clay-server 2.33.1 → 2.34.0-beta.2

package/lib/public/modules/tools.js

@@ -20,6 +20,14 @@ var todoItems = [];
 var todoWidgetEl = null;
 var todoWidgetVisible = true; // whether in-chat widget is in viewport
 var todoObserver = null;
+var todoMeta = {
+  variant: "tasks",
+  title: "Tasks",
+  icon: "list-checks",
+  showProgress: true,
+  showCompletedCount: true,
+  stickyEnabled: true,
+};
 
 // --- Tool tracking ---
 var tools = {};
@@ -1262,6 +1270,7 @@ function todoStatusIcon(status) {
 
 export function handleTodoWrite(input) {
   if (!input || !Array.isArray(input.todos)) return;
+  todoMeta = normalizeTodoMeta(input.meta);
   todoItems = input.todos.map(function (t, i) {
     return {
       id: t.id || String(i + 1),
@@ -1275,6 +1284,7 @@ export function handleTodoWrite(input) {
 
 export function handleTaskCreate(input) {
   if (!input) return;
+  todoMeta = normalizeTodoMeta();
   var id = String(todoItems.length + 1);
   todoItems.push({
     id: id,
@@ -1287,6 +1297,7 @@ export function handleTaskCreate(input) {
 
 export function handleTaskUpdate(input) {
   if (!input || !input.taskId) return;
+  todoMeta = normalizeTodoMeta();
   for (var i = 0; i < todoItems.length; i++) {
     if (todoItems[i].id === input.taskId) {
       if (input.status === "deleted") {
@@ -1302,11 +1313,33 @@ export function handleTaskUpdate(input) {
   renderTodoWidget();
 }
 
+function normalizeTodoMeta(meta) {
+  if (meta && meta.variant === "plan") {
+    return {
+      variant: "plan",
+      title: "Plan",
+      icon: "map",
+      showProgress: false,
+      showCompletedCount: false,
+      stickyEnabled: false,
+    };
+  }
+  return {
+    variant: "tasks",
+    title: "Tasks",
+    icon: "list-checks",
+    showProgress: true,
+    showCompletedCount: true,
+    stickyEnabled: true,
+  };
+}
+
 function renderTodoWidget() {
   if (todoItems.length === 0) {
     if (todoWidgetEl) { todoWidgetEl.remove(); todoWidgetEl = null; }
     if (todoObserver) { todoObserver.disconnect(); todoObserver = null; }
     todoWidgetVisible = true;
+    todoMeta = normalizeTodoMeta();
     updateTodoSticky();
     return;
   }
@@ -1316,19 +1349,26 @@ function renderTodoWidget() {
     todoWidgetEl = document.createElement("div");
     todoWidgetEl.className = "todo-widget";
   }
+  todoWidgetEl.className = "todo-widget" + (todoMeta.variant === "plan" ? " todo-widget-plan" : "");
 
   var completed = 0;
   for (var i = 0; i < todoItems.length; i++) {
     if (todoItems[i].status === "completed") completed++;
   }
 
+  var countText = todoMeta.showCompletedCount
+    ? (completed + "/" + todoItems.length)
+    : (todoItems.length + " " + (todoItems.length === 1 ? "step" : "steps"));
+
   var html = '<div class="todo-header">' +
-    '<span class="todo-header-icon">' + iconHtml("list-checks") + '</span>' +
-    '<span class="todo-header-title">Tasks</span>' +
-    '<span class="todo-header-count">' + completed + '/' + todoItems.length + '</span>' +
+    '<span class="todo-header-icon">' + iconHtml(todoMeta.icon) + '</span>' +
+    '<span class="todo-header-title">' + todoMeta.title + '</span>' +
+    '<span class="todo-header-count">' + countText + '</span>' +
     '</div>';
-  html += '<div class="todo-progress"><div class="todo-progress-bar" style="width:' +
-    (todoItems.length > 0 ? Math.round(completed / todoItems.length * 100) : 0) + '%"></div></div>';
+  if (todoMeta.showProgress) {
+    html += '<div class="todo-progress"><div class="todo-progress-bar" style="width:' +
+      (todoItems.length > 0 ? Math.round(completed / todoItems.length * 100) : 0) + '%"></div></div>';
+  }
   html += '<div class="todo-items">';
   for (var i = 0; i < todoItems.length; i++) {
     var t = todoItems[i];
@@ -1369,6 +1409,10 @@ function setupTodoObserver() {
 function updateTodoStickyVisibility() {
   var stickyEl = document.getElementById("todo-sticky");
   if (!stickyEl) return;
+  if (!todoMeta.stickyEnabled) {
+    stickyEl.classList.add("hidden");
+    return;
+  }
 
   if (todoWidgetVisible) {
     stickyEl.classList.add("hidden");
@@ -1387,6 +1431,11 @@ function updateTodoStickyVisibility() {
 function updateTodoSticky() {
   var stickyEl = document.getElementById("todo-sticky");
   if (!stickyEl) return;
+  if (!todoMeta.stickyEnabled) {
+    stickyEl.classList.add("hidden");
+    stickyEl.innerHTML = "";
+    return;
+  }
 
   // Hide if no active tasks (all completed or empty)
   var hasActive = false;
@@ -2195,6 +2244,7 @@ export function saveToolState() {
     tools: tools,
     currentThinking: currentThinking,
     todoWidgetEl: todoWidgetEl,
+    todoMeta: todoMeta,
     inPlanMode: inPlanMode,
     planContent: planContent,
     currentPlanCardEl: currentPlanCardEl,
@@ -2209,6 +2259,7 @@ export function restoreToolState(saved) {
   tools = saved.tools;
   currentThinking = saved.currentThinking;
   todoWidgetEl = saved.todoWidgetEl;
+  todoMeta = saved.todoMeta || normalizeTodoMeta();
   inPlanMode = saved.inPlanMode;
   planContent = saved.planContent;
   currentPlanCardEl = saved.currentPlanCardEl || null;
@@ -2229,6 +2280,7 @@ export function resetToolState() {
   planContent = null;
   currentPlanCardEl = null;
   todoItems = [];
+  todoMeta = normalizeTodoMeta();
   todoWidgetEl = null;
   todoWidgetVisible = true;
   if (todoObserver) { todoObserver.disconnect(); todoObserver = null; }

package/lib/sdk-bridge.js

@@ -1,7 +1,8 @@
 const crypto = require("crypto");
 var fs = require("fs");
 var path = require("path");
-var { execSync } = require("child_process");
+var execSync = require("child_process").execSync;
+var execFileSync = require("child_process").execFileSync;
 var usersModule = require("./users");
 var { getCodexConfig } = require("./codex-defaults");
 var { splitShellSegments, attachSkillDiscovery } = require("./sdk-skill-discovery");
@@ -373,12 +374,12 @@ function createSDKBridge(opts) {
         // Create and chown the project directory once
         if (!fs.existsSync(dstDir)) {
           fs.mkdirSync(dstDir, { recursive: true });
-          try { require("child_process").execSync("chown -R " + uid + " " + JSON.stringify(path.join(linuxUserHome, ".claude"))); } catch (e2) {}
+          try { execFileSync("chown", ["-R", String(uid), path.join(linuxUserHome, ".claude")]); } catch (e2) {}
         } else {
           try {
             var dirStat = fs.statSync(dstDir);
             if (dirStat.uid !== uid) {
-              require("child_process").execSync("chown " + uid + " " + JSON.stringify(dstDir));
+              execFileSync("chown", [String(uid), dstDir]);
             }
           } catch (e2) {}
         }
@@ -389,7 +390,7 @@ function createSDKBridge(opts) {
           var dstFile = path.join(dstDir, sessionFileName);
           if (fs.existsSync(srcFile) && !fs.existsSync(dstFile)) {
             fs.copyFileSync(srcFile, dstFile);
-            try { require("child_process").execSync("chown " + uid + " " + JSON.stringify(dstFile)); } catch (e2) {}
+            try { execFileSync("chown", [String(uid), dstFile]); } catch (e2) {}
             console.log("[sdk-bridge] Pre-copied CLI session " + session.cliSessionId + " to " + linuxUser);
           }
         }
@@ -447,6 +448,12 @@ function createSDKBridge(opts) {
       }
     }
 
+    // Auto-approve Mate datastore tools. These are scoped to the active Mate
+    // project and already enforce SQL policy server-side.
+    if (toolName.indexOf("mcp__clay-datastore__") === 0) {
+      return { behavior: "allow", updatedInput: input };
+    }
+
     // Auto-approve remote MCP tools that the user explicitly enabled in project settings.
     // These are user-owned local MCP servers, so no additional permission prompt needed.
     if (toolName.indexOf("mcp__") === 0 && getRemoteMcpServers) {
@@ -646,7 +653,7 @@ function createSDKBridge(opts) {
    */
   function findConflictingClaude() {
     try {
-      var output = execSync("ps ax -o pid,command 2>/dev/null", { encoding: "utf8", timeout: 5000 });
+      var output = execFileSync("ps", ["ax", "-o", "pid,command"], { encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
       var lines = output.trim().split("\n");
       var candidates = [];
       for (var i = 1; i < lines.length; i++) { // skip header
@@ -691,7 +698,7 @@ function createSDKBridge(opts) {
    */
   function isClaudeProcess(pid) {
     try {
-      var output = execSync("ps -p " + pid + " -o command= 2>/dev/null", { encoding: "utf8", timeout: 3000 }).trim();
+      var output = execFileSync("ps", ["-p", String(pid), "-o", "command="], { encoding: "utf8", timeout: 3000, stdio: ["pipe", "pipe", "pipe"] }).trim();
       return /\/claude(\s|$)/.test(output) || /^claude(\s|$)/.test(output);
     } catch (e) {
       return false;
@@ -1168,16 +1175,18 @@ function createSDKBridge(opts) {
 
     if (dangerouslySkipPermissions) {
       claudeOpts.allowDangerouslySkipPermissions = true;
-    }
-    var globalMode = sm.currentPermissionMode || "default";
-    var effectiveDefault;
-    if (globalMode === "bypassPermissions") effectiveDefault = "bypassPermissions";
-    else if (session.acceptEditsAfterStart) effectiveDefault = "acceptEdits";
-    else effectiveDefault = globalMode;
-    var modeToApply = session._loopPermissionMode || effectiveDefault;
-    if (session.acceptEditsAfterStart) delete session.acceptEditsAfterStart;
-    if (modeToApply && modeToApply !== "default") {
-      claudeOpts.permissionMode = modeToApply;
+      claudeOpts.permissionMode = "bypassPermissions";
+    } else {
+      var globalMode = sm.currentPermissionMode || "default";
+      var effectiveDefault;
+      if (globalMode === "bypassPermissions") effectiveDefault = "bypassPermissions";
+      else if (session.acceptEditsAfterStart) effectiveDefault = "acceptEdits";
+      else effectiveDefault = globalMode;
+      var modeToApply = session._loopPermissionMode || effectiveDefault;
+      if (session.acceptEditsAfterStart) delete session.acceptEditsAfterStart;
+      if (modeToApply && modeToApply !== "default") {
+        claudeOpts.permissionMode = modeToApply;
+      }
     }
     if (session.cliSessionId && session.lastRewindUuid) {
       claudeOpts.resumeSessionAt = session.lastRewindUuid;
@@ -1349,17 +1358,17 @@ function createSDKBridge(opts) {
   // Detect which vendor binaries are installed for this user.
   // In multi-user mode, runs checks as the specific Linux user.
   function detectInstalledVendors(linuxUser) {
-    var execSync = require("child_process").execSync;
+    var execFileSync = require("child_process").execFileSync;
     var fs = require("fs");
-    var path = require("path");
     var result = [];
 
-    function tryExec(cmd) {
+    function tryLookup(name) {
       try {
         if (linuxUser) {
-          execSync("su - " + linuxUser + " -c " + JSON.stringify(cmd), { timeout: 3000, stdio: ["pipe", "pipe", "pipe"] });
+          execFileSync("su", ["-", linuxUser, "-c", "which " + name], { timeout: 3000, stdio: ["pipe", "pipe", "pipe"] });
         } else {
-          execSync(cmd, { timeout: 3000, stdio: ["pipe", "pipe", "pipe"] });
+          if (process.platform === "win32") execFileSync("where", [name], { timeout: 3000, stdio: ["pipe", "pipe", "pipe"] });
+          else execFileSync("which", [name], { timeout: 3000, stdio: ["pipe", "pipe", "pipe"] });
         }
         return true;
       } catch (e) {
@@ -1368,14 +1377,14 @@ function createSDKBridge(opts) {
     }
 
     // Claude: check if binary is in PATH
-    if (tryExec("which claude")) result.push("claude");
+    if (tryLookup("claude")) result.push("claude");
 
     // Codex: check bundled binary or PATH
     var codexBin = null;
     try {
       codexBin = require("./yoke/codex-app-server").findCodexPath();
     } catch (e) {}
-    if ((codexBin && fs.existsSync(codexBin)) || tryExec("which codex")) result.push("codex");
+    if ((codexBin && fs.existsSync(codexBin)) || tryLookup("codex")) result.push("codex");
 
     return result;
   }

package/lib/sdk-message-processor.js

@@ -234,7 +234,13 @@ function attachMessageProcessor(ctx) {
         type: "tool_executing",
         id: parsed.turnId || "codex-plan",
         name: "TodoWrite",
-        input: { todos: todos },
+        input: {
+          todos: todos,
+          meta: {
+            variant: "plan",
+            title: parsed.title || "Plan",
+          },
+        },
       });
 
     } else if (parsed.yokeType === "plan_content") {

package/lib/updater.js

@@ -1,5 +1,5 @@
 const https = require("https");
-const { execSync, spawn } = require("child_process");
+const { execFileSync, spawn } = require("child_process");
 
 // ANSI helpers (mirrors cli.js)
 var isBasicTerm = process.env.TERM_PROGRAM === "Apple_Terminal";
@@ -84,7 +84,7 @@ function isNewer(latest, current) {
 function performUpdate(channel) {
   var tag = channel === "beta" ? "beta" : "latest";
   try {
-    execSync("npm install -g clay-server@" + tag, { stdio: "pipe" });
+    execFileSync("npm", ["install", "-g", "clay-server@" + tag], { stdio: "pipe" });
     return true;
   } catch (e) {
     return false;

package/lib/users.js

@@ -1,7 +1,7 @@
 var fs = require("fs");
 var path = require("path");
 var crypto = require("crypto");
-var { execSync } = require("child_process");
+var execFileSync = require("child_process").execFileSync;
 var { CONFIG_DIR } = require("./config");
 var { attachAuth } = require("./users-auth");
 var { DEFAULT_PERMISSIONS, ALL_PERMISSIONS, attachPermissions } = require("./users-permissions");
@@ -243,7 +243,7 @@ function updateLinuxUser(userId, linuxUsername) {
 
   // Validate Linux user exists
   try {
-    execSync("id " + linuxUsername, { encoding: "utf8", timeout: 5000 });
+    execFileSync("id", [linuxUsername], { encoding: "utf8", timeout: 5000, stdio: "pipe" });
   } catch (e) {
     return { error: "Linux user '" + linuxUsername + "' does not exist" };
   }

package/lib/ws-schema.js

@@ -454,6 +454,20 @@ var schema = {
   "memory_delete":            { direction: "c2s", handler: "lib/project.js", description: "Delete a memory entry by index" },
   "memory_deleted":           { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Memory entry was deleted" },
 
+  // -----------------------------------------------------------------------
+  // Mate datastore
+  // -----------------------------------------------------------------------
+  "mate_db_tables":           { direction: "c2s", handler: "lib/project-mate-datastore.js", description: "List schema objects in the current Mate datastore" },
+  "mate_db_describe":         { direction: "c2s", handler: "lib/project-mate-datastore.js", description: "Describe a table or view in the current Mate datastore" },
+  "mate_db_query":            { direction: "c2s", handler: "lib/project-mate-datastore.js", description: "Run read-only SQL against the current Mate datastore" },
+  "mate_db_exec":             { direction: "c2s", handler: "lib/project-mate-datastore.js", description: "Run schema or write SQL against the current Mate datastore" },
+  "mate_db_tables_result":    { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Schema objects returned from a Mate datastore" },
+  "mate_db_describe_result":  { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Table description returned from a Mate datastore" },
+  "mate_db_query_result":     { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Query results from a Mate datastore" },
+  "mate_db_exec_result":      { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Execution summary from a Mate datastore" },
+  "mate_db_error":            { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Mate datastore error" },
+  "mate_db_change":           { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Mate datastore changed" },
+
   // -----------------------------------------------------------------------
   // Loop (automated task runner)
   // -----------------------------------------------------------------------

package/lib/yoke/adapters/claude.js

@@ -943,6 +943,7 @@ function createClaudeAdapter(opts) {
         cwd: (initOpts && initOpts.cwd) || _cwd,
         settingSources: ["user", "project", "local"],
         abortController: ac,
+        settings: { disableAllHooks: true },
       };
       if (_claudeBinaryPath) warmupOptions.pathToClaudeCodeExecutable = _claudeBinaryPath;
 
@@ -1102,6 +1103,7 @@ function createClaudeAdapter(opts) {
       if (co.permissionMode) sdkOptions.permissionMode = co.permissionMode;
       if (co.allowDangerouslySkipPermissions) sdkOptions.allowDangerouslySkipPermissions = true;
       if (co.resumeSessionAt) sdkOptions.resumeSessionAt = co.resumeSessionAt;
+      if (co.settings) sdkOptions.settings = co.settings;
 
       var rawQuery = sdk.query({ prompt: mq, options: sdkOptions });
       return createQueryHandle(rawQuery, mq, ac);
@@ -1250,6 +1252,7 @@ function createClaudeAdapter(opts) {
     if (claudeOpts.betas && claudeOpts.betas.length > 0) queryOptions.betas = claudeOpts.betas;
     if (claudeOpts.permissionMode) queryOptions.permissionMode = claudeOpts.permissionMode;
     if (claudeOpts.allowDangerouslySkipPermissions) queryOptions.allowDangerouslySkipPermissions = true;
+    if (claudeOpts.settings) queryOptions.settings = claudeOpts.settings;
 
     if (queryOpts.toolServers) queryOptions.mcpServers = queryOpts.toolServers;
     if (queryOpts.model) queryOptions.model = queryOpts.model;
@@ -1356,6 +1359,7 @@ function createClaudeAdapter(opts) {
         cwd: (initOpts && initOpts.cwd) || _cwd,
         settingSources: ["user", "project", "local"],
         abortController: ac,
+        settings: { disableAllHooks: true },
       };
       if (_claudeBinaryPath) warmupOptions.pathToClaudeCodeExecutable = _claudeBinaryPath;
 
@@ -1430,7 +1434,7 @@ function createClaudeAdapter(opts) {
       throw new Error("Warmup worker failed to connect: " + (e.message || e));
     }
 
-    var warmupOptions = { cwd: workerCwd, settingSources: ["user", "project", "local"] };
+    var warmupOptions = { cwd: workerCwd, settingSources: ["user", "project", "local"], settings: { disableAllHooks: true } };
     if (_claudeBinaryPath) warmupOptions.pathToClaudeCodeExecutable = _claudeBinaryPath;
     if (initOpts && initOpts.dangerouslySkipPermissions) {
       warmupOptions.permissionMode = "bypassPermissions";

package/lib/yoke/adapters/codex.js

@@ -164,6 +164,7 @@ function flattenEvent(notification, state) {
       yokeType: "plan_updated",
       turnId: params.turnId || null,
       explanation: params.explanation || "",
+      title: "Plan",
       plan: Array.isArray(params.plan) ? params.plan.map(function(step) {
         return {
           step: step && step.step ? step.step : "",

package/lib/yoke/index.js

@@ -82,6 +82,18 @@ function checkAuth() {
   if (_authCache) return _authCache;
 
   var execSync = require("child_process").execSync;
+  var execFileSync = require("child_process").execFileSync;
+
+  function lookupBinary(name) {
+    try {
+      if (process.platform === "win32") {
+        return execFileSync("where", [name], { timeout: 3000, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim().split(/\r?\n/)[0] || null;
+      }
+      return execFileSync("which", [name], { timeout: 3000, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim().split(/\r?\n/)[0] || null;
+    } catch (e) {
+      return null;
+    }
+  }
 
   function parseClaudeAuthStatusJson(out) {
     if (!out) return null;
@@ -127,27 +139,20 @@ function checkAuth() {
   function resolveCodexBinary() {
     var fs = require("fs");
     var findCodexPath = require("./codex-app-server").findCodexPath;
-    var pathProbeCmd = process.platform === "win32" ? "where codex" : "which codex";
 
     try {
       var codexBin = findCodexPath();
       if (codexBin && fs.existsSync(codexBin)) return codexBin;
     } catch (e) {}
 
-    try {
-      var whichOut = execSync(pathProbeCmd, { timeout: 3000, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] });
-      var codexPath = whichOut.trim().split(/\r?\n/)[0];
-      if (codexPath) return codexPath;
-    } catch (e) {}
-
-    return null;
+    return lookupBinary("codex");
   }
 
   function checkCodex() {
     try {
       var codexBin = resolveCodexBinary();
       if (!codexBin) return false;
-      execSync('"' + codexBin + '" login status', { timeout: 5000, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] });
+      execFileSync(codexBin, ["login", "status"], { timeout: 5000, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] });
       return true;
     } catch (e) {
       return false;
@@ -164,10 +169,11 @@ function checkAuth() {
  */
 function checkInstalled() {
   var fs = require("fs");
-  var execSync = require("child_process").execSync;
+  var execFileSync = require("child_process").execFileSync;
   var result = { claude: false, codex: false };
   try {
-    execSync("which claude", { timeout: 3000, stdio: ["pipe", "pipe", "pipe"] });
+    if (process.platform === "win32") execFileSync("where", ["claude"], { timeout: 3000, stdio: ["pipe", "pipe", "pipe"] });
+    else execFileSync("which", ["claude"], { timeout: 3000, stdio: ["pipe", "pipe", "pipe"] });
     result.claude = true;
   } catch (e) {}
   try {
@@ -181,8 +187,9 @@ function checkInstalled() {
       }
     } catch (e) {}
 
-    var pathProbeCmd = process.platform === "win32" ? "where codex" : "which codex";
-    var whichOut = execSync(pathProbeCmd, { timeout: 3000, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] });
+    var whichOut = process.platform === "win32"
+      ? execFileSync("where", ["codex"], { timeout: 3000, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] })
+      : execFileSync("which", ["codex"], { timeout: 3000, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] });
     if (whichOut.trim()) result.codex = true;
   } catch (e) {}
   return result;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "2.33.1",
+  "version": "2.34.0-beta.2",
   "description": "Self-hosted Claude Code in your browser. Multi-session, multi-user, push notifications.",
   "bin": {
     "clay-server": "./bin/cli.js",