claude-threads 1.39.3 → 1.39.4

package/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.39.4] - 2026-10-30
+
+### Security
+- `proxy-addr` 2.0.7 → 2.0.8 (critical, IP spoofing), `@modelcontextprotocol/sdk` 1.30.1 → 1.32.2 (three high advisories), `body-parser` 2.3.0 → 2.4.0, `fast-uri` 4.2.1 → 4.2.3, `shell-quote` 1.10.0 → 1.12.0 and `hono` 4.13.9 → 4.13.13, all bundled into what users run (#650). Supersedes the separate Dependabot PRs, none of which could go green on its own.
+
+### Changed
+- `@hono/node-server` 2.1.5, `express-rate-limit` 8.7.1, `@redactpii/node` 1.0.19, `react` 19.3.1, `zod` 4.6.7, plus dev tooling (`eslint`, `knip`, `prettier`, `typescript-eslint`, `@types/*`). `ink` stays on 6.x; the 8.0 major is left for a separate change.
+
 ## [1.39.3] - 2026-10-01
 
 ### Fixed

package/dist/index.js

@@ -19189,7 +19189,7 @@ See https://react.dev/link/invalid-hook-call for tips about how to debug and fix
     exports.useTransition = function() {
       return resolveDispatcher().useTransition();
     };
-    exports.version = "19.3.0";
+    exports.version = "19.3.1";
     typeof __REACT_DEVTOOLS_GLOBAL_HOOK__ !== "undefined" && typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.registerInternalModuleStop === "function" && __REACT_DEVTOOLS_GLOBAL_HOOK__.registerInternalModuleStop(Error());
   })();
 });
@@ -57094,15 +57094,15 @@ class Redactor {
         name: "CREDIT_CARD"
       },
       EMAIL: {
-        pattern: /\b[a-z0-9][a-z0-9._-]*@[a-z0-9][\w.-]*\.[a-z]{2,}/gi,
+        pattern: /(?<![\p{L}\p{N}._%+-]|[\p{L}\p{N}]')[\p{L}\p{N}][\p{L}\p{N}._%+'-]*@[\p{L}\p{N}][\p{L}\p{N}_.-]*\.\p{L}{2,}/giu,
         name: "EMAIL"
       },
       NAME: {
-        pattern: /(?:^|\.\s+)(?:dear|hi|hello|greetings|hey|hey there)\s+([A-Z][a-z]+(?:\s+[A-Z][a-z]+)+)/gi,
+        pattern: /(?=[DdHhGg])(?<=(?:^|[.!?\n])\s*)(?:[Dd]ear|[Hh]i|[Hh]ello|[Gg]reetings|[Hh]ey(?:\s+[Tt]here)?)\s+\p{Lu}[\p{L}'’-]*\p{Ll}(?:[ \t]+\p{Lu}[\p{L}'’-]*\p{Ll})+/gu,
         name: "PERSON_NAME"
       },
       PHONE: {
-        pattern: /\b(?:\+?1[-.\s]?)?(?:\(?\d{3}\)?[-.\s]?)?\d{3}[-.\s]?\d{4}\b/g,
+        pattern: /(?<!\w)(?:\+?1[-.\s]?)?(?:\(?\d{3}\)?[-.\s]?)?\d{3}[-.\s]?\d{4}\b/g,
         name: "PHONE_NUMBER"
       },
       SSN: {
@@ -57116,15 +57116,15 @@ class Redactor {
         name: "CREDIT_CARD"
       },
       EMAIL: {
-        pattern: /\b[a-z0-9][a-z0-9._-]*\s*(?:@|\[at\]|\(at\))\s*[a-z0-9][\w.-]*\s*(?:\.|\[dot\]|\(dot\))\s*[a-z]{2,}\b/gi,
+        pattern: /(?<![\p{L}\p{N}._%+-]|[\p{L}\p{N}]')[\p{L}\p{N}][\p{L}\p{N}._%+'-]*\s*(?:@|\[at\]|\(at\))\s*[\p{L}\p{N}][\p{L}\p{N}_.-]*\s*(?:\.|\[dot\]|\(dot\))\s*\p{L}{2,}(?![\p{L}\p{N}_])/giu,
         name: "EMAIL"
       },
       NAME: {
-        pattern: /(?:^|\.\s+|,\s*)(?:dear|hi|hello|greetings|hey|hey there|mr|mrs|ms|dr|prof)\s+([A-Z][a-z]+(?:\s+[A-Z][a-z]+)*)/gi,
+        pattern: /(?=[DdHhGgMmPp])(?<=(?:^|[.!?\n,])\s*)(?:[Dd]ear|[Hh]i|[Hh]ello|[Gg]reetings|[Hh]ey(?:\s+[Tt]here)?|[Mm][Rr][Ss]?\.?|[Mm][Ss]\.?|[Dd][Rr]\.?|[Pp]rof\.?)\s+\p{Lu}[\p{L}'’-]*\p{Ll}(?:[ \t]+\p{Lu}[\p{L}'’-]*\p{Ll})*/gu,
         name: "PERSON_NAME"
       },
       PHONE: {
-        pattern: /\b(?:\+?1[-.\s]?)?(?:\(?\d{3}\)?[-.\s]?)?\d{3}[-.\s]?\d{4}\b|\b\d{3}[-.\s]\d{4}\b/g,
+        pattern: /(?<!\w)(?:\+?1[-.\s]?)?(?:\(?\d{3}\)?[-.\s]?)?\d{3}[-.\s]?\d{4}\b|\b\d{3}[-.\s]\d{4}\b/g,
         name: "PHONE_NUMBER"
       },
       SSN: {
@@ -57145,7 +57145,8 @@ class Redactor {
     return activeRules;
   }
   _clonePattern(pattern) {
-    return new RegExp(pattern.source, pattern.flags);
+    const flags = pattern.flags.replace("y", "");
+    return new RegExp(pattern.source, flags.includes("g") ? flags : `${flags}g`);
   }
   hasPII(text) {
     for (const { pattern } of this.activeRules) {
@@ -57185,48 +57186,42 @@ class Redactor {
   }
   _redactString(text, resetState) {
     const events = [];
-    let redactedText = text;
     if (resetState && this.anonymize) {
       this.anonymizationMap.clear();
       this.anonymizationCounters.clear();
     }
+    const spans = [];
     for (const { pattern, name } of this.activeRules) {
-      const clonedPattern = this._clonePattern(pattern);
-      redactedText = redactedText.replace(clonedPattern, (match) => {
-        const piiType = name;
-        events.push({ pii_type: piiType, action: "REDACTED" });
-        if (this.anonymize) {
-          const normalizedMatch = match.toLowerCase();
-          const key = `${piiType}:${normalizedMatch}`;
-          if (this.anonymizationMap.has(key)) {
-            return this.anonymizationMap.get(key) ?? match;
-          }
-          const counter = (this.anonymizationCounters.get(piiType) ?? 0) + 1;
-          this.anonymizationCounters.set(piiType, counter);
-          const tokenPrefix = this._getTokenPrefix(piiType);
-          const token = `${tokenPrefix}_${counter}`;
-          this.anonymizationMap.set(key, token);
-          return token;
-        }
-        if (this.globalReplaceWith !== undefined) {
-          return this.globalReplaceWith;
-        }
-        switch (piiType) {
-          case "CREDIT_CARD":
-            return "CREDIT_CARD_NUMBER";
-          case "EMAIL":
-            return "EMAIL_ADDRESS";
-          case "PERSON_NAME":
-            return "PERSON_NAME";
-          case "PHONE_NUMBER":
-            return "PHONE_NUMBER";
-          case "US_SOCIAL_SECURITY_NUMBER":
-            return "US_SOCIAL_SECURITY_NUMBER";
-          default:
-            return "DIGITS";
+      for (const match of text.matchAll(this._clonePattern(pattern))) {
+        if (match[0] === "") {
+          continue;
         }
-      });
+        const start = match.index;
+        spans.push({ start, end: start + match[0].length, name, length: match[0].length });
+      }
+    }
+    spans.sort((a, b) => a.start === b.start ? b.end - a.end : a.start - b.start);
+    const merged = [];
+    for (const span of spans) {
+      const last = merged[merged.length - 1];
+      if (last !== undefined && span.start < last.end) {
+        last.end = Math.max(last.end, span.end);
+        if (span.length > last.length) {
+          last.name = span.name;
+          last.length = span.length;
+        }
+      } else {
+        merged.push({ ...span });
+      }
     }
+    let redactedText = "";
+    let cursor = 0;
+    for (const { start, end, name } of merged) {
+      events.push({ pii_type: name, action: "REDACTED" });
+      redactedText += text.slice(cursor, start) + this._replacementFor(name, text.slice(start, end));
+      cursor = end;
+    }
+    redactedText += text.slice(cursor);
     if (resetState) {
       const hasValidApiKey = this.apiKey !== null && this.apiKey !== "";
       if (hasValidApiKey && events.length > 0) {
@@ -57239,6 +57234,38 @@ class Redactor {
     }
     return redactedText;
   }
+  _replacementFor(piiType, match) {
+    if (this.anonymize) {
+      const normalizedMatch = match.toLowerCase();
+      const key = `${piiType}:${normalizedMatch}`;
+      if (this.anonymizationMap.has(key)) {
+        return this.anonymizationMap.get(key) ?? match;
+      }
+      const counter = (this.anonymizationCounters.get(piiType) ?? 0) + 1;
+      this.anonymizationCounters.set(piiType, counter);
+      const tokenPrefix = this._getTokenPrefix(piiType);
+      const token = `${tokenPrefix}_${counter}`;
+      this.anonymizationMap.set(key, token);
+      return token;
+    }
+    if (this.globalReplaceWith !== undefined) {
+      return this.globalReplaceWith;
+    }
+    switch (piiType) {
+      case "CREDIT_CARD":
+        return "CREDIT_CARD_NUMBER";
+      case "EMAIL":
+        return "EMAIL_ADDRESS";
+      case "PERSON_NAME":
+        return "PERSON_NAME";
+      case "PHONE_NUMBER":
+        return "PHONE_NUMBER";
+      case "US_SOCIAL_SECURITY_NUMBER":
+        return "US_SOCIAL_SECURITY_NUMBER";
+      default:
+        return "DIGITS";
+    }
+  }
   redact(text) {
     return this._redactString(text, true);
   }

package/dist/mcp/mcp-server.js

@@ -3071,6 +3071,8 @@ var require_utils = __commonJS(function(exports, module) {
   var isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
   var isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/?]$/u);
   var isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u);
+  var isRegNameCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=]$/u);
+  var isLiteralRegName = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=]*$/u);
   function stringArrayToHexStripped(input) {
     let acc = "";
     let code = 0;
@@ -3300,13 +3302,47 @@ var require_utils = __commonJS(function(exports, module) {
     }
     return output.join("");
   }
-  var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
-  var HOST_DELIM_RE = /[@/?#:]/g;
-  var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
-  function reescapeHostDelimiters(host, isIP) {
-    const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
-    re.lastIndex = 0;
-    return host.replace(re, (ch) => HOST_DELIMS[ch]);
+  function removeDotSegmentsRelative(path) {
+    if (path === "" || path[0] === "/") {
+      return removeDotSegments(path);
+    }
+    const segments = path.split("/");
+    const last = segments.length - 1;
+    const output = [];
+    let trailingDirectory = false;
+    for (let i = 0;i <= last; i++) {
+      const segment = segments[i];
+      if (segment === "." || segment === "..") {
+        if (segment === "..") {
+          if (output.length !== 0 && output[output.length - 1] !== "..") {
+            output.pop();
+          } else {
+            output.push("..");
+          }
+        }
+        trailingDirectory = i === last;
+      } else {
+        output.push(segment);
+      }
+    }
+    if (trailingDirectory && output[output.length - 1] !== "..") {
+      output.push("");
+    }
+    if (output.length === 0 || output[0] === "" || output[0].includes(":")) {
+      output.unshift(".");
+    }
+    return output.join("/");
+  }
+  var IP_HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23" };
+  var IP_HOST_DELIM_RE = /[@/?#]/g;
+  function encodeHost(host, isIP, allowNonAscii = false) {
+    if (!isIP) {
+      if (isLiteralRegName(host))
+        return host;
+      return encodeComponent(host, isRegNameCharacter, allowNonAscii);
+    }
+    IP_HOST_DELIM_RE.lastIndex = 0;
+    return host.replace(IP_HOST_DELIM_RE, (ch) => IP_HOST_DELIMS[ch]);
   }
   function normalizePercentEncoding(input, decodeUnreserved = false) {
     if (input.indexOf("%") === -1) {
@@ -3472,7 +3508,7 @@ var require_utils = __commonJS(function(exports, module) {
     }
     return output;
   }
-  function encodeComponent(input, isAllowed) {
+  function encodeComponent(input, isAllowed, allowNonAscii = false) {
     let output = "";
     for (let i = 0;i < input.length; i++) {
       const ch = input[i];
@@ -3491,17 +3527,17 @@ var require_utils = __commonJS(function(exports, module) {
         if (code < 128) {
           output += BYTE_HEX[code];
         } else if (code < 55296 || code > 57343) {
-          output += percentEncodeNonAscii(code);
+          output += allowNonAscii ? ch : percentEncodeNonAscii(code);
         } else if (code <= 56319 && i + 1 < input.length) {
           const low = input.charCodeAt(i + 1);
           if (low >= 56320 && low <= 57343) {
-            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            output += allowNonAscii ? ch + input[i + 1] : percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
             i++;
           } else {
-            output += percentEncodeNonAscii(65533);
+            output += allowNonAscii ? "�" : percentEncodeNonAscii(65533);
           }
         } else {
-          output += percentEncodeNonAscii(65533);
+          output += allowNonAscii ? "�" : percentEncodeNonAscii(65533);
         }
       }
     }
@@ -3563,7 +3599,7 @@ var require_utils = __commonJS(function(exports, module) {
     }
     return;
   }
-  function recomposeAuthority(component) {
+  function recomposeAuthority(component, allowNonAscii = false) {
     const uriTokens = [];
     if (component.userinfo !== undefined) {
       uriTokens.push(encodeUserinfo(component.userinfo));
@@ -3584,7 +3620,7 @@ var require_utils = __commonJS(function(exports, module) {
           if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
             host = `[${ipV6res.escapedHost}]`;
           } else {
-            host = reescapeHostDelimiters(host, false);
+            host = encodeHost(host, false, allowNonAscii);
           }
         }
       }
@@ -3606,7 +3642,7 @@ var require_utils = __commonJS(function(exports, module) {
     nonSimpleDomain,
     nonSimpleMailtoDomain,
     recomposeAuthority,
-    reescapeHostDelimiters,
+    encodeHost,
     normalizePercentEncoding,
     normalizePathEncoding,
     serializePathEncoding,
@@ -3616,6 +3652,7 @@ var require_utils = __commonJS(function(exports, module) {
     encodeFragment,
     escapePreservingEscapes,
     removeDotSegments,
+    removeDotSegmentsRelative,
     isIPv4,
     isUUID,
     normalizeIPv6,
@@ -3771,7 +3808,8 @@ var require_schemes = __commonJS(function(exports, module) {
     scheme: "urn",
     parse: urnParse,
     serialize: urnSerialize,
-    skipNormalize: true
+    skipNormalize: true,
+    absolutePath: true
   };
   var urnuuid = {
     scheme: "urn:uuid",
@@ -4050,16 +4088,18 @@ var require_schemes = __commonJS(function(exports, module) {
 
 // node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS(function(exports, module) {
-  var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+  var { normalizeIPv6, removeDotSegments, removeDotSegmentsRelative, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, encodeHost, isIPv4, nonSimpleDomain } = require_utils();
   var { SCHEMES, getSchemeHandler } = require_schemes();
   var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
   var MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
-  function decodeValidScheme(scheme) {
-    const decodedScheme = unescape(String(scheme));
-    if (!VALID_SCHEME.test(decodedScheme)) {
+  var MALFORMED_HOST_ERROR = "URI host is malformed.";
+  var FORBIDDEN_DOMAIN_HOST_CHARACTER = /[\0-\x20"#/:<>?@[\\\]^`{|}\x7F]/u;
+  function validateScheme(scheme) {
+    const stringScheme = String(scheme);
+    if (!VALID_SCHEME.test(stringScheme)) {
       throw new TypeError(MALFORMED_SCHEME_ERROR);
     }
-    return decodedScheme;
+    return stringScheme;
   }
   function normalize(uri, options) {
     if (typeof uri === "string") {
@@ -4074,6 +4114,7 @@ var require_fast_uri = __commonJS(function(exports, module) {
     const {
       parsed: baseParsed,
       malformedAuthorityOrPort: baseMalformed,
+      malformedReferenceEdge: baseMalformedReferenceEdge,
       malformedPercentEncoding: baseMalformedPercentEncoding,
       malformedSchemeSpecific: baseMalformedSchemeSpecific,
       malformedHost: baseMalformedHost,
@@ -4082,24 +4123,34 @@ var require_fast_uri = __commonJS(function(exports, module) {
     const {
       parsed: relativeParsed,
       malformedAuthorityOrPort: relativeMalformed,
+      malformedReferenceEdge: relativeMalformedReferenceEdge,
       malformedPercentEncoding: relativeMalformedPercentEncoding,
       malformedSchemeSpecific: relativeMalformedSchemeSpecific,
       malformedHost: relativeMalformedHost,
       malformedScheme: relativeMalformedScheme
     } = parseWithStatus(relativeURI, schemelessOptions);
-    if (baseMalformed || relativeMalformed || baseMalformedPercentEncoding || relativeMalformedPercentEncoding || baseMalformedSchemeSpecific || relativeMalformedSchemeSpecific || baseMalformedHost || relativeMalformedHost || baseMalformedScheme || relativeMalformedScheme) {
+    if (baseMalformed || relativeMalformed || baseMalformedReferenceEdge || relativeMalformedReferenceEdge || baseMalformedPercentEncoding || relativeMalformedPercentEncoding || baseMalformedSchemeSpecific || relativeMalformedSchemeSpecific || baseMalformedHost || relativeMalformedHost || baseMalformedScheme || relativeMalformedScheme) {
       throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
     }
     const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
     const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
     const resolvedHost = resolved.host;
+    if ((resolved.scheme === "http" || resolved.scheme === "https") && !resolvedHost) {
+      throw new Error("HTTP URIs must have a host.");
+    }
     const resolvedHostIsIP = resolvedHost !== undefined && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+    if (hasForbiddenDomainHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP)) {
+      throw new Error(MALFORMED_HOST_ERROR);
+    }
     canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
     const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !/\P{ASCII}/u.test(resolvedHost);
     if (resolved.error && !encodedASCIIHost) {
       throw new Error(resolved.error);
     }
     schemelessOptions.skipEscape = true;
+    if (resolvedSchemeHandler && resolvedSchemeHandler.absolutePath) {
+      schemelessOptions.absolutePath = true;
+    }
     return serialize(resolved, schemelessOptions);
   }
   function copyHost(target, source) {
@@ -4120,7 +4171,8 @@ var require_fast_uri = __commonJS(function(exports, module) {
       target.userinfo = relative.userinfo;
       copyHost(target, relative);
       target.port = relative.port;
-      target.path = removeDotSegments(relative.path || "");
+      const relativeSchemeHandler = getSchemeHandler(relative.scheme);
+      target.path = relativeSchemeHandler && relativeSchemeHandler.absolutePath ? relative.path || "" : removeDotSegments(relative.path || "");
       target.query = relative.query;
     } else {
       if (relative.userinfo !== undefined || relative.host !== undefined || relative.port !== undefined) {
@@ -4141,14 +4193,15 @@ var require_fast_uri = __commonJS(function(exports, module) {
           if (relative.path[0] === "/") {
             target.path = removeDotSegments(relative.path);
           } else {
-            if ((base.userinfo !== undefined || base.host !== undefined || base.port !== undefined) && !base.path) {
+            const baseHasAuthority = base.userinfo !== undefined || base.host !== undefined || base.port !== undefined;
+            if (baseHasAuthority && !base.path) {
               target.path = "/" + relative.path;
             } else if (!base.path) {
               target.path = relative.path;
             } else {
               target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative.path;
             }
-            target.path = removeDotSegments(target.path);
+            target.path = base.scheme === undefined && !baseHasAuthority && target.path[0] !== "/" ? removeDotSegmentsRelative(target.path) : removeDotSegments(target.path);
           }
           target.query = relative.query;
         }
@@ -4191,13 +4244,14 @@ var require_fast_uri = __commonJS(function(exports, module) {
     const options = Object.assign({}, opts);
     const uriTokens = [];
     if (component.scheme) {
-      component.scheme = decodeValidScheme(component.scheme);
+      component.scheme = validateScheme(component.scheme);
     }
     const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
     if (schemeHandler && schemeHandler.serialize)
       schemeHandler.serialize(component, options);
     const hasAuthority = component.userinfo !== undefined || component.host !== undefined || component.port !== undefined;
-    const pathNoScheme = !options.skipEscape && component.scheme === undefined && !hasAuthority;
+    const schemelessReference = (component.scheme === undefined || options.reference === "suffix") && !hasAuthority;
+    const pathNoScheme = !options.skipEscape && schemelessReference;
     if (component.path !== undefined) {
       if (!options.skipEscape) {
         component.path = serializePathEncoding(component.path, pathNoScheme);
@@ -4206,10 +4260,11 @@ var require_fast_uri = __commonJS(function(exports, module) {
       }
     }
     if (options.reference !== "suffix" && component.scheme) {
-      component.scheme = decodeValidScheme(component.scheme);
+      component.scheme = validateScheme(component.scheme);
       uriTokens.push(component.scheme, ":");
     }
-    const authority = recomposeAuthority(component);
+    const allowNonAsciiHost = options.unicodeSupport === true || Boolean(schemeHandler && schemeHandler.unicodeSupport);
+    const authority = recomposeAuthority(component, allowNonAsciiHost);
     if (authority !== undefined) {
       if (options.reference !== "suffix") {
         uriTokens.push("//");
@@ -4222,9 +4277,9 @@ var require_fast_uri = __commonJS(function(exports, module) {
     if (component.path !== undefined) {
       let s = component.path;
       if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
-        s = removeDotSegments(s);
+        s = schemelessReference && s[0] !== "/" ? removeDotSegmentsRelative(s) : removeDotSegments(s);
       }
-      if (pathNoScheme) {
+      if (schemelessReference) {
         s = serializePathEncoding(s, true);
       }
       if (authority === undefined && s[0] === "/" && s[1] === "/") {
@@ -4273,16 +4328,32 @@ var require_fast_uri = __commonJS(function(exports, module) {
   }
   function canonicalizeHost(parsed, options, schemeHandler, isIP) {
     const bracketedIPLiteral = parsed.host && parsed.host[0] === "[" && parsed.host[parsed.host.length - 1] === "]";
+    if (hasForbiddenDomainHost(parsed, options, schemeHandler, isIP)) {
+      parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+      return true;
+    }
     if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && !bracketedIPLiteral && nonSimpleDomain(parsed.host)) {
+      let url;
       try {
-        parsed.host = new URL("http://" + parsed.host).hostname;
+        url = new URL("http://" + parsed.host);
       } catch (e) {
         parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
         return true;
       }
+      if (!isHostOnlyURL(url)) {
+        parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+        return true;
+      }
+      parsed.host = url.hostname;
     }
     return false;
   }
+  function hasForbiddenDomainHost(parsed, options, schemeHandler, isIP) {
+    return Boolean(parsed.host && isIP === false && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && FORBIDDEN_DOMAIN_HOST_CHARACTER.test(parsed.host));
+  }
+  function isHostOnlyURL(url) {
+    return url.username === "" && url.password === "" && url.port === "" && url.pathname === "/" && url.search === "" && url.hash === "" && url.hostname !== "";
+  }
   function parseWithStatus(uri, opts) {
     const options = Object.assign({}, opts);
     const parsed = {
@@ -4295,6 +4366,7 @@ var require_fast_uri = __commonJS(function(exports, module) {
       fragment: undefined
     };
     let malformedAuthorityOrPort = false;
+    const malformedReferenceEdge = uri.length !== 0 && (uri.charCodeAt(0) <= 32 || uri.charCodeAt(uri.length - 1) <= 32);
     let malformedPercentEncoding = false;
     let malformedSchemeSpecific = false;
     let malformedHost = false;
@@ -4327,6 +4399,9 @@ var require_fast_uri = __commonJS(function(exports, module) {
         }
       }
     }
+    if (malformedReferenceEdge) {
+      parsed.error = parsed.error || "URI must not contain leading or trailing C0 controls or spaces.";
+    }
     const matches = uri.match(URI_PARSE);
     if (matches) {
       parsed.scheme = matches[1];
@@ -4337,9 +4412,8 @@ var require_fast_uri = __commonJS(function(exports, module) {
       parsed.query = matches[7];
       parsed.fragment = matches[8];
       if (parsed.scheme !== undefined) {
-        const decodedScheme = unescape(parsed.scheme);
-        if (VALID_SCHEME.test(decodedScheme)) {
-          parsed.scheme = decodedScheme.toLowerCase();
+        if (VALID_SCHEME.test(parsed.scheme)) {
+          parsed.scheme = parsed.scheme.toLowerCase();
         } else {
           parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
           malformedScheme = true;
@@ -4370,7 +4444,7 @@ var require_fast_uri = __commonJS(function(exports, module) {
             parsed.ipv6Zone = parsed.host.slice(parsed.host.indexOf("%") + 1);
           }
           if (malformedIPLiteral) {
-            parsed.error = parsed.error || "URI host is malformed.";
+            parsed.error = parsed.error || MALFORMED_HOST_ERROR;
             malformedAuthorityOrPort = true;
           }
         } else {
@@ -4393,12 +4467,18 @@ var require_fast_uri = __commonJS(function(exports, module) {
       if (!malformedIPLiteral) {
         malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
       }
-      if (uri.indexOf("%") !== -1 && parsed.host !== undefined && !malformedIPLiteral) {
-        let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
-        if (!isIP) {
+      if (parsed.host !== undefined && !malformedIPLiteral) {
+        let host = parsed.host;
+        if (uri.indexOf("%") !== -1 && !isIP) {
+          host = normalizePercentEncoding(host, true);
           host = normalizePercentEncoding(host.toLowerCase());
         }
-        parsed.host = reescapeHostDelimiters(host, isIP);
+        if (options.scheme !== "null") {
+          const allowNonAsciiHost = options.unicodeSupport === true || Boolean(schemeHandler && schemeHandler.unicodeSupport);
+          parsed.host = encodeHost(host, isIP, allowNonAsciiHost);
+        } else {
+          parsed.host = host;
+        }
       }
       if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
         if (parsed.path) {
@@ -4420,7 +4500,7 @@ var require_fast_uri = __commonJS(function(exports, module) {
     } else {
       parsed.error = parsed.error || "URI can not be parsed.";
     }
-    return { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme };
+    return { parsed, malformedAuthorityOrPort, malformedReferenceEdge, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme };
   }
   function parse(uri, opts) {
     return parseWithStatus(uri, opts).parsed;
@@ -4429,10 +4509,11 @@ var require_fast_uri = __commonJS(function(exports, module) {
     return normalizeStringWithStatus(uri, opts).normalized;
   }
   function normalizeStringWithStatus(uri, opts) {
-    const { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts);
+    const { parsed, malformedAuthorityOrPort, malformedReferenceEdge, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts);
     return {
-      normalized: malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
+      normalized: malformedAuthorityOrPort || malformedReferenceEdge || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
       malformedAuthorityOrPort,
+      malformedReferenceEdge,
       malformedPercentEncoding,
       malformedSchemeSpecific,
       malformedHost,
@@ -4449,8 +4530,8 @@ var require_fast_uri = __commonJS(function(exports, module) {
     } catch {
       return;
     }
-    const { normalized, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts);
-    return malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? undefined : normalized;
+    const { normalized, malformedAuthorityOrPort, malformedReferenceEdge, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts);
+    return malformedAuthorityOrPort || malformedReferenceEdge || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? undefined : normalized;
   }
   var fastUri = {
     SCHEMES,
@@ -22680,6 +22761,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a;
   for (let i = start;i < issues.length; i++) {
@@ -23683,7 +23776,7 @@ ${content.join(`
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
 // node_modules/zod/v4/core/schemas.js
@@ -24294,6 +24387,29 @@ var $ZodDate = /* @__PURE__ */ $constructor("$ZodDate", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse(payload, ctx);
+  };
+}
+var arraySize = (input) => Array.isArray(input) ? input.length : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -24337,6 +24453,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input, optin, optout) {
   const isPresent = key in input;
@@ -31021,6 +31138,9 @@ class Protocol {
       this.setRequestHandler(GetTaskPayloadRequestSchema, async (request, extra) => {
         const handleTaskResult = async () => {
           const taskId = request.params.taskId;
+          if (!await this._taskStore.getTask(taskId, extra.sessionId)) {
+            throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
+          }
           if (this._taskMessageQueue) {
             let queuedMessage;
             while (queuedMessage = await this._taskMessageQueue.dequeue(taskId, extra.sessionId)) {
@@ -31051,12 +31171,12 @@ class Protocol {
             throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
           }
           if (!isTerminal(task.status)) {
-            await this._waitForTaskUpdate(taskId, extra.signal);
+            await this._waitForTaskUpdate(taskId, extra.signal, extra.sessionId);
             return await handleTaskResult();
           }
           if (isTerminal(task.status)) {
             const result = await this._taskStore.getTaskResult(taskId, extra.sessionId);
-            this._clearTaskQueue(taskId);
+            this._clearTaskQueue(taskId, extra.sessionId);
             return {
               ...result,
               _meta: {
@@ -31093,7 +31213,7 @@ class Protocol {
             throw new McpError(ErrorCode.InvalidParams, `Cannot cancel task in terminal status: ${task.status}`);
           }
           await this._taskStore.updateTaskStatus(request.params.taskId, "cancelled", "Client cancelled task execution.", extra.sessionId);
-          this._clearTaskQueue(request.params.taskId);
+          this._clearTaskQueue(request.params.taskId, extra.sessionId);
           const cancelledTask = await this._taskStore.getTask(request.params.taskId, extra.sessionId);
           if (!cancelledTask) {
             throw new McpError(ErrorCode.InvalidParams, `Task not found after cancellation: ${request.params.taskId}`);
@@ -31216,6 +31336,19 @@ class Protocol {
     const handler = this._requestHandlers.get(request.method) ?? this.fallbackRequestHandler;
     const capturedTransport = this._transport;
     const relatedTaskId = request.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
+    const sessionId = capturedTransport?.sessionId;
+    const store = this._taskStore;
+    let relatedTaskFound = true;
+    let relatedTaskLookup;
+    if (relatedTaskId && store && this._taskMessageQueue && sessionId !== undefined) {
+      relatedTaskFound = false;
+      relatedTaskLookup = (async () => {
+        if (!await store.getTask(relatedTaskId, sessionId)) {
+          throw new McpError(ErrorCode.InvalidParams, `Task not found: ${relatedTaskId}`);
+        }
+        relatedTaskFound = true;
+      })();
+    }
     if (handler === undefined) {
       const errorResponse = {
         jsonrpc: "2.0",
@@ -31225,7 +31358,10 @@ class Protocol {
           message: "Method not found"
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && relatedTaskLookup) {
+        const queuedError = { type: "error", message: errorResponse, timestamp: Date.now() };
+        relatedTaskLookup.then(() => this._enqueueTaskMessage(relatedTaskId, queuedError, sessionId), () => capturedTransport?.send(errorResponse)).catch((error) => this._onerror(new Error(`Failed to send an error response: ${error}`)));
+      } else if (relatedTaskId && this._taskMessageQueue) {
         this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -31276,7 +31412,10 @@ class Protocol {
       closeSSEStream: extra?.closeSSEStream,
       closeStandaloneSSEStream: extra?.closeStandaloneSSEStream
     };
-    Promise.resolve().then(() => {
+    (relatedTaskLookup ?? Promise.resolve()).then(() => {
+      if (relatedTaskLookup && abortController.signal.aborted) {
+        throw new McpError(ErrorCode.ConnectionClosed, "Request was cancelled");
+      }
       if (taskCreationParams) {
         this.assertTaskHandlerCapability(request.method);
       }
@@ -31311,7 +31450,7 @@ class Protocol {
           ...error["data"] !== undefined && { data: error["data"] }
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && this._taskMessageQueue && relatedTaskFound) {
         await this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -31699,7 +31838,7 @@ class Protocol {
       throw new Error("Cannot enqueue task message: taskStore and taskMessageQueue are not configured");
     }
     const maxQueueSize = this._options?.maxTaskQueueSize;
-    await this._taskMessageQueue.enqueue(taskId, message, sessionId, maxQueueSize);
+    await this._taskMessageQueue.enqueue(taskId, message, sessionId ?? this._transport?.sessionId, maxQueueSize);
   }
   async _clearTaskQueue(taskId, sessionId) {
     if (this._taskMessageQueue) {
@@ -31718,10 +31857,10 @@ class Protocol {
       }
     }
   }
-  async _waitForTaskUpdate(taskId, signal) {
+  async _waitForTaskUpdate(taskId, signal, sessionId) {
     let interval = this._options?.defaultTaskPollInterval ?? 1000;
     try {
-      const task = await this._taskStore?.getTask(taskId);
+      const task = await this._taskStore?.getTask(taskId, sessionId);
       if (task?.pollInterval) {
         interval = task.pollInterval;
       }
@@ -32388,6 +32527,43 @@ class ExperimentalMcpServerTasks {
   }
 }
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+function toolInputElementCount(value, max) {
+  let count = 0;
+  const stack = [value];
+  while (stack.length > 0) {
+    const node = stack.pop();
+    if (node === null || typeof node !== "object")
+      continue;
+    if (Array.isArray(node)) {
+      for (const child of node) {
+        if (++count > max)
+          return count;
+        if (child !== null && typeof child === "object")
+          stack.push(child);
+      }
+    } else {
+      for (const key in node) {
+        if (!Object.prototype.hasOwnProperty.call(node, key))
+          continue;
+        if (++count > max)
+          return count;
+        const child = node[key];
+        if (child !== null && typeof child === "object")
+          stack.push(child);
+      }
+    }
+  }
+  return count;
+}
+function resolveMaxToolInputElements(value) {
+  if (value === undefined || value === Infinity)
+    return;
+  if (typeof value !== "number" || Number.isNaN(value) || value < 1) {
+    throw new RangeError(`maxToolInputElements must be a number of at least 1, or Infinity, got ${String(value)}`);
+  }
+  return value;
+}
+
 class McpServer {
   constructor(serverInfo, options) {
     this._registeredResources = {};
@@ -32399,6 +32575,16 @@ class McpServer {
     this._resourceHandlersInitialized = false;
     this._promptHandlersInitialized = false;
     this.server = new Server(serverInfo, options);
+    this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
+    if (options?.capabilities?.tools) {
+      this.setToolRequestHandlers();
+    }
+    if (options?.capabilities?.resources) {
+      this.setResourceRequestHandlers();
+    }
+    if (options?.capabilities?.prompts) {
+      this.setPromptRequestHandlers();
+    }
   }
   get experimental() {
     if (!this._experimental) {
@@ -32505,12 +32691,15 @@ class McpServer {
     };
   }
   async validateToolInput(tool, args, toolName) {
+    if (this._maxToolInputElements !== undefined && toolInputElementCount(args, this._maxToolInputElements) > this._maxToolInputElements) {
+      throw new McpError(ErrorCode.InvalidParams, `Invalid arguments for tool ${toolName}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
+    }
     if (!tool.inputSchema) {
       return;
     }
     const inputObj = normalizeObjectSchema(tool.inputSchema);
     const schemaToParse = inputObj ?? tool.inputSchema;
-    const parseResult = await safeParseAsync2(schemaToParse, args);
+    const parseResult = await safeParseAsync2(schemaToParse, args ?? {});
     if (!parseResult.success) {
       const error = "error" in parseResult ? parseResult.error : "Unknown error";
       const errorMessage = getParseErrorMessage(error);
@@ -32735,7 +32924,7 @@ class McpServer {
       }
       if (prompt.argsSchema) {
         const argsObj = normalizeObjectSchema(prompt.argsSchema);
-        const parseResult = await safeParseAsync2(argsObj, request.params.arguments);
+        const parseResult = await safeParseAsync2(argsObj, request.params.arguments ?? {});
         if (!parseResult.success) {
           const error = "error" in parseResult ? parseResult.error : "Unknown error";
           const errorMessage = getParseErrorMessage(error);
@@ -38422,15 +38611,15 @@ class Redactor {
         name: "CREDIT_CARD"
       },
       EMAIL: {
-        pattern: /\b[a-z0-9][a-z0-9._-]*@[a-z0-9][\w.-]*\.[a-z]{2,}/gi,
+        pattern: /(?<![\p{L}\p{N}._%+-]|[\p{L}\p{N}]')[\p{L}\p{N}][\p{L}\p{N}._%+'-]*@[\p{L}\p{N}][\p{L}\p{N}_.-]*\.\p{L}{2,}/giu,
         name: "EMAIL"
       },
       NAME: {
-        pattern: /(?:^|\.\s+)(?:dear|hi|hello|greetings|hey|hey there)\s+([A-Z][a-z]+(?:\s+[A-Z][a-z]+)+)/gi,
+        pattern: /(?=[DdHhGg])(?<=(?:^|[.!?\n])\s*)(?:[Dd]ear|[Hh]i|[Hh]ello|[Gg]reetings|[Hh]ey(?:\s+[Tt]here)?)\s+\p{Lu}[\p{L}'’-]*\p{Ll}(?:[ \t]+\p{Lu}[\p{L}'’-]*\p{Ll})+/gu,
         name: "PERSON_NAME"
       },
       PHONE: {
-        pattern: /\b(?:\+?1[-.\s]?)?(?:\(?\d{3}\)?[-.\s]?)?\d{3}[-.\s]?\d{4}\b/g,
+        pattern: /(?<!\w)(?:\+?1[-.\s]?)?(?:\(?\d{3}\)?[-.\s]?)?\d{3}[-.\s]?\d{4}\b/g,
         name: "PHONE_NUMBER"
       },
       SSN: {
@@ -38444,15 +38633,15 @@ class Redactor {
         name: "CREDIT_CARD"
       },
       EMAIL: {
-        pattern: /\b[a-z0-9][a-z0-9._-]*\s*(?:@|\[at\]|\(at\))\s*[a-z0-9][\w.-]*\s*(?:\.|\[dot\]|\(dot\))\s*[a-z]{2,}\b/gi,
+        pattern: /(?<![\p{L}\p{N}._%+-]|[\p{L}\p{N}]')[\p{L}\p{N}][\p{L}\p{N}._%+'-]*\s*(?:@|\[at\]|\(at\))\s*[\p{L}\p{N}][\p{L}\p{N}_.-]*\s*(?:\.|\[dot\]|\(dot\))\s*\p{L}{2,}(?![\p{L}\p{N}_])/giu,
         name: "EMAIL"
       },
       NAME: {
-        pattern: /(?:^|\.\s+|,\s*)(?:dear|hi|hello|greetings|hey|hey there|mr|mrs|ms|dr|prof)\s+([A-Z][a-z]+(?:\s+[A-Z][a-z]+)*)/gi,
+        pattern: /(?=[DdHhGgMmPp])(?<=(?:^|[.!?\n,])\s*)(?:[Dd]ear|[Hh]i|[Hh]ello|[Gg]reetings|[Hh]ey(?:\s+[Tt]here)?|[Mm][Rr][Ss]?\.?|[Mm][Ss]\.?|[Dd][Rr]\.?|[Pp]rof\.?)\s+\p{Lu}[\p{L}'’-]*\p{Ll}(?:[ \t]+\p{Lu}[\p{L}'’-]*\p{Ll})*/gu,
         name: "PERSON_NAME"
       },
       PHONE: {
-        pattern: /\b(?:\+?1[-.\s]?)?(?:\(?\d{3}\)?[-.\s]?)?\d{3}[-.\s]?\d{4}\b|\b\d{3}[-.\s]\d{4}\b/g,
+        pattern: /(?<!\w)(?:\+?1[-.\s]?)?(?:\(?\d{3}\)?[-.\s]?)?\d{3}[-.\s]?\d{4}\b|\b\d{3}[-.\s]\d{4}\b/g,
         name: "PHONE_NUMBER"
       },
       SSN: {
@@ -38473,7 +38662,8 @@ class Redactor {
     return activeRules;
   }
   _clonePattern(pattern) {
-    return new RegExp(pattern.source, pattern.flags);
+    const flags = pattern.flags.replace("y", "");
+    return new RegExp(pattern.source, flags.includes("g") ? flags : `${flags}g`);
   }
   hasPII(text) {
     for (const { pattern } of this.activeRules) {
@@ -38513,48 +38703,42 @@ class Redactor {
   }
   _redactString(text, resetState) {
     const events = [];
-    let redactedText = text;
     if (resetState && this.anonymize) {
       this.anonymizationMap.clear();
       this.anonymizationCounters.clear();
     }
+    const spans = [];
     for (const { pattern, name } of this.activeRules) {
-      const clonedPattern = this._clonePattern(pattern);
-      redactedText = redactedText.replace(clonedPattern, (match) => {
-        const piiType = name;
-        events.push({ pii_type: piiType, action: "REDACTED" });
-        if (this.anonymize) {
-          const normalizedMatch = match.toLowerCase();
-          const key = `${piiType}:${normalizedMatch}`;
-          if (this.anonymizationMap.has(key)) {
-            return this.anonymizationMap.get(key) ?? match;
-          }
-          const counter = (this.anonymizationCounters.get(piiType) ?? 0) + 1;
-          this.anonymizationCounters.set(piiType, counter);
-          const tokenPrefix = this._getTokenPrefix(piiType);
-          const token = `${tokenPrefix}_${counter}`;
-          this.anonymizationMap.set(key, token);
-          return token;
-        }
-        if (this.globalReplaceWith !== undefined) {
-          return this.globalReplaceWith;
-        }
-        switch (piiType) {
-          case "CREDIT_CARD":
-            return "CREDIT_CARD_NUMBER";
-          case "EMAIL":
-            return "EMAIL_ADDRESS";
-          case "PERSON_NAME":
-            return "PERSON_NAME";
-          case "PHONE_NUMBER":
-            return "PHONE_NUMBER";
-          case "US_SOCIAL_SECURITY_NUMBER":
-            return "US_SOCIAL_SECURITY_NUMBER";
-          default:
-            return "DIGITS";
+      for (const match of text.matchAll(this._clonePattern(pattern))) {
+        if (match[0] === "") {
+          continue;
         }
-      });
+        const start = match.index;
+        spans.push({ start, end: start + match[0].length, name, length: match[0].length });
+      }
+    }
+    spans.sort((a, b) => a.start === b.start ? b.end - a.end : a.start - b.start);
+    const merged = [];
+    for (const span of spans) {
+      const last = merged[merged.length - 1];
+      if (last !== undefined && span.start < last.end) {
+        last.end = Math.max(last.end, span.end);
+        if (span.length > last.length) {
+          last.name = span.name;
+          last.length = span.length;
+        }
+      } else {
+        merged.push({ ...span });
+      }
     }
+    let redactedText = "";
+    let cursor = 0;
+    for (const { start, end, name } of merged) {
+      events.push({ pii_type: name, action: "REDACTED" });
+      redactedText += text.slice(cursor, start) + this._replacementFor(name, text.slice(start, end));
+      cursor = end;
+    }
+    redactedText += text.slice(cursor);
     if (resetState) {
       const hasValidApiKey = this.apiKey !== null && this.apiKey !== "";
       if (hasValidApiKey && events.length > 0) {
@@ -38567,6 +38751,38 @@ class Redactor {
     }
     return redactedText;
   }
+  _replacementFor(piiType, match) {
+    if (this.anonymize) {
+      const normalizedMatch = match.toLowerCase();
+      const key = `${piiType}:${normalizedMatch}`;
+      if (this.anonymizationMap.has(key)) {
+        return this.anonymizationMap.get(key) ?? match;
+      }
+      const counter = (this.anonymizationCounters.get(piiType) ?? 0) + 1;
+      this.anonymizationCounters.set(piiType, counter);
+      const tokenPrefix = this._getTokenPrefix(piiType);
+      const token = `${tokenPrefix}_${counter}`;
+      this.anonymizationMap.set(key, token);
+      return token;
+    }
+    if (this.globalReplaceWith !== undefined) {
+      return this.globalReplaceWith;
+    }
+    switch (piiType) {
+      case "CREDIT_CARD":
+        return "CREDIT_CARD_NUMBER";
+      case "EMAIL":
+        return "EMAIL_ADDRESS";
+      case "PERSON_NAME":
+        return "PERSON_NAME";
+      case "PHONE_NUMBER":
+        return "PHONE_NUMBER";
+      case "US_SOCIAL_SECURITY_NUMBER":
+        return "US_SOCIAL_SECURITY_NUMBER";
+      default:
+        return "DIGITS";
+    }
+  }
   redact(text) {
     return this._redactString(text, true);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-threads",
-  "version": "1.39.3",
+  "version": "1.39.4",
   "description": "Run Claude Code from Slack or Mattermost. Sessions stream live into threads where your whole team can watch and steer.",
   "main": "dist/index.js",
   "type": "module",
@@ -69,45 +69,45 @@
     "package.json"
   ],
   "dependencies": {
-    "@hono/node-server": "2.1.1",
+    "@hono/node-server": "2.1.5",
     "@inkjs/ui": "^2.0.0",
-    "@modelcontextprotocol/sdk": "^1.26.0",
-    "@redactpii/node": "^1.0.16",
+    "@modelcontextprotocol/sdk": "^1.32.1",
+    "@redactpii/node": "^1.0.19",
     "cli-spinners": "^3.3.0",
     "commander": "^14.0.2",
     "cross-spawn": "^7.0.6",
     "diff": "^8.0.3",
-    "express-rate-limit": "^8.3.0",
-    "hono": "4.13.9",
+    "express-rate-limit": "^8.7.1",
+    "hono": "4.13.13",
     "ink": "^6.6.0",
     "ink-scroll-view": "^0.3.5",
     "js-yaml": "^4.3.1",
     "prompts": "^2.4.2",
-    "react": "^19.2.3",
+    "react": "^19.3.1",
     "semver": "7.8.5",
     "update-notifier": "^7.3.1",
     "ws": "8.22.0",
-    "zod": "^4.3.6"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@types/bun": "latest",
     "@types/cross-spawn": "^6.0.6",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^26.1.1",
+    "@types/node": "^26.6.5",
     "@types/prompts": "^2.4.9",
     "@types/react": "^19.2.7",
     "@types/semver": "^7.7.1",
     "@types/update-notifier": "^6.0.8",
-    "@types/ws": "^8.18.0",
-    "eslint": "^10.7.0",
+    "@types/ws": "^8.18.2",
+    "eslint": "^10.13.0",
     "husky": "^9.1.7",
-    "knip": "6.38.0",
+    "knip": "6.41.0",
     "lint-staged": "^17.0.4",
-    "prettier": "^3.9.5",
+    "prettier": "^3.9.10",
     "react-devtools-core": "^8.0.0",
     "typescript": "^6.0.2",
-    "typescript-eslint": "^8.64.0"
+    "typescript-eslint": "^8.71.2"
   },
   "engines": {
     "node": ">=20.0.0",
@@ -126,11 +126,13 @@
     "flatted": ">=3.4.0",
     "picomatch": ">=2.3.2",
     "path-to-regexp": ">=8.4.0",
-    "fast-uri": ">=4.2.1",
+    "fast-uri": ">=4.2.3",
     "brace-expansion": ">=5.0.9",
     "ip-address": ">=10.3.1",
     "ws": "$ws",
-    "shell-quote": ">=1.10.0"
+    "shell-quote": ">=1.12.0",
+    "proxy-addr": ">=2.0.8",
+    "body-parser": ">=2.4.0"
   },
   "resolutions": {
     "hono": "$hono",
@@ -139,10 +141,12 @@
     "flatted": ">=3.4.0",
     "picomatch": ">=2.3.2",
     "path-to-regexp": ">=8.4.0",
-    "fast-uri": ">=4.2.1",
+    "fast-uri": ">=4.2.3",
     "brace-expansion": ">=5.0.9",
     "ip-address": ">=10.3.1",
     "ws": "$ws",
-    "shell-quote": ">=1.10.0"
+    "shell-quote": ">=1.12.0",
+    "proxy-addr": ">=2.0.8",
+    "body-parser": ">=2.4.0"
   }
 }