claude-threads 1.39.2 → 1.39.4

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.39.4] - 2026-10-30
+
+### Security
+- `proxy-addr` 2.0.7 → 2.0.8 (critical, IP spoofing), `@modelcontextprotocol/sdk` 1.30.1 → 1.32.2 (three high advisories), `body-parser` 2.3.0 → 2.4.0, `fast-uri` 4.2.1 → 4.2.3, `shell-quote` 1.10.0 → 1.12.0 and `hono` 4.13.9 → 4.13.13, all bundled into what users run (#650). Supersedes the separate Dependabot PRs, none of which could go green on its own.
+
+### Changed
+- `@hono/node-server` 2.1.5, `express-rate-limit` 8.7.1, `@redactpii/node` 1.0.19, `react` 19.3.1, `zod` 4.6.7, plus dev tooling (`eslint`, `knip`, `prettier`, `typescript-eslint`, `@types/*`). `ink` stays on 6.x; the 8.0 major is left for a separate change.
+
+## [1.39.3] - 2026-10-01
+
+### Fixed
+- **Mattermost: a skin-toned 👍 no longer denies** (#629). Mattermost names an emoji picked with a skin tone `+1_medium_skin_tone` (verified against Mattermost v11), and the permission prompt treats any emoji it does not recognize as a denial. 1.39.2 fixed Slack's `+1::skin-tone-3` form; the Mattermost form is now matched on its base name too, for permission prompts, plan approvals and the other reaction controls.
+- **One failed update no longer turns a code block into a post per flush** (#620). When the platform refused an update of the post Claude was writing a code block into, the bot gave up on that post at once. The continuation started in the middle of the block without its opening fence, so the rest rendered as prose, the height check split it every few lines (a new post per flush, close to 200 posts for a 2000-line file), and the closing fence opened a new block. A failed update is now retried on the next flush, which recovers the post completely for a passing error; only after three failures in a row is the post given up, with its code block reopened at the start of the next one.
+
 ## [1.39.2] - 2026-10-01
 
 ### Fixed

package/dist/index.js

@@ -6033,7 +6033,7 @@ var init_usage = __esm(() => {
 
 // src/utils/emoji.ts
 function withoutSkinTone(emoji) {
-  return emoji.replace(/::skin-tone-\d$/, "");
+  return emoji.replace(/::skin-tone-\d$/, "").replace(/(?<=.)_(?:light|medium_light|medium|medium_dark|dark)_skin_tone$/, "");
 }
 function isApprovalEmoji(emoji) {
   return APPROVAL_EMOJIS.includes(withoutSkinTone(emoji));
@@ -19189,7 +19189,7 @@ See https://react.dev/link/invalid-hook-call for tips about how to debug and fix
     exports.useTransition = function() {
       return resolveDispatcher().useTransition();
     };
-    exports.version = "19.3.0";
+    exports.version = "19.3.1";
     typeof __REACT_DEVTOOLS_GLOBAL_HOOK__ !== "undefined" && typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.registerInternalModuleStop === "function" && __REACT_DEVTOOLS_GLOBAL_HOOK__.registerInternalModuleStop(Error());
   })();
 });
@@ -57094,15 +57094,15 @@ class Redactor {
         name: "CREDIT_CARD"
       },
       EMAIL: {
-        pattern: /\b[a-z0-9][a-z0-9._-]*@[a-z0-9][\w.-]*\.[a-z]{2,}/gi,
+        pattern: /(?<![\p{L}\p{N}._%+-]|[\p{L}\p{N}]')[\p{L}\p{N}][\p{L}\p{N}._%+'-]*@[\p{L}\p{N}][\p{L}\p{N}_.-]*\.\p{L}{2,}/giu,
         name: "EMAIL"
       },
       NAME: {
-        pattern: /(?:^|\.\s+)(?:dear|hi|hello|greetings|hey|hey there)\s+([A-Z][a-z]+(?:\s+[A-Z][a-z]+)+)/gi,
+        pattern: /(?=[DdHhGg])(?<=(?:^|[.!?\n])\s*)(?:[Dd]ear|[Hh]i|[Hh]ello|[Gg]reetings|[Hh]ey(?:\s+[Tt]here)?)\s+\p{Lu}[\p{L}'’-]*\p{Ll}(?:[ \t]+\p{Lu}[\p{L}'’-]*\p{Ll})+/gu,
         name: "PERSON_NAME"
       },
       PHONE: {
-        pattern: /\b(?:\+?1[-.\s]?)?(?:\(?\d{3}\)?[-.\s]?)?\d{3}[-.\s]?\d{4}\b/g,
+        pattern: /(?<!\w)(?:\+?1[-.\s]?)?(?:\(?\d{3}\)?[-.\s]?)?\d{3}[-.\s]?\d{4}\b/g,
         name: "PHONE_NUMBER"
       },
       SSN: {
@@ -57116,15 +57116,15 @@ class Redactor {
         name: "CREDIT_CARD"
       },
       EMAIL: {
-        pattern: /\b[a-z0-9][a-z0-9._-]*\s*(?:@|\[at\]|\(at\))\s*[a-z0-9][\w.-]*\s*(?:\.|\[dot\]|\(dot\))\s*[a-z]{2,}\b/gi,
+        pattern: /(?<![\p{L}\p{N}._%+-]|[\p{L}\p{N}]')[\p{L}\p{N}][\p{L}\p{N}._%+'-]*\s*(?:@|\[at\]|\(at\))\s*[\p{L}\p{N}][\p{L}\p{N}_.-]*\s*(?:\.|\[dot\]|\(dot\))\s*\p{L}{2,}(?![\p{L}\p{N}_])/giu,
         name: "EMAIL"
       },
       NAME: {
-        pattern: /(?:^|\.\s+|,\s*)(?:dear|hi|hello|greetings|hey|hey there|mr|mrs|ms|dr|prof)\s+([A-Z][a-z]+(?:\s+[A-Z][a-z]+)*)/gi,
+        pattern: /(?=[DdHhGgMmPp])(?<=(?:^|[.!?\n,])\s*)(?:[Dd]ear|[Hh]i|[Hh]ello|[Gg]reetings|[Hh]ey(?:\s+[Tt]here)?|[Mm][Rr][Ss]?\.?|[Mm][Ss]\.?|[Dd][Rr]\.?|[Pp]rof\.?)\s+\p{Lu}[\p{L}'’-]*\p{Ll}(?:[ \t]+\p{Lu}[\p{L}'’-]*\p{Ll})*/gu,
         name: "PERSON_NAME"
       },
       PHONE: {
-        pattern: /\b(?:\+?1[-.\s]?)?(?:\(?\d{3}\)?[-.\s]?)?\d{3}[-.\s]?\d{4}\b|\b\d{3}[-.\s]\d{4}\b/g,
+        pattern: /(?<!\w)(?:\+?1[-.\s]?)?(?:\(?\d{3}\)?[-.\s]?)?\d{3}[-.\s]?\d{4}\b|\b\d{3}[-.\s]\d{4}\b/g,
         name: "PHONE_NUMBER"
       },
       SSN: {
@@ -57145,7 +57145,8 @@ class Redactor {
     return activeRules;
   }
   _clonePattern(pattern) {
-    return new RegExp(pattern.source, pattern.flags);
+    const flags = pattern.flags.replace("y", "");
+    return new RegExp(pattern.source, flags.includes("g") ? flags : `${flags}g`);
   }
   hasPII(text) {
     for (const { pattern } of this.activeRules) {
@@ -57185,48 +57186,42 @@ class Redactor {
   }
   _redactString(text, resetState) {
     const events = [];
-    let redactedText = text;
     if (resetState && this.anonymize) {
       this.anonymizationMap.clear();
       this.anonymizationCounters.clear();
     }
+    const spans = [];
     for (const { pattern, name } of this.activeRules) {
-      const clonedPattern = this._clonePattern(pattern);
-      redactedText = redactedText.replace(clonedPattern, (match) => {
-        const piiType = name;
-        events.push({ pii_type: piiType, action: "REDACTED" });
-        if (this.anonymize) {
-          const normalizedMatch = match.toLowerCase();
-          const key = `${piiType}:${normalizedMatch}`;
-          if (this.anonymizationMap.has(key)) {
-            return this.anonymizationMap.get(key) ?? match;
-          }
-          const counter = (this.anonymizationCounters.get(piiType) ?? 0) + 1;
-          this.anonymizationCounters.set(piiType, counter);
-          const tokenPrefix = this._getTokenPrefix(piiType);
-          const token = `${tokenPrefix}_${counter}`;
-          this.anonymizationMap.set(key, token);
-          return token;
-        }
-        if (this.globalReplaceWith !== undefined) {
-          return this.globalReplaceWith;
-        }
-        switch (piiType) {
-          case "CREDIT_CARD":
-            return "CREDIT_CARD_NUMBER";
-          case "EMAIL":
-            return "EMAIL_ADDRESS";
-          case "PERSON_NAME":
-            return "PERSON_NAME";
-          case "PHONE_NUMBER":
-            return "PHONE_NUMBER";
-          case "US_SOCIAL_SECURITY_NUMBER":
-            return "US_SOCIAL_SECURITY_NUMBER";
-          default:
-            return "DIGITS";
+      for (const match of text.matchAll(this._clonePattern(pattern))) {
+        if (match[0] === "") {
+          continue;
         }
-      });
+        const start = match.index;
+        spans.push({ start, end: start + match[0].length, name, length: match[0].length });
+      }
+    }
+    spans.sort((a, b) => a.start === b.start ? b.end - a.end : a.start - b.start);
+    const merged = [];
+    for (const span of spans) {
+      const last = merged[merged.length - 1];
+      if (last !== undefined && span.start < last.end) {
+        last.end = Math.max(last.end, span.end);
+        if (span.length > last.length) {
+          last.name = span.name;
+          last.length = span.length;
+        }
+      } else {
+        merged.push({ ...span });
+      }
     }
+    let redactedText = "";
+    let cursor = 0;
+    for (const { start, end, name } of merged) {
+      events.push({ pii_type: name, action: "REDACTED" });
+      redactedText += text.slice(cursor, start) + this._replacementFor(name, text.slice(start, end));
+      cursor = end;
+    }
+    redactedText += text.slice(cursor);
     if (resetState) {
       const hasValidApiKey = this.apiKey !== null && this.apiKey !== "";
       if (hasValidApiKey && events.length > 0) {
@@ -57239,6 +57234,38 @@ class Redactor {
     }
     return redactedText;
   }
+  _replacementFor(piiType, match) {
+    if (this.anonymize) {
+      const normalizedMatch = match.toLowerCase();
+      const key = `${piiType}:${normalizedMatch}`;
+      if (this.anonymizationMap.has(key)) {
+        return this.anonymizationMap.get(key) ?? match;
+      }
+      const counter = (this.anonymizationCounters.get(piiType) ?? 0) + 1;
+      this.anonymizationCounters.set(piiType, counter);
+      const tokenPrefix = this._getTokenPrefix(piiType);
+      const token = `${tokenPrefix}_${counter}`;
+      this.anonymizationMap.set(key, token);
+      return token;
+    }
+    if (this.globalReplaceWith !== undefined) {
+      return this.globalReplaceWith;
+    }
+    switch (piiType) {
+      case "CREDIT_CARD":
+        return "CREDIT_CARD_NUMBER";
+      case "EMAIL":
+        return "EMAIL_ADDRESS";
+      case "PERSON_NAME":
+        return "PERSON_NAME";
+      case "PHONE_NUMBER":
+        return "PHONE_NUMBER";
+      case "US_SOCIAL_SECURITY_NUMBER":
+        return "US_SOCIAL_SECURITY_NUMBER";
+      default:
+        return "DIGITS";
+    }
+  }
   redact(text) {
     return this._redactString(text, true);
   }
@@ -60297,7 +60324,8 @@ class ContentExecutor extends BaseExecutor {
       headerPostId: null,
       headerBody: "",
       turnOpen: false,
-      paragraphBreak: false
+      paragraphBreak: false,
+      updateFailures: 0
     };
   }
   setHeader(line) {
@@ -60318,6 +60346,7 @@ class ContentExecutor extends BaseExecutor {
     this.state.headerPostId = null;
     this.state.headerBody = "";
     this.state.turnOpen = false;
+    this.state.updateFailures = 0;
   }
   getRenderedCurrentPost() {
     const postId = this.state.currentPostId;
@@ -60344,7 +60373,9 @@ ${body}` : this.state.header;
     this.state.headerDirty = false;
     if (this.state.headerPostId) {
       const postId = this.state.headerPostId;
+      const failures = this.state.updateFailures;
       await this.tryUpdatePost(ctx, postId, this.state.headerBody, "header", { reason: "header_update", headerLength: this.state.header?.length ?? 0 }, { reason: "header_update_failed" }, () => {}, () => {});
+      this.state.updateFailures = failures;
       return;
     }
     if (this.state.header && this.state.turnOpen) {
@@ -60367,6 +60398,7 @@ ${body}` : this.state.header;
         this.state.headerBody = content;
         this.state.headerDirty = false;
       }
+      this.state.updateFailures = 0;
       onSuccess();
       ctx.threadLogger?.logExecutor("content", "update", postId, successDetails, logTag);
     } catch (err) {
@@ -60379,8 +60411,11 @@ ${body}` : this.state.header;
   closeCurrentPost(ctx) {
     const oldPostId = this.state.currentPostId;
     const contentLength = this.state.currentPostContent.length;
+    if (this.state.updateFailures > 0 && this.state.pendingContent.trim())
+      this.giveUpCurrentPost();
     this.state.currentPostId = null;
     this.state.currentPostContent = "";
+    this.state.updateFailures = 0;
     if (ctx?.threadLogger && oldPostId) {
       ctx.threadLogger.logExecutor("content", "close", oldPostId, {
         contentLength,
@@ -60436,13 +60471,22 @@ ${body}` : this.state.header;
         this.state.turnOpen = false;
       return;
     }
-    await this.flushPending(ctx);
-    if (this.state.headerDirty)
+    const postBefore = this.state.currentPostId;
+    await this.flushPending(ctx, reason);
+    if (reason === "result") {
+      if (this.state.updateFailures > 0 && this.state.currentPostId !== null && this.state.pendingContent.trim()) {
+        await this.flushPending(ctx, reason);
+      }
+      if (postBefore !== null && this.state.currentPostId === null && this.state.pendingContent.trim()) {
+        await this.flushPending(ctx, reason);
+      }
+    }
+    if (this.state.headerDirty && this.state.updateFailures === 0)
       await this.renderHeaderOnly(ctx);
     if (reason === "result")
       this.state.turnOpen = false;
   }
-  async flushPending(ctx) {
+  async flushPending(ctx, reason) {
     const pendingAtFlushStart = this.state.pendingContent;
     let content = ctx.formatter.formatMarkdown(pendingAtFlushStart).trim();
     const { maxLength: MAX_POST_LENGTH, hardThreshold: HARD_CONTINUATION_THRESHOLD } = ctx.platform.getMessageLimits();
@@ -60460,7 +60504,7 @@ ${body}` : this.state.header;
     const shouldBreakEarly = this.state.currentPostId && combinedContent.length > MIN_BREAK_THRESHOLD && ctx.contentBreaker.shouldFlushEarly(combinedContent);
     const reserve = this.headerReserve(this.state.currentPostId);
     if (this.state.currentPostId && (combinedContent.length + reserve > HARD_CONTINUATION_THRESHOLD || shouldBreakEarly)) {
-      await this.handleSplit(ctx, combinedContent, pendingAtFlushStart, HARD_CONTINUATION_THRESHOLD);
+      await this.handleSplit(ctx, combinedContent, pendingAtFlushStart, HARD_CONTINUATION_THRESHOLD, reason);
       return;
     }
     if (this.state.currentPostId && content.length + reserve > MAX_POST_LENGTH) {
@@ -60495,10 +60539,7 @@ ${body}` : this.state.header;
       await this.tryUpdatePost(ctx, postId, combinedContent, "flush", { newContentLength: content.length, combinedLength: combinedContent.length }, (err) => ({ failedOp: "updatePost", error: String(err) }), () => {
         this.state.currentPostContent = combinedContent;
         this.clearFlushedContent(pendingAtFlushStart);
-      }, () => {
-        this.state.currentPostId = null;
-        this.state.currentPostContent = "";
-      });
+      }, () => this.onInPlaceUpdateFailed(reason));
     } else {
       const chunks = splitContentForHeight(content, ctx.contentBreaker).flatMap((chunk) => chunk.length + reserve > MAX_POST_LENGTH ? splitByLength(chunk, HARD_CONTINUATION_THRESHOLD - reserve) : [chunk]);
       ctx.threadLogger?.logExecutor("content", "create_start", "none", {
@@ -60509,7 +60550,7 @@ ${body}` : this.state.header;
       await this.postChunks(ctx, chunks, pendingAtFlushStart, false);
     }
   }
-  async splitOversized(ctx, content, pendingAtFlushStart, hardThreshold) {
+  async splitOversized(ctx, content, pendingAtFlushStart, hardThreshold, reason) {
     const postId = this.state.currentPostId;
     if (!postId)
       return false;
@@ -60520,17 +60561,35 @@ ${body}` : this.state.header;
     let landed = false;
     await this.tryUpdatePost(ctx, postId, firstPiece, "handleSplit", { reason: "oversized_code_block", contentLength: content.length, pieces: rest.length + 1 }, { reason: "oversized_code_block_failed" }, () => {
       landed = true;
-    }, () => {
-      if (postId === this.state.headerPostId)
-        this.state.headerBody = firstPiece;
-    });
+    }, () => {});
+    if (!landed) {
+      this.onInPlaceUpdateFailed(reason);
+      return true;
+    }
     this.state.currentPostId = null;
     this.state.currentPostContent = "";
-    if (landed)
-      this.clearFlushedContent(pendingAtFlushStart);
-    await this.postChunks(ctx, rest, pendingAtFlushStart, landed);
+    this.clearFlushedContent(pendingAtFlushStart);
+    await this.postChunks(ctx, rest, pendingAtFlushStart, true);
     return true;
   }
+  onInPlaceUpdateFailed(reason) {
+    this.state.updateFailures++;
+    const limit = reason === "result" ? 2 : MAX_IN_PLACE_UPDATE_FAILURES;
+    if (this.state.updateFailures < limit)
+      return;
+    this.giveUpCurrentPost();
+  }
+  giveUpCurrentPost() {
+    const opener = openFenceOf(this.state.currentPostContent);
+    this.state.currentPostId = null;
+    this.state.currentPostContent = "";
+    this.state.updateFailures = 0;
+    if (!opener)
+      return;
+    const rest = this.state.pendingContent.replace(/^\n+/, "");
+    this.state.pendingContent = /^```[ \t]*(\n|$)/.test(rest) ? rest.replace(/^```[ \t]*\n?/, "") : `${opener}
+${rest}`;
+  }
   async postChunks(ctx, chunks, pendingAtFlushStart, flushCleared) {
     let cleared = flushCleared;
     for (let i = 0;i < chunks.length; i++) {
@@ -60554,7 +60613,7 @@ ${this.state.pendingContent}` : "");
       }
     }
   }
-  async handleSplit(ctx, content, pendingAtFlushStart, hardThreshold) {
+  async handleSplit(ctx, content, pendingAtFlushStart, hardThreshold, reason) {
     let breakPoint;
     let codeBlockOpenPosition;
     if (content.length > hardThreshold) {
@@ -60602,26 +60661,21 @@ ${this.state.pendingContent}` : "");
           await this.tryUpdatePost(ctx, postId, content, "handleSplit", { reason: "soft_break_no_breakpoint", contentLength: content.length }, { reason: "soft_break_no_breakpoint_failed" }, () => {
             this.state.currentPostContent = content;
             this.clearFlushedContent(pendingAtFlushStart);
-          }, () => {
-            this.state.currentPostId = null;
-          });
+          }, () => this.onInPlaceUpdateFailed(reason));
         }
         return;
       }
     }
     if (codeBlockOpenPosition !== undefined) {
       if (codeBlockOpenPosition === 0) {
-        if (await this.splitOversized(ctx, content, pendingAtFlushStart, hardThreshold))
+        if (await this.splitOversized(ctx, content, pendingAtFlushStart, hardThreshold, reason))
           return;
         if (this.state.currentPostId) {
           const postId = this.state.currentPostId;
           await this.tryUpdatePost(ctx, postId, content, "handleSplit", { reason: "code_block_at_start", contentLength: content.length }, { reason: "code_block_at_start_failed" }, () => {
             this.state.currentPostContent = content;
             this.clearFlushedContent(pendingAtFlushStart);
-          }, () => {
-            this.state.currentPostId = null;
-            this.state.currentPostContent = "";
-          });
+          }, () => this.onInPlaceUpdateFailed(reason));
         }
         return;
       }
@@ -60630,17 +60684,14 @@ ${this.state.pendingContent}` : "");
       if (breakBeforeCodeBlock > 0) {
         breakPoint = breakBeforeCodeBlock;
       } else {
-        if (await this.splitOversized(ctx, content, pendingAtFlushStart, hardThreshold))
+        if (await this.splitOversized(ctx, content, pendingAtFlushStart, hardThreshold, reason))
           return;
         if (this.state.currentPostId) {
           const postId = this.state.currentPostId;
           await this.tryUpdatePost(ctx, postId, content, "handleSplit", { reason: "no_break_before_code_block", contentLength: content.length }, { reason: "no_break_before_code_block_failed" }, () => {
             this.state.currentPostContent = content;
             this.clearFlushedContent(pendingAtFlushStart);
-          }, () => {
-            this.state.currentPostId = null;
-            this.state.currentPostContent = "";
-          });
+          }, () => this.onInPlaceUpdateFailed(reason));
         }
         return;
       }
@@ -60652,11 +60703,11 @@ ${this.state.pendingContent}` : "");
       const postId = this.state.currentPostId;
       await this.tryUpdatePost(ctx, postId, firstPart, "handleSplit", { reason: "split_first_part", firstPartLength: firstPart.length, remainderLength: remainder.length }, { reason: "split_first_part_failed" }, () => {
         firstPartLanded = true;
-      }, () => {
-        if (postId === this.state.headerPostId) {
-          this.state.headerBody = firstPart;
-        }
-      });
+      }, () => {});
+      if (!firstPartLanded) {
+        this.onInPlaceUpdateFailed(reason);
+        return;
+      }
     }
     this.state.currentPostId = null;
     this.state.currentPostContent = "";
@@ -60689,6 +60740,7 @@ ${content}` : header : content;
       if (bumpedPostId) {
         adoptAsHeaderPost(bumpedPostId);
         this.state.currentPostId = bumpedPostId;
+        this.state.updateFailures = 0;
         this.state.currentPostContent = content;
         this.clearFlushedContent(pendingAtFlushStart);
         ctx.threadLogger?.logExecutor("content", "create", bumpedPostId, {
@@ -60705,6 +60757,7 @@ ${content}` : header : content;
       const post = await ctx.createPost(rendered, { type: "content" });
       adoptAsHeaderPost(post.id);
       this.state.currentPostId = post.id;
+      this.state.updateFailures = 0;
       this.state.currentPostContent = content;
       this.clearFlushedContent(pendingAtFlushStart);
       ctx.logger.debug(`Created post ${formatShortId(post.id)}`);
@@ -60730,6 +60783,11 @@ ${content}` : header : content;
   }
 }
 var FENCE_LINE = /^```.*$/gm;
+var MAX_IN_PLACE_UPDATE_FAILURES = 3;
+function openFenceOf(text) {
+  const fences = text.match(FENCE_LINE) ?? [];
+  return fences.length % 2 === 1 ? fences[fences.length - 1] : null;
+}
 var FENCE_CLOSE = "\n```";
 function splitByLength(text, max) {
   const room = max - FENCE_CLOSE.length;
@@ -71905,7 +71963,6 @@ class SlackClient extends BasePlatformClient {
       token: this.botToken,
       channelId: this.channelId,
       allowedUsers: this.allowedUsers,
-      appToken: this.appToken,
       apiUrl: this.apiUrl,
       outboundFiles: this.outboundFiles,
       mcpServers: this.mcpServers,