claude-threads 1.13.0 → 1.14.0

package/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.14.0] - 2026-05-05
+
+### Changed
+- **`read_post` allows cross-channel reads on public Mattermost channels.** The cross-channel guard kept rejecting permalinks that pointed outside the bot's session channel — appropriate for private/DM/group channels (real privacy concern: a thread participant without access to the source channel sees content they shouldn't), but overzealous for public channels where anyone with an account can already navigate to the post. `McpPost` now carries a `channelType?: 'public' | 'private'` field, populated for Mattermost via `/channels/{id}` (type `O` = public; `P`/`D`/`G` = private) with a per-process cache so chatty threads don't trigger N redundant lookups. The resolver skips the wrong-channel check when `channelType === 'public'`; missing `channelType` is treated as private (fail-safe). Slack is unchanged: its MCP-side `readPost` is hard-scoped to the bot's configured channel via `conversations.history`, so cross-channel reads aren't possible there regardless of channel visibility. (#369)
+
+## [1.13.1] - 2026-05-05
+
+### Fixed
+- **`read_post` works on Mattermost subpath installs.** `parseMattermostPermalink` matched only on origin and ignored the configured baseUrl path, so on a Mattermost install at `/chat` (e.g. `digilab.overheid.nl/chat`) every permalink had a leading `/chat` segment that pushed the path to four segments and got rejected with "not a Mattermost permalink for ..." even though the link was on the bot's own instance. The parser now strips the configured subpath as a path-segment prefix before validating the `{team}/pl/{id}` or `_redirect/pl/{id}` shape; segment-level comparison so `/chat` doesn't accidentally match `/chatter`. Regression from #366. (#368)
+
 ## [1.13.0] - 2026-05-05
 
 ### Added

package/dist/index.js

@@ -51783,6 +51783,14 @@ async function getPostRaw(config, postId) {
     return null;
   }
 }
+async function getChannelRaw(config, channelId) {
+  try {
+    return await mattermostApi(config, "GET", `/channels/${channelId}`);
+  } catch (err) {
+    apiLog.debug(`Failed to get channel ${channelId}: ${err}`);
+    return null;
+  }
+}
 async function getThreadRaw(config, threadRootId) {
   try {
     return await mattermostApi(config, "GET", `/posts/${threadRootId}/thread`);
@@ -51820,6 +51828,7 @@ class MattermostMcpPlatformApi {
   config;
   formatter = new MattermostFormatter;
   botUserIdCache = null;
+  channelTypeCache = new Map;
   constructor(config) {
     this.config = config;
     this.apiConfig = {
@@ -51960,7 +51969,19 @@ class MattermostMcpPlatformApi {
     if (!post)
       return null;
     const username = post.user_id ? await this.getUsername(post.user_id) : null;
-    return toMcpPost(post, username);
+    const channelType = await this.getChannelType(post.channel_id);
+    return toMcpPost(post, username, channelType);
+  }
+  async getChannelType(channelId) {
+    const cached = this.channelTypeCache.get(channelId);
+    if (cached)
+      return cached;
+    const channel = await getChannelRaw(this.apiConfig, channelId);
+    if (!channel)
+      return;
+    const visibility = channel.type === "O" ? "public" : "private";
+    this.channelTypeCache.set(channelId, visibility);
+    return visibility;
   }
   async readThread(threadRootId, options) {
     mcpLogger.debug(`readThread: ${formatShortId(threadRootId)}`);
@@ -51975,10 +51996,11 @@ class MattermostMcpPlatformApi {
         usernameByUserId.set(p.user_id, await this.getUsername(p.user_id));
       }
     }
-    return limited.map((p) => toMcpPost(p, p.user_id ? usernameByUserId.get(p.user_id) ?? null : null));
+    const channelType = limited[0] ? await this.getChannelType(limited[0].channel_id) : undefined;
+    return limited.map((p) => toMcpPost(p, p.user_id ? usernameByUserId.get(p.user_id) ?? null : null, channelType));
   }
 }
-function toMcpPost(post, username) {
+function toMcpPost(post, username, channelType) {
   return {
     id: post.id,
     channelId: post.channel_id,
@@ -51986,7 +52008,8 @@ function toMcpPost(post, username) {
     username,
     message: post.message,
     createAt: post.create_at ?? 0,
-    threadRootId: post.root_id || undefined
+    threadRootId: post.root_id || undefined,
+    channelType
   };
 }
 

package/dist/mcp/mcp-server.js

@@ -56086,6 +56086,14 @@ async function getPostRaw(config3, postId) {
     return null;
   }
 }
+async function getChannelRaw(config3, channelId) {
+  try {
+    return await mattermostApi(config3, "GET", `/channels/${channelId}`);
+  } catch (err) {
+    apiLog.debug(`Failed to get channel ${channelId}: ${err}`);
+    return null;
+  }
+}
 async function getThreadRaw(config3, threadRootId) {
   try {
     return await mattermostApi(config3, "GET", `/posts/${threadRootId}/thread`);
@@ -56123,6 +56131,7 @@ class MattermostMcpPlatformApi {
   config;
   formatter = new MattermostFormatter;
   botUserIdCache = null;
+  channelTypeCache = new Map;
   constructor(config3) {
     this.config = config3;
     this.apiConfig = {
@@ -56263,7 +56272,19 @@ class MattermostMcpPlatformApi {
     if (!post2)
       return null;
     const username = post2.user_id ? await this.getUsername(post2.user_id) : null;
-    return toMcpPost(post2, username);
+    const channelType = await this.getChannelType(post2.channel_id);
+    return toMcpPost(post2, username, channelType);
+  }
+  async getChannelType(channelId) {
+    const cached3 = this.channelTypeCache.get(channelId);
+    if (cached3)
+      return cached3;
+    const channel = await getChannelRaw(this.apiConfig, channelId);
+    if (!channel)
+      return;
+    const visibility = channel.type === "O" ? "public" : "private";
+    this.channelTypeCache.set(channelId, visibility);
+    return visibility;
   }
   async readThread(threadRootId, options) {
     mcpLogger.debug(`readThread: ${formatShortId(threadRootId)}`);
@@ -56278,10 +56299,11 @@ class MattermostMcpPlatformApi {
         usernameByUserId.set(p.user_id, await this.getUsername(p.user_id));
       }
     }
-    return limited.map((p) => toMcpPost(p, p.user_id ? usernameByUserId.get(p.user_id) ?? null : null));
+    const channelType = limited[0] ? await this.getChannelType(limited[0].channel_id) : undefined;
+    return limited.map((p) => toMcpPost(p, p.user_id ? usernameByUserId.get(p.user_id) ?? null : null, channelType));
   }
 }
-function toMcpPost(post2, username) {
+function toMcpPost(post2, username, channelType) {
   return {
     id: post2.id,
     channelId: post2.channel_id,
@@ -56289,7 +56311,8 @@ function toMcpPost(post2, username) {
     username,
     message: post2.message,
     createAt: post2.create_at ?? 0,
-    threadRootId: post2.root_id || undefined
+    threadRootId: post2.root_id || undefined,
+    channelType
   };
 }
 function createMattermostMcpPlatformApi(config3) {
@@ -56868,7 +56891,13 @@ function parseMattermostPermalink(url2, baseUrl) {
   if (parsed.origin !== base.origin) {
     return null;
   }
-  const segments = parsed.pathname.replace(/^\/+|\/+$/g, "").split("/");
+  const baseSegments = base.pathname.replace(/^\/+|\/+$/g, "").split("/").filter(Boolean);
+  const allSegments = parsed.pathname.replace(/^\/+|\/+$/g, "").split("/");
+  for (let i2 = 0;i2 < baseSegments.length; i2++) {
+    if (allSegments[i2] !== baseSegments[i2])
+      return null;
+  }
+  const segments = allSegments.slice(baseSegments.length);
   if (segments.length !== 3)
     return null;
   if (segments[1] !== "pl")
@@ -56890,7 +56919,7 @@ async function resolvePermalink(api3, postId, botChannelId, opts = {}) {
   if (!post2) {
     return { ok: false, error: { kind: "not-found" } };
   }
-  if (botChannelId !== undefined && post2.channelId !== botChannelId) {
+  if (botChannelId !== undefined && post2.channelId !== botChannelId && post2.channelType !== "public") {
     return { ok: false, error: { kind: "wrong-channel" } };
   }
   if (!opts.includeThread) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-threads",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "description": "Share Claude Code sessions live in a Mattermost channel with interactive features",
   "main": "dist/index.js",
   "type": "module",