claude-threads 1.30.0 → 1.30.1

package/CHANGELOG.md

@@ -5,6 +5,11 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.30.1] - 2026-08-28
+
+### Security
+- **The card-injection guard now also covers the haiku-parsed `!watch`/`!routine` paths and the store-level gates.** 1.30.0 collapsed watch *keywords*; model-authored names, conditions and prompts from the natural-language parsers — and the stores' own name/condition normalization, the gate no caller can bypass — now go through the same shared `singleLine` helper (`utils/format.ts`), which replaces the two inline copies of the whitespace-collapse regex.
+
 ## [1.30.0] - 2026-08-28
 
 ### Added

package/dist/index.js

@@ -54578,6 +54578,9 @@ function truncateAtWord(str2, maxLength) {
   }
   return truncated + "…";
 }
+function singleLine(text) {
+  return text.replace(/[\s\u0085]+/g, " ").trim();
+}
 
 // src/utils/error-handler/index.ts
 var log7 = createLogger("error");
@@ -64908,7 +64911,7 @@ class RoutinesStore extends PlatformListStore {
       const scheduleError = validateSchedule(routine.schedule);
       if (scheduleError)
         return scheduleError;
-      const name = routine.name.trim().slice(0, 80);
+      const name = singleLine(routine.name).slice(0, 80);
       const prompt = routine.prompt.trim().slice(0, 2000);
       if (!name || !prompt)
         return "name and prompt are required";
@@ -64988,8 +64991,8 @@ function validateParsedRoutine(raw, defaultTimezone) {
   if (typeof raw.error === "string" && raw.error) {
     return { ok: false, error: raw.error };
   }
-  const name = typeof raw.name === "string" ? raw.name.trim() : "";
-  const prompt = typeof raw.prompt === "string" ? raw.prompt.trim() : "";
+  const name = typeof raw.name === "string" ? singleLine(raw.name) : "";
+  const prompt = typeof raw.prompt === "string" ? singleLine(raw.prompt) : "";
   const preset = raw.preset;
   if (!name)
     return { ok: false, error: "could not derive a routine name" };
@@ -65038,7 +65041,7 @@ var MAX_KEYWORD_LENGTH = 60;
 function validateKeywords(raw) {
   if (!Array.isArray(raw))
     return "keywords must be a list";
-  const cleaned = [...new Set(raw.filter((k) => typeof k === "string").map((k) => k.replace(/[\s\u0085]+/g, " ").trim().toLowerCase()).filter((k) => k.length > 0 && k.length <= MAX_KEYWORD_LENGTH))];
+  const cleaned = [...new Set(raw.filter((k) => typeof k === "string").map((k) => singleLine(k).toLowerCase()).filter((k) => k.length > 0 && k.length <= MAX_KEYWORD_LENGTH))];
   if (cleaned.length < MIN_KEYWORDS)
     return "at least one usable keyword is required";
   return cleaned.slice(0, MAX_KEYWORDS);
@@ -65051,7 +65054,7 @@ class WatchesStore extends PlatformListStore {
   applyItemDefaults(w) {
     w.enabled = w.enabled ?? true;
     w.consecutiveFailures = w.consecutiveFailures ?? 0;
-    w.keywords = Array.isArray(w.keywords) ? w.keywords.filter((k) => typeof k === "string").map((k) => k.replace(/[\s\u0085]+/g, " ").trim().toLowerCase()).filter((k) => k.length > 0) : [];
+    w.keywords = Array.isArray(w.keywords) ? w.keywords.filter((k) => typeof k === "string").map((k) => singleLine(k).toLowerCase()).filter((k) => k.length > 0) : [];
   }
   warn(message) {
     log20.warn(message);
@@ -65061,8 +65064,8 @@ class WatchesStore extends PlatformListStore {
   }
   async add(platformId, watch, maxWatches = DEFAULT_MAX_WATCHES) {
     const result = await this.addItem(platformId, maxWatches, "watch", () => {
-      const name = watch.name.trim().slice(0, 80);
-      const condition = watch.condition.trim().slice(0, 500);
+      const name = singleLine(watch.name).slice(0, 80);
+      const condition = singleLine(watch.condition).slice(0, 500);
       const prompt = watch.prompt.trim().slice(0, 2000);
       if (!name || !condition || !prompt)
         return "name, condition and prompt are required";
@@ -65112,9 +65115,9 @@ function validateParsedWatch(raw) {
   if (typeof raw.error === "string" && raw.error) {
     return { ok: false, error: raw.error };
   }
-  const name = typeof raw.name === "string" ? raw.name.trim() : "";
-  const condition = typeof raw.condition === "string" ? raw.condition.trim() : "";
-  const prompt = typeof raw.prompt === "string" ? raw.prompt.trim() : "";
+  const name = typeof raw.name === "string" ? singleLine(raw.name) : "";
+  const condition = typeof raw.condition === "string" ? singleLine(raw.condition) : "";
+  const prompt = typeof raw.prompt === "string" ? singleLine(raw.prompt) : "";
   if (!name || !condition || !prompt) {
     return { ok: false, error: "could not extract a name, condition and task from the request" };
   }
@@ -68055,9 +68058,6 @@ function refuseProposal(session, ctx, flavor) {
   return null;
 }
 var PROPOSED = "proposed_awaiting_human_approval";
-function singleLine(text) {
-  return text.replace(/[\s\u0085]+/g, " ").trim();
-}
 async function proposeRoutine(session, ctx, input, signal) {
   const refusal = refuseProposal(session, ctx, "routines");
   if (refusal)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-threads",
-  "version": "1.30.0",
+  "version": "1.30.1",
   "description": "Run Claude Code from Slack or Mattermost. Sessions stream live into threads where your whole team can watch and steer.",
   "main": "dist/index.js",
   "type": "module",