient {
         const resp = (await this.request('POST', '/rest/servicedeskapi/request', body));
         return this.getIssue(resp.issueKey);
     }
+    // ─── Attachments ───
+    /**
+     * List all attachments on a Jira issue.
+     * @param issueKey Issue key or numeric id (e.g. "SD-1234").
+     * @returns Array of attachment descriptors (id, filename, mimeType, size, contentUrl, author, created).
+     */
+    async listAttachments(issueKey) {
+        const resp = (await this.request('GET', `/rest/api/3/issue/${encodeURIComponent(issueKey)}?fields=attachment`));
+        const list = resp.fields?.attachment ?? [];
+        return list.map((a) => ({
+            id: a.id,
+            filename: a.filename,
+            mimeType: a.mimeType,
+            size: a.size,
+            contentUrl: a.content,
+            authorDisplayName: a.author?.displayName,
+            created: a.created,
+        }));
+    }
+    /**
+     * List attachments referenced by comments on an issue.
+     * Comments reference media via ADF nodes of type "media"; those ids resolve to entries in the
+     * issue's own attachment list.
+     * @param issueKey Issue key or numeric id.
+     * @param commentId Optional — restrict to a single comment.
+     * @returns Attachments referenced by matching comment ADF bodies.
+     */
+    async listCommentAttachments(issueKey, commentId) {
+        const resp = (await this.request('GET', `/rest/api/3/issue/${encodeURIComponent(issueKey)}/comment`));
+        const comments = commentId
+            ? (resp.comments ?? []).filter((c) => c.id === commentId)
+            : resp.comments ?? [];
+        const mediaIds = new Set();
+        for (const c of comments) {
+            for (const id of extractMediaIdsFromADF(c.body))
+                mediaIds.add(id);
+        }
+        if (mediaIds.size === 0)
+            return [];
+        const all = await this.listAttachments(issueKey);
+        return all.filter((a) => mediaIds.has(a.id));
+    }
+    /**
+     * Download a single attachment to disk.
+     * @param attachment Either the attachment id (string) or a full {@link JiraAttachment} object.
+     * @param outputPath Absolute or relative destination file path. Parent directory is created.
+     * @returns The destination path and bytes written.
+     */
+    async downloadAttachment(attachment, outputPath) {
+        if (!this.isConfigured) {
+            throw new Error('Jira client is not configured. Set base URL, email, and API token.');
+        }
+        const url = typeof attachment === 'string'
+            ? `${this.baseUrl}/rest/api/3/attachment/content/${encodeURIComponent(attachment)}`
+            : attachment.contentUrl;
+        const response = await fetch(url, {
+            method: 'GET',
+            headers: {
+                Authorization: `Basic ${this.auth}`,
+                Accept: '*/*',
+            },
+            redirect: 'follow',
+        });
+        if (!response.ok) {
+            const detail = await response.text().catch(() => '');
+            const id = typeof attachment === 'string' ? attachment : attachment.id;
+            throw new Error(`Jira attachment download failed for id ${id} (${response.status}): ${detail}`);
+        }
+        const buf = Buffer.from(await response.arrayBuffer());
+        await fs.mkdir(path.dirname(path.resolve(outputPath)), { recursive: true });
+        await fs.writeFile(outputPath, buf);
+        return { path: outputPath, bytes: buf.byteLength };
+    }
+    /**
+     * Fetch an attachment's raw bytes along with relevant response headers. Used by the HTTP
+     * proxy route to stream content back to a caller without exposing credentials.
+     * @param attachmentId Jira attachment id.
+     */
+    async fetchAttachmentBytes(attachmentId) {
+        if (!this.isConfigured) {
+            throw new Error('Jira client is not configured. Set base URL, email, and API token.');
+        }
+        const response = await fetch(`${this.baseUrl}/rest/api/3/attachment/content/${encodeURIComponent(attachmentId)}`, {
+            method: 'GET',
+            headers: {
+                Authorization: `Basic ${this.auth}`,
+                Accept: '*/*',
+            },
+            redirect: 'follow',
+        });
+        if (!response.ok) {
+            const detail = await response.text().catch(() => '');
+            throw new Error(`Jira attachment fetch failed for id ${attachmentId} (${response.status}): ${detail}`);
+        }
+        return {
+            buffer: Buffer.from(await response.arrayBuffer()),
+            contentType: response.headers.get('content-type'),
+            contentDisposition: response.headers.get('content-disposition'),
+            contentLength: response.headers.get('content-length'),
+        };
+    }
+    /**
+     * Download every attachment on an issue (optionally also those referenced by comments) to a directory.
+     * Filename collisions overwrite.
+     * @param issueKey Issue key or numeric id.
+     * @param outputDir Directory to write files into; created recursively if missing.
+     * @param opts.includeComments When true, union in attachments referenced by the issue's comments.
+     * @returns The list of attachments that were downloaded.
+     */
+    async downloadAllAttachments(issueKey, outputDir, opts) {
+        await fs.mkdir(outputDir, { recursive: true });
+        const issueAtts = await this.listAttachments(issueKey);
+        const byId = new Map();
+        for (const a of issueAtts)
+            byId.set(a.id, a);
+        if (opts?.includeComments) {
+            const commentAtts = await this.listCommentAttachments(issueKey);
+            for (const a of commentAtts)
+                if (!byId.has(a.id))
+                    byId.set(a.id, a);
+        }
+        const downloaded = [];
+        for (const att of byId.values()) {
+            const safeName = sanitizeFilename(att.filename) || att.id;
+            const outPath = path.join(outputDir, safeName);
+            await this.downloadAttachment(att, outPath);
+            downloaded.push(att);
+        }
+        return downloaded;
+    }
     // ─── Helpers ───
     /** Convert plain text to Atlassian Document Format (ADF). */
     toADF(text) {
@@ -201,3 +333,26 @@ export class JiraClient {
         return response.json();
     }
 }
+// ─── Module-level helpers ───
+/** Walk an ADF document and return all media-node ids (`{type:"media",attrs:{id,...}}`). */
+function extractMediaIdsFromADF(adf) {
+    const ids = [];
+    const walk = (node) => {
+        if (!node || typeof node !== 'object')
+            return;
+        const n = node;
+        if (n.type === 'media' && typeof n.attrs?.id === 'string') {
+            ids.push(n.attrs.id);
+        }
+        if (Array.isArray(n.content)) {
+            for (const child of n.content)
+                walk(child);
+        }
+    };
+    walk(adf);
+    return ids;
+}
+/** Strip path separators and NUL so an attachment filename is safe to join with an outputDir. */
+function sanitizeFilename(name) {
+    return name.replace(/[\\/\0]/g, '_').replace(/^\.+/, '_').trim();
+}

package/dist/src/packages/server/integrations/jira/jira-routes.js

@@ -10,6 +10,10 @@
  *   GET    /issues/:key/comments            - Get comments
  *   GET    /issues/:key/transitions         - List transitions
  *   POST   /issues/:key/transitions         - Transition issue
+ *   GET    /issues/:key/attachments         - List issue attachments
+ *   GET    /issues/:key/comments/attachments - List attachments referenced by comments (optional ?commentId=)
+ *   POST   /issues/:key/attachments/download-all - Server-side bulk download to outputDir
+ *   GET    /attachments/:id/content         - Proxy an attachment's binary content
  *   GET    /search                          - Search via JQL
  *   POST   /service-desk/:deskId/requests   - Create SD request
  */
@@ -197,6 +201,75 @@ export function createJiraRoutes(client, ctx) {
             res.status(500).json({ error: message });
         }
     });
+    // ─── Attachments ───
+    // List attachments on an issue
+    router.get('/issues/:key/attachments', async (req, res) => {
+        try {
+            const attachments = await client.listAttachments(req.params.key);
+            res.json({ attachments });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : 'Failed to list attachments';
+            res.status(500).json({ error: message });
+        }
+    });
+    // List attachments referenced by issue comments (optionally filter by commentId)
+    router.get('/issues/:key/comments/attachments', async (req, res) => {
+        try {
+            const commentId = req.query.commentId;
+            const attachments = await client.listCommentAttachments(req.params.key, commentId);
+            res.json({ attachments });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : 'Failed to list comment attachments';
+            res.status(500).json({ error: message });
+        }
+    });
+    // Server-side bulk download of all attachments for an issue
+    router.post('/issues/:key/attachments/download-all', async (req, res) => {
+        try {
+            const { outputDir, includeComments } = req.body;
+            if (!outputDir) {
+                res.status(400).json({ error: 'outputDir is required' });
+                return;
+            }
+            const downloaded = await client.downloadAllAttachments(req.params.key, outputDir, {
+                includeComments,
+            });
+            res.json({
+                outputDir,
+                count: downloaded.length,
+                attachments: downloaded.map((a) => ({
+                    id: a.id,
+                    filename: a.filename,
+                    mimeType: a.mimeType,
+                    size: a.size,
+                })),
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : 'Failed to download attachments';
+            ctx.log.error(`Bulk download for ${req.params.key} failed: ${message}`);
+            res.status(500).json({ error: message });
+        }
+    });
+    // Proxy a single attachment's binary content (auth is added server-side)
+    router.get('/attachments/:id/content', async (req, res) => {
+        try {
+            const { buffer, contentType, contentDisposition, contentLength } = await client.fetchAttachmentBytes(req.params.id);
+            if (contentType)
+                res.setHeader('Content-Type', contentType);
+            if (contentDisposition)
+                res.setHeader('Content-Disposition', contentDisposition);
+            if (contentLength)
+                res.setHeader('Content-Length', contentLength);
+            res.status(200).send(buffer);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : 'Failed to fetch attachment';
+            res.status(500).json({ error: message });
+        }
+    });
     // ─── Search ───
     router.get('/search', async (req, res) => {
         try {

package/dist/src/packages/server/integrations/jira/jira-skill.js

@@ -138,6 +138,38 @@ curl -s -X POST http://localhost:5174/api/jira/issues/SD-1234/transitions \\
   -d '{"transitionId": "31", "comment": "Transition reason"}'
 \`\`\`
 
+## Attachments
+
+**List attachments on an issue:**
+\`\`\`bash
+curl -s http://localhost:5174/api/jira/issues/SD-1234/attachments
+\`\`\`
+Returns \`{ "attachments": [ { "id", "filename", "mimeType", "size", "contentUrl", "authorDisplayName?", "created?" } ] }\`.
+
+**List attachments referenced by comments (optionally a single comment):**
+\`\`\`bash
+# All comment attachments on the issue
+curl -s http://localhost:5174/api/jira/issues/SD-1234/comments/attachments
+
+# Only attachments referenced by a single comment
+curl -s "http://localhost:5174/api/jira/issues/SD-1234/comments/attachments?commentId=10050"
+\`\`\`
+
+**Download a single attachment to disk (proxy streams binary, auth handled server-side):**
+\`\`\`bash
+curl -s http://localhost:5174/api/jira/attachments/10042/content -o /tmp/myfile.pdf
+\`\`\`
+The response preserves \`Content-Type\` and \`Content-Disposition\` from Jira.
+
+**Server-side bulk download of every attachment into a directory:**
+\`\`\`bash
+curl -s -X POST http://localhost:5174/api/jira/issues/SD-1234/attachments/download-all \\
+  -H "Content-Type: application/json" \\
+  -d '{"outputDir": "/tmp/jira/SD-1234", "includeComments": true}'
+\`\`\`
+The server writes files into \`outputDir\` (created if missing), overwriting on filename collision.
+Returns \`{ "outputDir", "count", "attachments": [ { "id", "filename", "mimeType", "size" } ] }\`.
+
 ## Service Desk Requests
 
 \`\`\`bash

package/dist/src/packages/server/integrations/slack/slack-client.js

@@ -3,9 +3,35 @@
  * Manages Slack Web API + Socket Mode connection, message sending/receiving,
  * channel/user lookup, and long-poll reply waiting.
  */
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
 import { WebClient } from '@slack/web-api';
 import { SocketModeClient } from '@slack/socket-mode';
 import { loadConfig, updateConfig } from './slack-config.js';
+// Subtypes we never want to trigger on: edits, deletions, channel housekeeping, bot echoes.
+// NOTE: `file_share` (legacy) and undefined (modern file-share) MUST NOT be in this set.
+const SKIP_MESSAGE_SUBTYPES = new Set([
+    'bot_message',
+    'message_changed',
+    'message_deleted',
+    'message_replied',
+    'channel_join',
+    'channel_leave',
+    'channel_topic',
+    'channel_purpose',
+    'channel_name',
+    'channel_archive',
+    'channel_unarchive',
+    'group_join',
+    'group_leave',
+    'group_topic',
+    'group_purpose',
+    'group_name',
+    'group_archive',
+    'group_unarchive',
+    'pinned_item',
+    'unpinned_item',
+]);
 // ─── State ───
 let webClient = null;
 let socketClient = null;
@@ -100,7 +126,16 @@ function setupSocketHandlers() {
         return;
     socketClient.on('message', async ({ event, ack }) => {
         await ack();
-        if (!event || !event.text || event.subtype)
+        if (!event)
+            return;
+        // Drop non-trigger-worthy subtypes (edits, joins, bot echoes, topic changes, etc.).
+        // Modern file-share messages have NO subtype; legacy ones use `file_share` — both must pass.
+        if (event.subtype && SKIP_MESSAGE_SUBTYPES.has(event.subtype))
+            return;
+        const hasFiles = Array.isArray(event.files) && event.files.length > 0;
+        const text = event.text ?? '';
+        // Require either text or attached files — otherwise there's nothing useful to trigger on.
+        if (!text && !hasFiles)
             return;
         // Skip bot's own messages
         const config = loadConfig();
@@ -109,14 +144,18 @@ function setupSocketHandlers() {
         // Resolve username
         const user = await resolveUser(event.user);
         const userName = user?.displayName || user?.name || event.user;
+        const files = hasFiles
+            ? event.files.map((f) => normalizeSlackFile(f))
+            : undefined;
         const message = {
             ts: event.ts,
             threadTs: event.thread_ts,
             channel: event.channel,
             userId: event.user,
             userName,
-            text: event.text,
+            text,
             timestamp: parseSlackTs(event.ts),
+            files,
         };
         // Log to SQLite
         ctx?.eventDb.logSlackMessage({
@@ -126,7 +165,7 @@ function setupSocketHandlers() {
             channelName: channelNameCache.get(event.channel),
             userId: event.user,
             userName,
-            text: event.text,
+            text,
             direction: 'inbound',
             rawEvent: event,
             receivedAt: Date.now(),
@@ -134,7 +173,13 @@ function setupSocketHandlers() {
         // Broadcast to WS clients
         ctx?.broadcast({
             type: 'slack_message_received',
-            payload: { channel: event.channel, userName, text: event.text, ts: event.ts },
+            payload: {
+                channel: event.channel,
+                userName,
+                text,
+                ts: event.ts,
+                fileCount: files?.length ?? 0,
+            },
         });
         // Notify trigger listeners
         for (const listener of messageListeners) {
@@ -363,6 +408,148 @@ export async function sendDm(params) {
         workflowInstanceId: params.workflowInstanceId,
     });
 }
+/**
+ * Upload a file to Slack via the new two-step flow:
+ *   1. files.getUploadURLExternal (filename, length) → { upload_url, file_id }
+ *   2. PUT raw bytes to upload_url
+ *   3. files.completeUploadExternal (files[], channel_id?, initial_comment?, thread_ts?)
+ * Requires the bot token to have the `files:write` scope.
+ */
+export async function uploadFile(params) {
+    if (!webClient)
+        throw new Error('Slack not connected');
+    const length = params.bytes instanceof Buffer ? params.bytes.length : params.bytes.byteLength;
+    if (!length)
+        throw new Error('uploadFile: bytes is empty');
+    // Step 1: get an external upload URL
+    const step1 = await webClient.files.getUploadURLExternal({
+        filename: params.filename,
+        length,
+    });
+    if (!step1.ok || !step1.upload_url || !step1.file_id) {
+        throw new Error(`Slack files.getUploadURLExternal failed: ${step1.error ?? 'unknown error'}`);
+    }
+    // Step 2: POST the raw bytes to the signed upload URL (no Slack auth on this call).
+    // Node's global fetch accepts Buffer/Uint8Array at runtime; BodyInit types require a cast.
+    const bodyBytes = params.bytes instanceof Buffer
+        ? new Uint8Array(params.bytes.buffer, params.bytes.byteOffset, params.bytes.byteLength)
+        : params.bytes;
+    const putResp = await fetch(step1.upload_url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/octet-stream' },
+        body: bodyBytes,
+    });
+    if (!putResp.ok) {
+        const detail = await putResp.text().catch(() => '');
+        throw new Error(`Slack upload_url POST failed (${putResp.status}): ${detail}`);
+    }
+    // Step 3: finalize and (optionally) share
+    const files = [
+        { id: step1.file_id, title: params.title ?? params.filename },
+    ];
+    const step3 = params.channelId
+        ? await webClient.files.completeUploadExternal({
+            files,
+            channel_id: params.channelId,
+            initial_comment: params.initialComment,
+            thread_ts: params.threadTs,
+        })
+        : await webClient.files.completeUploadExternal({ files });
+    if (!step3.ok) {
+        throw new Error(`Slack files.completeUploadExternal failed: ${step3.error ?? 'unknown error'}`);
+    }
+    const file = (step3.files?.[0] ?? { id: step1.file_id });
+    return { fileId: step1.file_id, file };
+}
+/**
+ * List files visible to the bot, optionally filtered by channel/user/time/type.
+ * Requires the bot token to have `files:read`.
+ */
+export async function listFiles(params = {}) {
+    if (!webClient)
+        throw new Error('Slack not connected');
+    const result = await webClient.files.list({
+        channel: params.channelId,
+        user: params.userId,
+        ts_from: params.tsFrom,
+        ts_to: params.tsTo,
+        types: params.types,
+        count: params.count ?? 50,
+        page: params.page,
+    });
+    return (result.files ?? []).map((f) => normalizeSlackFile(f));
+}
+/** Fetch metadata for a single file (title, permalink, url_private, mimetype, size, ...). */
+export async function getFileInfo(fileId) {
+    if (!webClient)
+        throw new Error('Slack not connected');
+    const result = await webClient.files.info({ file: fileId });
+    if (!result.ok || !result.file) {
+        throw new Error(`Slack files.info failed for ${fileId}: ${result.error ?? 'unknown error'}`);
+    }
+    return normalizeSlackFile(result.file);
+}
+/**
+ * Fetch a file's raw bytes using the bot token Bearer auth.
+ * Slack's `url_private` redirects to the CDN but requires the bot token on the initial request.
+ */
+export async function fetchFileBytes(fileId) {
+    const token = ctx?.secrets.get('SLACK_BOT_TOKEN');
+    if (!token)
+        throw new Error('Slack bot token is not configured');
+    const info = await getFileInfo(fileId);
+    const url = info.url_private_download || info.url_private;
+    if (!url)
+        throw new Error(`Slack file ${fileId} has no url_private`);
+    const response = await fetch(url, {
+        method: 'GET',
+        headers: {
+            Authorization: `Bearer ${token}`,
+            Accept: '*/*',
+        },
+        redirect: 'follow',
+    });
+    if (!response.ok) {
+        const detail = await response.text().catch(() => '');
+        throw new Error(`Slack file download failed for ${fileId} (${response.status}): ${detail}`);
+    }
+    return {
+        buffer: Buffer.from(await response.arrayBuffer()),
+        contentType: response.headers.get('content-type'),
+        contentDisposition: response.headers.get('content-disposition'),
+        contentLength: response.headers.get('content-length'),
+        filename: info.name,
+    };
+}
+/**
+ * Download a Slack file to disk. Accepts a file id or a full {@link SlackFile} object.
+ * Parent directory is created if missing; filename collisions overwrite.
+ */
+export async function downloadFile(file, outputPath) {
+    const fileId = typeof file === 'string' ? file : file.id;
+    const { buffer, filename, contentType } = await fetchFileBytes(fileId);
+    await fs.mkdir(path.dirname(path.resolve(outputPath)), { recursive: true });
+    await fs.writeFile(outputPath, buffer);
+    return {
+        path: outputPath,
+        bytes: buffer.byteLength,
+        filename,
+        mimeType: contentType ?? undefined,
+    };
+}
+function normalizeSlackFile(f) {
+    return {
+        id: f.id,
+        name: f.name,
+        title: f.title,
+        mimetype: f.mimetype,
+        size: f.size,
+        permalink: f.permalink,
+        permalink_public: f.permalink_public,
+        url_private: f.url_private,
+        url_private_download: f.url_private_download,
+    };
+}
 export async function searchUsers(query) {
     if (!webClient)
         throw new Error('Slack not connected');
@@ -428,6 +615,8 @@ async function slackApiMessageToSlackMessage(msg, channel) {
     catch {
         // Use userId as fallback
     }
+    const rawFiles = msg.files;
+    const files = rawFiles?.length ? rawFiles.map(normalizeSlackFile) : undefined;
     return {
         ts: msg.ts,
         threadTs: msg.thread_ts,
@@ -436,5 +625,6 @@ async function slackApiMessageToSlackMessage(msg, channel) {
         userName,
         text: msg.text || '',
         timestamp: parseSlackTs(msg.ts),
+        files,
     };
 }