clay-server 2.31.0 → 2.32.0-beta.10

package/lib/sdk-message-processor.js

@@ -9,12 +9,25 @@ function attachMessageProcessor(ctx) {
   var pushModule = ctx.pushModule;
   var getNotificationsModule = ctx.getNotificationsModule || function () { return null; };
   var getSDK = ctx.getSDK;
+  var adapter = ctx.adapter;
+  var cwd = ctx.cwd;
   var onProcessingChanged = ctx.onProcessingChanged;
   var onTurnDone = ctx.onTurnDone;
+  var onAutoTitle = ctx.onAutoTitle;
   var opts = ctx.opts;
   var discoverSkillDirs = ctx.discoverSkillDirs;
   var mergeSkills = ctx.mergeSkills;
 
+  var AUTO_TITLE_TURN_THRESHOLD = 3;
+
+  function getMateIdForNotification() {
+    if (!isMate) return null;
+    if (typeof slug === "string" && slug.indexOf("mate-") === 0) {
+      return slug.substring(5) || null;
+    }
+    return null;
+  }
+
   function sendAndRecord(session, obj) {
     sm.sendAndRecord(session, obj);
   }
@@ -37,11 +50,11 @@ function attachMessageProcessor(ctx) {
   }
 
   function processSubagentMessage(session, parsed) {
-    var parentId = parsed.parent_tool_use_id;
-    var content = parsed.message.content;
+    var parentId = parsed.parentToolUseId;
+    var content = parsed.content;
     if (!Array.isArray(content)) return;
 
-    if (parsed.type === "assistant") {
+    if (parsed.messageRole === "assistant") {
       // Extract tool_use blocks from sub-agent assistant messages
       for (var i = 0; i < content.length; i++) {
         var block = content[i];
@@ -69,59 +82,57 @@ function attachMessageProcessor(ctx) {
         }
       }
     }
-    // user messages with parent_tool_use_id contain tool_results -- skip silently
+    // user messages with parentToolUseId contain tool_results -- skip silently
   }
 
   function processSDKMessage(session, parsed) {
     // Timing: log key SDK milestones relative to query start
     if (session._queryStartTs) {
       var _elapsed = Date.now() - session._queryStartTs;
-      if (parsed.type === "system" && parsed.subtype === "init") {
+      if (parsed.yokeType === "init") {
         console.log("[PERF] processSDKMessage: system/init +" + _elapsed + "ms");
       }
-      if (parsed.type === "stream_event" && parsed.event) {
-        if (parsed.event.type === "message_start") {
-          console.log("[PERF] processSDKMessage: message_start (API response begun) +" + _elapsed + "ms");
-        }
-        if (parsed.event.type === "content_block_delta" && !session._firstTextLogged) {
-          session._firstTextLogged = true;
-          console.log("[PERF] processSDKMessage: FIRST content_block_delta (visible text) +" + _elapsed + "ms");
-        }
+      if (parsed.yokeType === "turn_start") {
+        console.log("[PERF] processSDKMessage: message_start (API response begun) +" + _elapsed + "ms");
       }
-      if (parsed.type === "result") {
+      if ((parsed.yokeType === "text_delta" || parsed.yokeType === "tool_input_delta" || parsed.yokeType === "thinking_delta") && !session._firstTextLogged) {
+        session._firstTextLogged = true;
+        console.log("[PERF] processSDKMessage: FIRST content_block_delta (visible text) +" + _elapsed + "ms");
+      }
+      if (parsed.yokeType === "result") {
         console.log("[PERF] processSDKMessage: result +" + _elapsed + "ms");
       }
     }
 
     // Extract session_id from any message that carries it
-    if (parsed.session_id && !session.cliSessionId) {
-      session.cliSessionId = parsed.session_id;
+    if (parsed.sessionId && !session.cliSessionId) {
+      session.cliSessionId = parsed.sessionId;
       sm.saveSessionFile(session);
       sendAndRecord(session, { type: "session_id", cliSessionId: session.cliSessionId });
-    } else if (parsed.session_id) {
-      session.cliSessionId = parsed.session_id;
+    } else if (parsed.sessionId) {
+      session.cliSessionId = parsed.sessionId;
     }
 
     // Capture message UUIDs for rewind support
     if (parsed.uuid) {
-      if (parsed.type === "user" && !parsed.parent_tool_use_id) {
+      if (parsed.messageType === "user" && !parsed.parentToolUseId) {
         session.messageUUIDs.push({ uuid: parsed.uuid, type: "user", historyIndex: session.history.length });
         sendAndRecord(session, { type: "message_uuid", uuid: parsed.uuid, messageType: "user" });
-      } else if (parsed.type === "assistant") {
+      } else if (parsed.messageType === "assistant") {
         session.messageUUIDs.push({ uuid: parsed.uuid, type: "assistant", historyIndex: session.history.length });
         sendAndRecord(session, { type: "message_uuid", uuid: parsed.uuid, messageType: "assistant" });
       }
     }
 
     // Cache slash_commands and model from CLI init message
-    if (parsed.type === "system" && parsed.subtype === "init") {
+    if (parsed.yokeType === "init") {
       var fsSkills = discoverSkillDirs();
       sm.skillNames = mergeSkills(parsed.skills, fsSkills);
-      if (parsed.slash_commands) {
+      if (parsed.slashCommands) {
         // Union: SDK slash_commands + merged skills (deduplicated)
         var seen = new Set();
         var combined = [];
-        var all = parsed.slash_commands.concat(Array.from(sm.skillNames));
+        var all = parsed.slashCommands.concat(Array.from(sm.skillNames));
         for (var k = 0; k < all.length; k++) {
           if (!seen.has(all[k])) {
             seen.add(all[k]);
@@ -132,102 +143,93 @@ function attachMessageProcessor(ctx) {
         send({ type: "slash_commands", commands: sm.slashCommands });
       }
       if (parsed.model) {
-        sm.currentModel = sm._savedDefaultModel || parsed.model;
+        sm.currentModel = sm.currentModel || sm._savedDefaultModel || parsed.model;
         send({ type: "model_info", model: sm.currentModel, models: sm.availableModels || [] });
       }
-      if (parsed.fast_mode_state) {
-        sendAndRecord(session, { type: "fast_mode_state", state: parsed.fast_mode_state });
+      if (parsed.fastModeState) {
+        sendAndRecord(session, { type: "fast_mode_state", state: parsed.fastModeState });
       }
     }
 
-    if (parsed.type === "stream_event" && parsed.event) {
-      var evt = parsed.event;
-
-      if (evt.type === "message_start" && evt.message && evt.message.usage) {
-        var u = evt.message.usage;
-        session.lastStreamInputTokens = (u.input_tokens || 0) + (u.cache_read_input_tokens || 0);
+    if (parsed.yokeType === "turn_start") {
+      if (parsed.inputTokens) {
+        session.lastStreamInputTokens = parsed.inputTokens;
       }
 
-      if (evt.type === "content_block_start") {
-        var block = evt.content_block;
-        var idx = evt.index;
+    } else if (parsed.yokeType === "tool_start" || parsed.yokeType === "thinking_start" || parsed.yokeType === "text_start") {
+      var idx = parsed.blockId;
 
-        if (block.type === "tool_use") {
-          session.blocks[idx] = { type: "tool_use", id: block.id, name: block.name, inputJson: "" };
-          sendAndRecord(session, { type: "tool_start", id: block.id, name: block.name });
-        } else if (block.type === "thinking") {
-          session.blocks[idx] = { type: "thinking", thinkingText: "", startTime: Date.now() };
-          sendAndRecord(session, { type: "thinking_start" });
-        } else if (block.type === "text") {
-          session.blocks[idx] = { type: "text" };
-        }
+      if (parsed.yokeType === "tool_start") {
+        session.blocks[idx] = { type: "tool_use", id: parsed.toolId, name: parsed.toolName, inputJson: "" };
+        sendAndRecord(session, { type: "tool_start", id: parsed.toolId, name: parsed.toolName });
+      } else if (parsed.yokeType === "thinking_start") {
+        session.blocks[idx] = { type: "thinking", thinkingText: "", startTime: Date.now() };
+        sendAndRecord(session, { type: "thinking_start" });
+      } else if (parsed.yokeType === "text_start") {
+        session.blocks[idx] = { type: "text" };
       }
 
-      if (evt.type === "content_block_delta" && evt.delta) {
-        var idx = evt.index;
+    } else if (parsed.yokeType === "text_delta" || parsed.yokeType === "tool_input_delta" || parsed.yokeType === "thinking_delta") {
+      var idx = parsed.blockId;
 
-        if (evt.delta.type === "text_delta" && typeof evt.delta.text === "string") {
-          session.streamedText = true;
-          if (session.responsePreview.length < 200) {
-            session.responsePreview += evt.delta.text;
-          }
-          // Accumulate text for mate DM response
-          if (typeof session._mateDmResponseText === "string") {
-            session._mateDmResponseText += evt.delta.text;
-          }
-          sendAndRecord(session, { type: "delta", text: evt.delta.text });
-        } else if (evt.delta.type === "input_json_delta" && session.blocks[idx]) {
-          session.blocks[idx].inputJson += evt.delta.partial_json;
-        } else if (evt.delta.type === "thinking_delta" && session.blocks[idx]) {
-          session.blocks[idx].thinkingText += evt.delta.thinking;
-          sendAndRecord(session, { type: "thinking_delta", text: evt.delta.thinking });
+      if (parsed.yokeType === "text_delta" && typeof parsed.text === "string") {
+        session.streamedText = true;
+        if (session.responsePreview.length < 200) {
+          session.responsePreview += parsed.text;
         }
-      }
-
-      if (evt.type === "content_block_stop") {
-        var idx = evt.index;
-        var block = session.blocks[idx];
-
-        if (block && block.type === "tool_use") {
-          var input = {};
-          try { input = JSON.parse(block.inputJson); } catch (e) {}
-          sendAndRecord(session, { type: "tool_executing", id: block.id, name: block.name, input: input });
-
-          // Track active Task tools for sub-agent done detection
-          if (block.name === "Task") {
-            if (!session.activeTaskToolIds) session.activeTaskToolIds = {};
-            session.activeTaskToolIds[block.id] = true;
-          }
-
-          if (pushModule && block.name === "AskUserQuestion" && input.questions) {
-            var q = input.questions[0];
-            pushModule.sendPush({
-              type: "ask_user",
-              slug: slug,
-              title: (mateDisplayName || "Claude") + " has a question",
-              body: q ? q.question : "Waiting for your response",
-              tag: "claude-ask",
-            });
-          }
-        } else if (block && block.type === "thinking") {
-          var duration = block.startTime ? (Date.now() - block.startTime) / 1000 : 0;
-          sendAndRecord(session, { type: "thinking_stop", duration: duration });
+        // Accumulate text for mate DM response
+        if (typeof session._mateDmResponseText === "string") {
+          session._mateDmResponseText += parsed.text;
+        }
+        sendAndRecord(session, { type: "delta", text: parsed.text });
+      } else if (parsed.yokeType === "tool_input_delta" && session.blocks[idx]) {
+        session.blocks[idx].inputJson += parsed.partialJson;
+      } else if (parsed.yokeType === "thinking_delta" && session.blocks[idx]) {
+        session.blocks[idx].thinkingText += parsed.text;
+        sendAndRecord(session, { type: "thinking_delta", text: parsed.text });
+      }
+
+    } else if (parsed.yokeType === "block_stop") {
+      var idx = parsed.blockId;
+      var block = session.blocks[idx];
+
+      if (block && block.type === "tool_use") {
+        var input = {};
+        try { input = JSON.parse(block.inputJson); } catch (e) {}
+        sendAndRecord(session, { type: "tool_executing", id: block.id, name: block.name, input: input });
+
+        // Track active Task tools for sub-agent done detection
+        if (block.name === "Task") {
+          if (!session.activeTaskToolIds) session.activeTaskToolIds = {};
+          session.activeTaskToolIds[block.id] = true;
         }
 
-        delete session.blocks[idx];
+        if (pushModule && block.name === "AskUserQuestion" && input.questions) {
+          var q = input.questions[0];
+          pushModule.sendPush({
+            type: "ask_user",
+            slug: slug,
+            title: (mateDisplayName || "Claude") + " has a question",
+            body: q ? q.question : "Waiting for your response",
+            tag: "claude-ask",
+          });
+        }
+      } else if (block && block.type === "thinking") {
+        var duration = block.startTime ? (Date.now() - block.startTime) / 1000 : 0;
+        sendAndRecord(session, { type: "thinking_stop", duration: duration });
       }
 
-    } else if ((parsed.type === "assistant" || parsed.type === "user") && parsed.message && parsed.message.content) {
+      delete session.blocks[idx];
+
+    } else if (parsed.yokeType === "subagent_message") {
       // Sub-agent messages: extract tool_use blocks for activity display
-      if (parsed.parent_tool_use_id) {
-        processSubagentMessage(session, parsed);
-        return;
-      }
+      processSubagentMessage(session, parsed);
 
-      var content = parsed.message.content;
+    } else if (parsed.yokeType === "message") {
+      var content = parsed.content;
 
       // Fallback: if assistant text wasn't streamed via deltas, send it now
-      if (parsed.type === "assistant" && !session.streamedText && Array.isArray(content)) {
+      if (parsed.messageRole === "assistant" && !session.streamedText && Array.isArray(content)) {
         var assistantText = content
           .filter(function(c) { return c.type === "text"; })
           .map(function(c) { return c.text; })
@@ -241,7 +243,7 @@ function attachMessageProcessor(ctx) {
       }
 
       // Check for local slash command output in user messages
-      if (parsed.type === "user") {
+      if (parsed.messageRole === "user") {
         var fullText = "";
         if (typeof content === "string") {
           fullText = content;
@@ -303,7 +305,7 @@ function attachMessageProcessor(ctx) {
         }
       }
 
-    } else if (parsed.type === "result") {
+    } else if (parsed.yokeType === "result") {
       session.blocks = {};
       session.sentToolResults = {};
       session.pendingPermissions = {};
@@ -319,10 +321,10 @@ function attachMessageProcessor(ctx) {
       // Only clear rateLimitResetsAt on genuine success (non-zero cost).
       // When rate-limited, the SDK sends result with zero cost right after
       // rate_limit_event; clearing here would prevent auto-continue scheduling.
-      if (parsed.total_cost_usd && parsed.total_cost_usd > 0) {
+      if (parsed.cost && parsed.cost > 0) {
         session.rateLimitResetsAt = null;
       }
-      console.log("[sdk-bridge] result handler: session " + session.localId + " cost=" + parsed.total_cost_usd + " rateLimitResetsAt=" + session.rateLimitResetsAt);
+      console.log("[sdk-bridge] result handler: session " + session.localId + " cost=" + parsed.cost + " rateLimitResetsAt=" + session.rateLimitResetsAt);
 
       // Handle SDK execution errors: show the error to the user instead of
       // silently swallowing it. These have subtype "error_during_execution".
@@ -331,7 +333,7 @@ function attachMessageProcessor(ctx) {
         var execError = execErrors.length > 0
           ? execErrors.join("; ")
           : "Unknown SDK error";
-        if (parsed.terminal_reason) execError += " (reason: " + parsed.terminal_reason + ")";
+        if (parsed.terminalReason) execError += " (reason: " + parsed.terminalReason + ")";
         console.error("[sdk-bridge] Execution error for session " + session.localId + ": " + execError);
         session.isProcessing = false;
         onProcessingChanged();
@@ -345,7 +347,7 @@ function attachMessageProcessor(ctx) {
       onProcessingChanged();
       // Detect "Not logged in" scenario early for the check below
       var previewTrimmed = (session.responsePreview || "").trim();
-      var isZeroCost = !parsed.total_cost_usd || parsed.total_cost_usd === 0;
+      var isZeroCost = !parsed.cost || parsed.cost === 0;
       var isLoginPrompt = isZeroCost && previewTrimmed.length < 100
         && /not logged in/i.test(previewTrimmed) && /\/login/i.test(previewTrimmed);
       // Fetch rich context usage breakdown (fire-and-forget, non-blocking)
@@ -357,19 +359,19 @@ function attachMessageProcessor(ctx) {
           console.error("[sdk-bridge] getContextUsage failed (non-fatal):", e.message || e);
         });
       }
-      var lastStreamInput = session.lastStreamInputTokens || null;
+      var lastStreamInput = session.lastStreamInputTokens || parsed.lastStreamInputTokens || null;
       session.lastStreamInputTokens = null;
       sendAndRecord(session, {
         type: "result",
-        cost: parsed.total_cost_usd,
-        duration: parsed.duration_ms,
+        cost: parsed.cost,
+        duration: parsed.duration,
         usage: parsed.usage || null,
         modelUsage: parsed.modelUsage || null,
-        sessionId: parsed.session_id,
+        sessionId: parsed.sessionId,
         lastStreamInputTokens: lastStreamInput,
       });
-      if (parsed.fast_mode_state) {
-        sendAndRecord(session, { type: "fast_mode_state", state: parsed.fast_mode_state });
+      if (parsed.fastModeState) {
+        sendAndRecord(session, { type: "fast_mode_state", state: parsed.fastModeState });
       }
       // Detect "Not logged in / Please run /login" from SDK.
       // This is a short canned response with zero cost, not actual AI output.
@@ -410,20 +412,34 @@ function attachMessageProcessor(ctx) {
           preview: _donePreviewText,
           slug: slug,
           sessionId: session.localId,
+          mateId: getMateIdForNotification(),
           ownerId: session.ownerId || null,
         });
       }
       // Reset for next turn in the same query
       session.lastActivityAt = Date.now();
+      session.turnCount = (session.turnCount || 0) + 1;
       var donePreview = session.responsePreview || "";
       session.responsePreview = "";
       session.streamedText = false;
       sm.broadcastSessionList();
+
+      // Auto-generate title after N turns (skip if loop or already auto-generated)
+      if (session.turnCount === AUTO_TITLE_TURN_THRESHOLD
+          && !session.titleAutoGenerated
+          && !session.titleManuallySet
+          && !session.loop
+          && onAutoTitle) {
+        try { onAutoTitle(session); } catch (e) {
+          console.error("[auto-title] onAutoTitle threw:", e.message || e);
+        }
+      }
+
       if (onTurnDone) {
         try { onTurnDone(session, donePreview); } catch (e) {}
       }
 
-    } else if (parsed.type === "system" && parsed.subtype === "status") {
+    } else if (parsed.yokeType === "status") {
       if (parsed.status === "compacting") {
         sendAndRecord(session, { type: "compacting", active: true });
       } else if (session.compacting) {
@@ -431,34 +447,34 @@ function attachMessageProcessor(ctx) {
       }
       session.compacting = parsed.status === "compacting";
 
-    } else if (parsed.type === "system" && parsed.subtype === "task_started") {
-      var parentId = parsed.tool_use_id;
+    } else if (parsed.yokeType === "task_started") {
+      var parentId = parsed.parentToolId;
       if (parentId) {
         if (!session.taskIdMap) session.taskIdMap = {};
-        session.taskIdMap[parentId] = parsed.task_id;
+        session.taskIdMap[parentId] = parsed.taskId;
         sendAndRecord(session, {
           type: "task_started",
           parentToolId: parentId,
-          taskId: parsed.task_id,
+          taskId: parsed.taskId,
           description: parsed.description || "",
         });
       }
 
-    } else if (parsed.type === "system" && parsed.subtype === "task_progress") {
-      var parentId = parsed.tool_use_id;
+    } else if (parsed.yokeType === "task_progress") {
+      var parentId = parsed.parentToolId;
       if (parentId) {
         sendAndRecord(session, {
           type: "task_progress",
           parentToolId: parentId,
-          taskId: parsed.task_id,
+          taskId: parsed.taskId,
           usage: parsed.usage || null,
-          lastToolName: parsed.last_tool_name || null,
+          lastToolName: parsed.lastToolName || null,
           description: parsed.description || "",
           summary: parsed.summary || null,
         });
       }
 
-    } else if (parsed.type === "system" && parsed.subtype === "task_updated") {
+    } else if (parsed.yokeType === "task_updated") {
       // Live task state patches (status, description, error, backgrounded)
       var taskId = parsed.task_id;
       var patch = parsed.patch || {};
@@ -477,19 +493,19 @@ function attachMessageProcessor(ctx) {
         });
       }
 
-    } else if (parsed.type === "tool_progress") {
+    } else if (parsed.yokeType === "tool_progress") {
       // Sub-agent tool_progress: forward as activity update
-      var parentId = parsed.parent_tool_use_id;
+      var parentId = parsed.parentToolId;
       if (parentId) {
         sendAndRecord(session, {
           type: "subagent_activity",
           parentToolId: parentId,
-          text: parsed.content || "",
+          text: parsed.text || "",
         });
       }
 
-    } else if (parsed.type === "task_notification") {
-      var parentId = parsed.parent_tool_use_id;
+    } else if (parsed.yokeType === "task_notification") {
+      var parentId = parsed.parentToolId;
       if (parentId) {
         sendAndRecord(session, {
           type: "subagent_done",
@@ -501,15 +517,15 @@ function attachMessageProcessor(ctx) {
       }
       if (session.taskIdMap) {
         for (var k in session.taskIdMap) {
-          if (session.taskIdMap[k] === parsed.task_id) {
+          if (session.taskIdMap[k] === parsed.taskId) {
             delete session.taskIdMap[k];
             break;
           }
         }
       }
 
-    } else if (parsed.type === "rate_limit_event" && parsed.rate_limit_info) {
-      var info = parsed.rate_limit_info;
+    } else if (parsed.yokeType === "rate_limit") {
+      var info = parsed.rateLimitInfo;
       console.log("[sdk-bridge] rate_limit_event for session " + session.localId + ": status=" + info.status + " resetsAt=" + info.resetsAt + " isUsingOverage=" + info.isUsingOverage + " isProcessing=" + session.isProcessing);
 
       // Broadcast reset time for top-bar usage link
@@ -565,13 +581,13 @@ function attachMessageProcessor(ctx) {
         }
       }
 
-    } else if (parsed.type === "prompt_suggestion") {
+    } else if (parsed.yokeType === "prompt_suggestion") {
       sendAndRecord(session, {
         type: "prompt_suggestion",
         suggestion: parsed.suggestion || "",
       });
 
-    } else if (parsed.type === "system" && parsed.subtype === "notification") {
+    } else if (parsed.yokeType === "notification") {
       var notifText = parsed.text || "";
       var notifPriority = parsed.priority || "low";
       if (notifText) {
@@ -585,12 +601,12 @@ function attachMessageProcessor(ctx) {
         });
       }
 
-    } else if (parsed.type === "system" && parsed.subtype === "api_retry") {
-      // Transient retry notification — show in UI but don't persist in history
+    } else if (parsed.yokeType === "api_retry") {
+      // Transient retry notification, show in UI but don't persist in history
       var retryText = parsed.message || parsed.error || "Retrying API request...";
       sendToSession(session, { type: "system_info", text: retryText });
 
-    } else if (parsed.type === "system") {
+    } else if (parsed.yokeType === "system") {
       // Catch-all for unhandled system subtypes (e.g. hook-block errors).
       // Extract any error text and surface it in the UI.
       var sysText = parsed.error || parsed.message || parsed.text || "";
@@ -604,7 +620,6 @@ function attachMessageProcessor(ctx) {
         console.log("[sdk-bridge] Unhandled system message (subtype=" + (parsed.subtype || "none") + "): " + sysText.substring(0, 200));
         sendAndRecord(session, { type: "error", text: sysText });
       }
-    } else if (parsed.type && parsed.type !== "user") {
     }
   }
 

package/lib/sdk-worker.js

@@ -1,3 +1,7 @@
+// DEPRECATED: This file has been moved to lib/yoke/adapters/claude-worker.js
+// It is kept here temporarily for backward compatibility with running worker processes.
+// New worker spawns use the path from adapter.workerScriptPath.
+//
 // sdk-worker.js — Standalone worker process for OS-level user isolation.
 // Runs as a target Linux user, loads the Claude Agent SDK, and communicates
 // with the main Clay daemon over a Unix domain socket using JSON lines.

package/lib/server-dm.js

@@ -77,6 +77,7 @@ function attachDm(ctx) {
             primary: !!mate.primary,
             mateStatus: mate.status,
             seedData: mate.seedData || {},
+            vendor: mate.vendor || null,
           },
         }));
         return true;

package/lib/server.js

@@ -459,6 +459,75 @@ function createServer(opts) {
       return;
     }
 
+    // --- Global MCP bridge endpoint (localhost only) ---
+    // Used by Codex mcp-bridge-server.js which can't know the active project slug.
+    // Aggregates MCP tools from all project contexts.
+    if (req.method === "POST" && fullUrl === "/api/mcp-bridge") {
+      var mcpRemoteAddr = req.socket.remoteAddress || "";
+      var mcpIsLocal = mcpRemoteAddr === "127.0.0.1" || mcpRemoteAddr === "::1" || mcpRemoteAddr === "::ffff:127.0.0.1";
+      if (!mcpIsLocal) {
+        res.writeHead(403, { "Content-Type": "application/json" });
+        res.end('{"error":"Forbidden"}');
+        return;
+      }
+      var parseJsonBody = function(r) {
+        return new Promise(function(resolve, reject) {
+          var chunks = [];
+          r.on("data", function(c) { chunks.push(c); });
+          r.on("end", function() {
+            try { resolve(JSON.parse(Buffer.concat(chunks).toString("utf8"))); }
+            catch(e) { reject(e); }
+          });
+        });
+      };
+      parseJsonBody(req).then(function(body) {
+        // Find the first project context that has a MCP bridge handler
+        var handler = null;
+        projects.forEach(function(ctx) {
+          if (handler) return;
+          if (ctx.getMcpBridgeHandler) {
+            var h = ctx.getMcpBridgeHandler();
+            if (h) handler = h;
+          }
+        });
+        if (!handler) {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end('{"error":"No MCP bridge handler available"}');
+          return;
+        }
+        if (body.action === "list_tools") {
+          handler.listTools().then(function(tools) {
+            var serverCounts = {};
+            for (var ti = 0; ti < tools.length; ti++) {
+              serverCounts[tools[ti].server] = (serverCounts[tools[ti].server] || 0) + 1;
+            }
+            console.log("[mcp-bridge-http] global list_tools:", tools.length, "tools -", Object.keys(serverCounts).map(function(s) { return s + "(" + serverCounts[s] + ")"; }).join(", ") || "(none)");
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ tools: tools }));
+          }).catch(function(err) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: err.message }));
+          });
+        } else if (body.action === "call_tool") {
+          console.log("[mcp-bridge-http] global call_tool:", body.server + "/" + body.tool);
+          handler.callTool(body.server, body.tool, body.args || {}).then(function(result) {
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ result: result }));
+          }).catch(function(err) {
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: err.message }));
+          });
+        } else {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end('{"error":"Unknown action"}');
+        }
+      }).catch(function() {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end('{"error":"Invalid JSON"}');
+      });
+      return;
+    }
+
     // --- Skills routes (delegated to server-skills) ---
     if (skills.handleRequest(req, res, fullUrl)) return;
 
@@ -563,7 +632,22 @@ function createServer(opts) {
     }
 
     // Auth check for project routes
-    if (!isRequestAuthed(req)) {
+    // Bypass auth for MCP bridge endpoint (localhost only).
+    // The mcp-bridge-server.js runs as a local child process and cannot carry cookies.
+    var projectUrlForAuth = stripPrefix(req.url.split("?")[0], slug);
+    // req.socket.remoteAddress may differ between HTTP/HTTPS (TLSSocket wraps net.Socket).
+    // Also check req.connection.remoteAddress for compatibility.
+    var remoteAddr = req.socket.remoteAddress
+      || (req.connection && req.connection.remoteAddress)
+      || "";
+    var isLocalhost = remoteAddr === "127.0.0.1" || remoteAddr === "::1" || remoteAddr === "::ffff:127.0.0.1";
+    var isMcpBridgeLocal = projectUrlForAuth === "/api/mcp-bridge"
+      && req.method === "POST"
+      && isLocalhost;
+    if (projectUrlForAuth === "/api/mcp-bridge") {
+      console.log("[server] MCP bridge auth: method=" + req.method + " addr=" + remoteAddr + " bypass=" + isMcpBridgeLocal);
+    }
+    if (!isMcpBridgeLocal && !isRequestAuthed(req)) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
       res.end(auth.getAuthPage());
       return;
@@ -872,6 +956,7 @@ function createServer(opts) {
       lanHost: lanHost,
       port: portNum,
       tls: !!tlsOptions,
+      authToken: pinHash || null,
       getProjectCount: function () { return projects.size; },
       getProjectList: function (userId) {
         var list = [];