claude-threads 1.13.1 → 1.14.0

package/CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.14.0] - 2026-05-05
+
+### Changed
+- **`read_post` allows cross-channel reads on public Mattermost channels.** The cross-channel guard kept rejecting permalinks that pointed outside the bot's session channel — appropriate for private/DM/group channels (real privacy concern: a thread participant without access to the source channel sees content they shouldn't), but overzealous for public channels where anyone with an account can already navigate to the post. `McpPost` now carries a `channelType?: 'public' | 'private'` field, populated for Mattermost via `/channels/{id}` (type `O` = public; `P`/`D`/`G` = private) with a per-process cache so chatty threads don't trigger N redundant lookups. The resolver skips the wrong-channel check when `channelType === 'public'`; missing `channelType` is treated as private (fail-safe). Slack is unchanged: its MCP-side `readPost` is hard-scoped to the bot's configured channel via `conversations.history`, so cross-channel reads aren't possible there regardless of channel visibility. (#369)
+
 ## [1.13.1] - 2026-05-05
 
 ### Fixed

package/dist/index.js

@@ -51783,6 +51783,14 @@ async function getPostRaw(config, postId) {
     return null;
   }
 }
+async function getChannelRaw(config, channelId) {
+  try {
+    return await mattermostApi(config, "GET", `/channels/${channelId}`);
+  } catch (err) {
+    apiLog.debug(`Failed to get channel ${channelId}: ${err}`);
+    return null;
+  }
+}
 async function getThreadRaw(config, threadRootId) {
   try {
     return await mattermostApi(config, "GET", `/posts/${threadRootId}/thread`);
@@ -51820,6 +51828,7 @@ class MattermostMcpPlatformApi {
   config;
   formatter = new MattermostFormatter;
   botUserIdCache = null;
+  channelTypeCache = new Map;
   constructor(config) {
     this.config = config;
     this.apiConfig = {
@@ -51960,7 +51969,19 @@ class MattermostMcpPlatformApi {
     if (!post)
       return null;
     const username = post.user_id ? await this.getUsername(post.user_id) : null;
-    return toMcpPost(post, username);
+    const channelType = await this.getChannelType(post.channel_id);
+    return toMcpPost(post, username, channelType);
+  }
+  async getChannelType(channelId) {
+    const cached = this.channelTypeCache.get(channelId);
+    if (cached)
+      return cached;
+    const channel = await getChannelRaw(this.apiConfig, channelId);
+    if (!channel)
+      return;
+    const visibility = channel.type === "O" ? "public" : "private";
+    this.channelTypeCache.set(channelId, visibility);
+    return visibility;
   }
   async readThread(threadRootId, options) {
     mcpLogger.debug(`readThread: ${formatShortId(threadRootId)}`);
@@ -51975,10 +51996,11 @@ class MattermostMcpPlatformApi {
         usernameByUserId.set(p.user_id, await this.getUsername(p.user_id));
       }
     }
-    return limited.map((p) => toMcpPost(p, p.user_id ? usernameByUserId.get(p.user_id) ?? null : null));
+    const channelType = limited[0] ? await this.getChannelType(limited[0].channel_id) : undefined;
+    return limited.map((p) => toMcpPost(p, p.user_id ? usernameByUserId.get(p.user_id) ?? null : null, channelType));
   }
 }
-function toMcpPost(post, username) {
+function toMcpPost(post, username, channelType) {
   return {
     id: post.id,
     channelId: post.channel_id,
@@ -51986,7 +52008,8 @@ function toMcpPost(post, username) {
     username,
     message: post.message,
     createAt: post.create_at ?? 0,
-    threadRootId: post.root_id || undefined
+    threadRootId: post.root_id || undefined,
+    channelType
   };
 }
 

package/dist/mcp/mcp-server.js

@@ -56086,6 +56086,14 @@ async function getPostRaw(config3, postId) {
     return null;
   }
 }
+async function getChannelRaw(config3, channelId) {
+  try {
+    return await mattermostApi(config3, "GET", `/channels/${channelId}`);
+  } catch (err) {
+    apiLog.debug(`Failed to get channel ${channelId}: ${err}`);
+    return null;
+  }
+}
 async function getThreadRaw(config3, threadRootId) {
   try {
     return await mattermostApi(config3, "GET", `/posts/${threadRootId}/thread`);
@@ -56123,6 +56131,7 @@ class MattermostMcpPlatformApi {
   config;
   formatter = new MattermostFormatter;
   botUserIdCache = null;
+  channelTypeCache = new Map;
   constructor(config3) {
     this.config = config3;
     this.apiConfig = {
@@ -56263,7 +56272,19 @@ class MattermostMcpPlatformApi {
     if (!post2)
       return null;
     const username = post2.user_id ? await this.getUsername(post2.user_id) : null;
-    return toMcpPost(post2, username);
+    const channelType = await this.getChannelType(post2.channel_id);
+    return toMcpPost(post2, username, channelType);
+  }
+  async getChannelType(channelId) {
+    const cached3 = this.channelTypeCache.get(channelId);
+    if (cached3)
+      return cached3;
+    const channel = await getChannelRaw(this.apiConfig, channelId);
+    if (!channel)
+      return;
+    const visibility = channel.type === "O" ? "public" : "private";
+    this.channelTypeCache.set(channelId, visibility);
+    return visibility;
   }
   async readThread(threadRootId, options) {
     mcpLogger.debug(`readThread: ${formatShortId(threadRootId)}`);
@@ -56278,10 +56299,11 @@ class MattermostMcpPlatformApi {
         usernameByUserId.set(p.user_id, await this.getUsername(p.user_id));
       }
     }
-    return limited.map((p) => toMcpPost(p, p.user_id ? usernameByUserId.get(p.user_id) ?? null : null));
+    const channelType = limited[0] ? await this.getChannelType(limited[0].channel_id) : undefined;
+    return limited.map((p) => toMcpPost(p, p.user_id ? usernameByUserId.get(p.user_id) ?? null : null, channelType));
   }
 }
-function toMcpPost(post2, username) {
+function toMcpPost(post2, username, channelType) {
   return {
     id: post2.id,
     channelId: post2.channel_id,
@@ -56289,7 +56311,8 @@ function toMcpPost(post2, username) {
     username,
     message: post2.message,
     createAt: post2.create_at ?? 0,
-    threadRootId: post2.root_id || undefined
+    threadRootId: post2.root_id || undefined,
+    channelType
   };
 }
 function createMattermostMcpPlatformApi(config3) {
@@ -56896,7 +56919,7 @@ async function resolvePermalink(api3, postId, botChannelId, opts = {}) {
   if (!post2) {
     return { ok: false, error: { kind: "not-found" } };
   }
-  if (botChannelId !== undefined && post2.channelId !== botChannelId) {
+  if (botChannelId !== undefined && post2.channelId !== botChannelId && post2.channelType !== "public") {
     return { ok: false, error: { kind: "wrong-channel" } };
   }
   if (!opts.includeThread) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-threads",
-  "version": "1.13.1",
+  "version": "1.14.0",
   "description": "Share Claude Code sessions live in a Mattermost channel with interactive features",
   "main": "dist/index.js",
   "type": "module",