Skip to content

🔄 Sync upstream 2026-04-04#5

Merged
baozitao merged 26 commits intomainfrom
upstream-sync-20260404
Apr 4, 2026
Merged

🔄 Sync upstream 2026-04-04#5
baozitao merged 26 commits intomainfrom
upstream-sync-20260404

Conversation

@baozitao
Copy link
Copy Markdown
Owner

@baozitao baozitao commented Apr 4, 2026

Upstream Changes

104d39b Merge pull request anthropics#885 from anthropics/sarah/restore-reload-plugins-readme
decc737 Add sonarqube-agent-plugins plugin (anthropics#1085)
0484869 remove(plugin-json): zoominfo — Cowork-only plugin (anthropics#1204)
b091cb4 Merge pull request anthropics#1188 from anthropics/tobinsouth-patch-1
a54e529 Removing posthog pin
52e95f6 Add mongodb plugin (anthropics#1095)
9ed1651 Add UI5 plugins from SAP (ui5 + ui5-typescript-conversion) (anthropics#1086)
92e3c1c Update postman plugin to latest version (anthropics#1080)
31e7200 Merge pull request anthropics#1055 from anthropics/kenneth/imessage-permission-selfchat-only
9d468ad math-olympiad: housekeeping (anthropics#1172)
183a6ca Merge pull request anthropics#1115 from anthropics/dickson/bash-prefix-hooks
986deab fix: invoke .sh hooks via bash prefix; add version for cache invalidation
548bfa8 Merge pull request anthropics#1008 from anthropics/russell/imessage-conversational-format
a1ffbcc feat(imessage): add IMESSAGE_DB_PATH env var for testing
451c481 Update flint plugin sha to f3d56e3 (anthropics#1077)
22bd61d imessage: bump to 0.1.0
60c3fc3 imessage: drop SMS/RCS by default, opt-in via IMESSAGE_ALLOW_SMS
c427452 imessage: trim comment cruft
8dfc279 imessage: harden echo filter normalization
c29338f imessage: drop whitespace-only messages from tapbacks/receipts

Auto-synced from anthropics/claude-plugins-official

sarahdeaton and others added 26 commits March 21, 2026 20:17
Partially reverts anthropics#758. The reload step is not redundant: the configure
skill runs before the restart step, so it is not loaded yet when the user
types /telegram:configure. CLI prints 'Run /reload-plugins to activate.'
after install (pluginInstallationHelpers.ts:529). Mintlify reports
confirm users hit 'Unknown skill: discord:configure' at step 3.
Reformat chat_messages output from flat per-message lines to grouped
conversation threads. Each thread gets a header labelling it DM or Group
with its participant list, date-separator lines when the calendar day
rolls over, and [HH:MM] local-time stamps instead of full ISO.

chat_guid is now optional — omit to dump every allowlisted chat at once
for a quick multi-thread overview. Default limit raised 20→100 per chat,
capped at 500.

New queries: qChatParticipants (handle list per chat) and qChatInfo
(display_name + style to distinguish DM/group). renderMsg replaced by
conversationHeader + renderConversation.
Permission prompts were being broadcast to all allowlisted contacts plus
every DM resolvable from the SELF address set. Two compounding bugs:

1. SELF was polluted by chat.last_addressed_handle, which on machines
   with SMS history returns short codes, business handles, and other
   contacts' numbers — not just the owner's addresses. One reporter's
   query returned 50 addresses (2 actually theirs) resolving to 148 DM
   chats, all of which received permission prompts.

2. Even with a clean SELF, the handler sent to allowFrom + SELF, so
   every allowlisted contact received the prompt and could reply to
   approve tool execution on the owner's machine.

Fix:
- Build SELF from message.account WHERE is_from_me=1 only
- Send permission prompts to self-chat only, not allowFrom
- Accept permission replies from self-chat only

Fixes anthropics#1048
Fixes anthropics#1010
Tapback reactions and read receipts synced from linked devices arrive
as chat.db rows with whitespace-only text. The existing empty-check
used falsy comparison which doesn't catch ' ' or invisible chars,
causing unsolicited replies to reaction taps.

Fixes anthropics#1041
The self-chat echo filter matches outbound text against what chat.db
stores on round-trip. Three divergence sources caused false negatives
and duplicate bubbles:

- Signature suffix: "\nSent by Claude" is appended on send, but the
  \n may not round-trip identically through attributedBody
- Emoji variation selectors (U+FE00-FE0F) and ZWJ (U+200D): chat.db
  can add or drop these on emoji characters
- Smart quotes: macOS auto-substitutes straight quotes on the way in

Strip/normalize all three in echoKey() before the existing whitespace
collapse.

Fixes anthropics#1024
SMS sender IDs are spoofable; iMessage is Apple-ID-authenticated and
end-to-end encrypted. The plugin previously treated both identically,
so a forged SMS from the owner's own number would match SELF, bypass
the access gate, and inherit owner-level trust — including permission
approval.

handleInbound now drops anything with service != 'iMessage' unless
IMESSAGE_ALLOW_SMS=true. Default is the safe path; users who want SMS
can opt in after reading the warning in README.
Co-authored-by: Claude <noreply@anthropic.com>
Mirrors the existing IMESSAGE_STATE_DIR override. Lets a mock sqlite
chat.db stand in for ~/Library/Messages/chat.db so chat_messages can be
tested without macOS + Full Disk Access + real iMessage history.
…onversational-format

feat(imessage): conversational format for chat_messages
…tion

Fixes anthropics#993 (Permission denied on hook scripts) without relying on
client-side +x preservation.

The hook executor spawns commands via /bin/sh -c, which requires +x
to execute a script directly. Prefixing with bash reads the script
as data — mode bits are irrelevant. This works on all Claude Code
versions, whereas the client-side chmod fix (claude-cli #24666) only
shipped in v2.1.86.

All 3 scripts declare #!/bin/bash and use bashisms ([[ ]], =~), so
bash (not sh) is the correct interpreter.

The version field forces a fresh cache path (1.0.0/ instead of
unknown/), ensuring the new hooks.json reaches users with stale
caches.
…x-hooks

fix: invoke .sh hooks via bash prefix (fixes anthropics#993)
* math-olympiad: add LICENSE, marketplace entry, and prettier formatting

- Add Apache 2.0 LICENSE file
- Register plugin in marketplace.json
- Run prettier (prose-wrap=always, 80 cols) over all plugin markdown
- Simplify model tier naming in reference docs

:house: Remote-Dev: homespace

* Update .claude-plugin/marketplace.json
…ermission-selfchat-only

imessage: restrict permission relay to self-chat, fix echo filter & tapback noise
Bumps pinned SHA from 0714280 (Feb 20) to 40b11ac (Mar 26).
New commit adds private network search support.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…s#1086)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Official MongoDB plugin (MCP Server + Skills) from mongodb/agent-skills.
Partner escalation — submitted via PR anthropics#158, Forge, and Slack.
Already merged on -internal (PR anthropics#667).
ZoomInfo submitted with platform "Claude Cowork" on their form (2/24/2026)
and is correctly listed on knowledge-work-plugins. This entry was swept
into -official via staging merge PR anthropics#730 but should not be on the Claude
Code plugin marketplace.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…d-plugins-readme

Restore /reload-plugins step in telegram/discord READMEs
@baozitao baozitao merged commit 71d2fbc into main Apr 4, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants