claude-threads 1.16.1 → 1.16.3

package/CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.16.3] - 2026-05-31
+
+### Changed
+- **Fixed the flaky Mattermost integration suite (two independent root causes).** These tests failed intermittently in CI, including on `main`, so this was a pre-existing infra flake rather than a regression. (1) *Channel contention:* every pooled test bot posted into one shared channel, each maintaining its own sticky message; run together the suites flooded that channel and tripped the Mattermost threads write race (`threads_pkey` 500s), surfacing as flaky task-list / context-prompt failures. Each suite now provisions a fresh channel via `initIsolatedTestContext`, routes its bot there, and removes it in `afterAll`, which eliminated the 500 storms. (2) *Leaked bot state across suites:* the bot/session/sticky layer keeps module-level global state (`stickyPostIds`, the session registry, the pool cursor) and live WebSockets, and Bun runs all suite files in one process. A bot whose socket wasn't fully torn down kept processing events into the next suite (posting "Bot Offline" stickies, resuming stale sessions), which broke the sticky suite. CI now runs each suite file in its own process, so process exit clears all shared state by construction. A follow-up also corrected the `should show status indicators` assertion, which required keep-alive indicators that a bypass-mode session-less bot never shows (it only passed before via the leaked state that process isolation removed). Test/CI-only; no runtime behavior changed. (#396, #398, #399)
+
+### Dependencies
+- **Production:** `@hono/node-server` 2.0.3 → 2.0.4, `hono` 4.12.21 → 4.12.23, `semver` 7.8.0 → 7.8.1, `ws` 8.20.1 → 8.21.0. `commander` 14 → 15 was deliberately held back: v15 requires Node ≥ 22.12 (the runtime floor is Node 20) and changes the default behavior of paired `--no-*` options the CLI relies on. (#401)
+- **Dev:** `eslint` 10.4.0 → 10.4.1, `lint-staged`, `typescript-eslint` 8.59.4 → 8.60.0. Lockfile-only. (#400)
+
+## [1.16.2] - 2026-05-31
+
+### Fixed
+- **Sturdier retry budget for the Mattermost post-save race.** Under load Mattermost can return a burst of 500s on `POST /posts` (the threads write race: duplicate key on `threads_pkey` / `app.post.save.app_error`) when several posts stream to the same thread. The retry budget was 3 attempts with plain exponential backoff; a heavy burst exhausted it and dropped a post, which surfaced as flaky task-list / sticky / context-prompt behavior. The budget is now 6 attempts with a capped (2s), equal-jittered backoff. The cap keeps the total wait bounded so a long retry chain can't itself stall things, and the jitter decorrelates concurrent posts that would otherwise re-collide on the same row lock every round. (#394)
+- **Two remaining memory leaks after #351.** First, `MessageManager.dispose()` cleared the post tracker but never called `this.events.removeAllListeners()` on the per-session emitter. Each session attaches a handful of listeners (`question:complete`, `task:update`, `approval:complete`, and the rest), and their closures kept session state reachable after the session ended, so the heap grew with every session. `dispose()` now removes the listeners before resetting. Second, React 19 enables user timing when both `console.timeStamp` and `performance.measure` exist (the case on Node.js 25+), so every component re-render calls `performance.measure()` with a structured-clone'd prop-diff detail that Node buffers indefinitely (~50-205 KB per entry, ~2 GB after a long uptime). Nothing in the bot reads those entries, so a guarded `setInterval` clears them every 60 seconds with `.unref()` so it never blocks a clean exit. (#394)
+
 ## [1.16.1] - 2026-05-22
 
 ### Security