claude-threads 1.34.2 → 1.35.1

package/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.35.1] - 2026-09-08
+
+### Fixed
+- **A finished session no longer leaks its event listeners** (#569, thanks @R09722akaBennett). `TypedEventEmitter.removeAllListeners()` forwarded its optional argument as an explicit `undefined`, which Node's `EventEmitter` reads as "the event named undefined", so `MessageManager.dispose()` removed nothing and every session's closures stayed alive. Invisible in CI because Bun 1.3.3 behaves differently from Node there; Bun 1.4.2 agrees with Node and fails the existing tests on the old code.
+- **The resume notice no longer promises that interrupted work continued** (#571, thanks @kaza; item 1 of #533). After a daemon restart or a platform re-enable, a thread whose turn was in flight was told "You can continue where you left off" while nothing continued: `isProcessing` starts false and nothing is sent to the CLI. The notice now says why the resume happened and, for the two daemon-initiated cases, that anything still running did not survive; only a resume a person asked for keeps the invitation. Attribution to the session owner is gone from the boot path, where nobody was there.
+
+## [1.35.0] - 2026-09-07
+
+### Changed
+- **Sessions no longer get the account's claude.ai connectors** (#560, #563). A bot run under a personal account handed every session in the channel that account's Gmail, Google Drive and Calendar tools, and anyone on `allowedUsers` could use them. The CLI is now started with `disableClaudeAiConnectors` in its inline settings and `ENABLE_CLAUDEAI_MCP_SERVERS=false` in its environment, which removes exactly those (verified on CLI 2.1.112, 2.1.251 and 2.1.263: the connectors vanish, a plugin's MCP server stays). The bot's own haiku one-shots (watch confirms, distillation, parsers, title suggestions, the usage probe) run without them too. Everything else the machine provides still loads: user-level servers, servers bundled with plugins, the repo's `.mcp.json`. Set `claudeAiConnectors: true` on a platform to let them through. If your account has connectors, the bot says so at startup (one free `/usage` probe per account) and the channel sticky shows a `🔌 N claude.ai connectors off` chip, so nobody has to discover the change from a Claude that "has no Gmail tool". Also new: `mcpServers` (top-level or per platform, stdio or http/sse) to declare servers in `config.yaml`, `strictMcpConfig: true` as opt-in hardening that passes `--strict-mcp-config` so a session gets only the bot's own set, a per-session log line of the MCP servers the CLI reported (with a warning when one did not connect, and an in-thread warning when connectors are active on a CLI that ignores the switch), a session-header row when a platform deviates from the default posture, and a note on `!plugin install` when strict mode will keep the plugin's MCP servers from loading.
+
 ## [1.34.2] - 2026-09-06
 
 ### Fixed