clay-server 2.25.0 → 2.26.0-beta.1

package/lib/public/modules/markdown.js

@@ -187,22 +187,18 @@ export function svgToPngDataUrl(svgEl) {
     var svgBlob = new Blob([svgStr], { type: "image/svg+xml;charset=utf-8" });
     var url = URL.createObjectURL(svgBlob);
 
-    // Inline external styles into SVG to avoid tainted canvas from cross-origin refs
-    var styleSheets = "";
-    try {
-      var computed = svgEl.querySelectorAll("style");
-      for (var si = 0; si < computed.length; si++) {
-        styleSheets += computed[si].textContent;
-      }
-    } catch (e) {}
-    // Strip any external references (url(), @import) that would taint the canvas
-    svgStr = svgStr.replace(/@import\s+url\([^)]*\)[^;]*;?/g, "");
+    // Strip all external references that would taint the canvas
+    // 1. @import rules
+    svgStr = svgStr.replace(/@import\s+[^;]*;?/g, "");
+    // 2. CSS url() pointing to external resources (keep data: and fragment-only refs)
+    svgStr = svgStr.replace(/url\(\s*['"]?(?!data:|#)([^'")]+)['"]?\s*\)/g, "url()");
+    // 3. xlink:href / href attributes pointing to external URLs
+    svgStr = svgStr.replace(/(xlink:href|href)\s*=\s*["'](?!#|data:)[^"']*["']/g, '$1=""');
     svgBlob = new Blob([svgStr], { type: "image/svg+xml;charset=utf-8" });
     URL.revokeObjectURL(url);
     url = URL.createObjectURL(svgBlob);
 
     var img = new Image();
-    img.crossOrigin = "anonymous";
     img.onload = function () {
       var canvas = document.createElement("canvas");
       canvas.width = w;

package/lib/public/modules/sidebar.js

@@ -1615,8 +1615,12 @@ function renderSheetTools(listEl) {
   var isMateDm = document.body.classList.contains("mate-dm-active");
 
   var items = isMateDm ? [
+    { icon: "brain", label: "Memory", action: "mate-memory" },
     { icon: "book-open", label: "Knowledge", action: "mate-knowledge" },
-    { icon: "calendar-clock", label: "Scheduled Tasks", action: "mate-scheduler" }
+    { icon: "sticky-note", label: "Sticky Notes", action: "mate-sticky" },
+    { icon: "puzzle", label: "Skills", action: "mate-skills" },
+    { icon: "calendar-clock", label: "Scheduled Tasks", action: "mate-scheduler" },
+    { icon: "mic", label: "Debate", action: "mate-debate" }
   ] : [
     { icon: "folder-tree", label: "Files", action: "files" },
     { icon: "square-terminal", label: "Terminal", action: "terminal" },
@@ -1641,11 +1645,15 @@ function renderSheetTools(listEl) {
           setTimeout(function () { openMobileSheet("mate-knowledge"); }, 250);
           return;
         } else if (item.action === "mate-sticky") {
-          targetId = "sticky-notes-toggle-btn";
+          targetId = "mate-sticky-notes-btn";
         } else if (item.action === "mate-skills") {
           targetId = "mate-skills-btn";
+        } else if (item.action === "mate-memory") {
+          targetId = "mate-memory-btn";
         } else if (item.action === "mate-scheduler") {
           targetId = "mate-scheduler-btn";
+        } else if (item.action === "mate-debate") {
+          targetId = "mate-debate-btn";
         }
         if (targetId) {
           var targetBtn = document.getElementById(targetId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "2.25.0",
+  "version": "2.26.0-beta.1",
   "description": "Self-hosted Claude Code in your browser. Multi-session, multi-user, push notifications.",
   "bin": {
     "clay-server": "./bin/cli.js",