claude-threads 1.31.0 → 1.31.1

package/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.31.1] - 2026-08-29
+
+### Security
+- **Regression guard for the cross-platform resume scoping (1.31.0).** The `resumePausedSession` sink is now covered by a test that fails if the `platformId` scope is removed — a message on one platform must never resume a session persisted under another platform whose thread id collides. The fix shipped correct in 1.31.0 but without this guard.
+
+### Fixed
+- **A rejected branch name can no longer break its own error message.** An invalid `!worktree <name>` whose name contains a backtick or newline is sanitized for display, so it stays inside its markdown code span in the error post.
+- **A downgraded "✅ Invite to session" reaction is no longer silent.** When a non-owner participant's ✅ is downgraded to a one-shot allow (only the owner may grant standing membership), the bot now says so, instead of leaving the reactor to assume the invite succeeded.
+
 ## [1.31.0] - 2026-08-29
 
 ### Added

package/dist/index.js

@@ -62633,6 +62633,7 @@ class MessageApprovalExecutor extends BaseExecutor {
         const isInviteAuthorized = pending.sessionOwner !== undefined && user === pending.sessionOwner || ctx.platform.isUserAllowed(user);
         if (!isInviteAuthorized) {
           ctx.logger.info(`Message approval invite (✅) from @${user} downgraded to allow-once: only the session owner may invite`);
+          await ctx.createPost(`ℹ️ Only the session owner can invite ${ctx.formatter.formatUserMention(pending.fromUser)} to the session — allowing this one message instead.`, { type: "system" });
           const handled2 = await this.handleMessageApprovalResponse(postId, "allow", user, ctx);
           ctx.logger.debug(`MessageApprovalExecutor: outcome=allow (invite downgraded), handled=${handled2}`);
           return handled2;
@@ -65482,6 +65483,9 @@ import { randomUUID as randomUUID5 } from "crypto";
 init_logger();
 var log24 = createLogger("worktree");
 var sessionLog5 = createSessionLog(log24);
+function displayBranchName(name) {
+  return name.replace(/[`\r\n]/g, "").slice(0, 100);
+}
 function parseWorktreeError(error) {
   const message = error instanceof Error ? error.message : String(error);
   const lowerMessage = message.toLowerCase();
@@ -65652,7 +65656,7 @@ async function handleWorktreeBranchResponse(session, branchName, username, respo
     return false;
   }
   if (!isValidBranchName(branchName)) {
-    await postError(session, `Invalid branch name: \`${branchName}\`. Please provide a valid git branch name.`);
+    await postError(session, `Invalid branch name: \`${displayBranchName(branchName)}\`. Please provide a valid git branch name.`);
     sessionLog5(session).warn(`\uD83C\uDF3F Invalid branch name: ${branchName}`);
     return true;
   }
@@ -65696,7 +65700,7 @@ async function createAndSwitchToWorktree(session, branch, username, options) {
   if (!await requireSessionOwner(session, username, "manage worktrees"))
     return;
   if (!isValidBranchName(branch)) {
-    await postError(session, `Invalid branch name: \`${branch}\`. Please provide a valid git branch name.`);
+    await postError(session, `Invalid branch name: \`${displayBranchName(branch)}\`. Please provide a valid git branch name.`);
     sessionLog5(session).warn(`\uD83C\uDF3F Rejected invalid branch name: ${branch}`);
     return;
   }

package/dist/mcp/mcp-server.js

@@ -51310,6 +51310,7 @@ class MessageApprovalExecutor extends BaseExecutor {
         const isInviteAuthorized = pending.sessionOwner !== undefined && user === pending.sessionOwner || ctx.platform.isUserAllowed(user);
         if (!isInviteAuthorized) {
           ctx.logger.info(`Message approval invite (✅) from @${user} downgraded to allow-once: only the session owner may invite`);
+          await ctx.createPost(`ℹ️ Only the session owner can invite ${ctx.formatter.formatUserMention(pending.fromUser)} to the session — allowing this one message instead.`, { type: "system" });
           const handled2 = await this.handleMessageApprovalResponse(postId, "allow", user, ctx);
           ctx.logger.debug(`MessageApprovalExecutor: outcome=allow (invite downgraded), handled=${handled2}`);
           return handled2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-threads",
-  "version": "1.31.0",
+  "version": "1.31.1",
   "description": "Run Claude Code from Slack or Mattermost. Sessions stream live into threads where your whole team can watch and steer.",
   "main": "dist/index.js",
   "type": "module",