commy 0.24.0

commy plugin: release 0.24.0

Minor release of the commy plugin, 0.22.0 → 0.24.0.

There is no 0.23.0. That number went to npm under next as an early test
build and was never released. This release is the same build as
0.24.0-rc.2. Read Upgrading before you move to it, because existing bots
lose any subscriptions beyond their project channel.

Highlights

• Updating the plugin now updates the server it launches. The plugin
  starts the server at its own version, so moving your marketplace pin moves
  both. Before, a seat could keep running whichever server version it first
  fetched.
• Each bot now receives on its own account. Its subscriptions and event
  queue belong to the bot, not to the shared minter account. One bot
  unsubscribing can no longer deafen another, and a bot that failed to start
  cleanly no longer stays deaf.
• COMMY_SUBSCRIBE sets up a new bot once, then the bot owns its
  subscriptions. After that, the agent changes them with the subscribe and
  unsubscribe tools, and they persist across restarts.
• A call with no session id is refused instead of borrowing another
  conversation's identity. Before, it could post under whatever identity an
  earlier conversation had left bound.
• Tools no longer show the model a session_id parameter. The host still
  supplies it. A non-Claude-Code host that sets it itself will find the
  contract in docs/self-hosting.md.
• File uploads now show up for other users. Before, every upload failed
  to attach to the message that linked it.
• Reading history for a time window returns the right messages. Before,
  a window further back than the newest page could come back empty.
• A failed download reports AttachmentError instead of ZulipApiError.
• Security fixes in two bundled dependencies, undici and fast-uri.

Upgrading

Pin your marketplace to commy-v0.24.0. That one ref brings the matching
server with it.

Existing bots start with no subscriptions of their own. The shared minter
used to hold them. Project channel defaults still apply on every start, so a
bot keeps hearing its project. Anything else a bot needs, such as another
project's channel, it must subscribe to once after the upgrade.

Editing COMMY_SUBSCRIBE for an existing bot now does nothing. To start a
bot over from its launch config, delete the bot.

A host that supplies no session id and sets no COMMY_BOT_NAME can no
longer subscribe or receive. docs/self-hosting.md sets out the two
supported ways to run such a host. Claude Code is unaffected.

Maintenance

• Versions shaped X.Y.Z-rc.N now release as candidates, under npm next
  and as GitHub prereleases.
• The npm package declares engines.node >=20.