clay-server 2.33.1 → 2.34.0-beta.10

package/lib/project-http.js

@@ -163,8 +163,8 @@ function attachHTTP(ctx) {
               var _osUM = require("./os-users");
               var _uid = _osUM.getLinuxUserUid(req._clayUser.linuxUser);
               if (_uid != null) {
-                require("child_process").execSync("chown " + _uid + " " + JSON.stringify(destPath));
-                require("child_process").execSync("chown " + _uid + " " + JSON.stringify(tmpDir));
+                execFileSync("chown", [String(_uid), destPath]);
+                execFileSync("chown", [String(_uid), tmpDir]);
               }
             } catch (e2) {}
           }
@@ -639,9 +639,8 @@ function attachHTTP(ctx) {
 
     // Git dirty check
     if (req.method === "GET" && urlPath === "/api/git-dirty") {
-      var execSync = require("child_process").execSync;
       try {
-        var out = execSync("git status --porcelain", { cwd: cwd, encoding: "utf8", timeout: 5000 });
+        var out = execFileSync("git", ["status", "--porcelain"], { cwd: cwd, encoding: "utf8", timeout: 5000 });
         var lines = out.trim().split("\n").filter(function (line) {
           return line.trim().length > 0 && !line.startsWith("??");
         });

package/lib/project-image.js

@@ -1,6 +1,7 @@
 var fs = require("fs");
 var path = require("path");
 var crypto = require("crypto");
+var execFileSync = require("child_process").execFileSync;
 
 /**
  * Attach image handling to a project context.
@@ -65,12 +66,12 @@ function attachImage(ctx) {
             var osUsersMod = require("./os-users");
             var uid = osUsersMod.getLinuxUserUid(ownerLinuxUser);
             if (uid != null) {
-              require("child_process").execSync("chown " + uid + " " + JSON.stringify(filePath));
+              execFileSync("chown", [String(uid), filePath]);
               // Also fix parent dirs if root-owned
               try {
                 var dirStat = fs.statSync(imagesDir);
                 if (dirStat.uid !== uid) {
-                  require("child_process").execSync("chown " + uid + " " + JSON.stringify(imagesDir));
+                  execFileSync("chown", [String(uid), imagesDir]);
                 }
               } catch (e2) {}
             }

package/lib/project-mate-datastore.js

@@ -0,0 +1,232 @@
+var z = require("zod");
+var datastore = require("./mate-datastore");
+var FEATURE_ENABLED = false;
+
+function attachMateDatastore(ctx) {
+  var cwd = ctx.cwd;
+  var isMate = ctx.isMate;
+  var send = ctx.send;
+  var sendTo = ctx.sendTo;
+
+  function isFeatureAvailable() {
+    return FEATURE_ENABLED && datastore.isMateDatastoreAvailable();
+  }
+
+  function ensureProjectDatastore() {
+    if (!FEATURE_ENABLED) {
+      return { ok: false, code: "MATE_DATASTORE_NOT_ALLOWED", message: "Mate datastore is not enabled." };
+    }
+    if (!isMate) {
+      return { ok: false, code: "MATE_DATASTORE_NOT_ALLOWED", message: "Mate datastore is only available in Mate sessions." };
+    }
+    try {
+      return datastore.ensureMateDatastore({ mateDir: cwd });
+    } catch (e) {
+      return { ok: false, code: "MATE_DATASTORE_UNAVAILABLE", message: e.message || "Mate datastore is unavailable." };
+    }
+  }
+
+  function getDatastoreWarning(handle) {
+    if (!handle || !handle.warning) return null;
+    return handle.warning;
+  }
+
+  function normalizeParams(input) {
+    if (!input) return [];
+    if (Array.isArray(input.params)) return input.params;
+    return [];
+  }
+
+  function normalizeToolResult(result, requestId) {
+    var payload = result || { ok: false, code: "MATE_DATASTORE_UNAVAILABLE", message: "Mate datastore is unavailable." };
+    if (typeof requestId !== "undefined") payload.requestId = requestId;
+    return payload;
+  }
+
+  function callToolInternal(toolName, input) {
+    var handle = ensureProjectDatastore();
+    if (!handle || handle.ok === false) {
+      return normalizeToolResult(handle, input && input.requestId);
+    }
+
+    var warning = getDatastoreWarning(handle);
+    var params = normalizeParams(input);
+
+    if (toolName === "clay_db_query") {
+      var queryResult = datastore.runQuery(handle, input.sql, params, { maxRows: 200, maxBytes: 1024 * 1024, includeSizeInfo: true });
+      if (warning && queryResult.ok && !queryResult.warning) queryResult.warning = warning;
+      return normalizeToolResult(queryResult, input && input.requestId);
+    }
+
+    if (toolName === "clay_db_exec") {
+      var execResult = datastore.runExec(handle, input.sql, params, { maxBytes: 1024 * 1024, includeSizeInfo: true });
+      if (warning && execResult.ok && !execResult.warning) execResult.warning = warning;
+      if (execResult.ok) {
+        broadcastDbChange({ tool: toolName, sql: input.sql, changes: execResult.changes || 0 });
+      }
+      return normalizeToolResult(execResult, input && input.requestId);
+    }
+
+    if (toolName === "clay_db_tables") {
+      var tablesResult = datastore.listSchemaObjects(handle);
+      if (warning && tablesResult.ok && !tablesResult.warning) tablesResult.warning = warning;
+      return normalizeToolResult(tablesResult, input && input.requestId);
+    }
+
+    if (toolName === "clay_db_describe") {
+      var describeResult = datastore.describeTable(handle, input.table);
+      if (warning && describeResult.ok && !describeResult.warning) describeResult.warning = warning;
+      return normalizeToolResult(describeResult, input && input.requestId);
+    }
+
+    return normalizeToolResult({ ok: false, code: "MATE_DATASTORE_NOT_ALLOWED", message: "Unknown datastore tool: " + toolName }, input && input.requestId);
+  }
+
+  function broadcastDbChange(details) {
+    var payload = {
+      type: "mate_db_change",
+      details: details || {},
+    };
+    send(payload);
+  }
+
+  function handleMateDatastoreMessage(ws, msg) {
+    if (msg.type !== "mate_db_tables" && msg.type !== "mate_db_describe" && msg.type !== "mate_db_query" && msg.type !== "mate_db_exec") {
+      return false;
+    }
+
+    if (!FEATURE_ENABLED) {
+      return false;
+    }
+
+    if (!isMate) {
+      sendTo(ws, {
+        type: "mate_db_error",
+        requestId: msg.requestId || null,
+        code: "MATE_DATASTORE_NOT_ALLOWED",
+        message: "Mate datastore is only available in Mate sessions.",
+      });
+      return true;
+    }
+
+    if (msg.type === "mate_db_tables") {
+      sendResult(ws, "mate_db_tables_result", callToolInternal("clay_db_tables", msg));
+      return true;
+    }
+
+    if (msg.type === "mate_db_describe") {
+      sendResult(ws, "mate_db_describe_result", callToolInternal("clay_db_describe", msg));
+      return true;
+    }
+
+    if (msg.type === "mate_db_query") {
+      sendResult(ws, "mate_db_query_result", callToolInternal("clay_db_query", msg));
+      return true;
+    }
+
+    if (msg.type === "mate_db_exec") {
+      sendResult(ws, "mate_db_exec_result", callToolInternal("clay_db_exec", msg));
+      return true;
+    }
+
+    return true;
+  }
+
+  function sendResult(ws, type, result) {
+    var payload = result || { ok: false, code: "MATE_DATASTORE_UNAVAILABLE", message: "Mate datastore is unavailable." };
+    payload.type = type;
+    sendTo(ws, payload);
+  }
+
+  function getToolDefinitions() {
+    if (!isMate || !isFeatureAvailable()) return [];
+    return [
+      {
+        name: "clay_db_query",
+        description: "Execute read-only SQL against the current Mate datastore.",
+        inputSchema: {
+          sql: z.string().min(1).describe("SQL query"),
+          params: z.array(z.any()).optional().describe("Positional parameters"),
+        },
+        handler: function (input) {
+          return callToolInternal("clay_db_query", input || {});
+        },
+      },
+      {
+        name: "clay_db_exec",
+        description: "Execute schema or write SQL against the current Mate datastore.",
+        inputSchema: {
+          sql: z.string().min(1).describe("SQL statement"),
+          params: z.array(z.any()).optional().describe("Positional parameters"),
+        },
+        handler: function (input) {
+          return callToolInternal("clay_db_exec", input || {});
+        },
+      },
+      {
+        name: "clay_db_tables",
+        description: "List schema objects in the current Mate datastore.",
+        inputSchema: undefined,
+        handler: function (input) {
+          return callToolInternal("clay_db_tables", input || {});
+        },
+      },
+      {
+        name: "clay_db_describe",
+        description: "Describe a table or view in the current Mate datastore.",
+        inputSchema: {
+          table: z.string().min(1).describe("Table name"),
+        },
+        handler: function (input) {
+          return callToolInternal("clay_db_describe", input || {});
+        },
+      },
+    ];
+  }
+
+  function createMcpServer() {
+    var defs = getToolDefinitions();
+    if (!defs.length) return null;
+    var registered = {};
+    for (var i = 0; i < defs.length; i++) {
+      registered[defs[i].name] = {
+        description: defs[i].description,
+        inputSchema: defs[i].inputSchema,
+        handler: defs[i].handler,
+      };
+    }
+    return {
+      name: "clay-datastore",
+      version: "1.0.0",
+      instance: {
+        _registeredTools: registered,
+      },
+    };
+  }
+
+  function getSessionToolDefinitions() {
+    if (!isMate || !isFeatureAvailable()) return null;
+    return getToolDefinitions();
+  }
+
+  function callMateTool(session, toolName, input) {
+    return callToolInternal(toolName, input || {});
+  }
+
+  function closeAllDatastores() {
+    datastore.closeAllMateDatastores();
+  }
+
+  return {
+    isFeatureAvailable: isFeatureAvailable,
+    handleMateDatastoreMessage: handleMateDatastoreMessage,
+    getToolDefinitions: getToolDefinitions,
+    createMcpServer: createMcpServer,
+    getSessionToolDefinitions: getSessionToolDefinitions,
+    callMateTool: callMateTool,
+    ensureProjectDatastore: ensureProjectDatastore,
+    closeAllDatastores: closeAllDatastores,
+  };
+}
+
+module.exports = { attachMateDatastore: attachMateDatastore };

package/lib/project-sessions.js

@@ -3,6 +3,33 @@ var path = require("path");
 var { execFileSync } = require("child_process");
 var { CODEX_DEFAULTS, getCodexConfig } = require("./codex-defaults");
 
+// Format a user's answer to an ask_user_questions card as a plain user
+// message so the MCP path can feed it back to the agent on the next turn.
+// The agent sees: its own question text, then the selected answer(s).
+function formatAskUserAnswerAsMessage(input, answers) {
+  var questions = (input && Array.isArray(input.questions)) ? input.questions : [];
+  if (questions.length === 0) {
+    // Shouldn't happen, but be defensive.
+    try { return "(answered with: " + JSON.stringify(answers || {}) + ")"; }
+    catch (e) { return "(answered)"; }
+  }
+  var lines = [];
+  for (var i = 0; i < questions.length; i++) {
+    var q = questions[i];
+    var qText = (q && q.question) ? q.question : ("Question " + (i + 1));
+    var ans = (answers && answers[i] != null) ? String(answers[i]) : "";
+    if (!ans) continue;
+    if (questions.length === 1) {
+      // Single question: keep it tight.
+      lines.push(ans);
+    } else {
+      lines.push("- " + qText + " → " + ans);
+    }
+  }
+  if (lines.length === 0) return "(no answer provided)";
+  return lines.join("\n");
+}
+
 /**
  * Attach session management, config, project management, and mid-section
  * message handlers to a project context.
@@ -12,7 +39,7 @@ var { CODEX_DEFAULTS, getCodexConfig } = require("./codex-defaults");
  *   sm, sdk, tm, clients,
  *   send, sendTo, sendToAdmins, sendToSession, sendToSessionOthers,
  *   opts, usersModule, userPresence, matesModule, pushModule,
- *   getSessionForWs, getLinuxUserForSession, getOsUserInfoForWs,
+ *   getSessionForWs, getLinuxUserForSession, ensureProjectAccessForSession, getOsUserInfoForWs,
  *   hydrateImageRefs, onProcessingChanged, broadcastPresence,
  *   adapter, getProjectList, getProjectCount, getScheduleCount,
  *   moveScheduleToProject, moveAllSchedulesToProject, getHubSchedules,
@@ -43,6 +70,7 @@ function attachSessions(ctx) {
   var pushModule = ctx.pushModule;
   var getSessionForWs = ctx.getSessionForWs;
   var getLinuxUserForSession = ctx.getLinuxUserForSession;
+  var ensureProjectAccessForSession = ctx.ensureProjectAccessForSession;
   var getOsUserInfoForWs = ctx.getOsUserInfoForWs;
   var hydrateImageRefs = ctx.hydrateImageRefs;
   var onProcessingChanged = ctx.onProcessingChanged;
@@ -136,6 +164,39 @@ function attachSessions(ctx) {
       return true;
     }
 
+    if (msg.type === "reorder_session_bookmarks") {
+      if (typeof msg.sourceId === "number" && typeof msg.targetId === "number" && msg.sourceId !== msg.targetId) {
+        var source = sm.sessions.get(msg.sourceId);
+        var target = sm.sessions.get(msg.targetId);
+        if (!source || !target) return true;
+        if (usersModule.isMultiUser() && ws._clayUser) {
+          if (!usersModule.canAccessSession(ws._clayUser.id, source, { visibility: "public" })) return true;
+          if (!usersModule.canAccessSession(ws._clayUser.id, target, { visibility: "public" })) return true;
+        }
+        sm.reorderBookmarkedSessions(msg.sourceId, msg.targetId, msg.insertBefore !== false);
+      }
+      return true;
+    }
+
+    if (msg.type === "bulk_delete_sessions") {
+      if (!Array.isArray(msg.sessionIds) || msg.sessionIds.length === 0) return true;
+      var deletableIds = [];
+      for (var di = 0; di < msg.sessionIds.length; di++) {
+        var bulkId = msg.sessionIds[di];
+        if (typeof bulkId !== "number") continue;
+        var bulkTarget = sm.sessions.get(bulkId);
+        if (!bulkTarget) continue;
+        if (usersModule.isMultiUser() && ws._clayUser) {
+          if (!usersModule.canAccessSession(ws._clayUser.id, bulkTarget, { visibility: "public" })) continue;
+        }
+        deletableIds.push(bulkId);
+      }
+      if (deletableIds.length > 0) {
+        sm.deleteSessionsBulk(deletableIds, ws);
+      }
+      return true;
+    }
+
     if (msg.type === "transfer_project_owner") {
       // Home directory projects: ownership is permanently locked
       if (osUsers && osUsers.length > 0 && /^\/home\/[^/]+\//.test(cwd)) {
@@ -243,6 +304,17 @@ function attachSessions(ctx) {
 
     if (msg.type === "switch_session") {
       if (msg.id && sm.sessions.has(msg.id)) {
+        // If the target session's vendor doesn't own the currently cached
+        // model, clear sm.currentModel so the UI and next query don't leak
+        // the previous session's vendor-specific model into this one.
+        var switchTargetSess = sm.sessions.get(msg.id);
+        if (switchTargetSess && sm.currentModel) {
+          var targetVendor = switchTargetSess.vendor || sm.defaultVendor || null;
+          var tvModels = (targetVendor && sm.modelsByVendor && sm.modelsByVendor[targetVendor]) || [];
+          if (tvModels.length > 0 && tvModels.indexOf(sm.currentModel) === -1) {
+            sm.currentModel = "";
+          }
+        }
         // Check access in multi-user mode
         if (usersModule.isMultiUser() && ws._clayUser) {
           var switchTarget = sm.sessions.get(msg.id);
@@ -747,10 +819,41 @@ function attachSessions(ctx) {
       if (!pending) return true;
       delete session.pendingAskUser[toolId];
       sm.sendAndRecord(session, { type: "ask_user_answered", toolId: toolId, answers: answers });
-      pending.resolve({
-        behavior: "allow",
-        updatedInput: Object.assign({}, pending.input, { answers: answers }),
-      });
+
+      if (pending.mode === "mcp") {
+        // Stateless MCP path: the tool already returned. Inject the user's
+        // answer as a new user message so the conversation continues
+        // naturally on the next turn. This matches how the mate would see
+        // any other user input.
+        var answerText = formatAskUserAnswerAsMessage(pending.input, answers);
+        var userMsg = { type: "user_message", text: answerText };
+        session.history.push(userMsg);
+        sm.appendToSessionFile(session, userMsg);
+        sendToSession(session.localId, userMsg);
+
+        if (!session.isProcessing) {
+          session.isProcessing = true;
+          onProcessingChanged();
+          session.sentToolResults = {};
+          sendToSession(session.localId, { type: "status", status: "processing" });
+          if (!session.queryInstance && !session.worker) {
+            sdk.startQuery(session, answerText, undefined, ensureProjectAccessForSession(session));
+          } else {
+            sdk.pushMessage(session, answerText);
+          }
+        } else {
+          // Turn is still running; queue for the next turn.
+          sdk.pushMessage(session, answerText);
+        }
+      } else {
+        // Claude native AskUserQuestion path (canUseTool). The SDK is
+        // synchronously blocked on the permission callback, so we must
+        // resolve it with the standard permission shape.
+        pending.resolve({
+          behavior: "allow",
+          updatedInput: Object.assign({}, pending.input, { answers: answers }),
+        });
+      }
       return true;
     }
 
@@ -863,7 +966,7 @@ function attachSessions(ctx) {
             newSession.sentToolResults = {};
             sendToSession(newSession.localId, { type: "status", status: "processing" });
             newSession.acceptEditsAfterStart = true;
-            sdk.startQuery(newSession, planPrompt, undefined, getLinuxUserForSession(newSession));
+            sdk.startQuery(newSession, planPrompt, undefined, ensureProjectAccessForSession(newSession));
           } catch (e) {
             console.error("[project] Error starting plan execution:", e);
             sendTo(ws, { type: "error", text: "Failed to start plan execution: " + (e.message || e) });
@@ -894,7 +997,7 @@ function attachSessions(ctx) {
               session.sentToolResults = {};
               sendToSession(session.localId, { type: "status", status: "processing" });
               if (!session.queryInstance && !session.worker) {
-                sdk.startQuery(session, feedback, undefined, getLinuxUserForSession(session));
+                sdk.startQuery(session, feedback, undefined, ensureProjectAccessForSession(session));
               } else {
                 sdk.pushMessage(session, feedback);
               }

package/lib/project-user-message.js

@@ -13,7 +13,7 @@ var fs = require("fs");
  *   send, sendTo, sendToSession, sendToSessionOthers,
  *   clients, opts,
  *   usersModule, matesModule,
- *   getSessionForWs, getLinuxUserForSession, getOsUserInfoForWs,
+ *   getSessionForWs, getLinuxUserForSession, ensureProjectAccessForSession, getOsUserInfoForWs,
  *   hydrateImageRefs, saveImageFile, imagesDir,
  *   onProcessingChanged, onSessionDone,
  *   _loop              - { handleLoopMessage: fn(ws, msg) }
@@ -49,6 +49,7 @@ function attachUserMessage(ctx) {
 
   var getSessionForWs = ctx.getSessionForWs;
   var getLinuxUserForSession = ctx.getLinuxUserForSession;
+  var ensureProjectAccessForSession = ctx.ensureProjectAccessForSession;
   var getOsUserInfoForWs = ctx.getOsUserInfoForWs;
 
   var hydrateImageRefs = ctx.hydrateImageRefs;
@@ -281,7 +282,7 @@ function attachUserMessage(ctx) {
       nowSession.isProcessing = true;
       onProcessingChanged();
       sendToSession(nowSession.localId, { type: "status", status: "processing" });
-      sdk.startQuery(nowSession, schedText, null, getLinuxUserForSession(nowSession));
+      sdk.startQuery(nowSession, schedText, null, ensureProjectAccessForSession(nowSession));
       sm.broadcastSessionList();
       return true;
     }
@@ -484,7 +485,7 @@ function attachUserMessage(ctx) {
           // No active query (or worker idle between queries): start a new query
           session._queryStartTs = Date.now();
           console.log("[PERF] project.js: startQuery called, localId=" + session.localId + " t=0ms");
-          sdk.startQuery(session, finalText, msg.images, getLinuxUserForSession(session));
+          sdk.startQuery(session, finalText, msg.images, ensureProjectAccessForSession(session));
         } else {
           sdk.pushMessage(session, finalText, msg.images);
         }