mattermost-claude-code 0.5.2 → 0.5.3

package/README.md

@@ -146,6 +146,16 @@ React 👍 to allow this message, ✅ to invite them to the session, 👎 to den
 
 Messages starting with `@someone-else` are ignored by the bot, allowing side conversations in the thread without triggering Claude.
 
+### Downgrade Permissions
+
+If the bot is running with `--skip-permissions` (auto mode), you can enable interactive permissions for a specific session:
+
+```
+/permissions interactive
+```
+
+This allows collaboration by requiring approval for Claude's actions. Note: you can only downgrade (auto → interactive), not upgrade - this ensures security.
+
 ## Interactive Features
 
 ### Permission Approval

package/dist/claude/session.d.ts

@@ -45,6 +45,7 @@ interface Session {
     pendingMessageApproval: PendingMessageApproval | null;
     planApproved: boolean;
     sessionAllowedUsers: Set<string>;
+    forceInteractivePermissions: boolean;
     sessionStartPostId: string | null;
     tasksPostId: string | null;
     activeSubagents: Map<string, string>;
@@ -111,6 +112,13 @@ export declare class SessionManager {
     inviteUser(threadId: string, invitedUser: string, invitedBy: string): Promise<void>;
     /** Kick a user from a specific session */
     kickUser(threadId: string, kickedUser: string, kickedBy: string): Promise<void>;
+    /**
+     * Enable interactive permissions for a session.
+     * Can only downgrade (skip → interactive), not upgrade.
+     */
+    enableInteractivePermissions(threadId: string, username: string): Promise<void>;
+    /** Check if a session should use interactive permissions */
+    isSessionInteractive(threadId: string): boolean;
     /** Update the session header post with current participants */
     private updateSessionHeader;
     /** Request approval for a message from an unauthorized user */

package/dist/claude/session.js

@@ -121,6 +121,7 @@ export class SessionManager {
             pendingMessageApproval: null,
             planApproved: false,
             sessionAllowedUsers: new Set([username]), // Owner is always allowed
+            forceInteractivePermissions: false, // Can be enabled via /permissions interactive
             sessionStartPostId: post.id, // Track for updating participants
             tasksPostId: null,
             activeSubagents: new Map(),
@@ -813,12 +814,53 @@ export class SessionManager {
             await this.mattermost.createPost(`⚠️ @${kickedUser} was not in this session`, threadId);
         }
     }
+    /**
+     * Enable interactive permissions for a session.
+     * Can only downgrade (skip → interactive), not upgrade.
+     */
+    async enableInteractivePermissions(threadId, username) {
+        const session = this.sessions.get(threadId);
+        if (!session)
+            return;
+        // Only session owner or globally allowed users can change permissions
+        if (session.startedBy !== username && !this.mattermost.isUserAllowed(username)) {
+            await this.mattermost.createPost(`⚠️ Only @${session.startedBy} or allowed users can change permissions`, threadId);
+            return;
+        }
+        // Can only downgrade, not upgrade
+        if (!this.skipPermissions) {
+            await this.mattermost.createPost(`ℹ️ Permissions are already interactive for this session`, threadId);
+            return;
+        }
+        // Already enabled for this session
+        if (session.forceInteractivePermissions) {
+            await this.mattermost.createPost(`ℹ️ Interactive permissions already enabled for this session`, threadId);
+            return;
+        }
+        session.forceInteractivePermissions = true;
+        await this.mattermost.createPost(`🔐 Interactive permissions enabled for this session by @${username}`, threadId);
+        console.log(`  🔐 Interactive permissions enabled for session by @${username}`);
+        await this.updateSessionHeader(session);
+    }
+    /** Check if a session should use interactive permissions */
+    isSessionInteractive(threadId) {
+        const session = this.sessions.get(threadId);
+        if (!session)
+            return !this.skipPermissions;
+        // If global is interactive, always interactive
+        if (!this.skipPermissions)
+            return true;
+        // If session has forced interactive, use that
+        return session.forceInteractivePermissions;
+    }
     /** Update the session header post with current participants */
     async updateSessionHeader(session) {
         if (!session.sessionStartPostId)
             return;
         const shortDir = this.workingDir.replace(process.env.HOME || '', '~');
-        const permMode = this.skipPermissions ? '⚡ Auto' : '🔐 Interactive';
+        // Check session-level permission override
+        const isInteractive = !this.skipPermissions || session.forceInteractivePermissions;
+        const permMode = isInteractive ? '🔐 Interactive' : '⚡ Auto';
         // Build participants list (excluding owner who is shown in "Started by")
         const otherParticipants = [...session.sessionAllowedUsers]
             .filter(u => u !== session.startedBy)

package/dist/index.js

@@ -102,6 +102,19 @@ async function main() {
                 await session.kickUser(threadRoot, kickMatch[1], username);
                 return;
             }
+            // Check for /permissions command
+            const permMatch = content.match(/^\/permissions?\s+(interactive|auto)/i);
+            if (permMatch) {
+                const mode = permMatch[1].toLowerCase();
+                if (mode === 'interactive') {
+                    await session.enableInteractivePermissions(threadRoot, username);
+                }
+                else {
+                    // Can't upgrade to auto - that would be less secure
+                    await mattermost.createPost(`⚠️ Cannot upgrade to auto permissions - can only downgrade to interactive`, threadRoot);
+                }
+                return;
+            }
             // Check if user is allowed in this session
             if (!session.isUserAllowedInSession(threadRoot, username)) {
                 // Request approval for their message

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mattermost-claude-code",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "Share Claude Code sessions live in a Mattermost channel with interactive features",
   "main": "dist/index.js",
   "type": "module",