clay-server 2.27.0-beta.4 → 2.27.0-beta.6

package/lib/sdk-bridge.js

@@ -2375,9 +2375,9 @@ function createSDKBridge(opts) {
           includePartialMessages: true,
           abortController: abortController,
           canUseTool: opts.canUseTool || function (toolName, input) {
-            var allowed = { Read: true, Glob: true, Grep: true, WebFetch: true, WebSearch: true };
-            if (allowed[toolName]) {
-              return Promise.resolve({ behavior: "allow", updatedInput: input });
+            var whitelisted = checkToolWhitelist(toolName, input);
+            if (whitelisted) {
+              return Promise.resolve(whitelisted);
             }
             return Promise.resolve({
               behavior: "deny",
@@ -2386,7 +2386,7 @@ function createSDKBridge(opts) {
           },
         };
       if (opts.model) mentionQueryOptions.model = opts.model;
-      if (mcpServers) mentionQueryOptions.mcpServers = mcpServers;
+      if (opts.includeMcpServers && mcpServers) mentionQueryOptions.mcpServers = mcpServers;
       query = sdk.query({
         prompt: mq,
         options: mentionQueryOptions,

package/lib/server.js

@@ -15,6 +15,7 @@ var { CONFIG_DIR } = require("./config");
 var { provisionLinuxUser } = require("./os-users");
 
 var https = require("https");
+var pkg = require("../package.json");
 
 var publicDir = path.join(__dirname, "public");
 var bundledThemesDir = path.join(__dirname, "themes");
@@ -1124,31 +1125,34 @@ function createServer(opts) {
       return;
     }
 
-    // Health check endpoint (no auth required, for monitoring tools)
+    // Health check endpoint
+    // Unauthenticated: minimal liveness info only
+    // Authenticated: full system details (memory, pid, version, sessions)
     if (req.method === "GET" && fullUrl === "/api/health") {
-      var mem = process.memoryUsage();
-      var activeSessions = 0;
-      projects.forEach(function (ctx) {
-        if (ctx && ctx.clients) {
-          activeSessions += ctx.clients.size || 0;
-        }
-      });
-      var pkg = require("../package.json");
       var health = {
         status: "ok",
-        uptime: process.uptime(),
-        version: pkg.version,
-        node: process.version,
-        sessions: activeSessions,
-        projects: projects.size,
-        memory: {
+        timestamp: new Date().toISOString(),
+      };
+      if (isRequestAuthed(req)) {
+        var mem = process.memoryUsage();
+        var activeSessions = 0;
+        projects.forEach(function (ctx) {
+          if (ctx && ctx.clients) {
+            activeSessions += ctx.clients.size || 0;
+          }
+        });
+        health.uptime = process.uptime();
+        health.version = pkg.version;
+        health.node = process.version;
+        health.sessions = activeSessions;
+        health.projects = projects.size;
+        health.memory = {
           rss: mem.rss,
           heapUsed: mem.heapUsed,
           heapTotal: mem.heapTotal,
-        },
-        pid: process.pid,
-        timestamp: new Date().toISOString(),
-      };
+        };
+        health.pid = process.pid;
+      }
       res.writeHead(200, { "Content-Type": "application/json" });
       res.end(JSON.stringify(health));
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "2.27.0-beta.4",
+  "version": "2.27.0-beta.6",
   "description": "Self-hosted Claude Code in your browser. Multi-session, multi-user, push notifications.",
   "bin": {
     "clay-server": "./bin/cli.js",