claude-threads 1.7.0 → 1.7.1

package/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.7.1] - 2026-04-21
+
+### Fixed
+- **`maxSessions` cap could be exceeded under concurrent session starts** — `startSession()` passed the cap check synchronously but then awaited `createPost()` before committing the session to the map, so concurrent starts all read the same stale count and over-admitted. The integration test `"should reject new session when at capacity"` flaked at ~40% for weeks because of this. Pending starts are now tracked alongside committed sessions in the cap check. (#331)
+- **Reject Claude accounts with both `home` and `apiKey` set** — the two are documented as mutually exclusive, but `AccountPool` silently preferred `home` when both were configured. Now the account is dropped with a warning so misconfiguration surfaces. (#330, thanks @shaders)
+- **Tighten `reset_at` epoch regex in rate-limit detection** — the old pattern matched `"preset": N` and (more importantly) `reset_after=N`, a *relative* retry-after hint that would have been misread as an absolute epoch and pushed cooldown decades into the future. Added word-boundary anchors and regression tests. (#330)
+- **Rate-limit emit guard now allows deadline extensions** — the boolean latch in `ClaudeCli` fired at most once per process, so a second rate-limit hit with a longer reset time couldn't widen `AccountPool.markCooling`'s extend-only window. Replaced with a numeric last-deadline tracker: repeat hits at the same severity still dedupe, but a later deadline re-emits. (#330)
+
 ## [1.7.0] - 2026-04-21
 
 ### Added

package/README.md

@@ -34,6 +34,7 @@
 - **Git worktrees** - Isolate changes in separate branches
 - **File attachments** - Attach images, PDFs, and files for Claude to analyze
 - **Chrome automation** - Control Chrome browser for web tasks
+- **Multi-account Claude (opt-in)** - Round-robin sessions across multiple Claude subscriptions or API keys with automatic rate-limit cooldown — see [Configuration](docs/CONFIGURATION.md#claude-accounts-optional-multi-account-mode)
 
 ## Quick Start
 

package/dist/index.js

@@ -53561,8 +53561,13 @@ class AccountPool {
       const hasAuth = !!acc.home || !!acc.apiKey;
       if (!hasAuth) {
         log6.warn(`Claude account ${acc.id} has neither home nor apiKey — ignoring`);
+        return false;
+      }
+      if (acc.home && acc.apiKey) {
+        log6.warn(`Claude account ${acc.id} has both home and apiKey set — must choose one; ignoring`);
+        return false;
       }
-      return hasAuth;
+      return true;
     });
     this.byId = new Map(this.accounts.map((acc) => [acc.id, acc]));
     for (const acc of this.accounts) {
@@ -54215,7 +54220,7 @@ function extractResetAt(text, now) {
     };
     return now + value * unitMs[unit];
   }
-  const unix = text.match(/["']?reset(?:_at)?["']?\s*[:=]\s*(\d{10,13})/);
+  const unix = text.match(/\breset(?:_at)?\b\s*["']?\s*[:=]\s*(\d{10,13})/);
   if (unix) {
     const raw = parseInt(unix[1], 10);
     return unix[1].length === 13 ? raw : raw * 1000;
@@ -54272,7 +54277,7 @@ class ClaudeCli extends EventEmitter2 {
   statusFilePath = null;
   lastStatusData = null;
   stderrBuffer = "";
-  rateLimitEmitted = false;
+  lastEmittedRateLimitDeadline = 0;
   log;
   constructor(options2) {
     super();
@@ -54324,7 +54329,7 @@ class ClaudeCli extends EventEmitter2 {
     if (this.process)
       throw new Error("Already running");
     this.stderrBuffer = "";
-    this.rateLimitEmitted = false;
+    this.lastEmittedRateLimitDeadline = 0;
     cleanupBrowserBridgeSockets();
     const claudePath = getClaudePath();
     const args = [
@@ -54479,9 +54484,11 @@ class ClaudeCli extends EventEmitter2 {
     const hit = detectRateLimit(text);
     if (!hit.detected)
       return;
-    if (this.rateLimitEmitted)
+    const newDeadline = cooldownDeadline(hit);
+    const MIN_ADVANCE_MS = 60000;
+    if (newDeadline - this.lastEmittedRateLimitDeadline < MIN_ADVANCE_MS)
       return;
-    this.rateLimitEmitted = true;
+    this.lastEmittedRateLimitDeadline = newDeadline;
     this.log.warn(`Rate limit detected: ${hit.matched ?? "(no match text)"}`);
     this.emit("rate-limit", hit);
   }
@@ -67216,6 +67223,11 @@ var sessionLog6 = createSessionLog(log26);
 function mutableSessions(ctx) {
   return ctx.state.sessions;
 }
+var pendingStartsCount = 0;
+function releasePendingStart() {
+  if (pendingStartsCount > 0)
+    pendingStartsCount--;
+}
 function mutablePostIndex(ctx) {
   return ctx.state.postIndex;
 }
@@ -67548,20 +67560,24 @@ async function startSession(options2, username, displayName, replyToPostId, plat
   if (!platform) {
     throw new Error(`Platform '${platformId}' not found. Call addPlatform() first.`);
   }
-  if (ctx.state.sessions.size >= ctx.config.maxSessions) {
+  const activeOrPending = ctx.state.sessions.size + pendingStartsCount;
+  if (activeOrPending >= ctx.config.maxSessions) {
     const formatter2 = platform.getFormatter();
     const tempSession = {
       platform,
       threadId: replyToPostId || "",
       sessionId: "temp"
     };
-    await post(tempSession, "warning", `${formatter2.formatBold("Too busy")} - ${ctx.state.sessions.size} sessions active. Please try again later.`);
+    await post(tempSession, "warning", `${formatter2.formatBold("Too busy")} - ${activeOrPending} sessions active. Please try again later.`);
     return;
   }
+  pendingStartsCount++;
   const startFormatter = platform.getFormatter();
   const startPost = await withErrorHandling(() => platform.createPost(startFormatter.formatItalic("Claude Threads session starting..."), replyToPostId), { action: "Create session post" });
-  if (!startPost)
+  if (!startPost) {
+    releasePendingStart();
     return;
+  }
   const actualThreadId = replyToPostId || startPost.id;
   const sessionId = ctx.ops.getSessionId(platformId, actualThreadId);
   platform.sendTyping(actualThreadId);
@@ -67576,11 +67592,13 @@ async function startSession(options2, username, displayName, replyToPostId, plat
     const resolvedDir = resolve6(requestedDir);
     if (!existsSync11(resolvedDir)) {
       await platform.updatePost(startPost.id, `❌ Directory does not exist: ${formatter.formatCode(initialOptions.workingDir)}`);
+      releasePendingStart();
       return;
     }
     const { statSync: statSync4 } = await import("fs");
     if (!statSync4(resolvedDir).isDirectory()) {
       await platform.updatePost(startPost.id, `❌ Not a directory: ${formatter.formatCode(initialOptions.workingDir)}`);
+      releasePendingStart();
       return;
     }
     workingDir = resolvedDir;
@@ -67649,6 +67667,7 @@ ${CHAT_PLATFORM_PROMPT}`;
     workingDir: ctx.config.workingDir
   });
   mutableSessions(ctx).set(sessionId, session);
+  releasePendingStart();
   ctx.ops.registerPost(startPost.id, actualThreadId);
   ctx.ops.emitSessionAdd(session);
   sessionLog6(session).info(`▶ Session started by @${username}`);

package/dist/mcp/permission-server.js

@@ -53526,6 +53526,11 @@ function detectRateLimit(text, now = Date.now()) {
   const resetAtEpochMs = extractResetAt(text, now);
   return { detected: true, matched, resetAtEpochMs };
 }
+function cooldownDeadline(hit, now = Date.now()) {
+  if (!hit.detected)
+    return now;
+  return hit.resetAtEpochMs ?? now + DEFAULT_COOLDOWN_MS;
+}
 function extractResetAt(text, now) {
   const relative = text.match(/(?:retry[_\s-]?after|resets?\s+in)\s+(\d+)\s*(second|minute|hour|day)s?/i);
   if (relative) {
@@ -53539,7 +53544,7 @@ function extractResetAt(text, now) {
     };
     return now + value * unitMs[unit];
   }
-  const unix = text.match(/["']?reset(?:_at)?["']?\s*[:=]\s*(\d{10,13})/);
+  const unix = text.match(/\breset(?:_at)?\b\s*["']?\s*[:=]\s*(\d{10,13})/);
   if (unix) {
     const raw = parseInt(unix[1], 10);
     return unix[1].length === 13 ? raw : raw * 1000;
@@ -53596,7 +53601,7 @@ class ClaudeCli extends EventEmitter2 {
   statusFilePath = null;
   lastStatusData = null;
   stderrBuffer = "";
-  rateLimitEmitted = false;
+  lastEmittedRateLimitDeadline = 0;
   log;
   constructor(options2) {
     super();
@@ -53648,7 +53653,7 @@ class ClaudeCli extends EventEmitter2 {
     if (this.process)
       throw new Error("Already running");
     this.stderrBuffer = "";
-    this.rateLimitEmitted = false;
+    this.lastEmittedRateLimitDeadline = 0;
     cleanupBrowserBridgeSockets();
     const claudePath = getClaudePath();
     const args = [
@@ -53803,9 +53808,11 @@ class ClaudeCli extends EventEmitter2 {
     const hit = detectRateLimit(text);
     if (!hit.detected)
       return;
-    if (this.rateLimitEmitted)
+    const newDeadline = cooldownDeadline(hit);
+    const MIN_ADVANCE_MS = 60000;
+    if (newDeadline - this.lastEmittedRateLimitDeadline < MIN_ADVANCE_MS)
       return;
-    this.rateLimitEmitted = true;
+    this.lastEmittedRateLimitDeadline = newDeadline;
     this.log.warn(`Rate limit detected: ${hit.matched ?? "(no match text)"}`);
     this.emit("rate-limit", hit);
   }

package/docs/CONFIGURATION.md

@@ -72,6 +72,33 @@ platforms:
 | `allowedUsers` | No | List of Slack usernames |
 | `skipPermissions` | No | Auto-approve actions (default: `false`) |
 
+## Claude Accounts (optional, multi-account mode)
+
+By default every session spawns `claude` with the bot's own `process.env`, so they all share one subscription's token budget. Add a `claudeAccounts` block to spread load across multiple accounts — the bot round-robins new sessions across the pool and automatically skips accounts in rate-limit cooldown. Omit the block entirely to stay in single-account mode (unchanged behavior).
+
+```yaml
+claudeAccounts:
+  # OAuth accounts — prepare each HOME first with `HOME=<path> claude login`
+  - id: primary
+    home: /home/bot/.claude-accounts/primary
+  - id: backup
+    displayName: Backup (Pro)
+    home: /home/bot/.claude-accounts/backup
+
+  # API-key billed
+  - id: shared-api
+    apiKey: sk-ant-api03-xxxxxxxx...
+```
+
+| Setting | Required | Description |
+|---------|----------|-------------|
+| `id` | Yes | Stable identifier used in logs, UI, and persisted session state |
+| `home` | One of | Alternate `$HOME` containing `.claude/.credentials.json` from a prior `HOME=<path> claude login`. For OAuth Pro/Max subscriptions. Session history also lives here, so resumed sessions pick the same account. |
+| `apiKey` | One of | Anthropic API key. Billed against that key; session history stays under the bot's default `HOME`. |
+| `displayName` | No | Human-readable label in UI (defaults to `id`) |
+
+Exactly one of `home` or `apiKey` should be set per account. Persisted sessions record which account they ran under and resume on the same one.
+
 ## Environment Variables
 
 | Variable | Description | Default |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-threads",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "description": "Share Claude Code sessions live in a Mattermost channel with interactive features",
   "main": "dist/index.js",
   "type": "module",