v2.6.0

Upgrade notes

• download no longer takes destDir (breaking). Files are saved into the exchange directory, ~/.local/share/slack-mcp/exchange by default (SLACK_MCP_EXCHANGE_DIR overrides it; client config only). filename= is a bare name; a taken name is saved as name (n).ext and the result says so.
• The log moved, and SLACK_MCP_DEBUG is gone. stdio logs to ~/.local/state/slack-mcp/slack-mcp.log (SLACK_MCP_LOG_FILE overrides it; /dev/null discards). Log lines never carry tokens, cookies, or whole responses.
• Restart every running server after upgrading. Older binaries don't understand the new pending-request records, so an old process left running could hand the agent a request ID that has been replaced.
• New settings, client config only: SLACK_MCP_IDENTITY (human|agent, default human) and SLACK_MCP_SAFETY (strict|soft, default strict). An unknown value refuses to start.

Outbound safety (ADR-013, ADR-014)

Everything say sends is now checked before it reaches Slack, in this order: the strike lock, the local file checks, the destination's quarantine, a secret scanner, and an approval gate.

• Secret scanner on message text, file names, and file contents: Slack tokens, cookies, and webhooks, AWS keys, GitHub tokens, model API keys, JWTs, private keys, credentials in URLs, and .env-style secrets. A match blocks the send, counts a strike, and can quarantine the destination. At the strike limit (2 under strict, 3 under soft) the strike lock engages: every say and mark-read is refused until you clear it.
• Approval gate for a destination outside your organization, or a file downloaded from one conversation and attached in another. Nothing is sent until you approve.
• Operator CLI: slack-mcp quarantine list|clear, slack-mcp approve [id], slack-mcp deny id, slack-mcp trust add|list|remove.
• New unlock tool: opens a one-time page in your browser, on 127.0.0.1, listing each quarantine and the strike lock with why it was set. Tick what to clear and press Clear, or Done to close; either one shuts the page. The agent never receives the link and isn't told what you cleared. This is the default path for desktop clients without a terminal; unattended or strict deployments can deny the agent this tool.
• mark-read is refused at a quarantined destination and never opens a DM.
• A read-only banner on inbox, messages, estate, and batch says when writes are locked or quarantined.

New

• say files=: attach up to 10 files from the exchange directory to one message, with text as the comment.
• messages search filters: in, from, after, before, has (link, pin, :emoji:), and thread, resolved by name and composed onto query=.
• Reactions validate the emoji name before anything is sent.

Fixed

• inbox view='new' reported "Thread feed unreadable" on every check; threads with new replies are reported again.
• messages target='@me' reads your self-DM; a bare @person reads that person's DM.
• Group DMs are named by their people ("group: alice, bob") everywhere, never by Slack's mpdm-… name.
• mark-read in a channel you're not in says so by name; bulk failures name the conversation, never its ID.
• estate view='channels': an explicit filter=member holds during a search, and the echo states the effective filter.
• Unread DMs show the newest five messages.
• The test suite no longer writes into the real data, state, or log directories.

What's Changed

• fix(log): never log credentials; move the log to a private state file by @aaronsb in #124
• feat(messages): structured search filters (in, from, after, before, has, thread) by @aaronsb in #123
• docs(adr): ADR-013 trusted destinations by @aaronsb in #122
• docs: align ADRs, README, and mcpb manifest with main (#96) by @aaronsb in #130
• feat(scanner): outbound secret scanner (ADR-013) by @aaronsb in #127
• feat(safety): outbound-safety state, posture settings, and operator CLI by @aaronsb in #128
• feat(exchange): exchange directory and download through it (ADR-012) by @aaronsb in #125
• feat(say): attach files from the exchange directory (#92) by @aaronsb in #126
• feat(safety): wire scanner and safety gate into write paths by @aaronsb in #131
• fix: live-check findings (thread feed, test isolation, naming, @me) by @aaronsb in #134
• fix: #134 review follow-ups (client log injection, @ reads, group DM labels) by @aaronsb in #135
• feat(unlock): local page to clear quarantines and the strike lock (#132) by @aaronsb in #133
• fix(unlock): no empty name or brackets in the clear log line by @aaronsb in #136

Full Changelog: v2.5.0...v2.6.0