slack-agent-cli v0.3.0

slack-agent-cli v0.3.0

Read and download files attached to messages in allowlisted Slack conversations,
including videos and attachments in thread replies.

Message history and thread results now include a typed files array. Use the
file ID and containing message timestamp to inspect or download an attachment:

slack-agent-cli files get F123 --profile NAME \
  --conversation-id C123 --message-ts 1234567890.123456
slack-agent-cli files download F123 --profile NAME \
  --conversation-id C123 --message-ts 1234567890.123456 \
  --output /absolute/path/video.mp4

For a reply attachment, include --thread-ts PARENT_TS. Each command verifies
the exact message attachment and the profile's read policy before files.info.
Downloads support hosted files in the selected workspace, up to 250 MiB within
two minutes. External files, remote-workspace downloads, query URLs and redirects
are rejected. Existing local paths are never overwritten; output remains a v1
JSON envelope with untrusted metadata, the saved path, byte count and SHA-256.

Existing installations

All five provisioning manifests now include files:read. Updating the binary
alone does not grant this Slack scope. The operator must reauthorize/reinstall
the app with the new scope and import its token with auth login for the exact
profile. Re-login changes credential generation and invalidates old policies.

Review the full read target set, preview it with auth allow-reads set --reset-stale-policy --dry-run, and apply the exact set with --yes. This clears
old write targets, which must be rebuilt separately. A channel absent from the
allowlist still needs explicit authorization.

Install

brew update
brew upgrade slack-agent-cli

Or install from source with Go 1.25.14 or newer:

go install github.com/abigotado/slack-agent-cli/cmd/slack-agent-cli@v0.3.0

The release includes a deterministic source archive, release-manifest.json,
and SHA256SUMS. The machine envelope remains version 1; all file fields,
commands, limits and the files.info route are additive.

Enterprise Grid E-owned file download paths are currently unsupported; the
validated file path must belong to the selected T-workspace. Downloads use
atomic no-overwrite rename on macOS/Linux and require filesystem support.
Local write errors and unsupported response content are non-retryable; cleanup
failures preserve the primary error and add a safe hint.