claude-threads 1.39.1 → 1.39.3

package/CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.39.3] - 2026-10-01
+
+### Fixed
+- **Mattermost: a skin-toned 👍 no longer denies** (#629). Mattermost names an emoji picked with a skin tone `+1_medium_skin_tone` (verified against Mattermost v11), and the permission prompt treats any emoji it does not recognize as a denial. 1.39.2 fixed Slack's `+1::skin-tone-3` form; the Mattermost form is now matched on its base name too, for permission prompts, plan approvals and the other reaction controls.
+- **One failed update no longer turns a code block into a post per flush** (#620). When the platform refused an update of the post Claude was writing a code block into, the bot gave up on that post at once. The continuation started in the middle of the block without its opening fence, so the rest rendered as prose, the height check split it every few lines (a new post per flush, close to 200 posts for a 2000-line file), and the closing fence opened a new block. A failed update is now retried on the next flush, which recovers the post completely for a passing error; only after three failures in a row is the post given up, with its code block reopened at the start of the next one.
+
+## [1.39.2] - 2026-10-01
+
+### Fixed
+- **Slack: reacting to a permission prompt works again** (#622, thanks @elganfd). With interactive permissions on Slack every 👍 / ✅ / 👎 on a tool permission prompt was ignored, so the prompt sat until it timed out and denied. Two causes, each enough on its own: the permission server sent its `users.info` lookup as a JSON body, which Slack ignores on read methods, so every reacting user came back `user_not_found` and counted as unauthorized; and it opened a Socket Mode connection of its own, while Slack spreads an app's events over all its connections, so it saw only part of the reactions (and took that part of the bot's own events while a prompt waited). Read methods now go out as GET requests, and the prompt is polled for reactions instead of watched over a second connection. The same JSON-body problem affected `read_post`, `read_thread`, `read_channel_history`, the channel lookups and DM recipient resolution on Slack; those are fixed too. Plan approvals and questions were never affected.
+- **A skin-toned 👍 no longer denies** (#628). Slack names an emoji picked with a skin tone `+1::skin-tone-3`, and the permission prompt treats any emoji it does not recognize as a denial. Emoji are now matched on their base name, which also covers plan approvals and the other reaction controls.
+
+### Security
+- `fast-uri` 4.1.4 → 4.2.1 (#625) and `ip-address` 10.4.0 → 10.7.2 (#626), both bundled into what users run.
+
+### Changed
+- `@modelcontextprotocol/sdk` 1.30.1, `hono` 4.13.9, `ws` 8.22.0 (#624).
+
 ## [1.39.1] - 2026-09-25
 
 ### Fixed

package/dist/index.js

@@ -5290,8 +5290,8 @@ function buildPermissionArgs(opts) {
         mcpEnv[AGENT_FEATURES_ENV.DCM] = "1";
     }
   }
-  if (opts.platformConfig.appToken) {
-    mcpEnv.PLATFORM_APP_TOKEN = opts.platformConfig.appToken;
+  if (opts.platformConfig.apiUrl) {
+    mcpEnv.PLATFORM_API_URL = opts.platformConfig.apiUrl;
   }
   if (opts.workingDir) {
     mcpEnv[OUTBOUND_ENV.SESSION_WORKING_DIR] = opts.workingDir;
@@ -6032,23 +6032,26 @@ var init_usage = __esm(() => {
 });
 
 // src/utils/emoji.ts
+function withoutSkinTone(emoji) {
+  return emoji.replace(/::skin-tone-\d$/, "").replace(/(?<=.)_(?:light|medium_light|medium|medium_dark|dark)_skin_tone$/, "");
+}
 function isApprovalEmoji(emoji) {
-  return APPROVAL_EMOJIS.includes(emoji);
+  return APPROVAL_EMOJIS.includes(withoutSkinTone(emoji));
 }
 function isDenialEmoji(emoji) {
-  return DENIAL_EMOJIS.includes(emoji);
+  return DENIAL_EMOJIS.includes(withoutSkinTone(emoji));
 }
 function isAllowAllEmoji(emoji) {
-  return ALLOW_ALL_EMOJIS.includes(emoji);
+  return ALLOW_ALL_EMOJIS.includes(withoutSkinTone(emoji));
 }
 function isCancelEmoji(emoji) {
-  return CANCEL_EMOJIS.includes(emoji);
+  return CANCEL_EMOJIS.includes(withoutSkinTone(emoji));
 }
 function isEscapeEmoji(emoji) {
-  return ESCAPE_EMOJIS.includes(emoji);
+  return ESCAPE_EMOJIS.includes(withoutSkinTone(emoji));
 }
 function isResumeEmoji(emoji) {
-  return RESUME_EMOJIS.includes(emoji);
+  return RESUME_EMOJIS.includes(withoutSkinTone(emoji));
 }
 function isMinimizeToggleEmoji(emoji) {
   return MINIMIZE_TOGGLE_EMOJIS.includes(emoji);
@@ -17137,11 +17140,23 @@ var require_websocket = __commonJS(function(exports, module) {
         this._isServer = false;
         this._redirects = 0;
         if (protocols === undefined) {
-          protocols = [];
+          if (!options || options.protocols === undefined) {
+            protocols = [];
+          } else if (Array.isArray(options.protocols)) {
+            protocols = options.protocols;
+          } else {
+            protocols = [options.protocols];
+          }
         } else if (!Array.isArray(protocols)) {
           if (typeof protocols === "object" && protocols !== null) {
             options = protocols;
-            protocols = [];
+            if (options.protocols === undefined) {
+              protocols = [];
+            } else if (Array.isArray(options.protocols)) {
+              protocols = options.protocols;
+            } else {
+              protocols = [options.protocols];
+            }
           } else {
             protocols = [protocols];
           }
@@ -17260,7 +17275,6 @@ var require_websocket = __commonJS(function(exports, module) {
         }
         return;
       }
-      this._readyState = WebSocket.CLOSING;
       this._sender.close(code, data, !this._isServer, (err) => {
         if (err)
           return;
@@ -17269,6 +17283,7 @@ var require_websocket = __commonJS(function(exports, module) {
           this._socket.end();
         }
       });
+      this._readyState = WebSocket.CLOSING;
       setCloseTimer(this);
     }
     pause() {
@@ -17456,6 +17471,7 @@ var require_websocket = __commonJS(function(exports, module) {
       socketPath: undefined,
       hostname: undefined,
       protocol: undefined,
+      protocols: undefined,
       timeout: undefined,
       method: "GET",
       host: undefined,
@@ -30090,7 +30106,7 @@ var require_react_reconciler = __commonJS(function(exports, module) {
 });
 
 // node_modules/ws/wrapper.mjs
-var import_stream, import_extension, import_permessage_deflate, import_receiver, import_sender, import_subprotocol, import_websocket5, import_websocket_server, wrapper_default;
+var import_stream, import_extension, import_permessage_deflate, import_receiver, import_sender, import_subprotocol, import_websocket4, import_websocket_server, wrapper_default;
 var init_wrapper = __esm(() => {
   import_stream = __toESM(require_stream(), 1);
   import_extension = __toESM(require_extension(), 1);
@@ -30098,9 +30114,9 @@ var init_wrapper = __esm(() => {
   import_receiver = __toESM(require_receiver(), 1);
   import_sender = __toESM(require_sender(), 1);
   import_subprotocol = __toESM(require_subprotocol(), 1);
-  import_websocket5 = __toESM(require_websocket(), 1);
+  import_websocket4 = __toESM(require_websocket(), 1);
   import_websocket_server = __toESM(require_websocket_server(), 1);
-  wrapper_default = import_websocket5.default;
+  wrapper_default = import_websocket4.default;
 });
 
 // node_modules/ink/build/devtools-window-polyfill.js
@@ -60281,7 +60297,8 @@ class ContentExecutor extends BaseExecutor {
       headerPostId: null,
       headerBody: "",
       turnOpen: false,
-      paragraphBreak: false
+      paragraphBreak: false,
+      updateFailures: 0
     };
   }
   setHeader(line) {
@@ -60302,6 +60319,7 @@ class ContentExecutor extends BaseExecutor {
     this.state.headerPostId = null;
     this.state.headerBody = "";
     this.state.turnOpen = false;
+    this.state.updateFailures = 0;
   }
   getRenderedCurrentPost() {
     const postId = this.state.currentPostId;
@@ -60328,7 +60346,9 @@ ${body}` : this.state.header;
     this.state.headerDirty = false;
     if (this.state.headerPostId) {
       const postId = this.state.headerPostId;
+      const failures = this.state.updateFailures;
       await this.tryUpdatePost(ctx, postId, this.state.headerBody, "header", { reason: "header_update", headerLength: this.state.header?.length ?? 0 }, { reason: "header_update_failed" }, () => {}, () => {});
+      this.state.updateFailures = failures;
       return;
     }
     if (this.state.header && this.state.turnOpen) {
@@ -60351,6 +60371,7 @@ ${body}` : this.state.header;
         this.state.headerBody = content;
         this.state.headerDirty = false;
       }
+      this.state.updateFailures = 0;
       onSuccess();
       ctx.threadLogger?.logExecutor("content", "update", postId, successDetails, logTag);
     } catch (err) {
@@ -60363,8 +60384,11 @@ ${body}` : this.state.header;
   closeCurrentPost(ctx) {
     const oldPostId = this.state.currentPostId;
     const contentLength = this.state.currentPostContent.length;
+    if (this.state.updateFailures > 0 && this.state.pendingContent.trim())
+      this.giveUpCurrentPost();
     this.state.currentPostId = null;
     this.state.currentPostContent = "";
+    this.state.updateFailures = 0;
     if (ctx?.threadLogger && oldPostId) {
       ctx.threadLogger.logExecutor("content", "close", oldPostId, {
         contentLength,
@@ -60420,13 +60444,22 @@ ${body}` : this.state.header;
         this.state.turnOpen = false;
       return;
     }
-    await this.flushPending(ctx);
-    if (this.state.headerDirty)
+    const postBefore = this.state.currentPostId;
+    await this.flushPending(ctx, reason);
+    if (reason === "result") {
+      if (this.state.updateFailures > 0 && this.state.currentPostId !== null && this.state.pendingContent.trim()) {
+        await this.flushPending(ctx, reason);
+      }
+      if (postBefore !== null && this.state.currentPostId === null && this.state.pendingContent.trim()) {
+        await this.flushPending(ctx, reason);
+      }
+    }
+    if (this.state.headerDirty && this.state.updateFailures === 0)
       await this.renderHeaderOnly(ctx);
     if (reason === "result")
       this.state.turnOpen = false;
   }
-  async flushPending(ctx) {
+  async flushPending(ctx, reason) {
     const pendingAtFlushStart = this.state.pendingContent;
     let content = ctx.formatter.formatMarkdown(pendingAtFlushStart).trim();
     const { maxLength: MAX_POST_LENGTH, hardThreshold: HARD_CONTINUATION_THRESHOLD } = ctx.platform.getMessageLimits();
@@ -60444,7 +60477,7 @@ ${body}` : this.state.header;
     const shouldBreakEarly = this.state.currentPostId && combinedContent.length > MIN_BREAK_THRESHOLD && ctx.contentBreaker.shouldFlushEarly(combinedContent);
     const reserve = this.headerReserve(this.state.currentPostId);
     if (this.state.currentPostId && (combinedContent.length + reserve > HARD_CONTINUATION_THRESHOLD || shouldBreakEarly)) {
-      await this.handleSplit(ctx, combinedContent, pendingAtFlushStart, HARD_CONTINUATION_THRESHOLD);
+      await this.handleSplit(ctx, combinedContent, pendingAtFlushStart, HARD_CONTINUATION_THRESHOLD, reason);
       return;
     }
     if (this.state.currentPostId && content.length + reserve > MAX_POST_LENGTH) {
@@ -60479,10 +60512,7 @@ ${body}` : this.state.header;
       await this.tryUpdatePost(ctx, postId, combinedContent, "flush", { newContentLength: content.length, combinedLength: combinedContent.length }, (err) => ({ failedOp: "updatePost", error: String(err) }), () => {
         this.state.currentPostContent = combinedContent;
         this.clearFlushedContent(pendingAtFlushStart);
-      }, () => {
-        this.state.currentPostId = null;
-        this.state.currentPostContent = "";
-      });
+      }, () => this.onInPlaceUpdateFailed(reason));
     } else {
       const chunks = splitContentForHeight(content, ctx.contentBreaker).flatMap((chunk) => chunk.length + reserve > MAX_POST_LENGTH ? splitByLength(chunk, HARD_CONTINUATION_THRESHOLD - reserve) : [chunk]);
       ctx.threadLogger?.logExecutor("content", "create_start", "none", {
@@ -60493,7 +60523,7 @@ ${body}` : this.state.header;
       await this.postChunks(ctx, chunks, pendingAtFlushStart, false);
     }
   }
-  async splitOversized(ctx, content, pendingAtFlushStart, hardThreshold) {
+  async splitOversized(ctx, content, pendingAtFlushStart, hardThreshold, reason) {
     const postId = this.state.currentPostId;
     if (!postId)
       return false;
@@ -60504,17 +60534,35 @@ ${body}` : this.state.header;
     let landed = false;
     await this.tryUpdatePost(ctx, postId, firstPiece, "handleSplit", { reason: "oversized_code_block", contentLength: content.length, pieces: rest.length + 1 }, { reason: "oversized_code_block_failed" }, () => {
       landed = true;
-    }, () => {
-      if (postId === this.state.headerPostId)
-        this.state.headerBody = firstPiece;
-    });
+    }, () => {});
+    if (!landed) {
+      this.onInPlaceUpdateFailed(reason);
+      return true;
+    }
     this.state.currentPostId = null;
     this.state.currentPostContent = "";
-    if (landed)
-      this.clearFlushedContent(pendingAtFlushStart);
-    await this.postChunks(ctx, rest, pendingAtFlushStart, landed);
+    this.clearFlushedContent(pendingAtFlushStart);
+    await this.postChunks(ctx, rest, pendingAtFlushStart, true);
     return true;
   }
+  onInPlaceUpdateFailed(reason) {
+    this.state.updateFailures++;
+    const limit = reason === "result" ? 2 : MAX_IN_PLACE_UPDATE_FAILURES;
+    if (this.state.updateFailures < limit)
+      return;
+    this.giveUpCurrentPost();
+  }
+  giveUpCurrentPost() {
+    const opener = openFenceOf(this.state.currentPostContent);
+    this.state.currentPostId = null;
+    this.state.currentPostContent = "";
+    this.state.updateFailures = 0;
+    if (!opener)
+      return;
+    const rest = this.state.pendingContent.replace(/^\n+/, "");
+    this.state.pendingContent = /^```[ \t]*(\n|$)/.test(rest) ? rest.replace(/^```[ \t]*\n?/, "") : `${opener}
+${rest}`;
+  }
   async postChunks(ctx, chunks, pendingAtFlushStart, flushCleared) {
     let cleared = flushCleared;
     for (let i = 0;i < chunks.length; i++) {
@@ -60538,7 +60586,7 @@ ${this.state.pendingContent}` : "");
       }
     }
   }
-  async handleSplit(ctx, content, pendingAtFlushStart, hardThreshold) {
+  async handleSplit(ctx, content, pendingAtFlushStart, hardThreshold, reason) {
     let breakPoint;
     let codeBlockOpenPosition;
     if (content.length > hardThreshold) {
@@ -60586,26 +60634,21 @@ ${this.state.pendingContent}` : "");
           await this.tryUpdatePost(ctx, postId, content, "handleSplit", { reason: "soft_break_no_breakpoint", contentLength: content.length }, { reason: "soft_break_no_breakpoint_failed" }, () => {
             this.state.currentPostContent = content;
             this.clearFlushedContent(pendingAtFlushStart);
-          }, () => {
-            this.state.currentPostId = null;
-          });
+          }, () => this.onInPlaceUpdateFailed(reason));
         }
         return;
       }
     }
     if (codeBlockOpenPosition !== undefined) {
       if (codeBlockOpenPosition === 0) {
-        if (await this.splitOversized(ctx, content, pendingAtFlushStart, hardThreshold))
+        if (await this.splitOversized(ctx, content, pendingAtFlushStart, hardThreshold, reason))
           return;
         if (this.state.currentPostId) {
           const postId = this.state.currentPostId;
           await this.tryUpdatePost(ctx, postId, content, "handleSplit", { reason: "code_block_at_start", contentLength: content.length }, { reason: "code_block_at_start_failed" }, () => {
             this.state.currentPostContent = content;
             this.clearFlushedContent(pendingAtFlushStart);
-          }, () => {
-            this.state.currentPostId = null;
-            this.state.currentPostContent = "";
-          });
+          }, () => this.onInPlaceUpdateFailed(reason));
         }
         return;
       }
@@ -60614,17 +60657,14 @@ ${this.state.pendingContent}` : "");
       if (breakBeforeCodeBlock > 0) {
         breakPoint = breakBeforeCodeBlock;
       } else {
-        if (await this.splitOversized(ctx, content, pendingAtFlushStart, hardThreshold))
+        if (await this.splitOversized(ctx, content, pendingAtFlushStart, hardThreshold, reason))
           return;
         if (this.state.currentPostId) {
           const postId = this.state.currentPostId;
           await this.tryUpdatePost(ctx, postId, content, "handleSplit", { reason: "no_break_before_code_block", contentLength: content.length }, { reason: "no_break_before_code_block_failed" }, () => {
             this.state.currentPostContent = content;
             this.clearFlushedContent(pendingAtFlushStart);
-          }, () => {
-            this.state.currentPostId = null;
-            this.state.currentPostContent = "";
-          });
+          }, () => this.onInPlaceUpdateFailed(reason));
         }
         return;
       }
@@ -60636,11 +60676,11 @@ ${this.state.pendingContent}` : "");
       const postId = this.state.currentPostId;
       await this.tryUpdatePost(ctx, postId, firstPart, "handleSplit", { reason: "split_first_part", firstPartLength: firstPart.length, remainderLength: remainder.length }, { reason: "split_first_part_failed" }, () => {
         firstPartLanded = true;
-      }, () => {
-        if (postId === this.state.headerPostId) {
-          this.state.headerBody = firstPart;
-        }
-      });
+      }, () => {});
+      if (!firstPartLanded) {
+        this.onInPlaceUpdateFailed(reason);
+        return;
+      }
     }
     this.state.currentPostId = null;
     this.state.currentPostContent = "";
@@ -60673,6 +60713,7 @@ ${content}` : header : content;
       if (bumpedPostId) {
         adoptAsHeaderPost(bumpedPostId);
         this.state.currentPostId = bumpedPostId;
+        this.state.updateFailures = 0;
         this.state.currentPostContent = content;
         this.clearFlushedContent(pendingAtFlushStart);
         ctx.threadLogger?.logExecutor("content", "create", bumpedPostId, {
@@ -60689,6 +60730,7 @@ ${content}` : header : content;
       const post = await ctx.createPost(rendered, { type: "content" });
       adoptAsHeaderPost(post.id);
       this.state.currentPostId = post.id;
+      this.state.updateFailures = 0;
       this.state.currentPostContent = content;
       this.clearFlushedContent(pendingAtFlushStart);
       ctx.logger.debug(`Created post ${formatShortId(post.id)}`);
@@ -60714,6 +60756,11 @@ ${content}` : header : content;
   }
 }
 var FENCE_LINE = /^```.*$/gm;
+var MAX_IN_PLACE_UPDATE_FAILURES = 3;
+function openFenceOf(text) {
+  const fences = text.match(FENCE_LINE) ?? [];
+  return fences.length % 2 === 1 ? fences[fences.length - 1] : null;
+}
 var FENCE_CLOSE = "\n```";
 function splitByLength(text, max) {
   const room = max - FENCE_CLOSE.length;
@@ -71889,7 +71936,7 @@ class SlackClient extends BasePlatformClient {
       token: this.botToken,
       channelId: this.channelId,
       allowedUsers: this.allowedUsers,
-      appToken: this.appToken,
+      apiUrl: this.apiUrl,
       outboundFiles: this.outboundFiles,
       mcpServers: this.mcpServers,
       strictMcpConfig: this.strictMcpConfig,
@@ -72197,6 +72244,14 @@ var apiLog = createLogger("mm-api");
 
 // src/platform/slack/mcp-platform-api.ts
 init_logger();
+var READ_METHODS = new Set([
+  "users.info",
+  "conversations.history",
+  "conversations.replies",
+  "conversations.info",
+  "conversations.members",
+  "reactions.get"
+]);
 // src/session/manager.ts
 import { EventEmitter as EventEmitter4 } from "events";
 

package/dist/mcp/mcp-server.js

@@ -3547,6 +3547,22 @@ var require_utils = __commonJS(function(exports, module) {
     }
     return output;
   }
+  function recomposeZonedIPv6Host(component) {
+    const zone = component.ipv6Zone;
+    if (zone === undefined)
+      return;
+    const host = component.host;
+    const separator = host.indexOf("%");
+    if (separator === -1)
+      return;
+    const address = host.slice(0, separator);
+    const escaped = address + "%25" + zone;
+    const derived = normalizeIPv6("[" + escaped + "]");
+    if (derived.isIPV6 === true && derived.host === host) {
+      return "[" + escaped + "]";
+    }
+    return;
+  }
   function recomposeAuthority(component) {
     const uriTokens = [];
     if (component.userinfo !== undefined) {
@@ -3556,15 +3572,20 @@ var require_utils = __commonJS(function(exports, module) {
     if (component.host !== undefined) {
       let host = component.host;
       if (!isIPv4(host)) {
-        let ipV6res = normalizeIPv6(host);
-        if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
-          host = normalizePercentEncoding(host, true);
-          ipV6res = normalizeIPv6(host);
-        }
-        if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
-          host = `[${ipV6res.escapedHost}]`;
+        const zonedHost = recomposeZonedIPv6Host(component);
+        if (zonedHost !== undefined) {
+          host = zonedHost;
         } else {
-          host = reescapeHostDelimiters(host, false);
+          let ipV6res = normalizeIPv6(host);
+          if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
+            host = normalizePercentEncoding(host, true);
+            ipV6res = normalizeIPv6(host);
+          }
+          if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
+            host = `[${ipV6res.escapedHost}]`;
+          } else {
+            host = reescapeHostDelimiters(host, false);
+          }
         }
       }
       uriTokens.push(host);
@@ -3777,6 +3798,7 @@ var require_schemes = __commonJS(function(exports, module) {
   var HEX_PAIR = /^[\da-f]{2}$/iu;
   var MAILTO_DOMAIN_LITERAL = /^\[[\x21-\x5A\x5E-\x7E]*\]$/u;
   var MAILTO_DOMAIN_ERROR = "URI mailto has an invalid recipient domain.";
+  var MAILTO_AUTHORITY_ERROR = "URI mailto must not have an authority component.";
   var HAS_SURROGATE = /[\uD800-\uDFFF]/u;
   function decodeHex(str) {
     if (typeof str !== "string" || str.indexOf("%") === -1) {
@@ -3891,30 +3913,37 @@ var require_schemes = __commonJS(function(exports, module) {
           mailtoComponent.error = mailtoComponent.error || "URI mailto has malformed header fields.";
           continue;
         }
-        const name = eqIdx === -1 ? token : token.slice(0, eqIdx);
+        const name = decodeHex(eqIdx === -1 ? token : token.slice(0, eqIdx));
+        const normalizedName = name.toLowerCase();
         const value = eqIdx === -1 ? "" : token.slice(eqIdx + 1);
-        if (name === "to") {
+        if (normalizedName === "to") {
           const addrs = value.split(",");
           for (let j = 0;j < addrs.length; j++)
             to.push(addrs[j]);
           continue;
         }
-        if (name === "subject") {
+        if (normalizedName === "subject") {
           mailtoComponent.subject = decodeHex(value);
           continue;
         }
-        if (name === "body") {
+        if (normalizedName === "body") {
           mailtoComponent.body = decodeHex(value);
           continue;
         }
         if (headers === null)
           headers = Object.create(null);
-        headers[decodeHex(name)] = decodeHex(value);
+        headers[name] = decodeHex(value);
       }
       if (headers !== null)
         mailtoComponent.headers = headers;
     }
     mailtoComponent.query = undefined;
+    if (to.length > 0 && (mailtoComponent.userinfo !== undefined || mailtoComponent.host !== undefined || mailtoComponent.port !== undefined)) {
+      mailtoComponent.userinfo = undefined;
+      mailtoComponent.host = undefined;
+      mailtoComponent.port = undefined;
+      mailtoComponent.error = mailtoComponent.error || MAILTO_AUTHORITY_ERROR;
+    }
     for (let i = 0;i < to.length; i++) {
       const rawAddr = to[i];
       const atIdx = rawAddr.lastIndexOf("@");
@@ -3931,10 +3960,35 @@ var require_schemes = __commonJS(function(exports, module) {
       mailtoComponent.to = to;
     return mailtoComponent;
   }
+  function mailtoEncodeHeaderName(name) {
+    return encodeWithAllow(name.replace(/%/gu, "%25"), HFNAME);
+  }
   function mailtoSerialize(component, options) {
     const mailtoComponent = component;
     const to = Array.isArray(mailtoComponent.to) ? mailtoComponent.to.slice() : [];
+    const sourceHeaders = mailtoComponent.headers && typeof mailtoComponent.headers === "object" ? Object.assign(Object.create(null), mailtoComponent.headers) : Object.create(null);
+    const headers = Object.create(null);
+    for (const name in sourceHeaders) {
+      const normalizedName = name.toLowerCase();
+      if (normalizedName === "to") {
+        const addrs = String(sourceHeaders[name]).split(",");
+        for (let i = 0;i < addrs.length; i++)
+          to.push(addrs[i]);
+      } else if (normalizedName === "subject" || normalizedName === "body") {
+        headers[normalizedName] = sourceHeaders[name];
+      } else {
+        headers[name] = sourceHeaders[name];
+      }
+    }
+    if (mailtoComponent.subject !== undefined)
+      headers.subject = mailtoComponent.subject;
+    if (mailtoComponent.body !== undefined)
+      headers.body = mailtoComponent.body;
+    mailtoComponent.headers = headers;
     if (to.length) {
+      mailtoComponent.userinfo = undefined;
+      mailtoComponent.host = undefined;
+      mailtoComponent.port = undefined;
       for (let i = 0;i < to.length; i++) {
         const addr = String(to[i]);
         const atIdx = addr.lastIndexOf("@");
@@ -3950,18 +4004,12 @@ var require_schemes = __commonJS(function(exports, module) {
     } else {
       mailtoComponent.path = undefined;
     }
-    const headers = mailtoComponent.headers && typeof mailtoComponent.headers === "object" ? Object.assign(Object.create(null), mailtoComponent.headers) : Object.create(null);
-    if (mailtoComponent.subject)
-      headers.subject = mailtoComponent.subject;
-    if (mailtoComponent.body)
-      headers.body = mailtoComponent.body;
-    mailtoComponent.headers = headers;
     let query = "";
     let count = 0;
     for (const name in headers) {
       if (count++ !== 0)
         query += "&";
-      query += encodeWithAllow(name, HFNAME) + "=" + encodeWithAllow(String(headers[name]), HFNAME);
+      query += mailtoEncodeHeaderName(name) + "=" + encodeWithAllow(String(headers[name]), HFNAME);
     }
     if (count !== 0) {
       mailtoComponent.query = query;
@@ -4054,6 +4102,12 @@ var require_fast_uri = __commonJS(function(exports, module) {
     schemelessOptions.skipEscape = true;
     return serialize(resolved, schemelessOptions);
   }
+  function copyHost(target, source) {
+    target.host = source.host;
+    if (source.ipv6Zone !== undefined) {
+      target.ipv6Zone = source.ipv6Zone;
+    }
+  }
   function resolveComponent(base, relative, options, skipNormalization) {
     const target = {};
     if (!skipNormalization) {
@@ -4064,14 +4118,14 @@ var require_fast_uri = __commonJS(function(exports, module) {
     if (!options.tolerant && relative.scheme) {
       target.scheme = relative.scheme;
       target.userinfo = relative.userinfo;
-      target.host = relative.host;
+      copyHost(target, relative);
       target.port = relative.port;
       target.path = removeDotSegments(relative.path || "");
       target.query = relative.query;
     } else {
       if (relative.userinfo !== undefined || relative.host !== undefined || relative.port !== undefined) {
         target.userinfo = relative.userinfo;
-        target.host = relative.host;
+        copyHost(target, relative);
         target.port = relative.port;
         target.path = removeDotSegments(relative.path || "");
         target.query = relative.query;
@@ -4099,7 +4153,7 @@ var require_fast_uri = __commonJS(function(exports, module) {
           target.query = relative.query;
         }
         target.userinfo = base.userinfo;
-        target.host = base.host;
+        copyHost(target, base);
         target.port = base.port;
       }
       target.scheme = base.scheme;
@@ -4115,6 +4169,7 @@ var require_fast_uri = __commonJS(function(exports, module) {
   function serialize(cmpts, opts) {
     const component = {
       host: cmpts.host,
+      ipv6Zone: cmpts.ipv6Zone,
       scheme: cmpts.scheme,
       userinfo: cmpts.userinfo,
       port: cmpts.port,
@@ -4311,6 +4366,9 @@ var require_fast_uri = __commonJS(function(exports, module) {
           isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
           malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
           parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
+          if (isIP && ipv6result.isIPV6 === true && parsed.host.indexOf("%") !== -1) {
+            parsed.ipv6Zone = parsed.host.slice(parsed.host.indexOf("%") + 1);
+          }
           if (malformedIPLiteral) {
             parsed.error = parsed.error || "URI host is malformed.";
             malformedAuthorityOrPort = true;
@@ -4335,13 +4393,14 @@ var require_fast_uri = __commonJS(function(exports, module) {
       if (!malformedIPLiteral) {
         malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
       }
-      if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
-        if (uri.indexOf("%") !== -1) {
-          if (parsed.host !== undefined && !malformedIPLiteral) {
-            const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
-            parsed.host = reescapeHostDelimiters(host, isIP);
-          }
+      if (uri.indexOf("%") !== -1 && parsed.host !== undefined && !malformedIPLiteral) {
+        let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
+        if (!isIP) {
+          host = normalizePercentEncoding(host.toLowerCase());
         }
+        parsed.host = reescapeHostDelimiters(host, isIP);
+      }
+      if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
         if (parsed.path) {
           parsed.path = normalizePathEncoding(parsed.path);
         }
@@ -12663,11 +12722,14 @@ var require_dist = __commonJS(function(exports, module) {
 });
 
 // src/utils/emoji.ts
+function withoutSkinTone(emoji) {
+  return emoji.replace(/::skin-tone-\d$/, "").replace(/(?<=.)_(?:light|medium_light|medium|medium_dark|dark)_skin_tone$/, "");
+}
 function isApprovalEmoji(emoji) {
-  return APPROVAL_EMOJIS.includes(emoji);
+  return APPROVAL_EMOJIS.includes(withoutSkinTone(emoji));
 }
 function isAllowAllEmoji(emoji) {
-  return ALLOW_ALL_EMOJIS.includes(emoji);
+  return ALLOW_ALL_EMOJIS.includes(withoutSkinTone(emoji));
 }
 var APPROVAL_EMOJIS, DENIAL_EMOJIS, ALLOW_ALL_EMOJIS;
 var init_emoji = __esm(() => {
@@ -17234,11 +17296,23 @@ var require_websocket = __commonJS(function(exports, module) {
         this._isServer = false;
         this._redirects = 0;
         if (protocols === undefined) {
-          protocols = [];
+          if (!options || options.protocols === undefined) {
+            protocols = [];
+          } else if (Array.isArray(options.protocols)) {
+            protocols = options.protocols;
+          } else {
+            protocols = [options.protocols];
+          }
         } else if (!Array.isArray(protocols)) {
           if (typeof protocols === "object" && protocols !== null) {
             options = protocols;
-            protocols = [];
+            if (options.protocols === undefined) {
+              protocols = [];
+            } else if (Array.isArray(options.protocols)) {
+              protocols = options.protocols;
+            } else {
+              protocols = [options.protocols];
+            }
           } else {
             protocols = [protocols];
           }
@@ -17357,7 +17431,6 @@ var require_websocket = __commonJS(function(exports, module) {
         }
         return;
       }
-      this._readyState = WebSocket.CLOSING;
       this._sender.close(code, data, !this._isServer, (err) => {
         if (err)
           return;
@@ -17366,6 +17439,7 @@ var require_websocket = __commonJS(function(exports, module) {
           this._socket.end();
         }
       });
+      this._readyState = WebSocket.CLOSING;
       setCloseTimer(this);
     }
     pause() {
@@ -17553,6 +17627,7 @@ var require_websocket = __commonJS(function(exports, module) {
       socketPath: undefined,
       hostname: undefined,
       protocol: undefined,
+      protocols: undefined,
       timeout: undefined,
       method: "GET",
       host: undefined,
@@ -40251,16 +40326,49 @@ async function uploadFileSlack(args) {
 
 // src/platform/slack/mcp-platform-api.ts
 var SLACK_API_BASE = "https://slack.com/api";
-async function slackApi(method, token, body) {
-  const url = `${SLACK_API_BASE}/${method}`;
-  const response = await fetch(url, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${token}`,
-      "Content-Type": "application/json; charset=utf-8"
-    },
-    body: body ? JSON.stringify(body) : undefined
-  });
+var READ_METHODS = new Set([
+  "users.info",
+  "conversations.history",
+  "conversations.replies",
+  "conversations.info",
+  "conversations.members",
+  "reactions.get"
+]);
+
+class SlackRateLimitError extends Error {
+  retryAfterMs;
+  constructor(retryAfterMs) {
+    super(`Slack API error: 429 rate limited, retry after ${retryAfterMs} ms`);
+    this.retryAfterMs = retryAfterMs;
+  }
+}
+async function slackApi(method, token, args, apiBase = SLACK_API_BASE) {
+  let response;
+  if (READ_METHODS.has(method)) {
+    const query = new URLSearchParams;
+    for (const [key, value] of Object.entries(args ?? {})) {
+      if (value !== undefined && value !== null)
+        query.set(key, String(value));
+    }
+    const qs = query.toString();
+    response = await fetch(`${apiBase}/${method}${qs ? `?${qs}` : ""}`, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${token}` }
+    });
+  } else {
+    response = await fetch(`${apiBase}/${method}`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json; charset=utf-8"
+      },
+      body: args ? JSON.stringify(args) : undefined
+    });
+  }
+  if (response.status === 429) {
+    const seconds = Number(response.headers.get("retry-after"));
+    throw new SlackRateLimitError(Number.isFinite(seconds) && seconds > 0 ? seconds * 1000 : 5000);
+  }
   if (!response.ok) {
     throw new Error(`Slack API error: ${response.status} ${response.statusText}`);
   }
@@ -40272,6 +40380,9 @@ async function slackApi(method, token, body) {
 }
 
 class SlackMcpPlatformApi {
+  slackApi(method, token, args) {
+    return slackApi(method, token, args, this.config.apiUrl || SLACK_API_BASE);
+  }
   config;
   formatter = new SlackFormatter;
   botUserIdCache = null;
@@ -40287,7 +40398,7 @@ class SlackMcpPlatformApi {
       return this.botUserIdCache;
     }
     mcpLogger.debug("Fetching bot user ID via auth.test...");
-    const response = await slackApi("auth.test", this.config.botToken);
+    const response = await this.slackApi("auth.test", this.config.botToken);
     this.botUserIdCache = response.user_id;
     mcpLogger.debug(`Bot user ID: ${response.user_id}`);
     return response.user_id;
@@ -40295,7 +40406,7 @@ class SlackMcpPlatformApi {
   async getUsername(userId) {
     try {
       mcpLogger.debug(`Looking up username for user ${userId}`);
-      const response = await slackApi("users.info", this.config.botToken, { user: userId });
+      const response = await this.slackApi("users.info", this.config.botToken, { user: userId });
       const username = response.user?.name;
       if (username) {
         mcpLogger.debug(`User ${userId} is @${username}`);
@@ -40317,7 +40428,7 @@ class SlackMcpPlatformApi {
   }
   async createInteractivePost(message, reactions, threadTs) {
     mcpLogger.debug(`Creating interactive post with ${reactions.length} reaction options`);
-    const response = await slackApi("chat.postMessage", this.config.botToken, {
+    const response = await this.slackApi("chat.postMessage", this.config.botToken, {
       channel: this.config.channelId,
       text: message,
       thread_ts: resolvePostThreadId(threadTs || this.config.threadTs),
@@ -40328,7 +40439,7 @@ class SlackMcpPlatformApi {
     for (const emoji of reactions) {
       try {
         const emojiName = getEmojiName(emoji);
-        await slackApi("reactions.add", this.config.botToken, {
+        await this.slackApi("reactions.add", this.config.botToken, {
           channel: this.config.channelId,
           timestamp: messageTs,
           name: emojiName
@@ -40342,120 +40453,54 @@ class SlackMcpPlatformApi {
   }
   async updatePost(postId, message) {
     mcpLogger.debug(`Updating post ${postId}`);
-    await slackApi("chat.update", this.config.botToken, {
+    await this.slackApi("chat.update", this.config.botToken, {
       channel: this.config.channelId,
       ts: postId,
       text: message,
       mrkdwn: true
     });
   }
+  reactionPollMs = 2000;
+  reactionSlowAfterMs = 30000;
+  reactionSlowPollMs = 5000;
+  seenTtlMs = 30000;
+  seenReactions = new Map;
   async waitForReaction(postId, botUserId, timeoutMs) {
-    return new Promise((resolve) => {
-      let resolved = false;
-      let ws = null;
-      const cleanup = () => {
-        if (ws && ws.readyState === WS.OPEN) {
-          ws.close();
-        }
-      };
-      const timeout = setTimeout(() => {
-        if (!resolved) {
-          mcpLogger.debug(`Reaction wait timed out after ${timeoutMs}ms`);
-          resolved = true;
-          cleanup();
-          resolve(null);
-        }
-      }, timeoutMs);
-      this.getSocketModeUrl().then((wsUrl) => {
-        if (resolved)
-          return;
-        mcpLogger.debug(`Connecting to Socket Mode: ${wsUrl.substring(0, 50)}...`);
-        ws = new WS(wsUrl);
-        ws.onopen = () => {
-          mcpLogger.debug("Socket Mode WebSocket connected");
-        };
-        ws.onmessage = (event) => {
-          if (resolved)
-            return;
-          try {
-            const data = typeof event.data === "string" ? event.data : event.data.toString();
-            const socketEvent = JSON.parse(data);
-            if (socketEvent.envelope_id) {
-              ws?.send(JSON.stringify({ envelope_id: socketEvent.envelope_id }));
-            }
-            mcpLogger.debug(`Socket Mode event type: ${socketEvent.type}`);
-            if (socketEvent.type === "events_api" && socketEvent.payload?.event) {
-              const slackEvent = socketEvent.payload.event;
-              if (slackEvent.type === "reaction_added") {
-                const item = slackEvent.item;
-                if (item?.type !== "message" || item.ts !== postId || item.channel !== this.config.channelId) {
-                  return;
-                }
-                if (slackEvent.user === botUserId) {
-                  mcpLogger.debug("Ignoring bot's own reaction");
-                  return;
-                }
-                const emojiName = slackEvent.reaction || "";
-                const userId = slackEvent.user || "";
-                mcpLogger.debug(`Reaction received: :${emojiName}: from user: ${userId}`);
-                resolved = true;
-                clearTimeout(timeout);
-                cleanup();
-                resolve({
-                  postId: item.ts,
-                  userId,
-                  emojiName
-                });
-              }
-            }
-            if (socketEvent.type === "hello") {
-              mcpLogger.debug("Socket Mode hello received, connection established");
-            }
-            if (socketEvent.type === "disconnect") {
-              mcpLogger.debug("Socket Mode disconnect requested");
-              if (!resolved) {
-                resolved = true;
-                clearTimeout(timeout);
-                cleanup();
-                resolve(null);
-              }
-            }
-          } catch (err) {
-            mcpLogger.debug(`Error parsing Socket Mode message: ${err}`);
-          }
-        };
-        ws.onerror = (event) => {
-          mcpLogger.error(`Socket Mode WebSocket error: ${formatWebSocketError(event)}`);
-          if (!resolved) {
-            resolved = true;
-            clearTimeout(timeout);
-            cleanup();
-            resolve(null);
-          }
-        };
-        ws.onclose = () => {
-          mcpLogger.debug("Socket Mode WebSocket closed");
-          if (!resolved) {
-            resolved = true;
-            clearTimeout(timeout);
-            resolve(null);
+    const started = Date.now();
+    const deadline = started + timeoutMs;
+    let warned = false;
+    const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, Math.max(0, Math.min(ms, deadline - Date.now()))));
+    while (Date.now() < deadline) {
+      let wait = Date.now() - started >= this.reactionSlowAfterMs ? this.reactionSlowPollMs : this.reactionPollMs;
+      try {
+        const response = await this.slackApi("reactions.get", this.config.botToken, { channel: this.config.channelId, timestamp: postId, full: true });
+        for (const reaction of response.message?.reactions ?? []) {
+          for (const userId of reaction.users ?? []) {
+            if (userId === botUserId)
+              continue;
+            const key = `${postId}|${userId}|${reaction.name}`;
+            const seenAt = this.seenReactions.get(key);
+            if (seenAt !== undefined && Date.now() - seenAt < this.seenTtlMs)
+              continue;
+            this.seenReactions.set(key, Date.now());
+            mcpLogger.debug(`Reaction received: :${reaction.name}: from user: ${userId}`);
+            return { postId, userId, emojiName: reaction.name };
           }
-        };
-      }).catch((err) => {
-        mcpLogger.error(`Failed to get Socket Mode URL: ${err}`);
-        if (!resolved) {
-          resolved = true;
-          clearTimeout(timeout);
-          resolve(null);
         }
-      });
-    });
-  }
-  async getSocketModeUrl() {
-    mcpLogger.debug("Getting Socket Mode WebSocket URL...");
-    const response = await slackApi("apps.connections.open", this.config.appToken);
-    mcpLogger.debug("Got Socket Mode URL");
-    return response.url;
+      } catch (err) {
+        if (err instanceof SlackRateLimitError) {
+          wait = err.retryAfterMs;
+        } else if (!warned) {
+          warned = true;
+          mcpLogger.warn(`reactions.get failed, will keep retrying: ${err}`);
+        } else {
+          mcpLogger.debug(`reactions.get failed, retrying: ${err}`);
+        }
+      }
+      await sleep(wait);
+    }
+    mcpLogger.debug(`Reaction wait timed out after ${timeoutMs}ms`);
+    return null;
   }
   async uploadFile(filePath, threadId, options) {
     const filename = sanitizeFilename(options?.filename ?? filePath);
@@ -40466,14 +40511,15 @@ class SlackMcpPlatformApi {
       threadTs: threadId,
       filePath,
       filename,
-      caption: options?.caption
+      caption: options?.caption,
+      apiUrl: this.config.apiUrl
     });
     return { postId: result.postId };
   }
   async readPost(postId) {
     mcpLogger.debug(`readPost: ts ${postId}`);
     try {
-      const response = await slackApi("conversations.history", this.config.botToken, {
+      const response = await this.slackApi("conversations.history", this.config.botToken, {
         channel: this.config.channelId,
         latest: postId,
         oldest: postId,
@@ -40493,7 +40539,7 @@ class SlackMcpPlatformApi {
   async addReaction(postId, emojiName) {
     const name = getEmojiName(emojiName);
     mcpLogger.debug(`addReaction: :${name}: on ts ${postId}`);
-    await slackApi("reactions.add", this.config.botToken, {
+    await this.slackApi("reactions.add", this.config.botToken, {
       channel: this.config.channelId,
       timestamp: postId,
       name
@@ -40502,7 +40548,7 @@ class SlackMcpPlatformApi {
   async readThread(threadRootId, options) {
     mcpLogger.debug(`readThread: ts ${threadRootId}`);
     try {
-      const response = await slackApi("conversations.replies", this.config.botToken, {
+      const response = await this.slackApi("conversations.replies", this.config.botToken, {
         channel: this.config.channelId,
         ts: threadRootId,
         limit: options?.limit ?? 100
@@ -40525,7 +40571,7 @@ class SlackMcpPlatformApi {
     const limit = options?.limit ?? 20;
     mcpLogger.debug(`readChannelHistory: ${channelId} (limit=${limit})`);
     try {
-      const response = await slackApi("conversations.history", this.config.botToken, {
+      const response = await this.slackApi("conversations.history", this.config.botToken, {
         channel: channelId,
         limit
       });
@@ -40545,7 +40591,7 @@ class SlackMcpPlatformApi {
   async getChannelInfo(channelId) {
     mcpLogger.debug(`getChannelInfo: ${channelId}`);
     try {
-      const response = await slackApi("conversations.info", this.config.botToken, { channel: channelId });
+      const response = await this.slackApi("conversations.info", this.config.botToken, { channel: channelId });
       const ch = response.channel;
       const isPrivate = ch.is_private || ch.is_im || ch.is_mpim || false;
       return {
@@ -40570,7 +40616,7 @@ class SlackMcpPlatformApi {
         };
         if (cursor)
           params.cursor = cursor;
-        const response = await slackApi("conversations.members", this.config.botToken, params);
+        const response = await this.slackApi("conversations.members", this.config.botToken, params);
         all.push(...response.members ?? []);
         cursor = response.response_metadata?.next_cursor;
         if (!cursor)
@@ -40589,7 +40635,7 @@ class SlackMcpPlatformApi {
       return null;
     }
     try {
-      const response = await slackApi("users.info", this.config.botToken, { user: id });
+      const response = await this.slackApi("users.info", this.config.botToken, { user: id });
       return { id: response.user.id, username: response.user.name ?? null };
     } catch (err) {
       mcpLogger.debug(`resolveRecipient ${id} failed: ${err}`);
@@ -40597,9 +40643,9 @@ class SlackMcpPlatformApi {
     }
   }
   async sendDirectMessage(recipientUserId, message) {
-    const opened = await slackApi("conversations.open", this.config.botToken, { users: recipientUserId });
+    const opened = await this.slackApi("conversations.open", this.config.botToken, { users: recipientUserId });
     const dmChannelId = opened.channel.id;
-    const post = await slackApi("chat.postMessage", this.config.botToken, {
+    const post = await this.slackApi("chat.postMessage", this.config.botToken, {
       channel: dmChannelId,
       text: message,
       mrkdwn: true
@@ -41046,7 +41092,8 @@ var SKIP_STANDARD_PERMISSION_PROMPT = new Set([
 var apiConfig = PLATFORM_TYPE === "slack" ? {
   platformType: "slack",
   botToken: PLATFORM_TOKEN,
-  appToken: process.env.PLATFORM_APP_TOKEN || "",
+  appToken: "",
+  apiUrl: process.env.PLATFORM_API_URL || undefined,
   channelId: PLATFORM_CHANNEL_ID,
   threadTs: PLATFORM_THREAD_ID || undefined,
   allowedUsers: ALLOWED_USERS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-threads",
-  "version": "1.39.1",
+  "version": "1.39.3",
   "description": "Run Claude Code from Slack or Mattermost. Sessions stream live into threads where your whole team can watch and steer.",
   "main": "dist/index.js",
   "type": "module",
@@ -24,7 +24,7 @@
     "test:integration:slack:setup": "bun run tests/integration/fixtures/slack/mock-server.ts &",
     "test:integration:slack:run": "TEST_PLATFORMS=slack INTEGRATION_TEST=1 bun test tests/integration/suites --timeout 120000",
     "test:integration:slack:teardown": "pkill -f 'mock-server.ts' || true",
-    "test:integration:slack": "bun run test:integration:slack:teardown; bun run tests/integration/fixtures/slack/mock-server.ts & sleep 2 && TEST_PLATFORMS=slack INTEGRATION_TEST=1 bun test tests/integration/suites --timeout 120000; bun run test:integration:slack:teardown",
+    "test:integration:slack": "bun run test:integration:slack:teardown; bun run tests/integration/fixtures/slack/mock-server.ts & sleep 2 && TEST_PLATFORMS=slack INTEGRATION_TEST=1 bun test tests/integration/suites --timeout 120000; status=$?; bun run test:integration:slack:teardown; exit $status",
     "test:integration:all": "bun run test:integration:setup && bun run tests/integration/fixtures/slack/mock-server.ts & sleep 2 && TEST_PLATFORMS=mattermost,slack INTEGRATION_TEST=1 bun test tests/integration/suites --timeout 120000; bun run test:integration:slack:teardown",
     "lint": "eslint src/",
     "lint:fix": "eslint src/ --fix",
@@ -78,7 +78,7 @@
     "cross-spawn": "^7.0.6",
     "diff": "^8.0.3",
     "express-rate-limit": "^8.3.0",
-    "hono": "4.13.8",
+    "hono": "4.13.9",
     "ink": "^6.6.0",
     "ink-scroll-view": "^0.3.5",
     "js-yaml": "^4.3.1",
@@ -86,7 +86,7 @@
     "react": "^19.2.3",
     "semver": "7.8.5",
     "update-notifier": "^7.3.1",
-    "ws": "8.21.3",
+    "ws": "8.22.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {
@@ -102,7 +102,7 @@
     "@types/ws": "^8.18.0",
     "eslint": "^10.7.0",
     "husky": "^9.1.7",
-    "knip": "6.37.0",
+    "knip": "6.38.0",
     "lint-staged": "^17.0.4",
     "prettier": "^3.9.5",
     "react-devtools-core": "^8.0.0",
@@ -126,7 +126,7 @@
     "flatted": ">=3.4.0",
     "picomatch": ">=2.3.2",
     "path-to-regexp": ">=8.4.0",
-    "fast-uri": ">=4.1.4",
+    "fast-uri": ">=4.2.1",
     "brace-expansion": ">=5.0.9",
     "ip-address": ">=10.3.1",
     "ws": "$ws",
@@ -139,7 +139,7 @@
     "flatted": ">=3.4.0",
     "picomatch": ">=2.3.2",
     "path-to-regexp": ">=8.4.0",
-    "fast-uri": ">=4.1.4",
+    "fast-uri": ">=4.2.1",
     "brace-expansion": ">=5.0.9",
     "ip-address": ">=10.3.1",
     "ws": "$ws",