feat(slack): forward inbound files and images to the agent - #7812

Closes #7087

The Slack sidecar was text-only on the inbound side. A message carrying an upload arrives with subtype file_share, and the subtype filter in parse_slack_event dropped every subtype other than message_changed, so the user's image or clip was discarded before any content parsing ran.

Changes

• sdk/python/librefang/sidecar/adapters/slack.py

  • file_share now shares the bare-message arm; every other subtype is still dropped.
  • New parse_slack_files / _file_content map a message's files array onto Content.image / Content.video / Content.audio / Content.file, keyed on mimetype, carrying url_private_download and using the message text as the caption. duration_ms becomes duration_seconds for video / audio.
  • One attachment per message (the wire carries one ChannelContent), extras counted in a warning; the attachment outranks the message text including a slash command. Both match the discord sidecar's precedent.
  • An upload with no comment is now a complete message: the empty-text drop only applies when there is no eligible attachment.
  • SlackFilePolicy holds the gate: SLACK_FILE_DOWNLOADS (bool, default true), SLACK_FILE_MAX_BYTES (default 10 MiB, the same cap as the outbound upload path), SLACK_FILE_ALLOWED_EXTENSIONS (empty = allow all, matching the SLACK_ALLOWED_CHANNELS convention already in this file), and the SLACK_FILE_DOWNLOAD_CHANNELS allow-list / SLACK_FILE_DOWNLOAD_EXCLUDE_CHANNELS deny-list pair. A non-integer SLACK_FILE_MAX_BYTES exits 2, following the TWITCH_RATE_LIMIT_* precedent; a value below 1 falls back to the default with a warning.
  • Files whose mode is tombstone or hidden_by_limit are refused — their url_private no longer serves bytes, and letting the daemon try only puts a [File download failed] line in the prompt.
  • All five knobs are declared as SCHEMA fields so the dashboard renders them.

• Credential handling. url_private_download 302s to a login page without the bot token, so the daemon needs it. The adapter declares header_rules for Slack's own file hosts (files.slack.com, slack-files.com); the daemon's fetch_headers_for (crates/librefang-channels/src/sidecar.rs) exact-matches the request host against those rules and attaches nothing for any other host. _is_slack_file_url applies the same pin adapter-side, refusing non-HTTPS URLs and URLs carrying userinfo (https://files.slack.com@evil.example/x resolves to evil.example), so a file registered through files.remote.add with a member-chosen url_private is never forwarded at all. The rules are only declared when forwarding is enabled, so SLACK_FILE_DOWNLOADS=false does not ship the token to the daemon.

• Why the URL and not the bytes. download_media_blocks in crates/librefang-channels/src/bridge.rs is what turns an inbound Image / File / Voice / Audio / Video URL into a vision image block, an audio transcription or a saved document path. Its match has no FileData arm (_ => None at bridge.rs:5873), and the inbound text arm renders FileData as [User sent a local file: …] (bridge.rs:4412), so an adapter that inlines inbound bytes delivers a placeholder and discards the payload. Forwarding the URL with a host-pinned auth rule is the mechanism the matrix sidecar already uses for MSC3916 media, and it needs no kernel change.

• Deliberately not followed: link-unfurl attachments[].image_url. That is preview metadata for a URL somebody pasted, not an upload, and following it would point the daemon at an arbitrary host. Noted in the module docstring.

• Docs: architecture note on header_rules and why inbound FileData is a dead end (docs/architecture/sidecar-channels.md); a "User Uploads" section, the files:read scope and the five env vars in the en and zh channel pages.

• Changelog fragment: changelog.d/added/7087-slack-inbound-attachments.md.

Verification

cd sdk/python && python3 -m pytest tests -q — 2044 passed (was 2016 before this branch; 28 new cases). This is the exact invocation of CI's Python SDK Tests job (.github/workflows/ci.yml, working-directory: sdk/python, python -m pytest tests -q).

cd sdk/python && python3 -m pytest tests/test_slack_adapter.py -q — 185 passed.

New tests in sdk/python/tests/test_slack_adapter.py, all against the pure parse_slack_event / parse_slack_files entry points:

• test_parse_event_file_share_emits_image_content — a file_share event produces {"Image": {url, caption, mime_type}} with routing metadata unchanged.
• test_parse_event_file_share_video_and_audio_and_document_variants — mimetype dispatch and duration_ms → duration_seconds.
• test_parse_event_file_share_oversize_is_rejected, test_parse_event_file_share_oversize_keeps_the_companion_text — the size cap, and proof a rejected attachment does not swallow the text the user typed with it.
• test_parse_event_file_share_disallowed_extension_is_rejected, ..._allowed_extension_passes, ..._extension_falls_back_to_filetype.
• test_parse_event_file_share_download_switch_off_drops_the_file, ..._per_channel_exclude_list, ..._per_channel_allow_list.
• test_inbound_attachment_parsing_performs_no_http — replaces _public_http_request and _http_request with a function that raises, then parses with the switch on and off: the adapter never fetches an inbound file itself.
• test_parse_event_file_share_rejects_non_slack_host — an attacker host, a suffix lookalike (files.slack.com.evil.example), the userinfo trick and plain HTTP are all refused.
• test_header_rules_pin_the_bot_token_to_slack_file_hosts, test_header_rules_absent_when_downloads_are_disabled (asserts the token string appears nowhere in the ready event), test_header_rules_surface_in_the_ready_event, test_is_slack_file_url_host_pinning — the token is declared only for Slack file hosts.
• test_parse_event_file_share_dropped_without_a_policy, test_parse_event_other_subtypes_are_still_dropped, test_parse_event_file_share_still_honours_self_skip_and_channel_filter — no behaviour change for callers that pass no policy, and the existing filters still apply.
• test_file_policy_defaults, test_file_policy_env_parsing, test_file_max_bytes_non_integer_exits_2, test_file_max_bytes_below_one_falls_back_to_default.

No cargo command was run: this branch touches no Rust source.

Left out

• Multi-file uploads deliver one attachment. The wire protocol carries one ChannelContent per message; Content.media_group exists but the inbound bridge has no MediaGroup arm in download_media_blocks, so it would land as a [Media group: N items] placeholder. Extras are logged rather than silently dropped.
• A non-media file loses its companion text. ChannelContent::File has no caption field, so Content.file cannot carry the message. Warned at the boundary, same as the discord sidecar. Giving File a caption is a change to crates/librefang-channels/src/types.rs and every adapter that constructs it — a different crate, so it is not folded in here.
• Attachments with an unknown size (external files sometimes omit it) are accepted; the daemon's own channels_download_max_bytes still bounds the fetch.