claude-threads 1.26.0 → 1.27.0

package/dist/mcp/mcp-server.js

@@ -47754,7 +47754,11 @@ function truncateWithEllipsis(str, maxLength) {
   return str.substring(0, maxLength) + "...";
 }
 function escapeCodeBlockContent(content) {
-  return content.replace(/```/g, "` ``");
+  let result = content;
+  while (result.includes("```")) {
+    result = result.replace(/```/g, "` ``");
+  }
+  return result;
 }
 // src/operations/tool-formatters/registry.ts
 class ToolFormatterRegistry {
@@ -48553,6 +48557,15 @@ var fileToolsFormatter = {
   }
 };
 // src/operations/tool-formatters/bash-tools.ts
+var PERMISSION_COMMAND_MAX = 1500;
+function truncateAtCodePoint(text, max) {
+  if (text.length <= max)
+    return { text, truncated: false };
+  const points = Array.from(text);
+  if (points.length <= max)
+    return { text, truncated: false };
+  return { text: points.slice(0, max).join(""), truncated: true };
+}
 var bashToolFormatter = {
   toolNames: ["Bash"],
   format(toolName, input, options) {
@@ -48565,9 +48578,13 @@ var bashToolFormatter = {
     }
     const truncated = cmd.length > maxCommandLength;
     const displayCmd = cmd.substring(0, maxCommandLength);
+    const permission = truncateAtCodePoint(cmd, PERMISSION_COMMAND_MAX);
+    const permissionCmd = escapeCodeBlockContent(permission.text) + (permission.truncated ? `
+[... truncated]` : "");
     return {
       display: `\uD83D\uDCBB ${formatter.formatBold("Bash")} ${formatter.formatCode(displayCmd + (truncated ? "..." : ""))}`,
-      permissionText: `\uD83D\uDCBB ${formatter.formatBold("Bash")} ${formatter.formatCode(cmd.substring(0, 100) + (cmd.length >= 100 ? "..." : ""))}`,
+      permissionText: `\uD83D\uDCBB ${formatter.formatBold("Bash")}
+${formatter.formatCodeBlock(permissionCmd, "bash")}`,
       isDestructive: true
     };
   }
@@ -49632,6 +49649,13 @@ function convertMarkdownTablesToSlack(content) {
 `);
   });
 }
+var DCM_THREAD_PREFIX = "dcm:";
+function isDcmThreadId(threadId) {
+  return !!threadId && threadId.startsWith(DCM_THREAD_PREFIX);
+}
+function resolvePostThreadId(threadId) {
+  return isDcmThreadId(threadId) ? undefined : threadId;
+}
 
 // src/version.ts
 import { readFileSync, existsSync } from "fs";
@@ -57732,6 +57756,7 @@ var log18 = createLogger("memory");
 // src/session/lifecycle.ts
 var log19 = createLogger("lifecycle");
 var sessionLog3 = createSessionLog(log19);
+var _inFlightSessionStarts = new Map;
 var CHAT_PLATFORM_PROMPT = generateChatPlatformPrompt();
 // src/update-notifier.ts
 var import_semver2 = __toESM(require_semver2(), 1);
@@ -58050,7 +58075,7 @@ async function uploadFileMattermost(args) {
   const postBody = {
     channel_id: channelId,
     message: caption ?? "",
-    root_id: threadId,
+    root_id: resolvePostThreadId(threadId),
     file_ids: [fileInfo.id]
   };
   log28.debug(`POST /posts (file_ids=[${fileInfo.id}])`);
@@ -58106,7 +58131,7 @@ async function createPost(config3, channelId, message, rootId) {
   return mattermostApi(config3, "POST", "/posts", {
     channel_id: channelId,
     message,
-    root_id: rootId
+    root_id: resolvePostThreadId(rootId)
   });
 }
 async function updatePostRaw(config3, postId, message) {
@@ -58588,7 +58613,7 @@ async function uploadFileSlack(args) {
   const step3Body = {
     files: [{ id: fileId, title: caption ?? filename }],
     channel_id: channelId,
-    thread_ts: threadTs
+    thread_ts: resolvePostThreadId(threadTs)
   };
   if (caption !== undefined) {
     step3Body.initial_comment = caption;
@@ -58687,7 +58712,7 @@ class SlackMcpPlatformApi {
     const response = await slackApi("chat.postMessage", this.config.botToken, {
       channel: this.config.channelId,
       text: message,
-      thread_ts: threadTs || this.config.threadTs,
+      thread_ts: resolvePostThreadId(threadTs || this.config.threadTs),
       mrkdwn: true
     });
     const messageTs = response.ts;
@@ -59631,6 +59656,12 @@ async function resolveLatestThreadPost(cfg) {
   if (!cfg.sessionThreadId) {
     return { ok: false, reason: "no session thread to react in — pass a permalink URL instead" };
   }
+  if (isDcmThreadId(cfg.sessionThreadId)) {
+    return {
+      ok: false,
+      reason: "this session runs in direct channel mode (no thread of its own) — pass a permalink URL to the target message instead"
+    };
+  }
   let thread;
   try {
     thread = await cfg.api.readThread(cfg.sessionThreadId);
@@ -59732,6 +59763,12 @@ async function handleListThreadWith(args, cfg) {
         reason: "no session thread to read — pass a permalink URL instead"
       };
     }
+    if (isDcmThreadId(cfg.sessionThreadId)) {
+      return {
+        ok: false,
+        reason: "this session runs in direct channel mode (no thread of its own) — use read_channel_history, or pass a permalink URL"
+      };
+    }
     rootId = cfg.sessionThreadId;
   }
   const limit = clampThreadLimit(args.max_messages);

package/docs/CONFIGURATION.md

@@ -129,6 +129,9 @@ stickyMessage:
 | `outboundFiles` | No | `send_file` settings: `{ enabled, maxBytes }` (defaults: enabled `true`, `maxBytes` 100 MB) |
 | `sessionHeader` | No | Per-thread header visibility: `full` (default) / `minimal` (status bar only) / `hidden` (no header post) |
 | `stickyMessage` | No | Channel sticky visibility: `full` (default) / `minimal` (status bar only) / `hidden` (no sticky, no bumping) |
+| `directChannelMode` | No | Direct channel mode: the whole channel is one session, and the bot replies with top-level channel posts instead of thread replies. `true` for defaults, or an options object (`respondTo`). See [Direct Channel Mode](#direct-channel-mode). |
+| `approvals` | No | Who may answer tool-permission prompts and other reaction gates: `owner` (session participants) or `all_users` (everyone on `allowedUsers`). Unset keeps the historical default per mode — `all_users` for thread sessions, `owner` for direct channel mode. See [Approvals](#approvals). |
+| `directMessages` | No | Mattermost only: DM auto-discovery. A direct message from a user on `allowedUsers` spawns a derived direct-channel-mode instance for that DM conversation — no per-DM entry needed. See [DM auto-discovery](#dm-auto-discovery). |
 
 ### Slack
 
@@ -147,6 +150,88 @@ stickyMessage:
 | `outboundFiles` | No | `send_file` settings: `{ enabled, maxBytes }` (defaults: enabled `true`, `maxBytes` 100 MB) |
 | `sessionHeader` | No | Per-thread header visibility: `full` (default) / `minimal` (status bar only) / `hidden` (no header post) |
 | `stickyMessage` | No | Channel sticky visibility: `full` (default) / `minimal` (status bar only) / `hidden` (no sticky, no bumping) |
+| `directChannelMode` | No | Direct channel mode: the whole channel is one session, and the bot replies with top-level channel posts instead of thread replies. `true` for defaults, or an options object (`respondTo`). See [Direct Channel Mode](#direct-channel-mode). |
+| `approvals` | No | Who may answer tool-permission prompts and other reaction gates: `owner` (session participants) or `all_users` (everyone on `allowedUsers`). Unset keeps the historical default per mode — `all_users` for thread sessions, `owner` for direct channel mode. See [Approvals](#approvals). |
+
+### Direct Channel Mode
+
+`directChannelMode: true` turns the configured channel into a single, always-on conversation with the bot:
+
+- Every message in the channel reaches the bot — no `@mention` required (messages starting with `@someone-else` are still treated as side conversations and ignored).
+- The bot replies with **top-level channel posts** instead of thread replies, so the channel reads like a plain chat.
+- Only **one session** exists per platform instance; internally it is keyed by the synthetic thread id `dcm:<platform id>`, so persistence, resume after bot restarts, emoji permission prompts, and `!commands` all work exactly as in thread sessions.
+- Messages posted inside any thread of the channel are routed to the same session.
+
+This is the mode to use for a dedicated channel with the bot (see issue #315). For shared channels where multiple parallel sessions are wanted, keep the default thread-per-session behavior.
+
+The long form configures how the shared channel behaves:
+
+```yaml
+directChannelMode:
+  respondTo: all_messages   # or: mention
+```
+
+| Option | Values | Default | Meaning |
+|--------|--------|---------|---------|
+| `respondTo` | `all_messages` / `mention` | `all_messages` | `all_messages`: every message from an allowed user reaches the bot. `mention`: the bot only reacts to messages that @mention it — useful when several people discuss in the channel and the bot should not join every exchange. Backed by the per-session quiet-mode flag, so `!mentions` toggles it at runtime. |
+
+Who may approve tool use in the channel is controlled by the platform-level [`approvals`](#approvals) option (DCM defaults to `owner`).
+
+### Approvals
+
+The platform-level `approvals` option controls who may answer tool-permission prompts (👍/✅/👎) and the other reaction gates — plan approvals, question answers, and session resume:
+
+- `owner` — the session participants: the starter plus explicitly `!invite`d users.
+- `all_users` — everyone on the platform's `allowedUsers` list.
+
+Unset keeps the historical default per mode, so existing setups are unaffected: thread sessions behave as before (`all_users`), direct channel mode defaults to the safer `owner`. Setting the option applies it to every session of that platform entry — including classic thread sessions, where `approvals: owner` is an opt-in hardening.
+
+Under effective `owner` mode the scoping is enforced consistently across every path, so the boundary cannot be talked around: the text alternatives (`!approve`, message-based resume) apply the same participant check as their reaction counterparts, and the owner-gated session commands (`!invite`, `!kick`, `!cd`, `!permissions`, …) additionally require the caller to be a session participant — a platform-allowlisted non-participant can neither approve directly nor `!invite` themselves into the approval set.
+
+The approval set is fixed when the Claude CLI is spawned; a later `!invite` extends message access immediately but reaches the approval set on the next CLI respawn (e.g. via `!cd` or `!permissions`).
+
+### Direct messages (DM)
+
+**Mattermost only.** A Mattermost DM is just a private channel with its own id, so a bot DM conversation is direct channel mode pointed at that id — no separate feature needed. (This recipe does NOT work on Slack: Socket Mode distributes event envelopes across an app's active connections, so a second platform entry sharing the same app credentials can consume and discard events meant for the other entry. Slack DM support needs a single-connection, channel-aware implementation.)
+
+```yaml
+platforms:
+  - id: mattermost-dm
+    type: mattermost
+    url: https://chat.example.com
+    token: your-bot-token       # same bot token as the main entry
+    channelId: <dm-channel-id>
+    botName: claude-code
+    directChannelMode: true
+    stickyMessage: hidden       # a sticky makes little sense in a DM
+    allowedUsers: [you]
+```
+
+Get the DM channel id with one API call: `POST /api/v4/channels/direct` with `["<bot-user-id>", "<your-user-id>"]` — the returned `id` is stable.
+
+#### DM auto-discovery
+
+Maintaining one static entry per DM conversation does not scale to a team. With `directMessages: true` on a Mattermost entry, anyone on that entry's `allowedUsers` can simply DM the bot "out of the cold":
+
+```yaml
+platforms:
+  - id: mattermost-main
+    type: mattermost
+    # ... regular entry ...
+    directMessages: true
+```
+
+On first contact the bot spawns a derived platform instance for that DM channel — a clone of the parent entry in direct channel mode, sticky hidden, `allowedUsers` scoped to the DM partner (which, with the DCM `approvals` default of `owner`, also scopes tool-permission prompts to that person). DM sessions persist and are reconstructed after a bot restart. Users not on the parent's `allowedUsers` are ignored.
+
+Details and caveats:
+
+- **Lifecycle**: when a DM session leaves the registry its derived instance and connection are torn down (after a short grace period). After an **idle timeout** the session is persisted — the next DM re-discovers the channel and resumes the conversation. After **`!stop`** the session is deliberately unpersisted — the next DM starts fresh. Instances that never produce a session are reaped after a TTL, so instances do not accumulate over uptime.
+- **Multiple entries, one bot account**: the first entry to discover a DM channel owns it — other `directMessages: true` entries stay out, so the bot never double-replies.
+- **Empty `allowedUsers`**: consistent with the rest of the bot, an empty list means *everyone* — combined with `directMessages: true` that is every user on the server who can DM the bot. Leave it empty only on servers you trust.
+- **Renaming a platform entry** strands its persisted DM sessions (as it does any persisted session referencing the old id); they are skipped with a warning.
+- Mattermost only — see the note above for why the multi-connection approach cannot work on Slack.
+
+Limitations: the thread-context prompt ("include previous messages?") is skipped — there is no thread history to offer — and the `list_thread` MCP tool cannot resolve the synthetic session id (use `read_channel_history` instead).
 
 ### Permission Modes
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-threads",
-  "version": "1.26.0",
+  "version": "1.27.0",
   "description": "Run Claude Code from Slack or Mattermost. Sessions stream live into threads where your whole team can watch and steer.",
   "main": "dist/index.js",
   "type": "module",
@@ -13,9 +13,9 @@
     "dev": "bun --watch src/index.ts",
     "build": "bun build src/index.ts --outdir dist --target node && bun build src/mcp/mcp-server.ts --outdir dist/mcp --target node && bun build src/statusline/writer.ts --outdir dist/statusline --target node",
     "start": "bun dist/index.js",
-    "test": "bun test src/",
-    "test:watch": "bun test src/ --watch",
-    "test:coverage": "bun test src/ --coverage",
+    "test": "bun test src/ --timeout 15000",
+    "test:watch": "bun test src/ --watch --timeout 15000",
+    "test:coverage": "bun test src/ --coverage --timeout 15000",
     "test:integration:setup": "docker compose -f tests/integration/docker/docker-compose.yml up -d && bun run tests/integration/setup/wait-for-mattermost.ts && bun run tests/integration/setup/setup-mattermost.ts",
     "test:integration:run": "INTEGRATION_TEST=1 bun test tests/integration/suites --timeout 120000",
     "test:integration": "bun run test:integration:setup && bun run test:integration:run",
@@ -111,7 +111,7 @@
   },
   "lint-staged": {
     "*.ts": "eslint --fix",
-    "*.test.ts": "bun test --bail",
+    "*.test.ts": "bun test --bail --timeout 15000",
     "*.{ts,tsx}": "bash -c 'tsc --noEmit'",
     "website/**/*.{html,css,js}": "prettier --write"
   },