tide-commander 1.91.0 → 1.93.0

package/dist/assets/{web-DMjkVCWy.js → web-BbNfUMzK.js}

@@ -1 +1 @@
-import{ck as t}from"./main-5eyR3isL.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class o extends t{constructor(){super(),this.handleVisibilityChange=()=>{const e={isActive:document.hidden!==!0};this.notifyListeners("appStateChange",e),document.hidden?this.notifyListeners("pause",null):this.notifyListeners("resume",null)},document.addEventListener("visibilitychange",this.handleVisibilityChange,!1)}exitApp(){throw this.unimplemented("Not implemented on web.")}async getInfo(){throw this.unimplemented("Not implemented on web.")}async getLaunchUrl(){return{url:""}}async getState(){return{isActive:document.hidden!==!0}}async minimizeApp(){throw this.unimplemented("Not implemented on web.")}async toggleBackButtonHandler(){throw this.unimplemented("Not implemented on web.")}async getAppLanguage(){return{value:navigator.language.split("-")[0].toLowerCase()}}}export{o as AppWeb};
+import{ck as t}from"./main-BUO6--48.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class o extends t{constructor(){super(),this.handleVisibilityChange=()=>{const e={isActive:document.hidden!==!0};this.notifyListeners("appStateChange",e),document.hidden?this.notifyListeners("pause",null):this.notifyListeners("resume",null)},document.addEventListener("visibilitychange",this.handleVisibilityChange,!1)}exitApp(){throw this.unimplemented("Not implemented on web.")}async getInfo(){throw this.unimplemented("Not implemented on web.")}async getLaunchUrl(){return{url:""}}async getState(){return{isActive:document.hidden!==!0}}async minimizeApp(){throw this.unimplemented("Not implemented on web.")}async toggleBackButtonHandler(){throw this.unimplemented("Not implemented on web.")}async getAppLanguage(){return{value:navigator.language.split("-")[0].toLowerCase()}}}export{o as AppWeb};

package/dist/assets/{web-Cx_ySRHK.js → web-CQsQBSkQ.js}

@@ -1 +1 @@
-import{ck as s}from"./main-5eyR3isL.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class l extends s{constructor(){super(...arguments),this.pending=[],this.deliveredNotifications=[],this.hasNotificationSupport=()=>{if(!("Notification"in window)||!Notification.requestPermission)return!1;if(Notification.permission!=="granted")try{new Notification("")}catch(i){if(i instanceof Error&&i.name==="TypeError")return!1}return!0}}async getDeliveredNotifications(){const i=[];for(const t of this.deliveredNotifications){const e={title:t.title,id:parseInt(t.tag),body:t.body};i.push(e)}return{notifications:i}}async removeDeliveredNotifications(i){for(const t of i.notifications){const e=this.deliveredNotifications.find(n=>n.tag===String(t.id));e==null||e.close(),this.deliveredNotifications=this.deliveredNotifications.filter(()=>!e)}}async removeAllDeliveredNotifications(){for(const i of this.deliveredNotifications)i.close();this.deliveredNotifications=[]}async createChannel(){throw this.unimplemented("Not implemented on web.")}async deleteChannel(){throw this.unimplemented("Not implemented on web.")}async listChannels(){throw this.unimplemented("Not implemented on web.")}async schedule(i){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");for(const t of i.notifications)this.sendNotification(t);return{notifications:i.notifications.map(t=>({id:t.id}))}}async getPending(){return{notifications:this.pending}}async registerActionTypes(){throw this.unimplemented("Not implemented on web.")}async cancel(i){this.pending=this.pending.filter(t=>!i.notifications.find(e=>e.id===t.id))}async areEnabled(){const{display:i}=await this.checkPermissions();return{value:i==="granted"}}async changeExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async checkExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async requestPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(await Notification.requestPermission())}}async checkPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(Notification.permission)}}transformNotificationPermission(i){switch(i){case"granted":return"granted";case"denied":return"denied";default:return"prompt"}}sendPending(){var i;const t=[],e=new Date().getTime();for(const n of this.pending)!((i=n.schedule)===null||i===void 0)&&i.at&&n.schedule.at.getTime()<=e&&(this.buildNotification(n),t.push(n));this.pending=this.pending.filter(n=>!t.find(o=>o===n))}sendNotification(i){var t;if(!((t=i.schedule)===null||t===void 0)&&t.at){const e=i.schedule.at.getTime()-new Date().getTime();this.pending.push(i),setTimeout(()=>{this.sendPending()},e);return}this.buildNotification(i)}buildNotification(i){const t=new Notification(i.title,{body:i.body,tag:String(i.id)});return t.addEventListener("click",this.onClick.bind(this,i),!1),t.addEventListener("show",this.onShow.bind(this,i),!1),t.addEventListener("close",()=>{this.deliveredNotifications=this.deliveredNotifications.filter(()=>!this)},!1),this.deliveredNotifications.push(t),t}onClick(i){const t={actionId:"tap",notification:i};this.notifyListeners("localNotificationActionPerformed",t)}onShow(i){this.notifyListeners("localNotificationReceived",i)}}export{l as LocalNotificationsWeb};
+import{ck as s}from"./main-BUO6--48.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class l extends s{constructor(){super(...arguments),this.pending=[],this.deliveredNotifications=[],this.hasNotificationSupport=()=>{if(!("Notification"in window)||!Notification.requestPermission)return!1;if(Notification.permission!=="granted")try{new Notification("")}catch(i){if(i instanceof Error&&i.name==="TypeError")return!1}return!0}}async getDeliveredNotifications(){const i=[];for(const t of this.deliveredNotifications){const e={title:t.title,id:parseInt(t.tag),body:t.body};i.push(e)}return{notifications:i}}async removeDeliveredNotifications(i){for(const t of i.notifications){const e=this.deliveredNotifications.find(n=>n.tag===String(t.id));e==null||e.close(),this.deliveredNotifications=this.deliveredNotifications.filter(()=>!e)}}async removeAllDeliveredNotifications(){for(const i of this.deliveredNotifications)i.close();this.deliveredNotifications=[]}async createChannel(){throw this.unimplemented("Not implemented on web.")}async deleteChannel(){throw this.unimplemented("Not implemented on web.")}async listChannels(){throw this.unimplemented("Not implemented on web.")}async schedule(i){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");for(const t of i.notifications)this.sendNotification(t);return{notifications:i.notifications.map(t=>({id:t.id}))}}async getPending(){return{notifications:this.pending}}async registerActionTypes(){throw this.unimplemented("Not implemented on web.")}async cancel(i){this.pending=this.pending.filter(t=>!i.notifications.find(e=>e.id===t.id))}async areEnabled(){const{display:i}=await this.checkPermissions();return{value:i==="granted"}}async changeExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async checkExactNotificationSetting(){throw this.unimplemented("Not implemented on web.")}async requestPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(await Notification.requestPermission())}}async checkPermissions(){if(!this.hasNotificationSupport())throw this.unavailable("Notifications not supported in this browser.");return{display:this.transformNotificationPermission(Notification.permission)}}transformNotificationPermission(i){switch(i){case"granted":return"granted";case"denied":return"denied";default:return"prompt"}}sendPending(){var i;const t=[],e=new Date().getTime();for(const n of this.pending)!((i=n.schedule)===null||i===void 0)&&i.at&&n.schedule.at.getTime()<=e&&(this.buildNotification(n),t.push(n));this.pending=this.pending.filter(n=>!t.find(o=>o===n))}sendNotification(i){var t;if(!((t=i.schedule)===null||t===void 0)&&t.at){const e=i.schedule.at.getTime()-new Date().getTime();this.pending.push(i),setTimeout(()=>{this.sendPending()},e);return}this.buildNotification(i)}buildNotification(i){const t=new Notification(i.title,{body:i.body,tag:String(i.id)});return t.addEventListener("click",this.onClick.bind(this,i),!1),t.addEventListener("show",this.onShow.bind(this,i),!1),t.addEventListener("close",()=>{this.deliveredNotifications=this.deliveredNotifications.filter(()=>!this)},!1),this.deliveredNotifications.push(t),t}onClick(i){const t={actionId:"tap",notification:i};this.notifyListeners("localNotificationActionPerformed",t)}onShow(i){this.notifyListeners("localNotificationReceived",i)}}export{l as LocalNotificationsWeb};

package/dist/assets/{web-DGO1VHbi.js → web-bKiHKTT6.js}

@@ -1 +1 @@
-import{ck as a}from"./main-5eyR3isL.js";import{ImpactStyle as i,NotificationType as r}from"./index-B4JdUiAe.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class h extends a{constructor(){super(...arguments),this.selectionStarted=!1}async impact(t){const e=this.patternForImpact(t==null?void 0:t.style);this.vibrateWithPattern(e)}async notification(t){const e=this.patternForNotification(t==null?void 0:t.type);this.vibrateWithPattern(e)}async vibrate(t){const e=(t==null?void 0:t.duration)||300;this.vibrateWithPattern([e])}async selectionStart(){this.selectionStarted=!0}async selectionChanged(){this.selectionStarted&&this.vibrateWithPattern([70])}async selectionEnd(){this.selectionStarted=!1}patternForImpact(t=i.Heavy){return t===i.Medium?[43]:t===i.Light?[20]:[61]}patternForNotification(t=r.Success){return t===r.Warning?[30,40,30,50,60]:t===r.Error?[27,45,50]:[35,65,21]}vibrateWithPattern(t){if(navigator.vibrate)navigator.vibrate(t);else throw this.unavailable("Browser does not support the vibrate API")}}export{h as HapticsWeb};
+import{ck as a}from"./main-BUO6--48.js";import{ImpactStyle as i,NotificationType as r}from"./index-mEu7CM6i.js";import"./vendor-react--Eh9ivFN.js";import"./vendor-three-Chj50gSY.js";class h extends a{constructor(){super(...arguments),this.selectionStarted=!1}async impact(t){const e=this.patternForImpact(t==null?void 0:t.style);this.vibrateWithPattern(e)}async notification(t){const e=this.patternForNotification(t==null?void 0:t.type);this.vibrateWithPattern(e)}async vibrate(t){const e=(t==null?void 0:t.duration)||300;this.vibrateWithPattern([e])}async selectionStart(){this.selectionStarted=!0}async selectionChanged(){this.selectionStarted&&this.vibrateWithPattern([70])}async selectionEnd(){this.selectionStarted=!1}patternForImpact(t=i.Heavy){return t===i.Medium?[43]:t===i.Light?[20]:[61]}patternForNotification(t=r.Success){return t===r.Warning?[30,40,30,50,60]:t===r.Error?[27,45,50]:[35,65,21]}vibrateWithPattern(t){if(navigator.vibrate)navigator.vibrate(t);else throw this.unavailable("Browser does not support the vibrate API")}}export{h as HapticsWeb};

package/dist/index.html

@@ -22,10 +22,10 @@
     <link rel="icon" type="image/png" sizes="16x16" href="/assets/icons/favicon-16x16.png" />
     <link rel="apple-touch-icon" sizes="180x180" href="/assets/icons/apple-touch-icon.png" />
     <title>Tide Commander</title>
-    <script type="module" crossorigin src="/assets/main-5eyR3isL.js"></script>
+    <script type="module" crossorigin src="/assets/main-BUO6--48.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/vendor-react--Eh9ivFN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-three-Chj50gSY.js">
-    <link rel="stylesheet" crossorigin href="/assets/main-CrGeO0Sc.css">
+    <link rel="stylesheet" crossorigin href="/assets/main-BfT_95fk.css">
   </head>
   <body>
     <div id="app"></div>

package/dist/locales/en/terminal.json

@@ -602,7 +602,8 @@
     "contextLabel": "Context",
     "percentFree": "{{percent}}% free",
     "msgsLabel": "msgs: {{tokens}}k",
-    "clickForContextStats": "Click for context stats"
+    "clickForContextStats": "Click for context stats",
+    "compactedLabel": "Context compacted"
   },
   "controls": {
     "title": "Controls",

package/dist/src/packages/server/index.js

@@ -16,6 +16,7 @@ import { logger, closeFileLogging, getLogFilePath, createLogger } from './utils/
 import { setupTerminalWsProxy } from './services/terminal-proxy.js';
 import { initIntegrations, shutdownIntegrations, getIntegrationTriggerHandlers } from './integrations/integration-registry.js';
 import { initBackupService, shutdownBackupService } from './services/backup-service.js';
+import { initAttachmentJanitor, shutdownAttachmentJanitor } from './services/attachment-janitor.js';
 // Configuration
 const PORT = process.env.PORT || 6200;
 const HOST = process.env.HOST || (process.env.LISTEN_ALL_INTERFACES ? '::' : '127.0.0.1');
@@ -141,6 +142,8 @@ async function main() {
     }
     // Start hourly backup scheduler (reads persisted enabled/disabled setting)
     initBackupService();
+    // Start hourly sweeper for the trigger-attachment temp dir.
+    initAttachmentJanitor();
     logger.server.log(`Data directory: ${getDataDir()}`);
     logger.server.log(`Log file: ${getLogFilePath()}`);
     // Create Express app and HTTP server
@@ -203,6 +206,7 @@ async function main() {
         forceShutdownTimer.unref();
         try {
             shutdownBackupService();
+            shutdownAttachmentJanitor();
             triggerService.shutdown();
             workflowService.shutdown();
             await shutdownIntegrations();

package/dist/src/packages/server/integrations/gmail/gmail-client.js

@@ -339,13 +339,24 @@ function parseGmailMessage(msg) {
         }
     }
     extractParts(msg.payload);
-    // Check attachments
+    // Check attachments — capture filename AND the metadata we need to fetch
+    // the bytes later via gmail.users.messages.attachments.get.
     const attachmentNames = [];
+    const attachmentsMeta = [];
     function findAttachments(payload) {
         if (!payload)
             return;
         if (payload.filename && payload.filename.length > 0) {
             attachmentNames.push(payload.filename);
+            const attachmentId = payload.body?.attachmentId;
+            if (attachmentId) {
+                attachmentsMeta.push({
+                    attachmentId,
+                    filename: payload.filename,
+                    mimeType: payload.mimeType || 'application/octet-stream',
+                    size: payload.body?.size ?? 0,
+                });
+            }
         }
         if (payload.parts) {
             for (const part of payload.parts) {
@@ -369,8 +380,78 @@ function parseGmailMessage(msg) {
         labels: msg.labelIds || undefined,
         hasAttachments: attachmentNames.length > 0,
         attachmentNames: attachmentNames.length > 0 ? attachmentNames : undefined,
+        attachmentsMeta: attachmentsMeta.length > 0 ? attachmentsMeta : undefined,
     };
 }
+/**
+ * Download a single Gmail attachment by id and persist it to disk under
+ * `<TEMP_DIR>/triggers/gmail/<messageId>/<sanitized-filename>`. Mirrors what
+ * the WA/Slack pipelines do with `attachment-downloader.downloadAttachment`,
+ * but Gmail's binary doesn't come from a URL — it comes from the SDK call
+ * `gmail.users.messages.attachments.get` which returns base64url-encoded
+ * bytes. Hard 25 MB cap, idempotent, never throws.
+ */
+export async function downloadGmailAttachment(messageId, meta) {
+    if (!gmail) {
+        ctx?.log.warn('Gmail not authenticated — skipping attachment download');
+        return null;
+    }
+    // Lazy-import the shared cap + temp root so we keep one source of truth.
+    const { MAX_ATTACHMENT_BYTES, TRIGGER_ATTACHMENT_ROOT } = await import('../../services/attachment-downloader.js');
+    if (meta.size > MAX_ATTACHMENT_BYTES) {
+        ctx?.log.warn(`Gmail attachment ${meta.filename} (${meta.size}B) exceeds cap; skipping`);
+        return null;
+    }
+    const path = await import('path');
+    const fs = await import('fs/promises');
+    // Sanitize segments the same way attachment-downloader does — strip
+    // path separators / `..` / control chars so a hostile filename can't
+    // escape the trigger dir.
+    const safe = (s) => s.replace(/[\\/\x00-\x1f\x7f]/g, '_').replace(/\.{2,}/g, '_').slice(0, 200) || 'file';
+    const targetDir = path.join(TRIGGER_ATTACHMENT_ROOT, 'gmail', safe(messageId));
+    const finalName = safe(meta.filename) || 'file';
+    const targetPath = path.join(targetDir, finalName);
+    // Idempotency: if a file with the expected size already lives at the
+    // target path, skip the network round-trip.
+    try {
+        const st = await fs.stat(targetPath);
+        if (st.isFile() && (meta.size === 0 || st.size === meta.size)) {
+            return { path: targetPath, bytesOnDisk: st.size, filename: finalName, mimeType: meta.mimeType };
+        }
+    }
+    catch { /* not cached */ }
+    await fs.mkdir(targetDir, { recursive: true });
+    let res;
+    try {
+        res = await gmail.users.messages.attachments.get({
+            userId: 'me',
+            messageId,
+            id: meta.attachmentId,
+        });
+    }
+    catch (err) {
+        ctx?.log.warn(`Gmail attachments.get failed for ${meta.filename}: ${err}`);
+        return null;
+    }
+    const b64 = res.data?.data;
+    if (!b64) {
+        ctx?.log.warn(`Gmail attachment ${meta.filename} returned empty data`);
+        return null;
+    }
+    const buf = Buffer.from(b64, 'base64url');
+    if (buf.byteLength > MAX_ATTACHMENT_BYTES) {
+        ctx?.log.warn(`Gmail attachment ${meta.filename} decoded to ${buf.byteLength}B (exceeds cap)`);
+        return null;
+    }
+    try {
+        await fs.writeFile(targetPath, buf);
+    }
+    catch (err) {
+        ctx?.log.warn(`Gmail attachment write failed for ${targetPath}: ${err}`);
+        return null;
+    }
+    return { path: targetPath, bytesOnDisk: buf.byteLength, filename: finalName, mimeType: meta.mimeType };
+}
 export async function getThread(threadId) {
     if (!gmail)
         throw new Error('Gmail not authenticated');

package/dist/src/packages/server/integrations/gmail/gmail-trigger-handler.js

@@ -4,11 +4,37 @@
  * Delegates event listening to gmail-client's polling and onNewMessage callback.
  */
 import * as gmailClient from './gmail-client.js';
+import { formatAttachmentLine } from '../../services/attachment-downloader.js';
+/** Labels we always drop unless the trigger explicitly opts in. Gmail tags
+ *  these on messages the user has already classified as junk. */
+const ALWAYS_DROP_LABELS = new Set(['SPAM', 'TRASH']);
 let unsubscribe = null;
 export const gmailTriggerHandler = {
     triggerType: 'email',
     async startListening(onEvent) {
-        unsubscribe = gmailClient.onNewMessage((message) => {
+        unsubscribe = gmailClient.onNewMessage(async (message) => {
+            // Download any attachments BEFORE we hand the event to the trigger
+            // service so `{{email.attachmentsBlock}}` is populated when the
+            // template renders. Mirrors the WA/Slack pipelines — the agent gets
+            // a local path it can open with the Read tool, not just a filename.
+            if (message.attachmentsMeta && message.attachmentsMeta.length > 0) {
+                const downloaded = [];
+                for (const meta of message.attachmentsMeta) {
+                    const result = await gmailClient.downloadGmailAttachment(message.messageId, meta);
+                    if (result) {
+                        downloaded.push({
+                            ...meta,
+                            filename: result.filename,
+                            mimeType: result.mimeType,
+                            path: result.path,
+                            bytesOnDisk: result.bytesOnDisk,
+                        });
+                    }
+                }
+                if (downloaded.length > 0) {
+                    message.downloadedAttachments = downloaded;
+                }
+            }
             onEvent({
                 source: 'email',
                 type: 'message',
@@ -26,6 +52,24 @@ export const gmailTriggerHandler = {
     structuralMatch(trigger, event) {
         const msg = event.data;
         const config = trigger.config;
+        const labels = msg.labels ?? [];
+        // Always drop SPAM / TRASH unless this trigger explicitly opted in to
+        // spam delivery. Saves the cost of LLM evaluation / agent prompts for
+        // junk that the user has already classified.
+        if (!config.includeSpam) {
+            for (const lbl of labels) {
+                if (ALWAYS_DROP_LABELS.has(lbl))
+                    return false;
+            }
+        }
+        // Per-trigger extra exclusions (e.g. CATEGORY_PROMOTIONS).
+        if (config.excludeLabels?.length) {
+            const exclude = new Set(config.excludeLabels);
+            for (const lbl of labels) {
+                if (exclude.has(lbl))
+                    return false;
+            }
+        }
         if (config.fromFilter?.length) {
             const fromLower = msg.from.toLowerCase();
             if (!config.fromFilter.some(f => fromLower.includes(f.toLowerCase())))
@@ -51,6 +95,19 @@ export const gmailTriggerHandler = {
         // Gmail tags sent messages with the SENT label. Anything else is treated
         // as inbound (covers INBOX, drafts, all-mail, etc.).
         const direction = labels.includes('SENT') ? 'outbound' : 'inbound';
+        // Build the attachments block from the downloaded files. Each line is
+        // shaped the same way as the WA / Slack pipelines so the existing
+        // `AttachmentChip` parser on the frontend picks them up unchanged.
+        const downloaded = msg.downloadedAttachments ?? [];
+        const attachmentsBlock = downloaded
+            .map((a) => formatAttachmentLine({
+            path: a.path,
+            filename: a.filename,
+            mimetype: a.mimeType,
+            size: a.bytesOnDisk,
+            sourceUrl: `gmail://attachment/${msg.messageId}/${a.attachmentId}`,
+        }))
+            .join('\n');
         return {
             'email.from': msg.from,
             'email.to': msg.to.join(', '),
@@ -61,6 +118,9 @@ export const gmailTriggerHandler = {
             'email.date': new Date(msg.date).toISOString(),
             'email.hasAttachments': String(msg.hasAttachments),
             'email.attachments': msg.attachmentNames?.join(', ') || '',
+            // New: local downloaded paths + ready-to-render attachment chips block.
+            'email.filePaths': downloaded.map((a) => a.path).join(','),
+            'email.attachmentsBlock': attachmentsBlock,
             'email.direction': direction,
             'email.labels': labels.join(', '),
         };

package/dist/src/packages/server/integrations/slack/slack-config.js

@@ -17,6 +17,7 @@ const DEFAULT_CONFIG = {
     pollingChannelAllowlist: '',
     pollingDmsAlways: true,
     pollingMinMsBetweenCalls: 1500,
+    pollingUseSearch: false,
     mirrorOwnMessages: false,
     currentMode: 'none',
 };
@@ -184,6 +185,14 @@ export const slackConfigSchema = [
         defaultValue: true,
         group: 'Polling',
     },
+    {
+        key: 'pollingUseSearch',
+        label: 'Use search.messages (catches thread replies)',
+        type: 'boolean',
+        description: 'When on, polling uses a single search.messages call per cycle instead of one conversations.history per channel. Catches replies on old threads that the per-channel sweep misses. Allowlist + DM filter still apply. Requires the user (xoxp-) token to have the search:read scope. Default off.',
+        defaultValue: false,
+        group: 'Polling',
+    },
     {
         key: 'mirrorOwnMessages',
         label: 'Mirror messages I send too',
@@ -232,6 +241,7 @@ export function getConfigValues(secrets, instanceId = DEFAULT_INSTANCE_ID) {
         pollingChannelAllowlist: config.pollingChannelAllowlist ?? '',
         pollingDmsAlways: config.pollingDmsAlways ?? true,
         pollingMinMsBetweenCalls: config.pollingMinMsBetweenCalls ?? 1500,
+        pollingUseSearch: config.pollingUseSearch ?? false,
         mirrorOwnMessages: config.mirrorOwnMessages ?? false,
         currentMode: config.currentMode ?? 'none',
         // Mask secret values for UI display
@@ -280,6 +290,9 @@ export async function setConfigValues(values, secrets, instanceId = DEFAULT_INST
     if (typeof values.pollingMinMsBetweenCalls === 'number' && Number.isFinite(values.pollingMinMsBetweenCalls)) {
         updates.pollingMinMsBetweenCalls = Math.max(0, values.pollingMinMsBetweenCalls);
     }
+    if (typeof values.pollingUseSearch === 'boolean') {
+        updates.pollingUseSearch = values.pollingUseSearch;
+    }
     if (typeof values.mirrorOwnMessages === 'boolean') {
         updates.mirrorOwnMessages = values.mirrorOwnMessages;
     }

package/dist/src/packages/server/integrations/slack/slack-instance.js

@@ -14,6 +14,7 @@ import * as os from 'node:os';
 import path from 'node:path';
 import { LogLevel, WebClient } from '@slack/web-api';
 import { SocketModeClient } from '@slack/socket-mode';
+import { downloadAttachment, MAX_ATTACHMENT_BYTES } from '../../services/attachment-downloader.js';
 import { instanceSecretKey, loadConfig, resolveAuthMode, updateConfig } from './slack-config.js';
 import { SlackPollingClient, asPollingWebClient } from './slack-polling-client.js';
 import { SlackWatermarkStore } from './slack-watermark-store.js';
@@ -183,6 +184,7 @@ export class SlackInstance {
             allowlistChannelIds,
             keepAllDms: config.pollingDmsAlways !== false,
             minMsBetweenCalls: config.pollingMinMsBetweenCalls ?? 1500,
+            useSearch: config.pollingUseSearch === true,
         });
         this.pollingClient.setOnFatalError((reason) => {
             updateConfig({ status: 'error', lastError: reason }, this.id);
@@ -287,6 +289,20 @@ export class SlackInstance {
         const files = hasFiles
             ? event.files.map((f) => normalizeSlackFile(f))
             : undefined;
+        // Download any attached files locally so triggered agents can read them
+        // directly with the Read tool (no need to re-fetch via Slack auth).
+        //
+        // We download regardless of direction. Earlier this branch had an
+        // `!isOwnMessage` filter, which broke the real-world case: when a Slack
+        // user uploads a file from their OWN workspace account (the one that
+        // owns the xoxp- token), Slack reports `direction='outbound'` and the
+        // attachment was silently skipped. Same root cause as the inbound-only
+        // filter that bit us on WhatsApp. If the bot itself (chat.postMessage
+        // with files) is the originator the echo lands here too — that self-
+        // fetch is benign and bounded by the 25 MB cap and the 24 h janitor.
+        const { attachmentPaths, skippedAttachments } = files && files.length > 0
+            ? await this.downloadInboundFiles(event.ts, files)
+            : { attachmentPaths: undefined, skippedAttachments: undefined };
         const message = {
             ts: event.ts,
             threadTs: event.thread_ts,
@@ -297,6 +313,8 @@ export class SlackInstance {
             text,
             timestamp: parseSlackTs(event.ts),
             files,
+            attachmentPaths,
+            skippedAttachments,
             isOwnMessage,
         };
         const direction = isOwnMessage ? 'outbound' : 'inbound';
@@ -358,6 +376,78 @@ export class SlackInstance {
             waiter.resolve(message);
         }
     }
+    /**
+     * Download up to MAX_INBOUND_FILES_PER_MESSAGE files locally so triggered
+     * agents can read them with the Read tool. Files beyond the cap, or whose
+     * size hint exceeds the 25 MB cap, are recorded under `skippedAttachments`.
+     * Never throws.
+     */
+    async downloadInboundFiles(messageTs, files) {
+        const MAX_INBOUND_FILES_PER_MESSAGE = 10;
+        const token = this.getSecret('SLACK_BOT_TOKEN');
+        if (!token) {
+            this.ctx?.log.warn(`Slack[${this.id}] cannot download inbound files — SLACK_BOT_TOKEN not configured`);
+            return { attachmentPaths: undefined, skippedAttachments: undefined };
+        }
+        const downloaded = [];
+        const skipped = [];
+        for (let i = 0; i < files.length; i++) {
+            const file = files[i];
+            if (i >= MAX_INBOUND_FILES_PER_MESSAGE) {
+                this.ctx?.log.info(`Slack[${this.id}] skipping file ${i + 1}/${files.length} — exceeds per-message cap`);
+                skipped.push({
+                    reason: 'unsupported',
+                    filename: file.name,
+                    size: file.size,
+                    detail: 'per-message cap (10 files)',
+                });
+                continue;
+            }
+            const url = file.url_private_download ?? file.url_private;
+            if (!url) {
+                skipped.push({
+                    reason: 'fetch-failed',
+                    filename: file.name,
+                    size: file.size,
+                    detail: 'no url_private',
+                });
+                continue;
+            }
+            if (typeof file.size === 'number' && file.size > MAX_ATTACHMENT_BYTES) {
+                skipped.push({
+                    reason: 'too-large',
+                    filename: file.name,
+                    size: file.size,
+                    sourceUrl: url,
+                });
+                continue;
+            }
+            const result = await downloadAttachment({
+                source: 'slack',
+                messageId: `${messageTs}-${file.id}`,
+                url,
+                headers: { Authorization: `Bearer ${token}` },
+                suggestedFilename: file.name,
+                mimetype: file.mimetype,
+                sizeHintBytes: file.size,
+            });
+            if (result) {
+                downloaded.push(result);
+            }
+            else {
+                skipped.push({
+                    reason: 'fetch-failed',
+                    filename: file.name,
+                    size: file.size,
+                    sourceUrl: url,
+                });
+            }
+        }
+        return {
+            attachmentPaths: downloaded.length > 0 ? downloaded : undefined,
+            skippedAttachments: skipped.length > 0 ? skipped : undefined,
+        };
+    }
     // ─── Sending ───
     async sendMessage(params) {
         if (!this.webClient)