claude-threads 1.6.0 → 1.6.2

package/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.6.2] - 2026-04-20
+
+### Fixed
+- **MCP server path resolution in bundled builds** - Fixes `__dirname` resolution when the project is bundled with `bun build` into a single `dist/index.js` (#316)
+- **CLAUDE_THREADS_INTERACTIVE forwarding to daemon subprocess** - Parent no longer falsely advertises a TTY to the piped-stdio child in daemon mode (#312, #317)
+- **Sticky message test regex** - Updated to match the actual header format (#319)
+- **Flaky permissions integration test** - Uses pattern-based waits instead of fixed post counts to tolerate intermittent CI 500s (#320)
+
+### Security
+- **Override path-to-regexp to >=8.4.0** - Fixes CVE-2026-4926 (HIGH severity DoS) pulled in transitively via @modelcontextprotocol/sdk → express → router (#318)
+- **Bump hono to 4.12.14** - Fixes GHSA-458j-xx4x-4375 (improper JSX attribute name handling in hono/jsx SSR) (#324)
+
+### Dependencies
+- **Bump production dependencies** - @hono/node-server, hono, @redactpii/node, react (#311, #326)
+- **Bump dev dependencies** - @types/yazl, @types/bun, @types/node, prettier, typescript-eslint (#310, #322)
+- **Bump CI actions** - actions/upload-pages-artifact 4 to 5 (#321)
+
+## [1.6.1] - 2026-04-07
+
+### Security
+- **Bump path-to-regexp to 8.4.0** - Fixes CVE-2026-4926 (DoS via malicious route patterns) (#303)
+
+### Dependencies
+- **Bump production dependencies** - @hono/node-server, @modelcontextprotocol/sdk, express-rate-limit, yauzl (#308)
+- **Bump dev dependencies** - TypeScript 5.9 to 6.0, @types/bun, @types/node, @types/react, lint-staged, typescript-eslint (#309)
+- **Bump CI actions** - actions/configure-pages 5 to 6, actions/deploy-pages 4 to 5, schneegans/dynamic-badges-action 1.7 to 1.8 (#304, #305, #306)
+
 ## [1.6.0] - 2026-03-27
 
 ### Added

package/dist/index.js

@@ -54372,11 +54372,19 @@ class ClaudeCli extends EventEmitter2 {
   getMcpServerPath() {
     const __filename2 = fileURLToPath3(import.meta.url);
     const __dirname4 = dirname6(__filename2);
+    const bundledPath = resolve3(__dirname4, "mcp", "permission-server.js");
+    if (existsSync8(bundledPath)) {
+      return bundledPath;
+    }
     return resolve3(__dirname4, "..", "mcp", "permission-server.js");
   }
   getStatusLineWriterPath() {
     const __filename2 = fileURLToPath3(import.meta.url);
     const __dirname4 = dirname6(__filename2);
+    const bundledPath = resolve3(__dirname4, "statusline", "writer.js");
+    if (existsSync8(bundledPath)) {
+      return bundledPath;
+    }
     return resolve3(__dirname4, "..", "statusline", "writer.js");
   }
 }
@@ -79624,7 +79632,7 @@ async function main() {
         env: {
           ...process.env,
           CLAUDE_THREADS_BIN: binPath,
-          ...process.stdout.isTTY ? { CLAUDE_THREADS_INTERACTIVE: "1" } : {}
+          CLAUDE_THREADS_INTERACTIVE: ""
         }
       });
     } else {
@@ -79633,7 +79641,7 @@ async function main() {
         env: {
           ...process.env,
           CLAUDE_THREADS_BIN: binPath,
-          ...process.stdout.isTTY ? { CLAUDE_THREADS_INTERACTIVE: "1" } : {}
+          CLAUDE_THREADS_INTERACTIVE: ""
         }
       });
     }

package/dist/mcp/permission-server.js

@@ -54444,11 +54444,19 @@ class ClaudeCli extends EventEmitter2 {
   getMcpServerPath() {
     const __filename2 = fileURLToPath3(import.meta.url);
     const __dirname4 = dirname4(__filename2);
+    const bundledPath = resolve3(__dirname4, "mcp", "permission-server.js");
+    if (existsSync4(bundledPath)) {
+      return bundledPath;
+    }
     return resolve3(__dirname4, "..", "mcp", "permission-server.js");
   }
   getStatusLineWriterPath() {
     const __filename2 = fileURLToPath3(import.meta.url);
     const __dirname4 = dirname4(__filename2);
+    const bundledPath = resolve3(__dirname4, "statusline", "writer.js");
+    if (existsSync4(bundledPath)) {
+      return bundledPath;
+    }
     return resolve3(__dirname4, "..", "statusline", "writer.js");
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-threads",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "description": "Share Claude Code sessions live in a Mattermost channel with interactive features",
   "main": "dist/index.js",
   "type": "module",
@@ -99,7 +99,7 @@
     "husky": "^9.1.7",
     "lint-staged": "^16.2.7",
     "prettier": "^3.4.2",
-    "typescript": "^5.9.3",
+    "typescript": "^6.0.2",
     "typescript-eslint": "^8.57.2",
     "yazl": "^3.3.1"
   },
@@ -118,13 +118,15 @@
     "@hono/node-server": "$@hono/node-server",
     "express-rate-limit": "$express-rate-limit",
     "flatted": ">=3.4.0",
-    "picomatch": ">=2.3.2"
+    "picomatch": ">=2.3.2",
+    "path-to-regexp": ">=8.4.0"
   },
   "resolutions": {
     "hono": "$hono",
     "@hono/node-server": "$@hono/node-server",
     "express-rate-limit": "$express-rate-limit",
     "flatted": ">=3.4.0",
-    "picomatch": ">=2.3.2"
+    "picomatch": ">=2.3.2",
+    "path-to-regexp": ">=8.4.0"
   }
 }