tide-commander 1.91.0 → 1.92.0

package/dist/assets/{web-Cx_ySRHK.js → web-CfwxlY8x.js}

@@ -1 +1 @@
-import{ck as s}from"./main-5eyR3isL.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class l extends s{constructor(){super(...arguments),this.pending=[],this.deliveredNotifications=[],this.hasNotificationSupport=()=>{if(!("Notification"in window)||!Notification.requestPermission)return!1;if(Notification.permission!=="granted")try{new Notification("")}catch(i){if(i instanceof Error&&i.name==="TypeError")return!1}return!0}}async getDeliveredNotifications(){const i=[];for(const t of this.deliveredNotifications){const e={title:t.title,id:parseInt(t.tag),body:t.body};i.push(e)}return{notifications:i}}async removeDeliveredNotifications(i){for(const t of i.notifications){const e=this.deliveredNotifications.find(n=>n.tag===String(t.id));e==null||e.close(),this.deliveredNotifications=this.deliveredNotifications.filter(()=>!e)}}async removeAllDeliveredNotifications(){for(const i of this.deliveredNotifications)i.close();this.deliveredNotifications=[]}async createChannel(){throw this.unimplemented("Not implemented on web.")}async deleteChannel(){throw this.unimplemented("Not implemented on web.")}async listChannels(){throw this.unimplemented("Not implemented on web.")}async schedule(i){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");for(const t of i.notifications)this.sendNotification(t);return{notifications:i.notifications.map(t=>({id:t.id}))}}async getPending(){return{notifications:this.pending}}async registerActionTypes(){throw this.unimplemented("Not implemented on web.")}async cancel(i){this.pending=this.pending.filter(t=>!i.notifications.find(e=>e.id===t.id))}async areEnabled(){const{display:i}=await this.checkPermissions();return{value:i==="granted"}}async changeExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async checkExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async requestPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(await Notification.requestPermission())}}async checkPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(Notification.permission)}}transformNotificationPermission(i){switch(i){case"granted":return"granted";case"denied":return"denied";default:return"prompt"}}sendPending(){var i;const t=[],e=new Date().getTime();for(const n of this.pending)!((i=n.schedule)===null||i===void 0)&&i.at&&n.schedule.at.getTime()<=e&&(this.buildNotification(n),t.push(n));this.pending=this.pending.filter(n=>!t.find(o=>o===n))}sendNotification(i){var t;if(!((t=i.schedule)===null||t===void 0)&&t.at){const e=i.schedule.at.getTime()-new Date().getTime();this.pending.push(i),setTimeout(()=>{this.sendPending()},e);return}this.buildNotification(i)}buildNotification(i){const t=new Notification(i.title,{body:i.body,tag:String(i.id)});return t.addEventListener("click",this.onClick.bind(this,i),!1),t.addEventListener("show",this.onShow.bind(this,i),!1),t.addEventListener("close",()=>{this.deliveredNotifications=this.deliveredNotifications.filter(()=>!this)},!1),this.deliveredNotifications.push(t),t}onClick(i){const t={actionId:"tap",notification:i};this.notifyListeners("localNotificationActionPerformed",t)}onShow(i){this.notifyListeners("localNotificationReceived",i)}}export{l as LocalNotificationsWeb};
+import{ck as s}from"./main-jN7LzP4f.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class l extends s{constructor(){super(...arguments),this.pending=[],this.deliveredNotifications=[],this.hasNotificationSupport=()=>{if(!("Notification"in window)||!Notification.requestPermission)return!1;if(Notification.permission!=="granted")try{new Notification("")}catch(i){if(i instanceof Error&&i.name==="TypeError")return!1}return!0}}async getDeliveredNotifications(){const i=[];for(const t of this.deliveredNotifications){const e={title:t.title,id:parseInt(t.tag),body:t.body};i.push(e)}return{notifications:i}}async removeDeliveredNotifications(i){for(const t of i.notifications){const e=this.deliveredNotifications.find(n=>n.tag===String(t.id));e==null||e.close(),this.deliveredNotifications=this.deliveredNotifications.filter(()=>!e)}}async removeAllDeliveredNotifications(){for(const i of this.deliveredNotifications)i.close();this.deliveredNotifications=[]}async createChannel(){throw this.unimplemented("Not implemented on web.")}async deleteChannel(){throw this.unimplemented("Not implemented on web.")}async listChannels(){throw this.unimplemented("Not implemented on web.")}async schedule(i){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");for(const t of i.notifications)this.sendNotification(t);return{notifications:i.notifications.map(t=>({id:t.id}))}}async getPending(){return{notifications:this.pending}}async registerActionTypes(){throw this.unimplemented("Not implemented on web.")}async cancel(i){this.pending=this.pending.filter(t=>!i.notifications.find(e=>e.id===t.id))}async areEnabled(){const{display:i}=await this.checkPermissions();return{value:i==="granted"}}async changeExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async checkExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async requestPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(await Notification.requestPermission())}}async checkPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(Notification.permission)}}transformNotificationPermission(i){switch(i){case"granted":return"granted";case"denied":return"denied";default:return"prompt"}}sendPending(){var i;const t=[],e=new Date().getTime();for(const n of this.pending)!((i=n.schedule)===null||i===void 0)&&i.at&&n.schedule.at.getTime()<=e&&(this.buildNotification(n),t.push(n));this.pending=this.pending.filter(n=>!t.find(o=>o===n))}sendNotification(i){var t;if(!((t=i.schedule)===null||t===void 0)&&t.at){const e=i.schedule.at.getTime()-new Date().getTime();this.pending.push(i),setTimeout(()=>{this.sendPending()},e);return}this.buildNotification(i)}buildNotification(i){const t=new Notification(i.title,{body:i.body,tag:String(i.id)});return t.addEventListener("click",this.onClick.bind(this,i),!1),t.addEventListener("show",this.onShow.bind(this,i),!1),t.addEventListener("close",()=>{this.deliveredNotifications=this.deliveredNotifications.filter(()=>!this)},!1),this.deliveredNotifications.push(t),t}onClick(i){const t={actionId:"tap",notification:i};this.notifyListeners("localNotificationActionPerformed",t)}onShow(i){this.notifyListeners("localNotificationReceived",i)}}export{l as LocalNotificationsWeb};

package/dist/assets/{web-DMjkVCWy.js → web-DZfyqisM.js}

@@ -1 +1 @@
-import{ck as t}from"./main-5eyR3isL.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class o extends t{constructor(){super(),this.handleVisibilityChange=()=>{const e={isActive:document.hidden!==!0};this.notifyListeners("appStateChange",e),document.hidden?this.notifyListeners("pause",null):this.notifyListeners("resume",null)},document.addEventListener("visibilitychange",this.handleVisibilityChange,!1)}exitApp(){throw this.unimplemented("Not implemented on web.")}async getInfo(){throw this.unimplemented("Not implemented on web.")}async getLaunchUrl(){return{url:""}}async getState(){return{isActive:document.hidden!==!0}}async minimizeApp(){throw this.unimplemented("Not implemented on web.")}async toggleBackButtonHandler(){throw this.unimplemented("Not implemented on web.")}async getAppLanguage(){return{value:navigator.language.split("-")[0].toLowerCase()}}}export{o as AppWeb};
+import{ck as t}from"./main-jN7LzP4f.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class o extends t{constructor(){super(),this.handleVisibilityChange=()=>{const e={isActive:document.hidden!==!0};this.notifyListeners("appStateChange",e),document.hidden?this.notifyListeners("pause",null):this.notifyListeners("resume",null)},document.addEventListener("visibilitychange",this.handleVisibilityChange,!1)}exitApp(){throw this.unimplemented("Not implemented on web.")}async getInfo(){throw this.unimplemented("Not implemented on web.")}async getLaunchUrl(){return{url:""}}async getState(){return{isActive:document.hidden!==!0}}async minimizeApp(){throw this.unimplemented("Not implemented on web.")}async toggleBackButtonHandler(){throw this.unimplemented("Not implemented on web.")}async getAppLanguage(){return{value:navigator.language.split("-")[0].toLowerCase()}}}export{o as AppWeb};

package/dist/assets/{web-DGO1VHbi.js → web-DbhP1mtF.js}

@@ -1 +1 @@
-import{ck as a}from"./main-5eyR3isL.js";import{ImpactStyle as i,NotificationType as r}from"./index-B4JdUiAe.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class h extends a{constructor(){super(...arguments),this.selectionStarted=!1}async impact(t){const e=this.patternForImpact(t==null?void 0:t.style);this.vibrateWithPattern(e)}async notification(t){const e=this.patternForNotification(t==null?void 0:t.type);this.vibrateWithPattern(e)}async vibrate(t){const e=(t==null?void 0:t.duration)||300;this.vibrateWithPattern([e])}async selectionStart(){this.selectionStarted=!0}async selectionChanged(){this.selectionStarted&&this.vibrateWithPattern([70])}async selectionEnd(){this.selectionStarted=!1}patternForImpact(t=i.Heavy){return t===i.Medium?[43]:t===i.Light?[20]:[61]}patternForNotification(t=r.Success){return t===r.Warning?[30,40,30,50,60]:t===r.Error?[27,45,50]:[35,65,21]}vibrateWithPattern(t){if(navigator.vibrate)navigator.vibrate(t);else throw this.unavailable("Browser does not support the vibrate API")}}export{h as HapticsWeb};
+import{ck as a}from"./main-jN7LzP4f.js";import{ImpactStyle as i,NotificationType as r}from"./index-cK048gKM.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class h extends a{constructor(){super(...arguments),this.selectionStarted=!1}async impact(t){const e=this.patternForImpact(t==null?void 0:t.style);this.vibrateWithPattern(e)}async notification(t){const e=this.patternForNotification(t==null?void 0:t.type);this.vibrateWithPattern(e)}async vibrate(t){const e=(t==null?void 0:t.duration)||300;this.vibrateWithPattern([e])}async selectionStart(){this.selectionStarted=!0}async selectionChanged(){this.selectionStarted&&this.vibrateWithPattern([70])}async selectionEnd(){this.selectionStarted=!1}patternForImpact(t=i.Heavy){return t===i.Medium?[43]:t===i.Light?[20]:[61]}patternForNotification(t=r.Success){return t===r.Warning?[30,40,30,50,60]:t===r.Error?[27,45,50]:[35,65,21]}vibrateWithPattern(t){if(navigator.vibrate)navigator.vibrate(t);else throw this.unavailable("Browser does not support the vibrate API")}}export{h as HapticsWeb};

package/dist/index.html

@@ -22,7 +22,7 @@
     <link rel="icon" type="image/png" sizes="16x16" href="/assets/icons/favicon-16x16.png" />
     <link rel="apple-touch-icon" sizes="180x180" href="/assets/icons/apple-touch-icon.png" />
     <title>Tide Commander</title>
-    <script type="module" crossorigin src="/assets/main-5eyR3isL.js"></script>
+    <script type="module" crossorigin src="/assets/main-jN7LzP4f.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/vendor-react--Eh9ivFN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-three-Chj50gSY.js">
     <link rel="stylesheet" crossorigin href="/assets/main-CrGeO0Sc.css">

package/dist/src/packages/server/index.js

@@ -16,6 +16,7 @@ import { logger, closeFileLogging, getLogFilePath, createLogger } from './utils/
 import { setupTerminalWsProxy } from './services/terminal-proxy.js';
 import { initIntegrations, shutdownIntegrations, getIntegrationTriggerHandlers } from './integrations/integration-registry.js';
 import { initBackupService, shutdownBackupService } from './services/backup-service.js';
+import { initAttachmentJanitor, shutdownAttachmentJanitor } from './services/attachment-janitor.js';
 // Configuration
 const PORT = process.env.PORT || 6200;
 const HOST = process.env.HOST || (process.env.LISTEN_ALL_INTERFACES ? '::' : '127.0.0.1');
@@ -141,6 +142,8 @@ async function main() {
     }
     // Start hourly backup scheduler (reads persisted enabled/disabled setting)
     initBackupService();
+    // Start hourly sweeper for the trigger-attachment temp dir.
+    initAttachmentJanitor();
     logger.server.log(`Data directory: ${getDataDir()}`);
     logger.server.log(`Log file: ${getLogFilePath()}`);
     // Create Express app and HTTP server
@@ -203,6 +206,7 @@ async function main() {
         forceShutdownTimer.unref();
         try {
             shutdownBackupService();
+            shutdownAttachmentJanitor();
             triggerService.shutdown();
             workflowService.shutdown();
             await shutdownIntegrations();

package/dist/src/packages/server/integrations/slack/slack-instance.js

@@ -14,6 +14,7 @@ import * as os from 'node:os';
 import path from 'node:path';
 import { LogLevel, WebClient } from '@slack/web-api';
 import { SocketModeClient } from '@slack/socket-mode';
+import { downloadAttachment, MAX_ATTACHMENT_BYTES } from '../../services/attachment-downloader.js';
 import { instanceSecretKey, loadConfig, resolveAuthMode, updateConfig } from './slack-config.js';
 import { SlackPollingClient, asPollingWebClient } from './slack-polling-client.js';
 import { SlackWatermarkStore } from './slack-watermark-store.js';
@@ -287,6 +288,20 @@ export class SlackInstance {
         const files = hasFiles
             ? event.files.map((f) => normalizeSlackFile(f))
             : undefined;
+        // Download any attached files locally so triggered agents can read them
+        // directly with the Read tool (no need to re-fetch via Slack auth).
+        //
+        // We download regardless of direction. Earlier this branch had an
+        // `!isOwnMessage` filter, which broke the real-world case: when a Slack
+        // user uploads a file from their OWN workspace account (the one that
+        // owns the xoxp- token), Slack reports `direction='outbound'` and the
+        // attachment was silently skipped. Same root cause as the inbound-only
+        // filter that bit us on WhatsApp. If the bot itself (chat.postMessage
+        // with files) is the originator the echo lands here too — that self-
+        // fetch is benign and bounded by the 25 MB cap and the 24 h janitor.
+        const { attachmentPaths, skippedAttachments } = files && files.length > 0
+            ? await this.downloadInboundFiles(event.ts, files)
+            : { attachmentPaths: undefined, skippedAttachments: undefined };
         const message = {
             ts: event.ts,
             threadTs: event.thread_ts,
@@ -297,6 +312,8 @@ export class SlackInstance {
             text,
             timestamp: parseSlackTs(event.ts),
             files,
+            attachmentPaths,
+            skippedAttachments,
             isOwnMessage,
         };
         const direction = isOwnMessage ? 'outbound' : 'inbound';
@@ -358,6 +375,78 @@ export class SlackInstance {
             waiter.resolve(message);
         }
     }
+    /**
+     * Download up to MAX_INBOUND_FILES_PER_MESSAGE files locally so triggered
+     * agents can read them with the Read tool. Files beyond the cap, or whose
+     * size hint exceeds the 25 MB cap, are recorded under `skippedAttachments`.
+     * Never throws.
+     */
+    async downloadInboundFiles(messageTs, files) {
+        const MAX_INBOUND_FILES_PER_MESSAGE = 10;
+        const token = this.getSecret('SLACK_BOT_TOKEN');
+        if (!token) {
+            this.ctx?.log.warn(`Slack[${this.id}] cannot download inbound files — SLACK_BOT_TOKEN not configured`);
+            return { attachmentPaths: undefined, skippedAttachments: undefined };
+        }
+        const downloaded = [];
+        const skipped = [];
+        for (let i = 0; i < files.length; i++) {
+            const file = files[i];
+            if (i >= MAX_INBOUND_FILES_PER_MESSAGE) {
+                this.ctx?.log.info(`Slack[${this.id}] skipping file ${i + 1}/${files.length} — exceeds per-message cap`);
+                skipped.push({
+                    reason: 'unsupported',
+                    filename: file.name,
+                    size: file.size,
+                    detail: 'per-message cap (10 files)',
+                });
+                continue;
+            }
+            const url = file.url_private_download ?? file.url_private;
+            if (!url) {
+                skipped.push({
+                    reason: 'fetch-failed',
+                    filename: file.name,
+                    size: file.size,
+                    detail: 'no url_private',
+                });
+                continue;
+            }
+            if (typeof file.size === 'number' && file.size > MAX_ATTACHMENT_BYTES) {
+                skipped.push({
+                    reason: 'too-large',
+                    filename: file.name,
+                    size: file.size,
+                    sourceUrl: url,
+                });
+                continue;
+            }
+            const result = await downloadAttachment({
+                source: 'slack',
+                messageId: `${messageTs}-${file.id}`,
+                url,
+                headers: { Authorization: `Bearer ${token}` },
+                suggestedFilename: file.name,
+                mimetype: file.mimetype,
+                sizeHintBytes: file.size,
+            });
+            if (result) {
+                downloaded.push(result);
+            }
+            else {
+                skipped.push({
+                    reason: 'fetch-failed',
+                    filename: file.name,
+                    size: file.size,
+                    sourceUrl: url,
+                });
+            }
+        }
+        return {
+            attachmentPaths: downloaded.length > 0 ? downloaded : undefined,
+            skippedAttachments: skipped.length > 0 ? skipped : undefined,
+        };
+    }
     // ─── Sending ───
     async sendMessage(params) {
         if (!this.webClient)

package/dist/src/packages/server/integrations/slack/slack-polling-client.js

@@ -77,9 +77,14 @@ export class SlackPollingClient {
     minMsBetweenCalls;
     scheduler;
     now;
-    /** Pacer state: serializes outbound API calls through a promise chain. */
-    rateGateChain = Promise.resolve();
-    /** When > now(), all paced calls sleep until that wall-clock ms. Set on 429. */
+    /** Token-bucket rate limiter shared by every paced API call. Concurrent
+     *  workers really run in parallel — only the *rate* (tokens/sec) is capped.
+     *  Replaces the older serial promise-chain gate which silently nullified
+     *  the `concurrency` option (every paced call was forced to run one at a
+     *  time spaced by `minMsBetweenCalls`, so `concurrency: 8` behaved like
+     *  `concurrency: 1`). */
+    bucket = null;
+    /** When > now(), every paced call sleeps until that wall-clock ms. Set on 429. */
     globalPauseUntil = 0;
     running = false;
     timer = null;
@@ -108,51 +113,44 @@ export class SlackPollingClient {
         this.minMsBetweenCalls = Math.max(0, opts.minMsBetweenCalls ?? 0);
         this.scheduler = opts.scheduler ?? DEFAULT_SCHEDULER;
         this.now = opts.now ?? Date.now;
+        if (this.minMsBetweenCalls > 0) {
+            // Tier 3 spec: ~50/min sustained with bursts up to ~5/sec. Refill rate
+            // = minMsBetweenCalls (e.g. 1200ms → 50/min). Burst capacity caps the
+            // initial flood from a cycle wake-up without us having to throttle every
+            // single call serially.
+            this.bucket = new TokenBucket({
+                capacity: 5,
+                refillIntervalMs: this.minMsBetweenCalls,
+                now: this.now,
+                globalPauseUntil: () => this.globalPauseUntil,
+                isRunning: () => this.running,
+            });
+        }
     }
     /**
      * Throttle gate for outbound Slack API calls. All calls (history + replies)
-     * go through here so the per-cycle burst is smeared across the cycle. When
-     * `minMsBetweenCalls` is 0 the gate is a no-op — used by tests.
+     * go through here. With `minMsBetweenCalls > 0` we acquire a token from the
+     * shared bucket; multiple workers can hold tokens concurrently up to the
+     * burst capacity, so `concurrency: 8` actually parallelizes (unlike the
+     * older serial promise-chain gate). With `minMsBetweenCalls === 0` we are
+     * in test mode and skip throttling entirely.
      *
-     * Honors `globalPauseUntil` set by 429 handlers so the entire client backs
-     * off when Slack tells us to.
+     * The bucket honors `globalPauseUntil` set by 429 handlers so the entire
+     * client backs off when Slack tells us to.
      */
     async paceCall(fn) {
-        // Stop() was called while we were queued — bail without consuming the
-        // pacing slot or making the API call.
         if (!this.running) {
             throw new Error('SlackPollingClient stopped');
         }
-        if (this.minMsBetweenCalls === 0 && this.globalPauseUntil <= this.now()) {
+        if (!this.bucket) {
+            // Test mode: no throttling at all.
             return fn();
         }
-        const prev = this.rateGateChain;
-        let release;
-        this.rateGateChain = new Promise((r) => { release = r; });
-        await prev;
-        // Re-check after waiting on the gate — stop() could have fired meanwhile.
+        await this.bucket.acquire();
         if (!this.running) {
-            release();
             throw new Error('SlackPollingClient stopped');
         }
-        // Sleep through any global pause first.
-        const pauseRemainingMs = this.globalPauseUntil - this.now();
-        if (pauseRemainingMs > 0) {
-            await new Promise((r) => setTimeout(r, pauseRemainingMs));
-        }
-        try {
-            return await fn();
-        }
-        finally {
-            // Release the gate after the min interval — the next paced call will
-            // unblock then. We don't await this; it's fire-and-forget.
-            if (this.minMsBetweenCalls > 0) {
-                setTimeout(release, this.minMsBetweenCalls);
-            }
-            else {
-                release();
-            }
-        }
+        return fn();
     }
     /** Subscribe to fatal-error notifications (e.g. invalid_auth). */
     setOnFatalError(cb) {
@@ -365,14 +363,15 @@ export class SlackPollingClient {
         if (messages.length === 0)
             return 0;
         // Slack returns newest-first; dispatch in chronological order so trigger
-        // listeners and dedupe see them in real-world order.
-        const ordered = [...messages].sort((a, b) => parseFloat(a.ts) - parseFloat(b.ts));
+        // listeners and dedupe see them in real-world order. BigInt sort avoids
+        // the precision loss `parseFloat` had on Slack's 16-sig-fig timestamps.
+        const ordered = [...messages].sort((a, b) => tsCmp(a.ts, b.ts));
         let dispatched = 0;
         let highestTs = wm?.lastTs ?? '0';
         for (const msg of ordered) {
             // Defense-in-depth: never re-dispatch ts <= watermark even if the
             // server returned an unexpected row.
-            if (wm && parseFloat(msg.ts) <= parseFloat(wm.lastTs))
+            if (wm && tsLte(msg.ts, wm.lastTs))
                 continue;
             const event = {
                 ts: msg.ts,
@@ -390,7 +389,7 @@ export class SlackPollingClient {
             catch (err) {
                 log.error(`dispatch error channel=${channelId} ts=${msg.ts}: ${describeErr(err)}`);
             }
-            if (parseFloat(msg.ts) > parseFloat(highestTs)) {
+            if (tsGt(msg.ts, highestTs)) {
                 highestTs = msg.ts;
             }
             // ─── Cheap thread-reply heuristic ───
@@ -404,7 +403,7 @@ export class SlackPollingClient {
             const parentTs = msg.ts;
             const replyCount = msg.reply_count ?? 0;
             const latestReply = msg.latest_reply;
-            const repliesAreNew = !!latestReply && parseFloat(latestReply) > parseFloat(wm?.lastTs ?? '0');
+            const repliesAreNew = !!latestReply && tsGt(latestReply, wm?.lastTs ?? '0');
             if (replyCount > 0 && repliesAreNew) {
                 const oldestForReplies = wm?.lastTs ?? parentTs;
                 try {
@@ -416,10 +415,10 @@ export class SlackPollingClient {
                     }));
                     const replies = (repliesRes.messages ?? []).filter((r) => !!r && typeof r.ts === 'string' && r.ts !== parentTs);
                     // conversations.replies returns oldest-first, but be defensive.
-                    const orderedReplies = [...replies].sort((a, b) => parseFloat(a.ts) - parseFloat(b.ts));
+                    const orderedReplies = [...replies].sort((a, b) => tsCmp(a.ts, b.ts));
                     for (const reply of orderedReplies) {
                         // Defense: skip ts already at or below the watermark (handles overlap).
-                        if (wm && parseFloat(reply.ts) <= parseFloat(wm.lastTs))
+                        if (wm && tsLte(reply.ts, wm.lastTs))
                             continue;
                         const replyEvent = {
                             ts: reply.ts,
@@ -437,7 +436,7 @@ export class SlackPollingClient {
                         catch (err) {
                             log.error(`dispatch error (reply) channel=${channelId} ts=${reply.ts}: ${describeErr(err)}`);
                         }
-                        if (parseFloat(reply.ts) > parseFloat(highestTs)) {
+                        if (tsGt(reply.ts, highestTs)) {
                             highestTs = reply.ts;
                         }
                     }
@@ -520,3 +519,112 @@ async function mapWithConcurrency(items, concurrency, worker) {
 export function asPollingWebClient(client) {
     return client;
 }
+// ─── Slack TS comparison helpers ───
+//
+// Slack timestamps are strings shaped like `XXXXXXXXXX.YYYYYY` — 10-digit
+// seconds + 6-digit microseconds. Using `parseFloat()` on them silently loses
+// precision in the last digits (JS doubles top out around 15–17 sig figs),
+// which can cause two adjacent timestamps to compare equal and a real message
+// to be silently dropped (`msg.ts <= wm.lastTs` accepting it as already-seen
+// and `msg.ts > highestTs` refusing to advance the watermark). We use BigInt
+// instead so the comparison is exact.
+function tsToBigInt(ts) {
+    if (!ts)
+        return 0n;
+    const dot = ts.indexOf('.');
+    const sec = dot === -1 ? ts : ts.slice(0, dot);
+    const micro = dot === -1 ? '' : ts.slice(dot + 1);
+    // Pad / truncate microseconds to exactly 6 digits so concatenation always
+    // produces a consistent-magnitude integer.
+    const microPadded = (micro + '000000').slice(0, 6);
+    try {
+        return BigInt(sec + microPadded);
+    }
+    catch {
+        return 0n;
+    }
+}
+/** True if `a <= b`. */
+function tsLte(a, b) {
+    return tsToBigInt(a) <= tsToBigInt(b);
+}
+/** True if `a > b`. */
+function tsGt(a, b) {
+    return tsToBigInt(a) > tsToBigInt(b);
+}
+/** Compare two ts strings for Array.sort. Returns -1, 0, or 1. */
+function tsCmp(a, b) {
+    const ab = tsToBigInt(a);
+    const bb = tsToBigInt(b);
+    return ab < bb ? -1 : ab > bb ? 1 : 0;
+}
+class TokenBucket {
+    tokens;
+    lastRefillMs;
+    waiters = [];
+    pumpScheduled = false;
+    capacity;
+    refillIntervalMs;
+    nowFn;
+    globalPauseUntilFn;
+    isRunningFn;
+    constructor(opts) {
+        this.capacity = Math.max(1, opts.capacity);
+        this.refillIntervalMs = Math.max(1, opts.refillIntervalMs);
+        this.nowFn = opts.now;
+        this.globalPauseUntilFn = opts.globalPauseUntil;
+        this.isRunningFn = opts.isRunning;
+        this.tokens = this.capacity;
+        this.lastRefillMs = opts.now();
+    }
+    refillNow() {
+        const elapsed = this.nowFn() - this.lastRefillMs;
+        if (elapsed <= 0)
+            return;
+        const gained = elapsed / this.refillIntervalMs;
+        if (gained > 0) {
+            this.tokens = Math.min(this.capacity, this.tokens + gained);
+            this.lastRefillMs = this.nowFn();
+        }
+    }
+    async acquire() {
+        if (!this.isRunningFn())
+            throw new Error('SlackPollingClient stopped');
+        // Wait through any global 429 pause before consuming a token so the
+        // entire workspace honors Retry-After.
+        const pauseRemaining = this.globalPauseUntilFn() - this.nowFn();
+        if (pauseRemaining > 0) {
+            await new Promise((r) => setTimeout(r, pauseRemaining));
+            if (!this.isRunningFn())
+                throw new Error('SlackPollingClient stopped');
+        }
+        this.refillNow();
+        if (this.tokens >= 1 && this.waiters.length === 0) {
+            this.tokens -= 1;
+            return;
+        }
+        return new Promise((resolve) => {
+            this.waiters.push(resolve);
+            this.schedulePump();
+        });
+    }
+    schedulePump() {
+        if (this.pumpScheduled)
+            return;
+        this.pumpScheduled = true;
+        const needed = Math.max(0, 1 - this.tokens);
+        const waitMs = Math.max(10, Math.ceil(needed * this.refillIntervalMs));
+        setTimeout(() => {
+            this.pumpScheduled = false;
+            this.refillNow();
+            while (this.tokens >= 1 && this.waiters.length > 0) {
+                this.tokens -= 1;
+                const resolve = this.waiters.shift();
+                resolve();
+            }
+            if (this.waiters.length > 0) {
+                this.schedulePump();
+            }
+        }, waitMs);
+    }
+}

package/dist/src/packages/server/integrations/slack/slack-skill.js

@@ -230,6 +230,22 @@ Disable the auto-ack by setting \`SLACK_REACT_ON_TRIGGER=false\` (accepts \`fals
 curl -s http://localhost:5174/api/slack/status
 \`\`\`
 
+## Reading Inbound Attachments from a Slack Trigger
+
+When a Slack message that fires your trigger carries file attachments (\`file_share\`, screenshots, PDFs, etc.), Tide Commander downloads the bytes server-side so you don't have to fetch them yourself. The local paths are surfaced in your prompt template under \`{{slack.attachmentsBlock}}\` (and \`{{slack.filePaths}}\` for a flat comma list).
+
+Each downloaded attachment renders as one line in the block:
+
+\`\`\`
+[attachment: /tmp/tide-commander-uploads/triggers/slack/<msgTs>-<fileId>/<filename>  mimetype=image/png  name=screenshot.png  size=124300]
+\`\`\`
+
+Use the **Read** tool directly on that absolute path — do NOT call the Slack file API yourself. Files older than 24 hours are swept automatically.
+
+If a file is too large (>25 MB) or the bot couldn't download it, the line becomes \`[attachment-skipped: too-large …]\` or \`[attachment-skipped: fetch-failed …]\` instead. In that case, surface the limitation to the user rather than silently ignoring the attachment.
+
+Per-message cap: at most 10 files are downloaded; additional files are emitted as \`[attachment-skipped: unsupported …]\`.
+
 ## Notes
 - Channel IDs look like \`C0123456789\`. Use the list channels endpoint to find them.
 - Thread timestamps look like \`1234567890.123456\`.

package/dist/src/packages/server/integrations/slack/slack-trigger-handler.js

@@ -10,6 +10,7 @@
 import * as slackClient from './slack-client.js';
 import { listInstances } from './slack-instance.js';
 import { listInstanceMetas } from './slack-instance-manifest.js';
+import { formatAttachmentLine } from '../../services/attachment-downloader.js';
 const unsubscribers = [];
 /** Env toggle: set SLACK_REACT_ON_TRIGGER=false (or 0/no/off) to disable the auto-:eyes: ack. */
 function reactOnTriggerEnabled() {
@@ -90,10 +91,24 @@ export const slackTriggerHandler = {
         const msg = event.data;
         void trigger;
         const files = msg.files ?? [];
+        const downloaded = msg.attachmentPaths ?? [];
+        const skipped = msg.skippedAttachments ?? [];
         // Resolved channel label: `#name` / `DM con @user` / `Grupo: @a, @b…`.
         // Falls back to the raw id when the resolver couldn't fetch metadata
         // (network blip, missing scope, deleted channel).
         const channelLabel = msg.channelName || msg.channel;
+        // Build the "attachments block" agents can ingest verbatim — one line per
+        // downloaded file with absolute path, plus a line per skipped file with
+        // the reason. Empty string when there are no attachments.
+        const blockLines = [];
+        for (const att of downloaded) {
+            blockLines.push(formatAttachmentLine(att));
+        }
+        for (const sk of skipped) {
+            const sizeMb = typeof sk.size === 'number' ? `${Math.round(sk.size / (1024 * 1024))}MB` : 'unknown';
+            blockLines.push(`[attachment-skipped: ${sk.reason} name=${sk.filename ?? 'unknown'} size=${sizeMb}${sk.detail ? ` detail=${sk.detail}` : ''}]`);
+        }
+        const attachmentsBlock = blockLines.join('\n');
         return {
             'slack.user': msg.userName,
             // fromName/fromId are the boss-canonical names mirroring the Slack
@@ -113,6 +128,10 @@ export const slackTriggerHandler = {
             'slack.fileIds': files.map((f) => f.id).join(','),
             'slack.fileNames': files.map((f) => f.name ?? '').filter(Boolean).join(','),
             'slack.attachmentsList': files.map((f) => f.name ?? '').filter(Boolean).join(','),
+            // New: absolute paths and ready-to-paste attachments block. Additive —
+            // existing user templates that don't reference these vars keep working.
+            'slack.filePaths': downloaded.map((a) => a.path).join(','),
+            'slack.attachmentsBlock': attachmentsBlock,
             'slack.instanceId': msg.instanceId,
             'slack.instanceName': msg.instanceId,
         };

package/dist/src/packages/server/integrations/whatsapp/whatsapp-skill.js

@@ -53,6 +53,18 @@ curl -s -X POST -H "X-Auth-Token: abcd" http://localhost:5174/api/whatsapp/send-
   -d '{"to":"5215532967210","mediaUrl":"https://example.com/cat.png","caption":"meow","type":"image"}'
 \`\`\`
 
+### 4. Read an attachment from an inbound WhatsApp trigger
+
+When your trigger fires from an inbound WhatsApp message that has media, Tide Commander downloads the bytes server-side and surfaces the local path in your prompt template under \`{{whatsapp.attachmentsBlock}}\` (and \`{{whatsapp.attachmentPath}}\` individually). The block looks like:
+
+\`\`\`
+[attachment: /tmp/tide-commander-uploads/triggers/whatsapp/<msgId>/<filename>  mimetype=image/jpeg  name=photo.jpg  size=124300]
+\`\`\`
+
+Use the **Read** tool directly on that path — do NOT try to fetch the original \`mediaUrl\` (it's an encrypted Meta CDN URL that you can't decrypt). Files older than 24 hours are swept automatically.
+
+If the line says \`[attachment-skipped: too-large …]\` or \`[attachment-skipped: fetch-failed …]\` instead, the bytes were not saved and you should respond accordingly (ask the user to re-send, or proceed without the attachment).
+
 ---
 
 ## Send a Text Message (full reference)