claude-threads 1.7.1 → 1.8.1

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.8.1] - 2026-04-21
+
+### Fixed
+- **Interactive users silently demoted to headless when `autoUpdate` was enabled** — the auto-restart daemon runs the child as a bash background job (`&`), which leaves stdout piped and stdin detached. Ink can't render there, so the TUI dropped out without any error. Three prior patches (#287, #300, #317) each fixed the active crash mode inside the daemon path; none questioned whether interactive users should be routed through the daemon at all. The daemon is now skipped when `process.stdout.isTTY` and `--headless` isn't set. Unattended paths (explicit `--auto-restart`, `--headless`, or no TTY) still go through the daemon. (#333)
+
+## [1.8.0] - 2026-04-21
+
+### Added
+- **Pass `MCP_CONNECTION_NONBLOCKING=true` to the Claude child** — caps `--mcp-config` connects at 5s so a slow MCP server never delays session startup. Requires Claude CLI 2.1.89+. Set it explicitly in the bot's own env to override.
+- **Pass `ENABLE_PROMPT_CACHING_1H=true` to the Claude child** — opts into the 1-hour prompt cache TTL, meaningfully reducing re-caching cost on long-lived threads that idle past the default 5-minute window. Requires Claude CLI 2.1.108+. Set it explicitly in the bot's own env to override.
+- **Documented `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1`** as an opt-in hardening flag. When set on the bot's env it passes through to Claude, which strips the specific credential env vars `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, `CLAUDE_CODE_OAUTH_TOKEN`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`, `AWS_BEARER_TOKEN_BEDROCK`, and `GOOGLE_APPLICATION_CREDENTIALS` from any Bash, hook, or stdio MCP subprocess it spawns (empirically verified on CLI 2.1.116). Bot-specific vars like `PLATFORM_TOKEN` / `MATTERMOST_TOKEN` / `SLACK_BOT_TOKEN` pass through untouched. **Side effect:** the flag also forces Claude's permission mode to `default` and rejects `--dangerously-skip-permissions`; the bot now warns at startup if the flag is set alongside any platform configured with `skipPermissions: true`. Requires Claude CLI 2.1.83+.
+
+### Fixed
+- **Stale Claude CLI version range in `CLAUDE.md`** — the docs said `>=2.0.74 <=2.0.76`, but the actual pin in `version-check.ts` has been `>=2.0.74 <2.2.0` since v1.x. Also bumped the "install a compatible version" hint in the runtime error from `@2.1.1` to `@2.1.116`.
+
 ## [1.7.1] - 2026-04-21
 
 ### Fixed

package/dist/index.js

@@ -50038,7 +50038,7 @@ function validateClaudeCli() {
       version: result.version,
       compatible: false,
       message: `Claude CLI version ${result.version} is not compatible. Required: ${CLAUDE_CLI_VERSION_RANGE}
-` + `Install a compatible version: npm install -g @anthropic-ai/claude-code@2.1.1`,
+` + `Install a compatible version: npm install -g @anthropic-ai/claude-code@2.1.116`,
       rawOutput: result.rawOutput ?? undefined
     };
   }
@@ -54260,6 +54260,25 @@ function cleanupBrowserBridgeSockets() {
     log10.debug(`Browser bridge cleanup failed: ${err}`);
   }
 }
+function buildClaudeChildEnv(parentEnv, account) {
+  const env = { ...parentEnv };
+  if (env.MCP_CONNECTION_NONBLOCKING === undefined) {
+    env.MCP_CONNECTION_NONBLOCKING = "true";
+  }
+  if (env.ENABLE_PROMPT_CACHING_1H === undefined) {
+    env.ENABLE_PROMPT_CACHING_1H = "true";
+  }
+  if (account?.home) {
+    env.HOME = account.home;
+    env.USERPROFILE = account.home;
+    delete env.ANTHROPIC_API_KEY;
+    delete env.CLAUDE_CODE_OAUTH_TOKEN;
+  } else if (account?.apiKey) {
+    env.ANTHROPIC_API_KEY = account.apiKey;
+    delete env.CLAUDE_CODE_OAUTH_TOKEN;
+  }
+  return env;
+}
 function isErrorResultEvent(event) {
   const ev = event;
   if (typeof ev.subtype === "string" && ev.subtype.startsWith("error"))
@@ -54561,20 +54580,7 @@ class ClaudeCli extends EventEmitter2 {
     return true;
   }
   buildChildEnv() {
-    const account = this.options.account;
-    if (!account)
-      return process.env;
-    const env = { ...process.env };
-    if (account.home) {
-      env.HOME = account.home;
-      env.USERPROFILE = account.home;
-      delete env.ANTHROPIC_API_KEY;
-      delete env.CLAUDE_CODE_OAUTH_TOKEN;
-    } else if (account.apiKey) {
-      env.ANTHROPIC_API_KEY = account.apiKey;
-      delete env.CLAUDE_CODE_OAUTH_TOKEN;
-    }
-    return env;
+    return buildClaudeChildEnv(process.env, this.options.account);
   }
   getMcpServerPath() {
     const __filename2 = fileURLToPath3(import.meta.url);
@@ -79894,6 +79900,8 @@ async function main() {
       return false;
     if (opts.autoRestart === true)
       return true;
+    if (!isHeadless && process.stdout.isTTY)
+      return false;
     if (await configExists()) {
       try {
         const config = loadConfigWithMigration();
@@ -80005,6 +80013,15 @@ async function startWithoutDaemon() {
     console.error("");
     process.exit(1);
   }
+  if (process.env.CLAUDE_CODE_SUBPROCESS_ENV_SCRUB === "1") {
+    const hasSkipPermissionPlatform = config.platforms.some((p) => p.skipPermissions === true);
+    if (hasSkipPermissionPlatform) {
+      console.error(red("  ⚠️  CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1 is set but a platform has skipPermissions: true."));
+      console.error(dim("     Claude CLI will force permissionMode: default and reject --dangerously-skip-permissions."));
+      console.error(dim("     Either unset the env var or set skipPermissions: false on all platforms."));
+      console.error("");
+    }
+  }
   let triggerShutdown = null;
   const updateState = loadUpdateState();
   const restoredSettings = updateState.justUpdated ? updateState.runtimeSettings : undefined;

package/dist/mcp/permission-server.js

@@ -53584,6 +53584,25 @@ function cleanupBrowserBridgeSockets() {
     log7.debug(`Browser bridge cleanup failed: ${err}`);
   }
 }
+function buildClaudeChildEnv(parentEnv, account) {
+  const env = { ...parentEnv };
+  if (env.MCP_CONNECTION_NONBLOCKING === undefined) {
+    env.MCP_CONNECTION_NONBLOCKING = "true";
+  }
+  if (env.ENABLE_PROMPT_CACHING_1H === undefined) {
+    env.ENABLE_PROMPT_CACHING_1H = "true";
+  }
+  if (account?.home) {
+    env.HOME = account.home;
+    env.USERPROFILE = account.home;
+    delete env.ANTHROPIC_API_KEY;
+    delete env.CLAUDE_CODE_OAUTH_TOKEN;
+  } else if (account?.apiKey) {
+    env.ANTHROPIC_API_KEY = account.apiKey;
+    delete env.CLAUDE_CODE_OAUTH_TOKEN;
+  }
+  return env;
+}
 function isErrorResultEvent(event) {
   const ev = event;
   if (typeof ev.subtype === "string" && ev.subtype.startsWith("error"))
@@ -53885,20 +53904,7 @@ class ClaudeCli extends EventEmitter2 {
     return true;
   }
   buildChildEnv() {
-    const account = this.options.account;
-    if (!account)
-      return process.env;
-    const env = { ...process.env };
-    if (account.home) {
-      env.HOME = account.home;
-      env.USERPROFILE = account.home;
-      delete env.ANTHROPIC_API_KEY;
-      delete env.CLAUDE_CODE_OAUTH_TOKEN;
-    } else if (account.apiKey) {
-      env.ANTHROPIC_API_KEY = account.apiKey;
-      delete env.CLAUDE_CODE_OAUTH_TOKEN;
-    }
-    return env;
+    return buildClaudeChildEnv(process.env, this.options.account);
   }
   getMcpServerPath() {
     const __filename2 = fileURLToPath3(import.meta.url);

package/docs/CONFIGURATION.md

@@ -107,6 +107,19 @@ Exactly one of `home` or `apiKey` should be set per account. Persisted sessions
 | `SESSION_TIMEOUT_MS` | Idle timeout in milliseconds | `1800000` (30 min) |
 | `NO_UPDATE_NOTIFIER` | Disable update checks | - |
 | `DEBUG` | Enable verbose logging | - |
+| `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB` | Strip `ANTHROPIC_*` / `AWS_*_TOKEN` / `CLAUDE_CODE_OAUTH_TOKEN` / `GOOGLE_APPLICATION_CREDENTIALS` etc. from Bash, hook, and stdio-MCP subprocesses Claude spawns. Bot-specific vars like `PLATFORM_TOKEN` pass through. **Also forces permission mode to `default`** — `--dangerously-skip-permissions` will be rejected. Requires Claude CLI 2.1.83+. | - |
+
+### Forwarded to Claude CLI automatically
+
+The bot sets two tuning flags on the Claude child process when they aren't
+already present in the bot's environment:
+
+| Variable | Effect | Requires |
+|----------|--------|----------|
+| `MCP_CONNECTION_NONBLOCKING=true` | Caps `--mcp-config` connects at 5s so a slow MCP server never delays startup | Claude CLI 2.1.89+ |
+| `ENABLE_PROMPT_CACHING_1H=true` | Opts into 1-hour prompt cache TTL, cutting re-caching cost on long-lived threads | Claude CLI 2.1.108+ |
+
+Export either with a different value in the bot's own env to disable.
 
 ## CLI Options
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-threads",
-  "version": "1.7.1",
+  "version": "1.8.1",
   "description": "Share Claude Code sessions live in a Mattermost channel with interactive features",
   "main": "dist/index.js",
   "type": "module",