claude-threads 1.17.2 → 1.18.0

package/CHANGELOG.md

@@ -5,9 +5,23 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [1.18.0] - 2026-07-17
 
-## [1.17.2] - 2026-06-19
+### Added
+- **Multi-account pool balances new sessions by real subscription usage.** When a Claude account pool is configured, new sessions used to be spread by round-robin / sticky-by-thread, which ignores how much of each account's rate limit has actually been consumed — a nearly-capped account was as likely to be picked as a fresh one. The pool now routes each new session to the account with the most headroom: at session start the bot probes every account's live limits with `claude -p "/usage" --output-format json` (runs zero turns, costs $0) under that account's `HOME`, parses the reported percentages, and selects the lowest `max(session%, week%)` non-cooling account. Probing is on-demand and synchronous — an idle bot probes nothing — with a short hot-path deadline, in-flight coalescing, and a brief result cache so a burst of concurrent starts triggers a single set of probes rather than one per start. In-flight sessions add a small provisional load penalty so a burst spreads across accounts instead of piling onto the single lowest one, and a rotating cursor breaks exact ties. A failed/timed-out/unparseable probe marks that account "usage unknown" so it sorts last (routing around a logged-out OAuth account, whose auth error never triggers rate-limit cooldown); if every account is unknown, selection degrades gracefully to round-robin. Resume is unaffected — it still re-binds to the persisted `claudeAccountId` so a session resumes under the `HOME` its history lives in. Targets OAuth (subscription) accounts; API-key accounts have no `/usage` limits and sort as unknown. The channel sticky message now shows the pool's `min–max % used` range. (#419)
+
+### Fixed
+- **`react_to_post` now targets the message that triggered it, not the thread root.** The only permalink ever exposed to the model was the thread-root URL injected once into the system prompt, so any reaction the bot placed to acknowledge a specific user message — e.g. the "👀 acknowledge task" convention — always landed on the first post of the thread instead of the message that prompted it. Each incoming follow-up message now carries its own permalink (`PlatformClient.getPostPermalink()`, added for both Mattermost and Slack), so `react_to_post` can target the exact message. (#422, #429)
+
+## [1.17.3] - 2026-07-01
+
+### Dependencies
+- **Production:** `@hono/node-server` 2.0.5 → 2.0.6, `hono` 4.12.26 → 4.12.27, `semver` 7.8.4 → 7.8.5. (#417)
+- **Dev:** `@types/node` 25 → 26, `typescript-eslint` 8.61.1 → 8.62.1. (#416)
+
+### Changed
+- **Held `js-yaml` on 4.x and added a dependabot ignore for `js-yaml >=5.0.0`.** Dependabot grouped a `js-yaml` 4.x → 5.x major into the production bump, but 5.x is ESM-only and dropped the CommonJS `default` export, breaking our `import yaml from 'js-yaml'` call sites with `Missing 'default' export`. The bump now stays on 4.x until the code migrates to named ESM imports. (#417)
+- **CI:** `actions/checkout` 6 → 7. (#413)
 
 ### Security
 - **`@hono/node-server` 2.0.4 → 2.0.5** to resolve GHSA-frvp-7c67-39w9: on Windows, prefix-mounted Serve Static middleware could be bypassed. Only affects Windows deployments using Serve Static. (#408)