claude-threads 1.40.0 → 1.40.2

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.40.2] - 2026-10-30
+
+### Changed
+- `hono` 4.13.14, plus dev tooling (#655, #656).
+
+### Fixed
+- **Auto-update respects `engines`.** The updater now skips a release this host's Node or Bun cannot run, logs why, and `!update` says so instead of reporting "Up to date". npm only warns about `engines`, so an update used to install anyway. A host that is held back gets no further releases until its runtime is upgraded (#659).
+
+## [1.40.1] - 2026-10-30
+
+### Added
+- **`bugReports: { repo: owner/name }` files `!bug` reports in your own repository** (#577). `true` and `false` keep their meaning, and a malformed `repo` disables bug reports rather than falling back to the public default.
+
+### Changed
+- **Screenshots no longer go to catbox.moe** (#577). They are attached to the GitHub issue with `gh issue create --attach`, which needs `gh` 2.99 or newer and write access to the target repository. Without those the report is filed without them and says so. Attachments on a public repository stay online permanently, even if the issue is deleted, and the preview warns about that.
+- **Nothing leaves before approval.** Screenshots used to be uploaded while the preview was being built, so a cancelled report had already sent them. The preview now also names the destination repository and whether it is public.
+
+### Security
+- **The `!bug` title can no longer run commands on the host.** The title went into a shell string with only double quotes escaped, so `$(...)` and backticks in a bug description were executed. `gh` is now called with an argument list.
+
 ## [1.40.0] - 2026-10-30
 
 ### Fixed

package/dist/index.js

@@ -2345,6 +2345,10 @@ function resolveWatchesEnabled(value, fieldPath) {
 function resolveAuditLogEnabled(value, fieldPath) {
   return resolveBooleanFeature(value, fieldPath ?? "auditLog", { default: false, verb: "audit log stays off" });
 }
+function isBugReportRepoConfig(value) {
+  const repo = value?.repo;
+  return typeof repo === "string" && GITHUB_REPO_PATTERN.test(repo);
+}
 function resolveBugReportsEnabled(value, fieldPath) {
   if (value === undefined)
     return true;
@@ -2352,9 +2356,14 @@ function resolveBugReportsEnabled(value, fieldPath) {
     return true;
   if (value === false)
     return false;
-  console.warn(`Invalid ${fieldPath ?? "bugReports"} config: expected boolean, got ${JSON.stringify(value)} — ` + `bug reports are DISABLED (this flag fails closed: it controls data leaving your infrastructure)`);
+  if (isBugReportRepoConfig(value))
+    return true;
+  console.warn(`Invalid ${fieldPath ?? "bugReports"} config: expected boolean or { repo: owner/name }, got ${JSON.stringify(value)} — ` + `bug reports are DISABLED (this flag fails closed: it controls data leaving your infrastructure)`);
   return false;
 }
+function resolveBugReportRepo(value) {
+  return isBugReportRepoConfig(value) ? value.repo : DEFAULT_BUG_REPORT_REPO;
+}
 function isRemoteMcpServer(server) {
   return server.type === "http" || server.type === "sse";
 }
@@ -2473,7 +2482,7 @@ function effectivePermissionMode(input) {
     return "default";
   return input.botWideMode;
 }
-var OVERHEAD_VISIBILITY_VALUES, DEFAULT_OVERHEAD_VISIBILITY = "full", RECONNECT_POLICY_VALUES, DEFAULT_RECONNECT_POLICY = "retry", PRESENTATION_MODE_VALUES, PRESENTATION_MODE_EXPANSIONS, TURN_MARKER_VALUES, DEFAULT_TURN_MARKER, DEFAULT_TURN_MARKER_EMOJI = "checkered_flag", TURN_COMPLETE_EVENT_TYPE = "claude_threads_turn_complete", TURN_COMPLETE_PAYLOAD_VERSION = 1, TOOL_ACTIVITY_VALUES, TOOL_DETAILS_VALUES, DEFAULT_TOOL_ACTIVITY, DEFAULT_MEMORY_CONFIG, MEMORY_DISABLED, BOT_MCP_SERVER_NAME = "claude-threads-mcp", STDIO_KEYS, REMOTE_KEYS, LIMITS_DEFAULTS, MODE_INFO;
+var OVERHEAD_VISIBILITY_VALUES, DEFAULT_OVERHEAD_VISIBILITY = "full", RECONNECT_POLICY_VALUES, DEFAULT_RECONNECT_POLICY = "retry", PRESENTATION_MODE_VALUES, PRESENTATION_MODE_EXPANSIONS, TURN_MARKER_VALUES, DEFAULT_TURN_MARKER, DEFAULT_TURN_MARKER_EMOJI = "checkered_flag", TURN_COMPLETE_EVENT_TYPE = "claude_threads_turn_complete", TURN_COMPLETE_PAYLOAD_VERSION = 1, TOOL_ACTIVITY_VALUES, TOOL_DETAILS_VALUES, DEFAULT_TOOL_ACTIVITY, DEFAULT_MEMORY_CONFIG, MEMORY_DISABLED, DEFAULT_BUG_REPORT_REPO = "anneschuth/claude-threads", GITHUB_REPO_PATTERN, BOT_MCP_SERVER_NAME = "claude-threads-mcp", STDIO_KEYS, REMOTE_KEYS, LIMITS_DEFAULTS, MODE_INFO;
 var init_types = __esm(() => {
   OVERHEAD_VISIBILITY_VALUES = ["full", "minimal", "hidden"];
   RECONNECT_POLICY_VALUES = ["retry", "exit"];
@@ -2503,6 +2512,7 @@ var init_types = __esm(() => {
     channelLayer: false,
     distillation: false
   };
+  GITHUB_REPO_PATTERN = /^[A-Za-z0-9][\w.-]*\/[A-Za-z0-9][\w.-]*$/;
   STDIO_KEYS = new Set(["type", "command", "args", "env"]);
   REMOTE_KEYS = new Set(["type", "url", "headers"]);
   LIMITS_DEFAULTS = {
@@ -57530,8 +57540,8 @@ function getUpdateInfo() {
 init_emoji();
 
 // src/operations/bug-report/handler.ts
-import { execSync as execSync2 } from "child_process";
-import { writeFileSync as writeFileSync5, unlinkSync as unlinkSync3 } from "fs";
+import { execSync as execSync2, execFileSync } from "child_process";
+import { writeFileSync as writeFileSync5, unlinkSync as unlinkSync3, mkdtempSync as mkdtempSync2, rmSync } from "fs";
 import { tmpdir as tmpdir4 } from "os";
 import { join as join9 } from "path";
 
@@ -57791,58 +57801,67 @@ class Redactor {
 }
 
 // src/operations/bug-report/handler.ts
+var import_semver4 = __toESM(require_semver2(), 1);
 init_version_check();
 var piiRedactor = new Redactor({ aggressive: true });
-var CATBOX_API_URL = "https://catbox.moe/user/api.php";
-async function uploadImageToCatbox(imageBuffer, filename) {
-  const arrayBuffer = imageBuffer.buffer.slice(imageBuffer.byteOffset, imageBuffer.byteOffset + imageBuffer.byteLength);
-  const formData = new FormData;
-  formData.append("reqtype", "fileupload");
-  formData.append("fileToUpload", new Blob([arrayBuffer]), filename);
-  const response = await fetch(CATBOX_API_URL, {
-    method: "POST",
-    body: formData
-  });
-  if (!response.ok) {
-    throw new Error(`Catbox upload failed: ${response.status} ${response.statusText}`);
-  }
-  const responseText = await response.text();
-  if (responseText.startsWith("https://")) {
-    return responseText.trim();
-  }
-  throw new Error(`Catbox upload failed: ${responseText}`);
-}
-async function uploadImages(files, downloadFile) {
-  const results = [];
+var GH_MIN_ATTACH_VERSION = "2.99.0";
+var MAX_SCREENSHOT_BYTES = 10 * 1024 * 1024;
+var ATTACH_PERMISSIONS = ["ADMIN", "MAINTAIN", "WRITE"];
+function selectScreenshots(files, target) {
+  const screenshots = [];
+  const skipped = [];
   for (const file of files) {
     if (!file.mimeType.startsWith("image/")) {
-      results.push({
-        success: false,
-        error: "Not an image file",
-        originalFile: file
-      });
-      continue;
+      skipped.push(`${file.name}: not an image`);
+    } else if (file.size > MAX_SCREENSHOT_BYTES) {
+      skipped.push(`${file.name}: larger than 10 MB`);
+    } else if (!target.canAttach) {
+      skipped.push(`${file.name}: ${target.attachBlocker}`);
+    } else {
+      screenshots.push(file);
     }
+  }
+  return { screenshots, skipped };
+}
+async function saveScreenshots(files, downloadFile) {
+  if (files.length === 0) {
+    return { paths: [], failed: 0, cleanup: () => {} };
+  }
+  const dir = mkdtempSync2(join9(tmpdir4(), "bug-screenshots-"));
+  const paths = [];
+  let failed = 0;
+  for (const [index, file] of files.entries()) {
     try {
+      if (!downloadFile)
+        throw new Error("Platform cannot download files");
       const buffer = await downloadFile(file.id);
-      const url = await uploadImageToCatbox(buffer, file.name);
-      results.push({
-        success: true,
-        url,
-        originalFile: file
-      });
-    } catch (err) {
-      results.push({
-        success: false,
-        error: err instanceof Error ? err.message : String(err),
-        originalFile: file
-      });
+      const extension = (file.extension ?? file.mimeType.split("/")[1] ?? "").replace(/^\./, "").toLowerCase();
+      const path = join9(dir, `screenshot-${index + 1}.${/^[a-z0-9]+$/.test(extension) ? extension : "png"}`);
+      writeFileSync5(path, buffer, { mode: 384 });
+      paths.push(path);
+    } catch {
+      failed++;
     }
   }
-  return results;
+  return {
+    paths,
+    failed,
+    cleanup: () => {
+      try {
+        rmSync(dir, { recursive: true, force: true });
+      } catch {}
+    }
+  };
+}
+function omittedScreenshotsNote(count) {
+  return `${count} screenshot(s) were shared in the chat thread but are not attached to this issue.`;
+}
+function withOmittedScreenshots(body, count) {
+  return count > 0 ? `${body}
+
+${omittedScreenshotsNote(count)}` : body;
 }
 var MAX_RECENT_EVENTS = 10;
-var GITHUB_REPO = "anneschuth/claude-threads";
 function trackEvent(session, type, summary) {
   if (!session.recentEvents) {
     session.recentEvents = [];
@@ -58033,18 +58052,15 @@ function formatLogEntries(entries) {
   }).join(`
 `);
 }
-function formatIssueBody(context, userDescription, imageUrls = []) {
+function formatIssueBody(context, userDescription, omittedScreenshots = 0) {
   const sections = [];
   sections.push(`## Description
 
 ${sanitizeText(userDescription)}`);
-  if (imageUrls.length > 0) {
-    const imageSection = imageUrls.map((url, i) => `![Screenshot ${i + 1}](${url})`).join(`
-
-`);
+  if (omittedScreenshots > 0) {
     sections.push(`## Screenshots
 
-${imageSection}`);
+${omittedScreenshotsNote(omittedScreenshots)}`);
   }
   sections.push(`## Environment
 
@@ -58104,16 +58120,15 @@ _Reported via claude-threads bug report feature_`);
 
 `);
 }
-function escapeShell(str) {
-  return str.replace(/"/g, "\\\"");
-}
-function checkGitHubCli(exec = execSync2) {
+var runGh = (args, options) => execFileSync("gh", args, options);
+var GH_CHECK_OPTIONS = {
+  encoding: "utf-8",
+  timeout: 5000,
+  stdio: ["pipe", "pipe", "pipe"]
+};
+function checkGitHubCli(exec = runGh) {
   try {
-    exec("gh --version", {
-      encoding: "utf-8",
-      timeout: 5000,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
+    exec(["--version"], GH_CHECK_OPTIONS);
   } catch {
     return {
       installed: false,
@@ -58122,11 +58137,7 @@ function checkGitHubCli(exec = execSync2) {
     };
   }
   try {
-    exec("gh auth status", {
-      encoding: "utf-8",
-      timeout: 5000,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
+    exec(["auth", "status"], GH_CHECK_OPTIONS);
   } catch {
     return {
       installed: true,
@@ -58136,29 +58147,79 @@ function checkGitHubCli(exec = execSync2) {
   }
   return { installed: true, authenticated: true };
 }
-async function createGitHubIssue(title, body, workingDir, exec = execSync2) {
+function inspectBugReportTarget(repo, exec = runGh) {
+  let visibility;
+  let viewerPermission;
+  try {
+    const info = JSON.parse(exec(["repo", "view", repo, "--json", "viewerPermission,visibility"], GH_CHECK_OPTIONS));
+    visibility = info.visibility;
+    viewerPermission = info.viewerPermission;
+  } catch {
+    return { repo, isPublic: true, canAttach: false, attachBlocker: `could not read ${repo}` };
+  }
+  const isPublic = visibility !== "PRIVATE" && visibility !== "INTERNAL";
+  if (viewerPermission && !ATTACH_PERMISSIONS.includes(viewerPermission)) {
+    return { repo, isPublic, canAttach: false, attachBlocker: `attaching needs write access to ${repo}` };
+  }
+  let ghVersion = null;
+  try {
+    ghVersion = import_semver4.coerce(exec(["--version"], GH_CHECK_OPTIONS));
+  } catch {}
+  if (ghVersion && import_semver4.lt(ghVersion, GH_MIN_ATTACH_VERSION)) {
+    return { repo, isPublic, canAttach: false, attachBlocker: `attaching needs gh ${GH_MIN_ATTACH_VERSION} or newer` };
+  }
+  return { repo, isPublic, canAttach: true };
+}
+async function createGitHubIssue(title, body, workingDir, options) {
+  const { repo, attachments = [], exec = runGh } = options;
   const ghStatus = checkGitHubCli(exec);
   if (!ghStatus.installed || !ghStatus.authenticated) {
     throw new Error(ghStatus.error);
   }
   const bodyFile = join9(tmpdir4(), `bug-body-${Date.now()}.md`);
-  try {
-    writeFileSync5(bodyFile, body, "utf-8");
-    const cmd = `gh issue create --repo "${GITHUB_REPO}" --title "${escapeShell(title)}" --body-file "${bodyFile}"`;
-    const result = exec(cmd, {
+  const create = (issueBody, paths) => {
+    writeFileSync5(bodyFile, issueBody, "utf-8");
+    return exec([
+      "issue",
+      "create",
+      "--repo",
+      repo,
+      "--title",
+      title,
+      "--body-file",
+      bodyFile,
+      ...paths.flatMap((path, index) => ["--attach", `${path}#Screenshot ${index + 1}`])
+    ], {
       cwd: workingDir,
       encoding: "utf-8",
-      timeout: 30000,
+      timeout: paths.length > 0 ? 120000 : 30000,
       stdio: ["pipe", "pipe", "pipe"]
-    });
-    return result.trim();
+    }).trim();
+  };
+  try {
+    try {
+      return { url: create(body, attachments), attachmentsIncomplete: false };
+    } catch (err) {
+      if (attachments.length === 0)
+        throw err;
+      const failure = err;
+      const url = String(failure.stdout ?? "").match(/https:\/\/\S+\/issues\/\d+/)?.[0];
+      if (url)
+        return { url, attachmentsIncomplete: true };
+      if (failure.code === "ETIMEDOUT")
+        throw err;
+      return {
+        url: create(withOmittedScreenshots(body, attachments.length), []),
+        attachmentsIncomplete: true
+      };
+    }
   } finally {
     try {
       unlinkSync3(bodyFile);
     } catch {}
   }
 }
-function formatBugPreview(title, description, context, imageUrls, imageErrors, formatter) {
+function formatBugPreview(title, description, context, target, screenshotCount, skippedScreenshots, formatter) {
   const lines = [];
   lines.push(`${formatter.formatBold("Bug Report Preview")}`);
   lines.push("");
@@ -58185,14 +58246,20 @@ function formatBugPreview(title, description, context, imageUrls, imageErrors, f
       lines.push(formatter.formatListItem(`${event.type}: ${event.summary.substring(0, 40)}...`));
     }
   }
-  if (imageUrls.length > 0 || imageErrors.length > 0) {
+  lines.push("");
+  lines.push(formatter.formatBold("Destination:"));
+  lines.push(formatter.formatListItem(`Issue on ${formatter.formatCode(target.repo)}${target.isPublic ? " (public: anyone can read it)" : ""}`));
+  if (screenshotCount > 0 || skippedScreenshots.length > 0) {
     lines.push("");
     lines.push(formatter.formatBold("Screenshots:"));
-    if (imageUrls.length > 0) {
-      lines.push(formatter.formatListItem(`✅ ${imageUrls.length} image(s) uploaded successfully`));
+    if (screenshotCount > 0) {
+      lines.push(formatter.formatListItem(`\uD83D\uDCCE ${screenshotCount} image(s) will be attached when you approve`));
+      if (target.isPublic) {
+        lines.push(formatter.formatListItem("⚠️ Attachments on a public repository stay online permanently, even if the issue is deleted. Check them for personal data first."));
+      }
     }
-    if (imageErrors.length > 0) {
-      lines.push(formatter.formatListItem(`⚠️ ${imageErrors.length} image(s) failed: ${imageErrors[0]}`));
+    if (skippedScreenshots.length > 0) {
+      lines.push(formatter.formatListItem(`⚠️ ${skippedScreenshots.length} image(s) not attached (${skippedScreenshots[0]}). Add them to the issue by hand if needed.`));
     }
   }
   lines.push("");
@@ -67363,6 +67430,11 @@ async function showUpdateStatus(session, updateManager, ctx) {
   }
   const updateInfo = await updateManager.checkNow();
   if (!updateInfo || !updateInfo.available) {
+    const blocked = updateManager.getBlockedUpdate();
+    if (blocked) {
+      await post(session, "warning", `${formatter.formatBold(`v${blocked.latestVersion} is available but not installable`)}: ${blocked.reason}`);
+      return;
+    }
     await post(session, "success", `${formatter.formatBold("Up to date")} - no updates available`);
     return;
   }
@@ -67396,7 +67468,8 @@ async function forceUpdateNow(session, username, updateManager) {
   }
   const updateInfo = await updateManager.checkNow();
   if (!updateInfo || !updateInfo.available) {
-    await post(session, "info", `No update available to install`);
+    const blocked = updateManager.getBlockedUpdate();
+    await post(session, "info", blocked ? `Not installing v${blocked.latestVersion}: ${blocked.reason}` : `No update available to install`);
     return;
   }
   await post(session, "info", `\uD83D\uDD04 ${formatter.formatBold("Forcing update")} to v${updateInfo.latestVersion} - restarting shortly...
@@ -67420,7 +67493,7 @@ async function deferUpdate(session, username, updateManager) {
   await post(session, "success", `⏸️ ${formatter.formatBold("Update deferred")} for 1 hour
 ` + formatter.formatItalic("Use !update now to apply earlier"));
 }
-async function reportBug(session, description, username, ctx, errorContext, attachedFiles) {
+async function reportBug(session, description, username, ctx, errorContext, attachedFiles, exec) {
   const formatter = session.platform.getFormatter();
   if (!ctx.config.bugReportsEnabled) {
     await post(session, "info", `${formatter.formatBold("Bug reporting is disabled")} by this server's configuration ` + `(${formatter.formatCode("bugReports: false")}).
@@ -67435,25 +67508,18 @@ async function reportBug(session, description, username, ctx, errorContext, atta
 ` + `Or react with \uD83D\uDC1B on any error message to report it.`);
     return;
   }
-  const ghStatus = checkGitHubCli();
+  const ghStatus = checkGitHubCli(exec);
   if (!ghStatus.installed || !ghStatus.authenticated) {
     await postError(session, ghStatus.error || "GitHub CLI not configured");
     return;
   }
   const bugDescription = description || (errorContext ? `Error: ${errorContext.message.substring(0, 200)}` : "Unknown error");
   const context = await collectBugReportContext(session, errorContext);
-  let imageUrls = [];
-  let imageErrors = [];
-  const downloadFile = session.platform.downloadFile?.bind(session.platform);
-  if (attachedFiles && attachedFiles.length > 0 && downloadFile) {
-    await post(session, "info", `\uD83D\uDCE4 Uploading ${attachedFiles.length} image(s)...`);
-    const uploadResults = await uploadImages(attachedFiles, downloadFile);
-    imageUrls = uploadResults.filter((r) => r.success && typeof r.url === "string").map((r) => r.url);
-    imageErrors = uploadResults.filter((r) => !r.success).map((r) => `${r.originalFile.name}: ${r.error}`);
-  }
+  const target = inspectBugReportTarget(ctx.config.bugReportRepo, exec);
+  const { screenshots, skipped } = selectScreenshots(attachedFiles ?? [], target);
   const title = generateIssueTitle(bugDescription);
-  const body = formatIssueBody(context, bugDescription, imageUrls);
-  const preview = formatBugPreview(title, bugDescription, context, imageUrls, imageErrors, formatter);
+  const body = formatIssueBody(context, bugDescription, skipped.length);
+  const preview = formatBugPreview(title, bugDescription, context, target, screenshots.length, skipped, formatter);
   const previewMessage = `\uD83D\uDC1B ${preview}`;
   const bugReportPost = await postInteractiveAndRegister(session, previewMessage, [APPROVAL_EMOJIS[0], DENIAL_EMOJIS[0]], ctx.ops.registerPost);
   session.messageManager?.setPendingBugReport({
@@ -67461,8 +67527,7 @@ async function reportBug(session, description, username, ctx, errorContext, atta
     title,
     body,
     userDescription: bugDescription,
-    imageUrls,
-    imageErrors,
+    screenshots,
     errorContext
   });
   sessionLog8(session).info(`\uD83D\uDC1B Bug report preview created by @${username}: ${title}`);
@@ -67476,14 +67541,19 @@ async function handleBugReportApproval(session, isApproved, username, ctx, exec)
   }
   const formatter = session.platform.getFormatter();
   if (isApproved) {
+    const saved = await saveScreenshots(pending.screenshots ?? [], session.platform.downloadFile?.bind(session.platform));
     try {
-      const issueUrl = await createGitHubIssue(pending.title, pending.body, session.workingDir, exec);
-      await updatePostSuccess(session, pending.postId, `${formatter.formatBold("Bug report submitted")}: ${issueUrl}`);
-      sessionLog8(session).info(`\uD83D\uDC1B Bug report created by @${username}: ${issueUrl}`);
+      const issue = await createGitHubIssue(pending.title, withOmittedScreenshots(pending.body, saved.failed), session.workingDir, { repo: ctx.config.bugReportRepo, attachments: saved.paths, exec });
+      const incomplete = issue.attachmentsIncomplete || saved.failed > 0;
+      await updatePostSuccess(session, pending.postId, `${formatter.formatBold("Bug report submitted")}: ${issue.url}` + (incomplete ? `
+⚠️ Not every screenshot could be attached. Add the missing ones to the issue by hand.` : ""));
+      sessionLog8(session).info(`\uD83D\uDC1B Bug report created by @${username}: ${issue.url}`);
     } catch (err) {
       const errorMessage = err instanceof Error ? err.message : String(err);
       await updatePostError(session, pending.postId, `${formatter.formatBold("Failed to create bug report")}: ${errorMessage}`);
       sessionLog8(session).error(`Failed to create bug report: ${errorMessage}`);
+    } finally {
+      saved.cleanup();
     }
   } else {
     await updatePostCancelled(session, pending.postId, `${formatter.formatBold("Bug report cancelled")} by ${formatter.formatUserMention(username)}`);
@@ -73915,6 +73985,7 @@ class SessionManager extends EventEmitter4 {
   userAttribution;
   threadLogsEnabled;
   bugReportsEnabled;
+  bugReportRepo;
   usageShowEmails;
   threadLogsRetentionDays;
   limits;
@@ -73944,7 +74015,7 @@ class SessionManager extends EventEmitter4 {
   connectorsOff = null;
   usageRefreshInFlight = null;
   usageRefreshedAt = 0;
-  constructor(workingDir, permissionModeOrSkipFlag = "default", chromeEnabled = false, worktreeMode = "prompt", sessionsPath, threadLogsEnabled = true, threadLogsRetentionDays = 30, limits, claudeAccounts, respondOnlyWhenMentioned = false, userAttribution = true, bugReportsEnabled = true, usage) {
+  constructor(workingDir, permissionModeOrSkipFlag = "default", chromeEnabled = false, worktreeMode = "prompt", sessionsPath, threadLogsEnabled = true, threadLogsRetentionDays = 30, limits, claudeAccounts, respondOnlyWhenMentioned = false, userAttribution = true, bugReportsEnabled = true, usage, bugReportRepo = DEFAULT_BUG_REPORT_REPO) {
     super();
     this.workingDir = workingDir;
     this.permissionMode = typeof permissionModeOrSkipFlag === "boolean" ? permissionModeOrSkipFlag ? "bypass" : "default" : permissionModeOrSkipFlag;
@@ -73953,6 +74024,7 @@ class SessionManager extends EventEmitter4 {
     this.respondOnlyWhenMentioned = respondOnlyWhenMentioned;
     this.userAttribution = userAttribution;
     this.bugReportsEnabled = bugReportsEnabled;
+    this.bugReportRepo = bugReportRepo;
     this.threadLogsEnabled = threadLogsEnabled;
     this.threadLogsRetentionDays = threadLogsRetentionDays;
     this.limits = resolveLimits(limits);
@@ -74097,7 +74169,8 @@ class SessionManager extends EventEmitter4 {
       threadLogsRetentionDays: this.threadLogsRetentionDays,
       permissionTimeoutMs: this.limits.permissionTimeoutSeconds * 1000,
       flushDelayMs: this.limits.flushDelayMs,
-      bugReportsEnabled: this.bugReportsEnabled
+      bugReportsEnabled: this.bugReportsEnabled,
+      bugReportRepo: this.bugReportRepo
     };
     const state = {
       sessions: this.registry.getSessions(),
@@ -74762,7 +74835,8 @@ class SessionManager extends EventEmitter4 {
     }
     const updateInfo = await this.autoUpdateManager.checkNow();
     if (!updateInfo || !updateInfo.available) {
-      await platform.createPost(`✅ ${formatter.formatBold("Up to date")} - no updates available`, threadId);
+      const blocked = this.autoUpdateManager.getBlockedUpdate();
+      await platform.createPost(blocked ? `⚠️ ${formatter.formatBold(`v${blocked.latestVersion} is available but not installable`)}: ${blocked.reason}` : `✅ ${formatter.formatBold("Up to date")} - no updates available`, threadId);
       return;
     }
     const scheduledAt = this.autoUpdateManager.getScheduledRestartAt();
@@ -77817,12 +77891,12 @@ function wrapAnsi2(string, columns, options) {
 
 // node_modules/terminal-size/index.js
 import process12 from "node:process";
-import { execFileSync } from "node:child_process";
+import { execFileSync as execFileSync2 } from "node:child_process";
 import fs6 from "node:fs";
 import tty2 from "node:tty";
 var defaultColumns = 80;
 var defaultRows = 24;
-var exec5 = (command, arguments_, { shell, env } = {}) => execFileSync(command, arguments_, {
+var exec5 = (command, arguments_, { shell, env } = {}) => execFileSync2(command, arguments_, {
   encoding: "utf8",
   stdio: ["ignore", "pipe", "ignore"],
   timeout: 500,
@@ -89734,6 +89808,7 @@ import { EventEmitter as EventEmitter9 } from "events";
 
 // src/auto-update/checker.ts
 init_logger();
+var import_semver5 = __toESM(require_semver2(), 1);
 import { EventEmitter as EventEmitter7 } from "events";
 var log54 = createLogger("checker");
 var PACKAGE_NAME = "claude-threads";
@@ -89750,7 +89825,16 @@ function compareVersions(a, b) {
   }
   return 0;
 }
-async function fetchLatestVersion() {
+function unmetEngine(engines, versions = process.versions) {
+  const [runtime, running] = versions.bun ? ["bun", versions.bun] : ["node", versions.node];
+  const required = engines?.[runtime];
+  if (!required || !import_semver5.validRange(required))
+    return null;
+  if (import_semver5.satisfies(running, required, { includePrerelease: true }))
+    return null;
+  return `requires ${runtime} ${required}, this host runs ${running}`;
+}
+async function fetchLatestRelease() {
   try {
     const response = await fetch(`https://registry.npmjs.org/${PACKAGE_NAME}/latest`, {
       headers: {
@@ -89762,7 +89846,7 @@ async function fetchLatestVersion() {
       return null;
     }
     const data = await response.json();
-    return data.version ?? null;
+    return data.version ? { version: data.version, engines: data.engines } : null;
   } catch (err) {
     log54.warn(`Failed to fetch latest version: ${err}`);
     return null;
@@ -89774,6 +89858,7 @@ class UpdateChecker extends EventEmitter7 {
   checkInterval = null;
   lastCheck = null;
   lastUpdateInfo = null;
+  blockedUpdate = null;
   isChecking = false;
   constructor(config) {
     super();
@@ -89813,14 +89898,25 @@ class UpdateChecker extends EventEmitter7 {
     this.emit("check:start");
     try {
       log54.debug("Checking for updates...");
-      const latestVersion = await fetchLatestVersion();
-      if (!latestVersion) {
+      const latest = await fetchLatestRelease();
+      if (!latest) {
         this.emit("check:complete", false);
         return null;
       }
       this.lastCheck = new Date;
+      const latestVersion = latest.version;
       const currentVersion = VERSION;
       const hasUpdate = compareVersions(latestVersion, currentVersion) > 0;
+      const blockedReason = hasUpdate ? unmetEngine(latest.engines) : null;
+      if (blockedReason) {
+        if (this.blockedUpdate?.latestVersion !== latestVersion) {
+          log54.warn(`⚠️ Not updating to v${latestVersion}: ${blockedReason}`);
+        }
+        this.blockedUpdate = { latestVersion, reason: blockedReason };
+        this.emit("check:complete", false);
+        return null;
+      }
+      this.blockedUpdate = null;
       if (hasUpdate) {
         const updateInfo = {
           available: true,
@@ -89850,6 +89946,9 @@ class UpdateChecker extends EventEmitter7 {
   getLastUpdateInfo() {
     return this.lastUpdateInfo;
   }
+  getBlockedUpdate() {
+    return this.blockedUpdate;
+  }
   getLastCheckTime() {
     return this.lastCheck;
   }
@@ -90557,6 +90656,9 @@ class AutoUpdateManager extends EventEmitter9 {
   getUpdateInfo() {
     return this.state.updateInfo;
   }
+  getBlockedUpdate() {
+    return this.checker.getBlockedUpdate();
+  }
   getScheduledRestartAt() {
     return this.scheduler.getScheduledRestartAt();
   }
@@ -91137,7 +91239,7 @@ async function startWithoutDaemon() {
   const threadLogsRetentionDays = config.threadLogs?.retentionDays ?? 30;
   const bugReportsEnabled = resolveBugReportsEnabled(config.bugReports);
   configureBugReports(bugReportsEnabled);
-  const session = new SessionManager(workingDir, initialPermissionMode, config.chrome, config.worktreeMode, undefined, threadLogsEnabled, threadLogsRetentionDays, config.limits, config.claudeAccounts, config.respondOnlyWhenMentioned, config.userAttribution, bugReportsEnabled, config.usage);
+  const session = new SessionManager(workingDir, initialPermissionMode, config.chrome, config.worktreeMode, undefined, threadLogsEnabled, threadLogsRetentionDays, config.limits, config.claudeAccounts, config.respondOnlyWhenMentioned, config.userAttribution, bugReportsEnabled, config.usage, resolveBugReportRepo(config.bugReports));
   if (config.stickyMessage) {
     session.setStickyMessageCustomization(config.stickyMessage.description, config.stickyMessage.footer);
   }

package/dist/mcp/mcp-server.js

@@ -38835,6 +38835,7 @@ class Redactor {
 }
 
 // src/operations/bug-report/handler.ts
+var import_semver2 = __toESM(require_semver2(), 1);
 init_version_check();
 
 // src/persistence/thread-logger.ts
@@ -38845,6 +38846,7 @@ var LOGS_BASE_DIR = join4(stateHome(), ".claude-threads", "logs");
 
 // src/operations/bug-report/handler.ts
 var piiRedactor = new Redactor({ aggressive: true });
+var MAX_SCREENSHOT_BYTES = 10 * 1024 * 1024;
 // src/mcp/decision-bridge.ts
 import { createServer, createConnection } from "node:net";
 var MAX_BRIDGE_REQUEST_BYTES = 1024 * 1024;
@@ -39812,7 +39814,7 @@ var CHAT_PLATFORM_PROMPT = generateChatPlatformPrompt();
 init_cli();
 
 // src/update-notifier.ts
-var import_semver2 = __toESM(require_semver2(), 1);
+var import_semver3 = __toESM(require_semver2(), 1);
 
 // src/operations/commands/handler.ts
 init_emoji();

package/docs/CONFIGURATION.md

@@ -54,7 +54,7 @@ platforms:
 | `respondOnlyWhenMentioned` | Start new threads in quiet mode, where the bot only replies to messages that @mention it. Users can still toggle per-thread with `!mentions`. | `false` |
 | `userAttribution` | Prefix each user turn sent to Claude with the sender's `[@username]:` so Claude can tell who is speaking in multi-user threads. Only applied once a thread has more than one participant (after `!invite`); solo threads are left untouched. Set `false` to disable. Applies to new sessions. | `true` |
 | `keepAlive` | Prevent system sleep while sessions are active | `true` |
-| `bugReports` | Whether `!bug` may file a report. ⚠️ A bug report leaves your infrastructure: attached screenshots are uploaded to a public anonymous file host, and the report body — session context plus recent daemon log lines — is filed as an issue on the project's public GitHub repository, behind best-effort redaction. Claude can also invoke `!bug` itself. Set `false` and the whole path is removed: the command is refused, Claude cannot invoke it either, the 🐛 error reaction does nothing, the approval that would file the issue is refused, and `!bug` disappears from `!help`. **Fails closed** — a malformed value disables it rather than defaulting to on. | `true` |
+| `bugReports` | Whether `!bug` may file a report, and where. ⚠️ A bug report leaves your infrastructure: the report body — session context plus recent daemon log lines — is filed as an issue on the project's public GitHub repository, behind best-effort redaction, unless you set `bugReports: { repo: owner/name }` to file in your own repository. Attached screenshots go along with the issue once someone approves the preview; this needs `gh` 2.99 or newer and write access to the target repository, and without those the report is filed without them. An attachment on a public repository stays online permanently, even if the issue is deleted. Claude can also invoke `!bug` itself, but a person still has to approve the preview. Set `false` and the whole path is removed: the command is refused, Claude cannot invoke it either, the 🐛 error reaction does nothing, the approval that would file the issue is refused, and `!bug` disappears from `!help`. **Fails closed** — a malformed value disables it rather than defaulting to on. | `true` |
 | `limits` | Resource limits and timeouts (see below) | see below |
 | `threadLogs` | Thread logging (see below) | enabled |
 | `stickyMessage` | Sticky message text customization (see below) | none |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-threads",
-  "version": "1.40.0",
+  "version": "1.40.2",
   "description": "Run Claude Code from Slack or Mattermost. Sessions stream live into threads where your whole team can watch and steer.",
   "main": "dist/index.js",
   "type": "module",
@@ -78,7 +78,7 @@
     "cross-spawn": "^7.0.6",
     "diff": "^8.0.3",
     "express-rate-limit": "^8.7.1",
-    "hono": "4.13.13",
+    "hono": "4.13.14",
     "ink": "^8.0.0",
     "js-yaml": "^4.3.1",
     "prompts": "^2.4.2",
@@ -101,7 +101,7 @@
     "@types/ws": "^8.18.2",
     "eslint": "^10.13.0",
     "husky": "^9.1.7",
-    "knip": "6.41.0",
+    "knip": "6.43.0",
     "lint-staged": "^17.0.4",
     "prettier": "^3.9.10",
     "react-devtools-core": "^8.0.0",