claude-threads 1.31.0 → 1.31.2

package/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [1.31.2] - 2026-08-30
+
+### Added
+- **The approval posture of a routine or watch is now visible and changeable after creation.** `!routines` / `!watches` listings show each item's posture inline (👍 approvals · ✅ autonomous), and a new owner-gated `!routines approval <n> on|off` / `!watches approval <n> on|off` flips it — `off` makes an item run autonomously, `on` restores per-action approval. Turning a watch autonomous is the same sensitive choice the creation card gates behind the owner and an explicit ✅, so the flip command is owner-gated too; the safe approvals-required posture stays the default for older data.
+
+### Security
+- **Active-session thread-id lookups are now scoped by `platformId`**, completing the cross-platform privacy boundary that 1.31.0/1.31.1 established for the persisted store. `SessionRegistry.findByThreadId` takes an optional `platformId` and resolves O(1) against the composite key when given; the message router (`handleMessage`) and the in-session authorization check (`isUserAllowedInSession`) now pass it, so a thread id that collides across platforms can no longer resolve to — or authorize a user against — another platform's *active* session, and the router and auth check always agree on which session a message belongs to. Defense-in-depth: real Mattermost (26-char) and Slack (dotted-ts) ids don't collide today.
+
+## [1.31.1] - 2026-08-29
+
+### Security
+- **Regression guard for the cross-platform resume scoping (1.31.0).** The `resumePausedSession` sink is now covered by a test that fails if the `platformId` scope is removed — a message on one platform must never resume a session persisted under another platform whose thread id collides. The fix shipped correct in 1.31.0 but without this guard.
+
+### Fixed
+- **A rejected branch name can no longer break its own error message.** An invalid `!worktree <name>` whose name contains a backtick or newline is sanitized for display, so it stays inside its markdown code span in the error post.
+- **A downgraded "✅ Invite to session" reaction is no longer silent.** When a non-owner participant's ✅ is downgraded to a one-shot allow (only the owner may grant standing membership), the bot now says so, instead of leaving the reactor to assume the invite succeeded.
+
 ## [1.31.0] - 2026-08-29
 
 ### Added

package/README.md

@@ -126,9 +126,9 @@ Type `!help` in any session thread:
 | `!remember <text>`                          | Save a note to the channel's shared memory                                               |
 | `!memory`                                   | Show channel memory (`forget <n\|text>` removes entries)                                 |
 | `!routine <schedule, task>`                 | Schedule a recurring routine in natural language (confirmed with 👍)                     |
-| `!routines`                                 | List routines (`pause\|resume\|delete\|run <n>` to manage)                               |
+| `!routines`                                 | List routines (`pause\|resume\|delete\|run <n>`, `approval <n> on\|off` to manage)       |
 | `!watch <when ..., task>`                   | Create an event trigger in natural language (confirmed with 👍)                          |
-| `!watches`                                  | List event triggers (`pause\|resume\|delete <n>` to manage)                             |
+| `!watches`                                  | List event triggers (`pause\|resume\|delete <n>`, `approval <n> on\|off` to manage)      |
 | `!update`                                   | Show auto-update status (`!update now` / `!update defer`)                                |
 | `!bug <desc>`                               | Report a bug with context (creates a GitHub issue)                                       |
 | `!approve`                                  | Approve pending plan (alternative to 👍; also `!yes`)                                    |

package/dist/index.js

@@ -62633,6 +62633,7 @@ class MessageApprovalExecutor extends BaseExecutor {
         const isInviteAuthorized = pending.sessionOwner !== undefined && user === pending.sessionOwner || ctx.platform.isUserAllowed(user);
         if (!isInviteAuthorized) {
           ctx.logger.info(`Message approval invite (✅) from @${user} downgraded to allow-once: only the session owner may invite`);
+          await ctx.createPost(`ℹ️ Only the session owner can invite ${ctx.formatter.formatUserMention(pending.fromUser)} to the session — allowing this one message instead.`, { type: "system" });
           const handled2 = await this.handleMessageApprovalResponse(postId, "allow", user, ctx);
           ctx.logger.debug(`MessageApprovalExecutor: outcome=allow (invite downgraded), handled=${handled2}`);
           return handled2;
@@ -65226,6 +65227,9 @@ async function postRoutineConfirmation(session, ctx, parsed, requestedBy, opts =
   });
   sessionLog4(session).info(`\uD83D\uDD58 Routine proposal posted for @${requestedBy}${opts.proposedByAgent ? " (agent-proposed)" : ""}: "${parsed.name}"`);
 }
+function postureMarker(item) {
+  return item.requireApproval === false ? " · ✅ autonomous" : " · \uD83D\uDC4D approvals";
+}
 async function manageListItems(session, args, username, flavor) {
   const formatter = session.platform.getFormatter();
   const trimmed = args?.trim();
@@ -65243,13 +65247,32 @@ async function manageListItems(session, args, username, flavor) {
 ` + `${lines.join(`
 `)}
 
-` + `${formatter.formatItalic(`Manage with ${"`" + cmd + " " + flavor.actions + " <n>`"}.`)}`);
+` + `${formatter.formatItalic(`Manage with ${"`" + cmd + " " + flavor.actions + " <n>`"}; set approval posture with ${"`" + cmd + " approval <n> on|off`"}.`)}`);
     session.threadLogger?.logCommand(flavor.command, "list", username);
     return;
   }
+  const approvalMatch = trimmed.match(/^approval\s+(\d+)\s+(on|off)$/i);
+  if (approvalMatch) {
+    const [, indexArg2, mode] = approvalMatch;
+    const item2 = flavor.list()[parseInt(indexArg2, 10) - 1];
+    if (!item2) {
+      await post(session, "warning", `${flavor.emoji} No ${flavor.noun.toLowerCase()} ${indexArg2}. See ${formatter.formatCode(cmd)}.`);
+      return;
+    }
+    if (!await requireSessionOwner(session, username, `manage ${flavor.command}`)) {
+      return;
+    }
+    const requireApproval = mode.toLowerCase() === "on";
+    await flavor.update(item2.id, { requireApproval });
+    await post(session, "success", requireApproval ? `\uD83D\uDC4D ${flavor.noun} ${formatter.formatBold(item2.name)} will ask for approval before each action.` : `✅ ${flavor.noun} ${formatter.formatBold(item2.name)} will run autonomously — no approval prompts. Only leave this on for triggers you fully trust.`);
+    sessionLog4(session).info(`${flavor.emoji} @${username}: ${cmd} approval ${indexArg2} ${mode.toLowerCase()} ("${item2.name}")`);
+    auditCommand(session, flavor.command, `approval ${indexArg2} ${mode.toLowerCase()}`, username);
+    session.threadLogger?.logCommand(flavor.command, `approval ${indexArg2} ${mode.toLowerCase()}`, username);
+    return;
+  }
   const match = trimmed.match(new RegExp(`^(${flavor.actions})\\s+(\\d+)$`, "i"));
   if (!match) {
-    await post(session, "warning", `${flavor.emoji} Usage: ${formatter.formatCode(cmd)} or ${formatter.formatCode(`${cmd} ${flavor.actions} <n>`)}`);
+    await post(session, "warning", `${flavor.emoji} Usage: ${formatter.formatCode(cmd)}, ${formatter.formatCode(`${cmd} ${flavor.actions} <n>`)} or ${formatter.formatCode(`${cmd} approval <n> on|off`)}`);
     return;
   }
   const [, action, indexArg] = match;
@@ -65301,7 +65324,7 @@ async function manageRoutines(session, args, username, ctx) {
     describe: (r, formatter) => {
       const status = r.enabled ? "" : " — ⏸️ paused";
       const last = r.lastRunAt ? ` · last run ${formatIsoMinute(r.lastRunAt)} (${r.lastRunStatus})` : "";
-      return `${formatter.formatBold(r.name)} — ${describeSchedule(r.schedule)} · by ${formatter.formatCode("@" + r.createdBy)}${status}${last}`;
+      return `${formatter.formatBold(r.name)} — ${describeSchedule(r.schedule)} · by ${formatter.formatCode("@" + r.createdBy)}${postureMarker(r)}${status}${last}`;
     },
     list: () => ctx.state.routinesStore.list(platformId),
     update: (id, patch) => ctx.state.routinesStore.update(platformId, id, patch),
@@ -65387,7 +65410,7 @@ async function manageWatches(session, args, username, ctx) {
     describe: (w, formatter) => {
       const status = w.enabled ? "" : " — ⏸️ paused";
       const last = w.lastFiredAt ? ` · last fired ${formatIsoMinute(w.lastFiredAt)} (${w.lastFireStatus})` : "";
-      return `${formatter.formatBold(w.name)} — fires when ${w.condition} · by ${formatter.formatCode("@" + w.createdBy)}${status}${last}`;
+      return `${formatter.formatBold(w.name)} — fires when ${w.condition} · by ${formatter.formatCode("@" + w.createdBy)}${postureMarker(w)}${status}${last}`;
     },
     list: () => ctx.state.watchesStore.list(platformId),
     update: (id, patch) => ctx.state.watchesStore.update(platformId, id, patch),
@@ -65482,6 +65505,9 @@ import { randomUUID as randomUUID5 } from "crypto";
 init_logger();
 var log24 = createLogger("worktree");
 var sessionLog5 = createSessionLog(log24);
+function displayBranchName(name) {
+  return name.replace(/[`\r\n]/g, "").slice(0, 100);
+}
 function parseWorktreeError(error) {
   const message = error instanceof Error ? error.message : String(error);
   const lowerMessage = message.toLowerCase();
@@ -65652,7 +65678,7 @@ async function handleWorktreeBranchResponse(session, branchName, username, respo
     return false;
   }
   if (!isValidBranchName(branchName)) {
-    await postError(session, `Invalid branch name: \`${branchName}\`. Please provide a valid git branch name.`);
+    await postError(session, `Invalid branch name: \`${displayBranchName(branchName)}\`. Please provide a valid git branch name.`);
     sessionLog5(session).warn(`\uD83C\uDF3F Invalid branch name: ${branchName}`);
     return true;
   }
@@ -65696,7 +65722,7 @@ async function createAndSwitchToWorktree(session, branch, username, options) {
   if (!await requireSessionOwner(session, username, "manage worktrees"))
     return;
   if (!isValidBranchName(branch)) {
-    await postError(session, `Invalid branch name: \`${branch}\`. Please provide a valid git branch name.`);
+    await postError(session, `Invalid branch name: \`${displayBranchName(branch)}\`. Please provide a valid git branch name.`);
     sessionLog5(session).warn(`\uD83C\uDF3F Rejected invalid branch name: ${branch}`);
     return;
   }
@@ -67884,7 +67910,10 @@ class SessionRegistry {
   find(platformId, threadId) {
     return this.sessions.get(this.getSessionId(platformId, threadId));
   }
-  findByThreadId(threadId) {
+  findByThreadId(threadId, platformId) {
+    if (platformId !== undefined) {
+      return this.find(platformId, threadId);
+    }
     for (const session of this.sessions.values()) {
       if (session.threadId === threadId) {
         return session;
@@ -75427,7 +75456,7 @@ class SessionManager extends EventEmitter4 {
     return session !== undefined && session.claude.isRunning();
   }
   hasPausedSession(threadId, platformId) {
-    if (this.registry.findByThreadId(threadId))
+    if (this.registry.findByThreadId(threadId, platformId))
       return false;
     return this.registry.getPersistedByThreadId(threadId, platformId) !== undefined;
   }
@@ -75739,7 +75768,7 @@ Mention me to start a session in this worktree.`, threadId);
     }
   }
   isUserAllowedInSession(threadId, username, platformId) {
-    const session = this.findSessionByThreadId(threadId);
+    const session = this.registry.find(platformId, threadId);
     if (!session) {
       const persisted = this.getPersistedSession(threadId, platformId);
       if (persisted) {
@@ -85464,7 +85493,7 @@ async function handleMessage(client, session, post2, user, options) {
       await onKill?.(username);
       return;
     }
-    const activeSession = session.registry.findByThreadId(threadRoot);
+    const activeSession = session.registry.findByThreadId(threadRoot, platformId);
     if (activeSession) {
       const sideMentionActive = leadingOtherUserMention(client, message);
       if (sideMentionActive) {

package/dist/mcp/mcp-server.js

@@ -51310,6 +51310,7 @@ class MessageApprovalExecutor extends BaseExecutor {
         const isInviteAuthorized = pending.sessionOwner !== undefined && user === pending.sessionOwner || ctx.platform.isUserAllowed(user);
         if (!isInviteAuthorized) {
           ctx.logger.info(`Message approval invite (✅) from @${user} downgraded to allow-once: only the session owner may invite`);
+          await ctx.createPost(`ℹ️ Only the session owner can invite ${ctx.formatter.formatUserMention(pending.fromUser)} to the session — allowing this one message instead.`, { type: "system" });
           const handled2 = await this.handleMessageApprovalResponse(postId, "allow", user, ctx);
           ctx.logger.debug(`MessageApprovalExecutor: outcome=allow (invite downgraded), handled=${handled2}`);
           return handled2;
@@ -58100,7 +58101,10 @@ class SessionRegistry {
   find(platformId, threadId) {
     return this.sessions.get(this.getSessionId(platformId, threadId));
   }
-  findByThreadId(threadId) {
+  findByThreadId(threadId, platformId) {
+    if (platformId !== undefined) {
+      return this.find(platformId, threadId);
+    }
     for (const session of this.sessions.values()) {
       if (session.threadId === threadId) {
         return session;

package/docs/CONFIGURATION.md

@@ -382,8 +382,12 @@ confirmation says so.
 
 **Managing:**
 
-- `!routines` — numbered list with schedule, creator, and last-run status
+- `!routines` — numbered list with schedule, creator, last-run status, and
+  the approval posture (👍 approvals · ✅ autonomous)
 - `!routines pause|resume|delete <n>` — owner-gated
+- `!routines approval <n> on|off` — owner-gated; flip the approval posture
+  after creation. `on` restores per-action approval, `off` makes each run
+  autonomous (no approval prompts, even on a `skipPermissions` platform)
 - `!routines run <n>` — fire now, outside the schedule (platform-allowed
   users only — not temporarily `!invite`d guests; does not consume the
   period's scheduled fire)
@@ -452,8 +456,12 @@ all three, and **nothing is saved until someone reacts 👍**.
 
 **Managing:**
 
-- `!watches` — numbered list with condition, creator, and last-fire status
+- `!watches` — numbered list with condition, creator, last-fire status, and
+  the approval posture (👍 approvals · ✅ autonomous)
 - `!watches pause|resume|delete <n>` — owner-gated
+- `!watches approval <n> on|off` — owner-gated; flip the approval posture
+  after creation. `off` makes each fire autonomous — reserve it for triggers
+  you fully trust, since a watch fires on channel content anyone can post
 - (No manual `run` — watches are event-driven; use `!routines run` for
   on-demand work.)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-threads",
-  "version": "1.31.0",
+  "version": "1.31.2",
   "description": "Run Claude Code from Slack or Mattermost. Sessions stream live into threads where your whole team can watch and steer.",
   "main": "dist/index.js",
   "type": "module",