After the CVE fix in 2026.3.2 added `assertLocalMediaAllowed`
enforcement, all outbound file uploads require files to be under
explicit allowed directories. The Feishu plugin was patched (#27884)
but Slack was not, causing all local file uploads to fail with
`LocalMediaAccessError("path-not-allowed")`.
The fix propagates `mediaLocalRoots` through the three-layer call
chain:
1. slack.actions.ts: pass `ctx.mediaLocalRoots` into handleSlackAction
2. slack-actions.ts: add `mediaLocalRoots` to SlackActionContext,
forward to sendSlackMessage
3. actions.ts: accept and pass `mediaLocalRoots` to sendMessageSlack
(which already supports it)
Fixes#36477
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
604d8c4e41