claude-threads 1.39.0 → 1.39.2

package/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.39.2] - 2026-10-01
+
+### Fixed
+- **Slack: reacting to a permission prompt works again** (#622, thanks @elganfd). With interactive permissions on Slack every 👍 / ✅ / 👎 on a tool permission prompt was ignored, so the prompt sat until it timed out and denied. Two causes, each enough on its own: the permission server sent its `users.info` lookup as a JSON body, which Slack ignores on read methods, so every reacting user came back `user_not_found` and counted as unauthorized; and it opened a Socket Mode connection of its own, while Slack spreads an app's events over all its connections, so it saw only part of the reactions (and took that part of the bot's own events while a prompt waited). Read methods now go out as GET requests, and the prompt is polled for reactions instead of watched over a second connection. The same JSON-body problem affected `read_post`, `read_thread`, `read_channel_history`, the channel lookups and DM recipient resolution on Slack; those are fixed too. Plan approvals and questions were never affected.
+- **A skin-toned 👍 no longer denies** (#628). Slack names an emoji picked with a skin tone `+1::skin-tone-3`, and the permission prompt treats any emoji it does not recognize as a denial. Emoji are now matched on their base name, which also covers plan approvals and the other reaction controls.
+
+### Security
+- `fast-uri` 4.1.4 → 4.2.1 (#625) and `ip-address` 10.4.0 → 10.7.2 (#626), both bundled into what users run.
+
+### Changed
+- `@modelcontextprotocol/sdk` 1.30.1, `hono` 4.13.9, `ws` 8.22.0 (#624).
+
+## [1.39.1] - 2026-09-25
+
+### Fixed
+- **A long burst or a long code block no longer overflows one post** (#617, #619). When a lot of text reached a reply that already had a post, the part that did not fit went into one new post of any size, and a code block Claude was still writing kept growing the last post without limit. Slack cut such a post off; Mattermost refused it, and the text was posted twice later. Both now split over posts that fit, with code blocks closed and reopened with their language. Normal replies below the limit are unchanged.
+
 ## [1.39.0] - 2026-09-25
 
 ### Added

package/dist/index.js

@@ -5290,8 +5290,8 @@ function buildPermissionArgs(opts) {
         mcpEnv[AGENT_FEATURES_ENV.DCM] = "1";
     }
   }
-  if (opts.platformConfig.appToken) {
-    mcpEnv.PLATFORM_APP_TOKEN = opts.platformConfig.appToken;
+  if (opts.platformConfig.apiUrl) {
+    mcpEnv.PLATFORM_API_URL = opts.platformConfig.apiUrl;
   }
   if (opts.workingDir) {
     mcpEnv[OUTBOUND_ENV.SESSION_WORKING_DIR] = opts.workingDir;
@@ -6032,23 +6032,26 @@ var init_usage = __esm(() => {
 });
 
 // src/utils/emoji.ts
+function withoutSkinTone(emoji) {
+  return emoji.replace(/::skin-tone-\d$/, "");
+}
 function isApprovalEmoji(emoji) {
-  return APPROVAL_EMOJIS.includes(emoji);
+  return APPROVAL_EMOJIS.includes(withoutSkinTone(emoji));
 }
 function isDenialEmoji(emoji) {
-  return DENIAL_EMOJIS.includes(emoji);
+  return DENIAL_EMOJIS.includes(withoutSkinTone(emoji));
 }
 function isAllowAllEmoji(emoji) {
-  return ALLOW_ALL_EMOJIS.includes(emoji);
+  return ALLOW_ALL_EMOJIS.includes(withoutSkinTone(emoji));
 }
 function isCancelEmoji(emoji) {
-  return CANCEL_EMOJIS.includes(emoji);
+  return CANCEL_EMOJIS.includes(withoutSkinTone(emoji));
 }
 function isEscapeEmoji(emoji) {
-  return ESCAPE_EMOJIS.includes(emoji);
+  return ESCAPE_EMOJIS.includes(withoutSkinTone(emoji));
 }
 function isResumeEmoji(emoji) {
-  return RESUME_EMOJIS.includes(emoji);
+  return RESUME_EMOJIS.includes(withoutSkinTone(emoji));
 }
 function isMinimizeToggleEmoji(emoji) {
   return MINIMIZE_TOGGLE_EMOJIS.includes(emoji);
@@ -17137,11 +17140,23 @@ var require_websocket = __commonJS(function(exports, module) {
         this._isServer = false;
         this._redirects = 0;
         if (protocols === undefined) {
-          protocols = [];
+          if (!options || options.protocols === undefined) {
+            protocols = [];
+          } else if (Array.isArray(options.protocols)) {
+            protocols = options.protocols;
+          } else {
+            protocols = [options.protocols];
+          }
         } else if (!Array.isArray(protocols)) {
           if (typeof protocols === "object" && protocols !== null) {
             options = protocols;
-            protocols = [];
+            if (options.protocols === undefined) {
+              protocols = [];
+            } else if (Array.isArray(options.protocols)) {
+              protocols = options.protocols;
+            } else {
+              protocols = [options.protocols];
+            }
           } else {
             protocols = [protocols];
           }
@@ -17260,7 +17275,6 @@ var require_websocket = __commonJS(function(exports, module) {
         }
         return;
       }
-      this._readyState = WebSocket.CLOSING;
       this._sender.close(code, data, !this._isServer, (err) => {
         if (err)
           return;
@@ -17269,6 +17283,7 @@ var require_websocket = __commonJS(function(exports, module) {
           this._socket.end();
         }
       });
+      this._readyState = WebSocket.CLOSING;
       setCloseTimer(this);
     }
     pause() {
@@ -17456,6 +17471,7 @@ var require_websocket = __commonJS(function(exports, module) {
       socketPath: undefined,
       hostname: undefined,
       protocol: undefined,
+      protocols: undefined,
       timeout: undefined,
       method: "GET",
       host: undefined,
@@ -30090,7 +30106,7 @@ var require_react_reconciler = __commonJS(function(exports, module) {
 });
 
 // node_modules/ws/wrapper.mjs
-var import_stream, import_extension, import_permessage_deflate, import_receiver, import_sender, import_subprotocol, import_websocket5, import_websocket_server, wrapper_default;
+var import_stream, import_extension, import_permessage_deflate, import_receiver, import_sender, import_subprotocol, import_websocket4, import_websocket_server, wrapper_default;
 var init_wrapper = __esm(() => {
   import_stream = __toESM(require_stream(), 1);
   import_extension = __toESM(require_extension(), 1);
@@ -30098,9 +30114,9 @@ var init_wrapper = __esm(() => {
   import_receiver = __toESM(require_receiver(), 1);
   import_sender = __toESM(require_sender(), 1);
   import_subprotocol = __toESM(require_subprotocol(), 1);
-  import_websocket5 = __toESM(require_websocket(), 1);
+  import_websocket4 = __toESM(require_websocket(), 1);
   import_websocket_server = __toESM(require_websocket_server(), 1);
-  wrapper_default = import_websocket5.default;
+  wrapper_default = import_websocket4.default;
 });
 
 // node_modules/ink/build/devtools-window-polyfill.js
@@ -60490,26 +60506,51 @@ ${body}` : this.state.header;
         chunkCount: chunks.length,
         reason: "no_currentPostId"
       }, "flush");
-      let lastPosted = null;
-      for (let i = 0;i < chunks.length; i++) {
-        const created = await this.createNewPost(ctx, chunks[i], lastPosted ? "" : pendingAtFlushStart);
-        if (!created) {
-          if (lastPosted) {
-            this.state.pendingContent = chunks.slice(i).join(`
+      await this.postChunks(ctx, chunks, pendingAtFlushStart, false);
+    }
+  }
+  async splitOversized(ctx, content, pendingAtFlushStart, hardThreshold) {
+    const postId = this.state.currentPostId;
+    if (!postId)
+      return false;
+    const reserve = this.headerReserve(postId);
+    if (content.length + reserve <= ctx.platform.getMessageLimits().maxLength)
+      return false;
+    const [firstPiece, ...rest] = splitByLength(content, hardThreshold - reserve);
+    let landed = false;
+    await this.tryUpdatePost(ctx, postId, firstPiece, "handleSplit", { reason: "oversized_code_block", contentLength: content.length, pieces: rest.length + 1 }, { reason: "oversized_code_block_failed" }, () => {
+      landed = true;
+    }, () => {
+      if (postId === this.state.headerPostId)
+        this.state.headerBody = firstPiece;
+    });
+    this.state.currentPostId = null;
+    this.state.currentPostContent = "";
+    if (landed)
+      this.clearFlushedContent(pendingAtFlushStart);
+    await this.postChunks(ctx, rest, pendingAtFlushStart, landed);
+    return true;
+  }
+  async postChunks(ctx, chunks, pendingAtFlushStart, flushCleared) {
+    let cleared = flushCleared;
+    for (let i = 0;i < chunks.length; i++) {
+      const created = await this.createNewPost(ctx, chunks[i], cleared ? "" : pendingAtFlushStart);
+      if (!created) {
+        if (cleared) {
+          this.state.pendingContent = chunks.slice(i).join(`
 
 `) + (this.state.pendingContent ? `
 
 ${this.state.pendingContent}` : "");
-          }
-          this.state.currentPostId = null;
-          this.state.currentPostContent = "";
-          break;
-        }
-        lastPosted = { id: this.state.currentPostId, content: this.state.currentPostContent };
-        if (i < chunks.length - 1) {
-          this.state.currentPostId = null;
-          this.state.currentPostContent = "";
         }
+        this.state.currentPostId = null;
+        this.state.currentPostContent = "";
+        return;
+      }
+      cleared = true;
+      if (i < chunks.length - 1) {
+        this.state.currentPostId = null;
+        this.state.currentPostContent = "";
       }
     }
   }
@@ -60570,6 +60611,8 @@ ${this.state.pendingContent}` : "");
     }
     if (codeBlockOpenPosition !== undefined) {
       if (codeBlockOpenPosition === 0) {
+        if (await this.splitOversized(ctx, content, pendingAtFlushStart, hardThreshold))
+          return;
         if (this.state.currentPostId) {
           const postId = this.state.currentPostId;
           await this.tryUpdatePost(ctx, postId, content, "handleSplit", { reason: "code_block_at_start", contentLength: content.length }, { reason: "code_block_at_start_failed" }, () => {
@@ -60587,6 +60630,8 @@ ${this.state.pendingContent}` : "");
       if (breakBeforeCodeBlock > 0) {
         breakPoint = breakBeforeCodeBlock;
       } else {
+        if (await this.splitOversized(ctx, content, pendingAtFlushStart, hardThreshold))
+          return;
         if (this.state.currentPostId) {
           const postId = this.state.currentPostId;
           await this.tryUpdatePost(ctx, postId, content, "handleSplit", { reason: "no_break_before_code_block", contentLength: content.length }, { reason: "no_break_before_code_block_failed" }, () => {
@@ -60602,9 +60647,12 @@ ${this.state.pendingContent}` : "");
     }
     const firstPart = content.substring(0, breakPoint).trim();
     const remainder = content.substring(breakPoint).trim();
+    let firstPartLanded = false;
     if (this.state.currentPostId) {
       const postId = this.state.currentPostId;
-      await this.tryUpdatePost(ctx, postId, firstPart, "handleSplit", { reason: "split_first_part", firstPartLength: firstPart.length, remainderLength: remainder.length }, { reason: "split_first_part_failed" }, () => {}, () => {
+      await this.tryUpdatePost(ctx, postId, firstPart, "handleSplit", { reason: "split_first_part", firstPartLength: firstPart.length, remainderLength: remainder.length }, { reason: "split_first_part_failed" }, () => {
+        firstPartLanded = true;
+      }, () => {
         if (postId === this.state.headerPostId) {
           this.state.headerBody = firstPart;
         }
@@ -60613,7 +60661,14 @@ ${this.state.pendingContent}` : "");
     this.state.currentPostId = null;
     this.state.currentPostContent = "";
     if (remainder) {
-      await this.createNewPost(ctx, remainder, pendingAtFlushStart);
+      const MAX_POST_LENGTH = ctx.platform.getMessageLimits().maxLength;
+      const reserve = this.headerReserve(null);
+      const chunks = remainder.length + reserve > MAX_POST_LENGTH ? splitByLength(remainder, hardThreshold - reserve) : [remainder];
+      if (firstPartLanded)
+        this.clearFlushedContent(pendingAtFlushStart);
+      await this.postChunks(ctx, chunks, pendingAtFlushStart, firstPartLanded);
+    } else if (firstPartLanded) {
+      this.clearFlushedContent(pendingAtFlushStart);
     }
   }
   async createNewPost(ctx, content, pendingAtFlushStart) {
@@ -71851,6 +71906,7 @@ class SlackClient extends BasePlatformClient {
       channelId: this.channelId,
       allowedUsers: this.allowedUsers,
       appToken: this.appToken,
+      apiUrl: this.apiUrl,
       outboundFiles: this.outboundFiles,
       mcpServers: this.mcpServers,
       strictMcpConfig: this.strictMcpConfig,
@@ -72158,6 +72214,14 @@ var apiLog = createLogger("mm-api");
 
 // src/platform/slack/mcp-platform-api.ts
 init_logger();
+var READ_METHODS = new Set([
+  "users.info",
+  "conversations.history",
+  "conversations.replies",
+  "conversations.info",
+  "conversations.members",
+  "reactions.get"
+]);
 // src/session/manager.ts
 import { EventEmitter as EventEmitter4 } from "events";
 

package/dist/mcp/mcp-server.js

@@ -3547,6 +3547,22 @@ var require_utils = __commonJS(function(exports, module) {
     }
     return output;
   }
+  function recomposeZonedIPv6Host(component) {
+    const zone = component.ipv6Zone;
+    if (zone === undefined)
+      return;
+    const host = component.host;
+    const separator = host.indexOf("%");
+    if (separator === -1)
+      return;
+    const address = host.slice(0, separator);
+    const escaped = address + "%25" + zone;
+    const derived = normalizeIPv6("[" + escaped + "]");
+    if (derived.isIPV6 === true && derived.host === host) {
+      return "[" + escaped + "]";
+    }
+    return;
+  }
   function recomposeAuthority(component) {
     const uriTokens = [];
     if (component.userinfo !== undefined) {
@@ -3556,15 +3572,20 @@ var require_utils = __commonJS(function(exports, module) {
     if (component.host !== undefined) {
       let host = component.host;
       if (!isIPv4(host)) {
-        let ipV6res = normalizeIPv6(host);
-        if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
-          host = normalizePercentEncoding(host, true);
-          ipV6res = normalizeIPv6(host);
-        }
-        if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
-          host = `[${ipV6res.escapedHost}]`;
+        const zonedHost = recomposeZonedIPv6Host(component);
+        if (zonedHost !== undefined) {
+          host = zonedHost;
         } else {
-          host = reescapeHostDelimiters(host, false);
+          let ipV6res = normalizeIPv6(host);
+          if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
+            host = normalizePercentEncoding(host, true);
+            ipV6res = normalizeIPv6(host);
+          }
+          if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
+            host = `[${ipV6res.escapedHost}]`;
+          } else {
+            host = reescapeHostDelimiters(host, false);
+          }
         }
       }
       uriTokens.push(host);
@@ -3777,6 +3798,7 @@ var require_schemes = __commonJS(function(exports, module) {
   var HEX_PAIR = /^[\da-f]{2}$/iu;
   var MAILTO_DOMAIN_LITERAL = /^\[[\x21-\x5A\x5E-\x7E]*\]$/u;
   var MAILTO_DOMAIN_ERROR = "URI mailto has an invalid recipient domain.";
+  var MAILTO_AUTHORITY_ERROR = "URI mailto must not have an authority component.";
   var HAS_SURROGATE = /[\uD800-\uDFFF]/u;
   function decodeHex(str) {
     if (typeof str !== "string" || str.indexOf("%") === -1) {
@@ -3891,30 +3913,37 @@ var require_schemes = __commonJS(function(exports, module) {
           mailtoComponent.error = mailtoComponent.error || "URI mailto has malformed header fields.";
           continue;
         }
-        const name = eqIdx === -1 ? token : token.slice(0, eqIdx);
+        const name = decodeHex(eqIdx === -1 ? token : token.slice(0, eqIdx));
+        const normalizedName = name.toLowerCase();
         const value = eqIdx === -1 ? "" : token.slice(eqIdx + 1);
-        if (name === "to") {
+        if (normalizedName === "to") {
           const addrs = value.split(",");
           for (let j = 0;j < addrs.length; j++)
             to.push(addrs[j]);
           continue;
         }
-        if (name === "subject") {
+        if (normalizedName === "subject") {
           mailtoComponent.subject = decodeHex(value);
           continue;
         }
-        if (name === "body") {
+        if (normalizedName === "body") {
           mailtoComponent.body = decodeHex(value);
           continue;
         }
         if (headers === null)
           headers = Object.create(null);
-        headers[decodeHex(name)] = decodeHex(value);
+        headers[name] = decodeHex(value);
       }
       if (headers !== null)
         mailtoComponent.headers = headers;
     }
     mailtoComponent.query = undefined;
+    if (to.length > 0 && (mailtoComponent.userinfo !== undefined || mailtoComponent.host !== undefined || mailtoComponent.port !== undefined)) {
+      mailtoComponent.userinfo = undefined;
+      mailtoComponent.host = undefined;
+      mailtoComponent.port = undefined;
+      mailtoComponent.error = mailtoComponent.error || MAILTO_AUTHORITY_ERROR;
+    }
     for (let i = 0;i < to.length; i++) {
       const rawAddr = to[i];
       const atIdx = rawAddr.lastIndexOf("@");
@@ -3931,10 +3960,35 @@ var require_schemes = __commonJS(function(exports, module) {
       mailtoComponent.to = to;
     return mailtoComponent;
   }
+  function mailtoEncodeHeaderName(name) {
+    return encodeWithAllow(name.replace(/%/gu, "%25"), HFNAME);
+  }
   function mailtoSerialize(component, options) {
     const mailtoComponent = component;
     const to = Array.isArray(mailtoComponent.to) ? mailtoComponent.to.slice() : [];
+    const sourceHeaders = mailtoComponent.headers && typeof mailtoComponent.headers === "object" ? Object.assign(Object.create(null), mailtoComponent.headers) : Object.create(null);
+    const headers = Object.create(null);
+    for (const name in sourceHeaders) {
+      const normalizedName = name.toLowerCase();
+      if (normalizedName === "to") {
+        const addrs = String(sourceHeaders[name]).split(",");
+        for (let i = 0;i < addrs.length; i++)
+          to.push(addrs[i]);
+      } else if (normalizedName === "subject" || normalizedName === "body") {
+        headers[normalizedName] = sourceHeaders[name];
+      } else {
+        headers[name] = sourceHeaders[name];
+      }
+    }
+    if (mailtoComponent.subject !== undefined)
+      headers.subject = mailtoComponent.subject;
+    if (mailtoComponent.body !== undefined)
+      headers.body = mailtoComponent.body;
+    mailtoComponent.headers = headers;
     if (to.length) {
+      mailtoComponent.userinfo = undefined;
+      mailtoComponent.host = undefined;
+      mailtoComponent.port = undefined;
       for (let i = 0;i < to.length; i++) {
         const addr = String(to[i]);
         const atIdx = addr.lastIndexOf("@");
@@ -3950,18 +4004,12 @@ var require_schemes = __commonJS(function(exports, module) {
     } else {
       mailtoComponent.path = undefined;
     }
-    const headers = mailtoComponent.headers && typeof mailtoComponent.headers === "object" ? Object.assign(Object.create(null), mailtoComponent.headers) : Object.create(null);
-    if (mailtoComponent.subject)
-      headers.subject = mailtoComponent.subject;
-    if (mailtoComponent.body)
-      headers.body = mailtoComponent.body;
-    mailtoComponent.headers = headers;
     let query = "";
     let count = 0;
     for (const name in headers) {
       if (count++ !== 0)
         query += "&";
-      query += encodeWithAllow(name, HFNAME) + "=" + encodeWithAllow(String(headers[name]), HFNAME);
+      query += mailtoEncodeHeaderName(name) + "=" + encodeWithAllow(String(headers[name]), HFNAME);
     }
     if (count !== 0) {
       mailtoComponent.query = query;
@@ -4054,6 +4102,12 @@ var require_fast_uri = __commonJS(function(exports, module) {
     schemelessOptions.skipEscape = true;
     return serialize(resolved, schemelessOptions);
   }
+  function copyHost(target, source) {
+    target.host = source.host;
+    if (source.ipv6Zone !== undefined) {
+      target.ipv6Zone = source.ipv6Zone;
+    }
+  }
   function resolveComponent(base, relative, options, skipNormalization) {
     const target = {};
     if (!skipNormalization) {
@@ -4064,14 +4118,14 @@ var require_fast_uri = __commonJS(function(exports, module) {
     if (!options.tolerant && relative.scheme) {
       target.scheme = relative.scheme;
       target.userinfo = relative.userinfo;
-      target.host = relative.host;
+      copyHost(target, relative);
       target.port = relative.port;
       target.path = removeDotSegments(relative.path || "");
       target.query = relative.query;
     } else {
       if (relative.userinfo !== undefined || relative.host !== undefined || relative.port !== undefined) {
         target.userinfo = relative.userinfo;
-        target.host = relative.host;
+        copyHost(target, relative);
         target.port = relative.port;
         target.path = removeDotSegments(relative.path || "");
         target.query = relative.query;
@@ -4099,7 +4153,7 @@ var require_fast_uri = __commonJS(function(exports, module) {
           target.query = relative.query;
         }
         target.userinfo = base.userinfo;
-        target.host = base.host;
+        copyHost(target, base);
         target.port = base.port;
       }
       target.scheme = base.scheme;
@@ -4115,6 +4169,7 @@ var require_fast_uri = __commonJS(function(exports, module) {
   function serialize(cmpts, opts) {
     const component = {
       host: cmpts.host,
+      ipv6Zone: cmpts.ipv6Zone,
       scheme: cmpts.scheme,
       userinfo: cmpts.userinfo,
       port: cmpts.port,
@@ -4311,6 +4366,9 @@ var require_fast_uri = __commonJS(function(exports, module) {
           isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
           malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
           parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
+          if (isIP && ipv6result.isIPV6 === true && parsed.host.indexOf("%") !== -1) {
+            parsed.ipv6Zone = parsed.host.slice(parsed.host.indexOf("%") + 1);
+          }
           if (malformedIPLiteral) {
             parsed.error = parsed.error || "URI host is malformed.";
             malformedAuthorityOrPort = true;
@@ -4335,13 +4393,14 @@ var require_fast_uri = __commonJS(function(exports, module) {
       if (!malformedIPLiteral) {
         malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
       }
-      if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
-        if (uri.indexOf("%") !== -1) {
-          if (parsed.host !== undefined && !malformedIPLiteral) {
-            const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
-            parsed.host = reescapeHostDelimiters(host, isIP);
-          }
+      if (uri.indexOf("%") !== -1 && parsed.host !== undefined && !malformedIPLiteral) {
+        let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
+        if (!isIP) {
+          host = normalizePercentEncoding(host.toLowerCase());
         }
+        parsed.host = reescapeHostDelimiters(host, isIP);
+      }
+      if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
         if (parsed.path) {
           parsed.path = normalizePathEncoding(parsed.path);
         }
@@ -12663,11 +12722,14 @@ var require_dist = __commonJS(function(exports, module) {
 });
 
 // src/utils/emoji.ts
+function withoutSkinTone(emoji) {
+  return emoji.replace(/::skin-tone-\d$/, "");
+}
 function isApprovalEmoji(emoji) {
-  return APPROVAL_EMOJIS.includes(emoji);
+  return APPROVAL_EMOJIS.includes(withoutSkinTone(emoji));
 }
 function isAllowAllEmoji(emoji) {
-  return ALLOW_ALL_EMOJIS.includes(emoji);
+  return ALLOW_ALL_EMOJIS.includes(withoutSkinTone(emoji));
 }
 var APPROVAL_EMOJIS, DENIAL_EMOJIS, ALLOW_ALL_EMOJIS;
 var init_emoji = __esm(() => {
@@ -17234,11 +17296,23 @@ var require_websocket = __commonJS(function(exports, module) {
         this._isServer = false;
         this._redirects = 0;
         if (protocols === undefined) {
-          protocols = [];
+          if (!options || options.protocols === undefined) {
+            protocols = [];
+          } else if (Array.isArray(options.protocols)) {
+            protocols = options.protocols;
+          } else {
+            protocols = [options.protocols];
+          }
         } else if (!Array.isArray(protocols)) {
           if (typeof protocols === "object" && protocols !== null) {
             options = protocols;
-            protocols = [];
+            if (options.protocols === undefined) {
+              protocols = [];
+            } else if (Array.isArray(options.protocols)) {
+              protocols = options.protocols;
+            } else {
+              protocols = [options.protocols];
+            }
           } else {
             protocols = [protocols];
           }
@@ -17357,7 +17431,6 @@ var require_websocket = __commonJS(function(exports, module) {
         }
         return;
       }
-      this._readyState = WebSocket.CLOSING;
       this._sender.close(code, data, !this._isServer, (err) => {
         if (err)
           return;
@@ -17366,6 +17439,7 @@ var require_websocket = __commonJS(function(exports, module) {
           this._socket.end();
         }
       });
+      this._readyState = WebSocket.CLOSING;
       setCloseTimer(this);
     }
     pause() {
@@ -17553,6 +17627,7 @@ var require_websocket = __commonJS(function(exports, module) {
       socketPath: undefined,
       hostname: undefined,
       protocol: undefined,
+      protocols: undefined,
       timeout: undefined,
       method: "GET",
       host: undefined,
@@ -40251,16 +40326,49 @@ async function uploadFileSlack(args) {
 
 // src/platform/slack/mcp-platform-api.ts
 var SLACK_API_BASE = "https://slack.com/api";
-async function slackApi(method, token, body) {
-  const url = `${SLACK_API_BASE}/${method}`;
-  const response = await fetch(url, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${token}`,
-      "Content-Type": "application/json; charset=utf-8"
-    },
-    body: body ? JSON.stringify(body) : undefined
-  });
+var READ_METHODS = new Set([
+  "users.info",
+  "conversations.history",
+  "conversations.replies",
+  "conversations.info",
+  "conversations.members",
+  "reactions.get"
+]);
+
+class SlackRateLimitError extends Error {
+  retryAfterMs;
+  constructor(retryAfterMs) {
+    super(`Slack API error: 429 rate limited, retry after ${retryAfterMs} ms`);
+    this.retryAfterMs = retryAfterMs;
+  }
+}
+async function slackApi(method, token, args, apiBase = SLACK_API_BASE) {
+  let response;
+  if (READ_METHODS.has(method)) {
+    const query = new URLSearchParams;
+    for (const [key, value] of Object.entries(args ?? {})) {
+      if (value !== undefined && value !== null)
+        query.set(key, String(value));
+    }
+    const qs = query.toString();
+    response = await fetch(`${apiBase}/${method}${qs ? `?${qs}` : ""}`, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${token}` }
+    });
+  } else {
+    response = await fetch(`${apiBase}/${method}`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json; charset=utf-8"
+      },
+      body: args ? JSON.stringify(args) : undefined
+    });
+  }
+  if (response.status === 429) {
+    const seconds = Number(response.headers.get("retry-after"));
+    throw new SlackRateLimitError(Number.isFinite(seconds) && seconds > 0 ? seconds * 1000 : 5000);
+  }
   if (!response.ok) {
     throw new Error(`Slack API error: ${response.status} ${response.statusText}`);
   }
@@ -40272,6 +40380,9 @@ async function slackApi(method, token, body) {
 }
 
 class SlackMcpPlatformApi {
+  slackApi(method, token, args) {
+    return slackApi(method, token, args, this.config.apiUrl || SLACK_API_BASE);
+  }
   config;
   formatter = new SlackFormatter;
   botUserIdCache = null;
@@ -40287,7 +40398,7 @@ class SlackMcpPlatformApi {
       return this.botUserIdCache;
     }
     mcpLogger.debug("Fetching bot user ID via auth.test...");
-    const response = await slackApi("auth.test", this.config.botToken);
+    const response = await this.slackApi("auth.test", this.config.botToken);
     this.botUserIdCache = response.user_id;
     mcpLogger.debug(`Bot user ID: ${response.user_id}`);
     return response.user_id;
@@ -40295,7 +40406,7 @@ class SlackMcpPlatformApi {
   async getUsername(userId) {
     try {
       mcpLogger.debug(`Looking up username for user ${userId}`);
-      const response = await slackApi("users.info", this.config.botToken, { user: userId });
+      const response = await this.slackApi("users.info", this.config.botToken, { user: userId });
       const username = response.user?.name;
       if (username) {
         mcpLogger.debug(`User ${userId} is @${username}`);
@@ -40317,7 +40428,7 @@ class SlackMcpPlatformApi {
   }
   async createInteractivePost(message, reactions, threadTs) {
     mcpLogger.debug(`Creating interactive post with ${reactions.length} reaction options`);
-    const response = await slackApi("chat.postMessage", this.config.botToken, {
+    const response = await this.slackApi("chat.postMessage", this.config.botToken, {
       channel: this.config.channelId,
       text: message,
       thread_ts: resolvePostThreadId(threadTs || this.config.threadTs),
@@ -40328,7 +40439,7 @@ class SlackMcpPlatformApi {
     for (const emoji of reactions) {
       try {
         const emojiName = getEmojiName(emoji);
-        await slackApi("reactions.add", this.config.botToken, {
+        await this.slackApi("reactions.add", this.config.botToken, {
           channel: this.config.channelId,
           timestamp: messageTs,
           name: emojiName
@@ -40342,120 +40453,54 @@ class SlackMcpPlatformApi {
   }
   async updatePost(postId, message) {
     mcpLogger.debug(`Updating post ${postId}`);
-    await slackApi("chat.update", this.config.botToken, {
+    await this.slackApi("chat.update", this.config.botToken, {
       channel: this.config.channelId,
       ts: postId,
       text: message,
       mrkdwn: true
     });
   }
+  reactionPollMs = 2000;
+  reactionSlowAfterMs = 30000;
+  reactionSlowPollMs = 5000;
+  seenTtlMs = 30000;
+  seenReactions = new Map;
   async waitForReaction(postId, botUserId, timeoutMs) {
-    return new Promise((resolve) => {
-      let resolved = false;
-      let ws = null;
-      const cleanup = () => {
-        if (ws && ws.readyState === WS.OPEN) {
-          ws.close();
-        }
-      };
-      const timeout = setTimeout(() => {
-        if (!resolved) {
-          mcpLogger.debug(`Reaction wait timed out after ${timeoutMs}ms`);
-          resolved = true;
-          cleanup();
-          resolve(null);
-        }
-      }, timeoutMs);
-      this.getSocketModeUrl().then((wsUrl) => {
-        if (resolved)
-          return;
-        mcpLogger.debug(`Connecting to Socket Mode: ${wsUrl.substring(0, 50)}...`);
-        ws = new WS(wsUrl);
-        ws.onopen = () => {
-          mcpLogger.debug("Socket Mode WebSocket connected");
-        };
-        ws.onmessage = (event) => {
-          if (resolved)
-            return;
-          try {
-            const data = typeof event.data === "string" ? event.data : event.data.toString();
-            const socketEvent = JSON.parse(data);
-            if (socketEvent.envelope_id) {
-              ws?.send(JSON.stringify({ envelope_id: socketEvent.envelope_id }));
-            }
-            mcpLogger.debug(`Socket Mode event type: ${socketEvent.type}`);
-            if (socketEvent.type === "events_api" && socketEvent.payload?.event) {
-              const slackEvent = socketEvent.payload.event;
-              if (slackEvent.type === "reaction_added") {
-                const item = slackEvent.item;
-                if (item?.type !== "message" || item.ts !== postId || item.channel !== this.config.channelId) {
-                  return;
-                }
-                if (slackEvent.user === botUserId) {
-                  mcpLogger.debug("Ignoring bot's own reaction");
-                  return;
-                }
-                const emojiName = slackEvent.reaction || "";
-                const userId = slackEvent.user || "";
-                mcpLogger.debug(`Reaction received: :${emojiName}: from user: ${userId}`);
-                resolved = true;
-                clearTimeout(timeout);
-                cleanup();
-                resolve({
-                  postId: item.ts,
-                  userId,
-                  emojiName
-                });
-              }
-            }
-            if (socketEvent.type === "hello") {
-              mcpLogger.debug("Socket Mode hello received, connection established");
-            }
-            if (socketEvent.type === "disconnect") {
-              mcpLogger.debug("Socket Mode disconnect requested");
-              if (!resolved) {
-                resolved = true;
-                clearTimeout(timeout);
-                cleanup();
-                resolve(null);
-              }
-            }
-          } catch (err) {
-            mcpLogger.debug(`Error parsing Socket Mode message: ${err}`);
-          }
-        };
-        ws.onerror = (event) => {
-          mcpLogger.error(`Socket Mode WebSocket error: ${formatWebSocketError(event)}`);
-          if (!resolved) {
-            resolved = true;
-            clearTimeout(timeout);
-            cleanup();
-            resolve(null);
-          }
-        };
-        ws.onclose = () => {
-          mcpLogger.debug("Socket Mode WebSocket closed");
-          if (!resolved) {
-            resolved = true;
-            clearTimeout(timeout);
-            resolve(null);
+    const started = Date.now();
+    const deadline = started + timeoutMs;
+    let warned = false;
+    const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, Math.max(0, Math.min(ms, deadline - Date.now()))));
+    while (Date.now() < deadline) {
+      let wait = Date.now() - started >= this.reactionSlowAfterMs ? this.reactionSlowPollMs : this.reactionPollMs;
+      try {
+        const response = await this.slackApi("reactions.get", this.config.botToken, { channel: this.config.channelId, timestamp: postId, full: true });
+        for (const reaction of response.message?.reactions ?? []) {
+          for (const userId of reaction.users ?? []) {
+            if (userId === botUserId)
+              continue;
+            const key = `${postId}|${userId}|${reaction.name}`;
+            const seenAt = this.seenReactions.get(key);
+            if (seenAt !== undefined && Date.now() - seenAt < this.seenTtlMs)
+              continue;
+            this.seenReactions.set(key, Date.now());
+            mcpLogger.debug(`Reaction received: :${reaction.name}: from user: ${userId}`);
+            return { postId, userId, emojiName: reaction.name };
           }
-        };
-      }).catch((err) => {
-        mcpLogger.error(`Failed to get Socket Mode URL: ${err}`);
-        if (!resolved) {
-          resolved = true;
-          clearTimeout(timeout);
-          resolve(null);
         }
-      });
-    });
-  }
-  async getSocketModeUrl() {
-    mcpLogger.debug("Getting Socket Mode WebSocket URL...");
-    const response = await slackApi("apps.connections.open", this.config.appToken);
-    mcpLogger.debug("Got Socket Mode URL");
-    return response.url;
+      } catch (err) {
+        if (err instanceof SlackRateLimitError) {
+          wait = err.retryAfterMs;
+        } else if (!warned) {
+          warned = true;
+          mcpLogger.warn(`reactions.get failed, will keep retrying: ${err}`);
+        } else {
+          mcpLogger.debug(`reactions.get failed, retrying: ${err}`);
+        }
+      }
+      await sleep(wait);
+    }
+    mcpLogger.debug(`Reaction wait timed out after ${timeoutMs}ms`);
+    return null;
   }
   async uploadFile(filePath, threadId, options) {
     const filename = sanitizeFilename(options?.filename ?? filePath);
@@ -40466,14 +40511,15 @@ class SlackMcpPlatformApi {
       threadTs: threadId,
       filePath,
       filename,
-      caption: options?.caption
+      caption: options?.caption,
+      apiUrl: this.config.apiUrl
     });
     return { postId: result.postId };
   }
   async readPost(postId) {
     mcpLogger.debug(`readPost: ts ${postId}`);
     try {
-      const response = await slackApi("conversations.history", this.config.botToken, {
+      const response = await this.slackApi("conversations.history", this.config.botToken, {
         channel: this.config.channelId,
         latest: postId,
         oldest: postId,
@@ -40493,7 +40539,7 @@ class SlackMcpPlatformApi {
   async addReaction(postId, emojiName) {
     const name = getEmojiName(emojiName);
     mcpLogger.debug(`addReaction: :${name}: on ts ${postId}`);
-    await slackApi("reactions.add", this.config.botToken, {
+    await this.slackApi("reactions.add", this.config.botToken, {
       channel: this.config.channelId,
       timestamp: postId,
       name
@@ -40502,7 +40548,7 @@ class SlackMcpPlatformApi {
   async readThread(threadRootId, options) {
     mcpLogger.debug(`readThread: ts ${threadRootId}`);
     try {
-      const response = await slackApi("conversations.replies", this.config.botToken, {
+      const response = await this.slackApi("conversations.replies", this.config.botToken, {
         channel: this.config.channelId,
         ts: threadRootId,
         limit: options?.limit ?? 100
@@ -40525,7 +40571,7 @@ class SlackMcpPlatformApi {
     const limit = options?.limit ?? 20;
     mcpLogger.debug(`readChannelHistory: ${channelId} (limit=${limit})`);
     try {
-      const response = await slackApi("conversations.history", this.config.botToken, {
+      const response = await this.slackApi("conversations.history", this.config.botToken, {
         channel: channelId,
         limit
       });
@@ -40545,7 +40591,7 @@ class SlackMcpPlatformApi {
   async getChannelInfo(channelId) {
     mcpLogger.debug(`getChannelInfo: ${channelId}`);
     try {
-      const response = await slackApi("conversations.info", this.config.botToken, { channel: channelId });
+      const response = await this.slackApi("conversations.info", this.config.botToken, { channel: channelId });
       const ch = response.channel;
       const isPrivate = ch.is_private || ch.is_im || ch.is_mpim || false;
       return {
@@ -40570,7 +40616,7 @@ class SlackMcpPlatformApi {
         };
         if (cursor)
           params.cursor = cursor;
-        const response = await slackApi("conversations.members", this.config.botToken, params);
+        const response = await this.slackApi("conversations.members", this.config.botToken, params);
         all.push(...response.members ?? []);
         cursor = response.response_metadata?.next_cursor;
         if (!cursor)
@@ -40589,7 +40635,7 @@ class SlackMcpPlatformApi {
       return null;
     }
     try {
-      const response = await slackApi("users.info", this.config.botToken, { user: id });
+      const response = await this.slackApi("users.info", this.config.botToken, { user: id });
       return { id: response.user.id, username: response.user.name ?? null };
     } catch (err) {
       mcpLogger.debug(`resolveRecipient ${id} failed: ${err}`);
@@ -40597,9 +40643,9 @@ class SlackMcpPlatformApi {
     }
   }
   async sendDirectMessage(recipientUserId, message) {
-    const opened = await slackApi("conversations.open", this.config.botToken, { users: recipientUserId });
+    const opened = await this.slackApi("conversations.open", this.config.botToken, { users: recipientUserId });
     const dmChannelId = opened.channel.id;
-    const post = await slackApi("chat.postMessage", this.config.botToken, {
+    const post = await this.slackApi("chat.postMessage", this.config.botToken, {
       channel: dmChannelId,
       text: message,
       mrkdwn: true
@@ -41046,7 +41092,8 @@ var SKIP_STANDARD_PERMISSION_PROMPT = new Set([
 var apiConfig = PLATFORM_TYPE === "slack" ? {
   platformType: "slack",
   botToken: PLATFORM_TOKEN,
-  appToken: process.env.PLATFORM_APP_TOKEN || "",
+  appToken: "",
+  apiUrl: process.env.PLATFORM_API_URL || undefined,
   channelId: PLATFORM_CHANNEL_ID,
   threadTs: PLATFORM_THREAD_ID || undefined,
   allowedUsers: ALLOWED_USERS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-threads",
-  "version": "1.39.0",
+  "version": "1.39.2",
   "description": "Run Claude Code from Slack or Mattermost. Sessions stream live into threads where your whole team can watch and steer.",
   "main": "dist/index.js",
   "type": "module",
@@ -24,7 +24,7 @@
     "test:integration:slack:setup": "bun run tests/integration/fixtures/slack/mock-server.ts &",
     "test:integration:slack:run": "TEST_PLATFORMS=slack INTEGRATION_TEST=1 bun test tests/integration/suites --timeout 120000",
     "test:integration:slack:teardown": "pkill -f 'mock-server.ts' || true",
-    "test:integration:slack": "bun run test:integration:slack:teardown; bun run tests/integration/fixtures/slack/mock-server.ts & sleep 2 && TEST_PLATFORMS=slack INTEGRATION_TEST=1 bun test tests/integration/suites --timeout 120000; bun run test:integration:slack:teardown",
+    "test:integration:slack": "bun run test:integration:slack:teardown; bun run tests/integration/fixtures/slack/mock-server.ts & sleep 2 && TEST_PLATFORMS=slack INTEGRATION_TEST=1 bun test tests/integration/suites --timeout 120000; status=$?; bun run test:integration:slack:teardown; exit $status",
     "test:integration:all": "bun run test:integration:setup && bun run tests/integration/fixtures/slack/mock-server.ts & sleep 2 && TEST_PLATFORMS=mattermost,slack INTEGRATION_TEST=1 bun test tests/integration/suites --timeout 120000; bun run test:integration:slack:teardown",
     "lint": "eslint src/",
     "lint:fix": "eslint src/ --fix",
@@ -78,7 +78,7 @@
     "cross-spawn": "^7.0.6",
     "diff": "^8.0.3",
     "express-rate-limit": "^8.3.0",
-    "hono": "4.13.8",
+    "hono": "4.13.9",
     "ink": "^6.6.0",
     "ink-scroll-view": "^0.3.5",
     "js-yaml": "^4.3.1",
@@ -86,7 +86,7 @@
     "react": "^19.2.3",
     "semver": "7.8.5",
     "update-notifier": "^7.3.1",
-    "ws": "8.21.3",
+    "ws": "8.22.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {
@@ -102,7 +102,7 @@
     "@types/ws": "^8.18.0",
     "eslint": "^10.7.0",
     "husky": "^9.1.7",
-    "knip": "6.37.0",
+    "knip": "6.38.0",
     "lint-staged": "^17.0.4",
     "prettier": "^3.9.5",
     "react-devtools-core": "^8.0.0",
@@ -126,7 +126,7 @@
     "flatted": ">=3.4.0",
     "picomatch": ">=2.3.2",
     "path-to-regexp": ">=8.4.0",
-    "fast-uri": ">=4.1.4",
+    "fast-uri": ">=4.2.1",
     "brace-expansion": ">=5.0.9",
     "ip-address": ">=10.3.1",
     "ws": "$ws",
@@ -139,7 +139,7 @@
     "flatted": ">=3.4.0",
     "picomatch": ">=2.3.2",
     "path-to-regexp": ">=8.4.0",
-    "fast-uri": ">=4.1.4",
+    "fast-uri": ">=4.2.1",
     "brace-expansion": ">=5.0.9",
     "ip-address": ">=10.3.1",
     "ws": "$ws",