claude-threads 1.18.1 → 1.18.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +28 -0
- package/README.md +78 -57
- package/dist/index.js +3864 -3472
- package/dist/mcp/mcp-server.js +3020 -2462
- package/docs/CONFIGURATION.md +98 -13
- package/docs/MCP-TOOLS.md +107 -0
- package/package.json +18 -11
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,34 @@ All notable changes to this project will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [1.18.4] - 2026-07-27
|
|
9
|
+
|
|
10
|
+
> Version 1.18.3 was bumped but never tagged or published — releasing it needed a
|
|
11
|
+
> local machine with the `gh` CLI, which is the very gap `release.yml` (below)
|
|
12
|
+
> closes. Its contents ship here instead; no 1.18.3 artifact ever existed.
|
|
13
|
+
|
|
14
|
+
### Fixed
|
|
15
|
+
- **CI is green again on `main`.** Two jobs had been failing on the daily scheduled run without any code change, both because an unpinned tool pulled a newer release. (#441)
|
|
16
|
+
- **Knip (`lint` job).** A knip release started flagging every barrel-file re-export as an unused export (86 findings) plus the `eslint`/`husky`/`lint-staged`/`tsc` tooling. Knip is now pinned to an exact version as a devDependency (matching how Bun and the Claude CLI are pinned so a release can't silently break CI), run via `bun run knip`. `knip.json` treats `src/**/index.ts` as entry points so public barrel exports are no longer false positives, and the tooling deps/binaries are ignored the same way `prettier` already is. One genuinely dead re-export (`clearAllTimers` from `session/types.ts`) was removed.
|
|
17
|
+
- **Trivy + `bun audit` (`security` job).** Cleared HIGH advisories by bumping `js-yaml` to `^4.3.0` (CVE-2026-59869) and raising the `fast-uri` override to `>=3.1.4` (CVE-2026-13676, CVE-2026-16221). With Trivy passing, the previously-skipped `bun audit` step now runs; its newly-surfaced advisories are cleared by raising the `shell-quote` override to `>=1.10.0` (GHSA-395f-4hp3-45gv) and adding a `brace-expansion` `>=5.0.7` override (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg).
|
|
18
|
+
|
|
19
|
+
### Added
|
|
20
|
+
- **Releases can be cut without a local machine.** A new `release.yml` workflow fires when a version change lands on `main` (or on demand via `workflow_dispatch`), re-runs typecheck/lint/knip/tests/build, then creates the tag, creates the GitHub release, and publishes to npm. Previously a release needed someone at a terminal with the `gh` CLI to run `gh release create`. The job publishes in-process rather than handing off to `publish.yml`, because a release created with `GITHUB_TOKEN` does not emit a `release: published` event that can start another workflow — the alternative would be storing a long-lived PAT. It exits before tagging when the current version's tag already exists, so re-runs and unrelated `package.json` edits are no-ops. `publish.yml` is unchanged and still handles releases a human creates by hand.
|
|
21
|
+
|
|
22
|
+
### Changed
|
|
23
|
+
- **Dependency updates.** `hono` 4.12.30 → 4.12.31 and `@hono/node-server` 2.0.9 → 2.0.11, the latter carrying a fix for an unauthenticated memory-leak DoS via aborted WebSocket handshake (GHSA-9mqv-5hh9-4cgg). (#434)
|
|
24
|
+
- **`body-parser` 2.2.2 → 2.3.0.** (#436)
|
|
25
|
+
- **Dev tooling updates.** `eslint` 10.7.0 → 10.8.0, `lint-staged` 17.0.8 → 17.2.0, `prettier` 3.9.5 → 3.9.6, `typescript-eslint` 8.64.0 → 8.65.0. Dependabot maintains `package-lock.json` only, so `bun.lock` was regenerated alongside it — CI installs with Bun, and without that sync the bumps would not actually reach CI. (#442)
|
|
26
|
+
|
|
27
|
+
## [1.18.2] - 2026-07-17
|
|
28
|
+
|
|
29
|
+
### Changed
|
|
30
|
+
- **New visual identity: the thread-spine mark.** The ✴-star ASCII logo (a leftover of the Claude Code Christmas logo) is replaced everywhere by a mark of our own: heavy box-drawing CT letters with a light thread gutter showing a root node, a reply branch, and a closing arc. Applied consistently to the terminal header, the favicon, a rebuilt pure-vector `logo.svg` with no font dependency, the README, and the website. (#431)
|
|
31
|
+
- **README overhaul.** Screenshots for both platforms directly under the pitch, a How it works section, a table of all nine MCP tools with their guardrails (seven were previously undocumented), and a command table synced with the registry. Corrected copy along the way: multi-account selection is usage-balanced since 1.18.0 (the README still said round-robin), the resume reaction is 🔄 (the documented ↩️ was never accepted), and the `send_dm` guardrail is approved from the session thread, not by the recipient. Cross-file links are now absolute so they no longer break on the npm package page, and the configuration link points at `docs/CONFIGURATION.md` instead of the internal `CLAUDE.md`. (#431)
|
|
32
|
+
- **Docs sync.** `docs/CONFIGURATION.md` audited against the real config schema: the `limits` block, `threadLogs`, sticky text customization, permission modes, `outboundFiles`, usage-balanced accounts, and the env var list. New `docs/MCP-TOOLS.md` documents every MCP tool with inputs and guardrails. `SETUP_GUIDE.md` drops stale version pins and deprecated permission vocabulary; `CONTRIBUTING.md` gains dev commands and a pointer to the platform implementation guide. (#431)
|
|
33
|
+
- **Website redesign: the page is a thread.** claude-threads.run rebuilt on the same terminal identity with the thread as its structure: a rail runs down the content and every section attaches to it as a reply, the last one closing the arc. Content synced with 1.18 (MCP tools table, full command list, a Mattermost showcase section), OpenGraph/Twitter cards with a generated social image, and the Node prerequisite corrected from 18+ to 20+. (#432)
|
|
34
|
+
- **npm metadata.** The package description finally mentions Slack, keywords gain `slack`, `chatops`, `pair-programming`, and `collaboration`, and the homepage points at claude-threads.run. Takes effect with this release. (#431)
|
|
35
|
+
|
|
8
36
|
## [1.18.1] - 2026-07-17
|
|
9
37
|
|
|
10
38
|
### Changed
|
package/README.md
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
# Claude Threads
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
3
|
+
<p align="center">
|
|
4
|
+
<img src="https://raw.githubusercontent.com/anneschuth/claude-threads/main/website/assets/logo.svg" alt="claude-threads logo: a chat-thread spine next to the letters CT" width="200">
|
|
5
|
+
</p>
|
|
6
|
+
|
|
7
|
+
<p align="center"><sub>Claude Code × Slack & Mattermost</sub></p>
|
|
8
8
|
|
|
9
9
|
<p align="center">
|
|
10
10
|
<a href="https://claude-threads.run"><strong>claude-threads.run</strong></a>
|
|
@@ -18,28 +18,64 @@
|
|
|
18
18
|
[](https://nodejs.org/)
|
|
19
19
|
[](https://github.com/anneschuth/claude-threads/pulls)
|
|
20
20
|
|
|
21
|
-
**
|
|
21
|
+
**Run Claude Code from your team's chat.** The bot lives on your machine, next to your checkout and your local tools. Sessions stream live into Slack or Mattermost threads where teammates watch and steer what Claude does. No cloud sandbox and no enterprise plan required: it works with the Claude subscription or API key you already have.
|
|
22
22
|
|
|
23
23
|
> _Think of it as screen-sharing for AI pair programming, but everyone can type._
|
|
24
24
|
|
|
25
|
+
<table>
|
|
26
|
+
<tr>
|
|
27
|
+
<td width="50%" valign="top"><img src="https://raw.githubusercontent.com/anneschuth/claude-threads/main/website/assets/screenshots/slack-thread.png" alt="A Claude Code session streaming into a Slack thread, with session header badges and live tool output"></td>
|
|
28
|
+
<td width="50%" valign="top"><img src="https://raw.githubusercontent.com/anneschuth/claude-threads/main/website/assets/screenshots/mattermost-thread.png" alt="The same bot in a Mattermost thread, showing the session header table and Claude's reply"></td>
|
|
29
|
+
</tr>
|
|
30
|
+
<tr>
|
|
31
|
+
<td align="center"><sub>Slack</sub></td>
|
|
32
|
+
<td align="center"><sub>Mattermost</sub></td>
|
|
33
|
+
</tr>
|
|
34
|
+
</table>
|
|
35
|
+
|
|
36
|
+
## How it works
|
|
37
|
+
|
|
38
|
+
1. Mention the bot in a channel: `@claude fix the flaky test in ci.yml`
|
|
39
|
+
2. It spawns a real Claude Code session in a working directory on your machine.
|
|
40
|
+
3. Everything streams into the thread: output, diffs, task lists, permission prompts.
|
|
41
|
+
4. Steer by replying in the thread or reacting with emoji. Anyone you invite can do the same.
|
|
42
|
+
|
|
25
43
|
## Features
|
|
26
44
|
|
|
27
|
-
- **
|
|
28
|
-
- **
|
|
29
|
-
- **
|
|
30
|
-
- **
|
|
31
|
-
- **
|
|
32
|
-
- **
|
|
33
|
-
- **
|
|
34
|
-
- **
|
|
35
|
-
- **
|
|
36
|
-
- **
|
|
37
|
-
- **
|
|
45
|
+
- **Live streaming** - Responses, tool calls, diffs, and a sticky task list render in the thread as the session runs
|
|
46
|
+
- **Slack and Mattermost** - Connect multiple workspaces at once. Mattermost support means this also works where chat is self-hosted and cloud assistants cannot go
|
|
47
|
+
- **A session per thread** - Concurrent sessions, each with its own working directory, resumed automatically after a bot restart
|
|
48
|
+
- **Your machine, your setup** - Sessions use your local checkout plus whatever MCP servers and plugins you already configured
|
|
49
|
+
- **Your existing subscription** - Any Claude Pro/Max account or API key works. An optional multi-account pool routes each new session to the account with the most subscription headroom and cools down rate-limited ones ([docs](https://github.com/anneschuth/claude-threads/blob/main/docs/CONFIGURATION.md#claude-accounts-optional-multi-account-mode))
|
|
50
|
+
- **Permission control by emoji** - `default` prompts the thread for every tool use (👍/✅/👎), `auto` lets Claude's classifier approve low-risk actions, `bypass` skips prompts entirely. Switch per session with `!permissions`
|
|
51
|
+
- **Collaboration** - `!invite` teammates into a session; commits Claude makes get `Co-Authored-By:` trailers for everyone involved
|
|
52
|
+
- **A real chat citizen** - Nine MCP tools let Claude post files, follow permalinks, react, and DM, each behind its own guardrail (see [What Claude can do in your chat](#what-claude-can-do-in-your-chat))
|
|
53
|
+
- **Git worktrees** - `!worktree feature/foo` isolates Claude's changes on a branch
|
|
54
|
+
- **Files both ways** - Drop any file into the chat for Claude to read, with full multimodal for images and PDFs; Claude posts screenshots, plots, or PDFs back with `send_file` (100 MB cap)
|
|
55
|
+
- **Quiet mode and verbosity dials** - `!mentions on` makes a session respond only when mentioned; session headers and the channel sticky each have `full`/`minimal`/`hidden` modes
|
|
56
|
+
- **Runs on macOS, Linux, and Windows** - Windows via Git Bash or WSL
|
|
57
|
+
- **Auto-update** - The bot watches npm for new versions; `!update now` applies one from chat
|
|
58
|
+
|
|
59
|
+
## What Claude can do in your chat
|
|
60
|
+
|
|
61
|
+
Each session runs its own MCP server, giving Claude tools that act on the chat platform. Every tool carries its own guardrail; nothing reaches beyond the channels the bot can already see.
|
|
62
|
+
|
|
63
|
+
| Tool | What Claude does with it | Guardrail |
|
|
64
|
+
| :--------------------- | :---------------------------------------------------- | :------------------------------------------------------------ |
|
|
65
|
+
| `send_file` | Post a file from the working directory into the thread | Path validated against the session working directory |
|
|
66
|
+
| `read_post` | Resolve a Slack or Mattermost permalink to its content | Bot's channel plus public channels only |
|
|
67
|
+
| `list_thread` | Read the current thread, or a permalinked one | Same channel scoping |
|
|
68
|
+
| `read_channel_history` | Read recent messages from a channel | Bot's channel plus public channels, capped at 100 messages |
|
|
69
|
+
| `search_messages` | Search messages | Mattermost only, capped at 25 results |
|
|
70
|
+
| `react_to_post` | Add an emoji reaction | Defaults to the message that triggered it |
|
|
71
|
+
| `update_own_post` | Edit one of its earlier posts | Bot-authored posts only |
|
|
72
|
+
| `send_dm` | Send a direct message to a channel member | 3 per recipient per session; the thread approves each one |
|
|
73
|
+
| `permission_prompt` | Ask the thread to approve a tool use | This one _is_ the approval flow (👍/✅/👎) |
|
|
74
|
+
|
|
75
|
+
The full reference, including inputs and scoping rules, is in [docs/MCP-TOOLS.md](https://github.com/anneschuth/claude-threads/blob/main/docs/MCP-TOOLS.md).
|
|
38
76
|
|
|
39
77
|
## Quick Start
|
|
40
78
|
|
|
41
|
-
### Install & Run
|
|
42
|
-
|
|
43
79
|
```bash
|
|
44
80
|
# Install (pick one)
|
|
45
81
|
bun install -g claude-threads # with Bun (recommended)
|
|
@@ -50,23 +86,14 @@ cd /your/project
|
|
|
50
86
|
claude-threads
|
|
51
87
|
```
|
|
52
88
|
|
|
53
|
-
The
|
|
89
|
+
The interactive wizard configures your Slack or Mattermost bot, tests the credentials, and gets you running in minutes. For creating the bot account itself, follow the [Setup Guide](https://github.com/anneschuth/claude-threads/blob/main/SETUP_GUIDE.md).
|
|
54
90
|
|
|
55
|
-
|
|
56
|
-
- Set up your Mattermost or Slack bot
|
|
57
|
-
- Test credentials and permissions
|
|
58
|
-
- Get you up and running in minutes
|
|
59
|
-
|
|
60
|
-
**Need help with platform setup?** See the [Setup Guide](SETUP_GUIDE.md) for Mattermost or Slack bot creation.
|
|
61
|
-
|
|
62
|
-
### Prerequisites
|
|
91
|
+
**Prerequisites**
|
|
63
92
|
|
|
64
93
|
- **Bun 1.2.21+** or **Node 20+** - [Install Bun](https://bun.sh/) or [Install Node](https://nodejs.org/)
|
|
65
|
-
- **Claude Code CLI
|
|
66
|
-
|
|
67
|
-
### Use
|
|
94
|
+
- **Claude Code CLI** - test with `claude --version` (needs a subscription or API key)
|
|
68
95
|
|
|
69
|
-
|
|
96
|
+
Then mention the bot in your channel:
|
|
70
97
|
|
|
71
98
|
```
|
|
72
99
|
@claude help me fix the bug in src/auth.ts
|
|
@@ -93,33 +120,28 @@ Type `!help` in any session thread:
|
|
|
93
120
|
| `!github-email <email>` | Register your GitHub noreply email so `!invite` can attribute commits to you |
|
|
94
121
|
| `!update` | Show auto-update status (`!update now` / `!update defer`) |
|
|
95
122
|
| `!bug <desc>` | Report a bug with context (creates a GitHub issue) |
|
|
96
|
-
| `!approve` | Approve pending plan (alternative to
|
|
97
|
-
| `!escape` | Interrupt current task
|
|
98
|
-
| `!stop` | Stop this session
|
|
123
|
+
| `!approve` | Approve pending plan (alternative to 👍; also `!yes`) |
|
|
124
|
+
| `!escape` | Interrupt current task, session stays active (also `!interrupt`) |
|
|
125
|
+
| `!stop` | Stop this session (also `!cancel`) |
|
|
99
126
|
| `!kill` | Emergency shutdown (kills ALL sessions and exits the bot) |
|
|
100
127
|
|
|
128
|
+
Unknown `!commands` are checked against Claude Code's own slash commands and passed through when they match.
|
|
129
|
+
|
|
101
130
|
## Interactive Controls
|
|
102
131
|
|
|
103
|
-
**Permission approval** - When Claude wants to
|
|
132
|
+
**Permission approval** - When Claude wants to run a tool:
|
|
104
133
|
|
|
105
134
|
- 👍 Allow this action
|
|
106
135
|
- ✅ Allow all future actions
|
|
107
136
|
- 👎 Deny
|
|
108
137
|
|
|
109
|
-
**Plan approval** - When Claude
|
|
110
|
-
|
|
111
|
-
- 👍 Approve and start
|
|
112
|
-
- 👎 Request changes
|
|
138
|
+
**Plan approval** - When Claude presents a plan: 👍 approve, 👎 request changes
|
|
113
139
|
|
|
114
140
|
**Questions** - React with 1️⃣ 2️⃣ 3️⃣ 4️⃣ to answer multiple choice
|
|
115
141
|
|
|
116
|
-
**Session control** - ⏸️
|
|
142
|
+
**Session control** - ⏸️ interrupt, ❌ or 🛑 stop, 🔄 resume a timed-out session
|
|
117
143
|
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
Drop any file into the chat (image, PDF, archive, source, log, you name it). The bot saves it to a per-thread directory and prepends the path to your message; Claude reads it with its own `Read` tool (full multimodal for images and PDFs) or processes it via Bash. Single 100 MB cap per file. Need to extract a zip? Claude runs `unzip` itself.
|
|
121
|
-
|
|
122
|
-
Going the other way, Claude can post files back into the thread (screenshots, generated PDFs, plots, MP3s) by calling the `send_file` MCP tool. Path is validated against the session working directory; auto-approved so the user doesn't have to 👍 every screenshot.
|
|
144
|
+
**Housekeeping** - 🔽 collapses long task lists and subagent output; 🐛 on an error post opens a bug report
|
|
123
145
|
|
|
124
146
|
## Collaboration
|
|
125
147
|
|
|
@@ -128,13 +150,9 @@ Going the other way, Claude can post files back into the thread (screenshots, ge
|
|
|
128
150
|
!kick @colleague # Remove access
|
|
129
151
|
```
|
|
130
152
|
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
Invited collaborators are added as `Co-Authored-By:` trailers on any commits Claude makes during the session. Each collaborator runs `!github-email <their-noreply-address>` once (find yours at <https://github.com/settings/emails>) and the bot remembers it across sessions.
|
|
134
|
-
|
|
135
|
-
## Sharing Links With Claude
|
|
153
|
+
Messages from users outside the session can be approved one at a time by the session owner with a 👍 reaction.
|
|
136
154
|
|
|
137
|
-
|
|
155
|
+
Invited collaborators end up as `Co-Authored-By:` trailers on commits Claude makes during the session. Each collaborator runs `!github-email <their-noreply-address>` once (find yours at <https://github.com/settings/emails>) and the bot remembers it across sessions.
|
|
138
156
|
|
|
139
157
|
## Git Worktrees
|
|
140
158
|
|
|
@@ -148,14 +166,17 @@ Or mid-session: `!worktree feature/add-auth`
|
|
|
148
166
|
|
|
149
167
|
## Access Control
|
|
150
168
|
|
|
151
|
-
Restrict who can use the bot during setup
|
|
169
|
+
Restrict who can use the bot during setup, or reconfigure later with `claude-threads --setup`. An empty allowlist lets anyone in the channel start sessions, so leave it empty only in channels you trust.
|
|
152
170
|
|
|
153
|
-
|
|
171
|
+
Who may do what (start sessions, react to permission prompts, approve guest messages) is written down in the [authorization model](https://github.com/anneschuth/claude-threads/blob/main/SECURITY.md).
|
|
154
172
|
|
|
155
173
|
## Documentation
|
|
156
174
|
|
|
157
|
-
- **[Setup Guide](SETUP_GUIDE.md)** -
|
|
158
|
-
- **[Configuration Reference](
|
|
175
|
+
- **[Setup Guide](https://github.com/anneschuth/claude-threads/blob/main/SETUP_GUIDE.md)** - Creating the bot account on Mattermost or Slack, step by step
|
|
176
|
+
- **[Configuration Reference](https://github.com/anneschuth/claude-threads/blob/main/docs/CONFIGURATION.md)** - Every `config.yaml` option, environment variables, CLI flags
|
|
177
|
+
- **[MCP Tools Reference](https://github.com/anneschuth/claude-threads/blob/main/docs/MCP-TOOLS.md)** - The nine tools Claude gets in chat, with their guardrails
|
|
178
|
+
- **[Security Model](https://github.com/anneschuth/claude-threads/blob/main/SECURITY.md)** - Authorization matrix and vulnerability reporting
|
|
179
|
+
- **[Changelog](https://github.com/anneschuth/claude-threads/blob/main/CHANGELOG.md)** - Detailed release history
|
|
159
180
|
|
|
160
181
|
## Updates
|
|
161
182
|
|
|
@@ -163,7 +184,7 @@ Leave the allowed users list empty to let anyone in the channel use the bot (be
|
|
|
163
184
|
npm install -g claude-threads
|
|
164
185
|
```
|
|
165
186
|
|
|
166
|
-
The bot checks for
|
|
187
|
+
The bot checks npm for new versions on its own and offers the update in chat.
|
|
167
188
|
|
|
168
189
|
## License
|
|
169
190
|
|