clay-server 2.44.1-beta.1 → 2.45.0-beta.1

package/lib/yoke/adapters/claude.js

@@ -12,6 +12,12 @@ var crypto = require("crypto");
 var { spawn } = require("child_process");
 var { resolveOsUserInfo } = require("../../os-users");
 
+// SDK-specific knowledge stays in the adapter (not the relay): the host dialog
+// kinds this client can render, declared to the SDK when an onUserDialog
+// callback is wired. The CLI fails closed — kinds not listed here are never
+// emitted. Keep in sync with the client's generic user-dialog renderer.
+var SUPPORTED_DIALOG_KINDS = ["refusal_fallback_prompt"];
+
 // --- SDK loading ---
 // Async loader (ESM dynamic import, same pattern as current project.js getSDK)
 var _sdkPromise = null;
@@ -182,6 +188,68 @@ function flattenEvent(raw) {
       base.summary = raw.summary || null;
       return base;
     }
+    // Model refusal: the model declined and the CLI either fell back to
+    // another model or ended the turn. Translate to a vendor-neutral
+    // yokeType so the relay never sees SDK subtype strings.
+    if (raw.subtype === "model_refusal_fallback") {
+      base.yokeType = "model_refusal";
+      base.refusalKind = "fallback";
+      base.originalModel = raw.original_model || null;
+      base.fallbackModel = raw.fallback_model || null;
+      base.direction = raw.direction || null;
+      base.category = raw.api_refusal_category || null;
+      return base;
+    }
+    if (raw.subtype === "model_refusal_no_fallback") {
+      base.yokeType = "model_refusal";
+      base.refusalKind = "no_fallback";
+      base.originalModel = raw.original_model || null;
+      base.category = raw.api_refusal_category || null;
+      base.explanation = raw.api_refusal_explanation || null;
+      base.content = raw.content || null;
+      return base;
+    }
+    // Slash-command list changed mid-session (e.g. skills discovered dynamically).
+    if (raw.subtype === "commands_changed") {
+      base.yokeType = "commands_changed";
+      base.commandNames = Array.isArray(raw.commands)
+        ? raw.commands.map(function(c) { return (c && typeof c === "object") ? c.name : c; }).filter(Boolean)
+        : [];
+      return base;
+    }
+    // The session worker is shutting down (reason is a host-set snake_case code).
+    if (raw.subtype === "worker_shutting_down") {
+      base.yokeType = "worker_shutting_down";
+      base.reason = raw.reason || "";
+      return base;
+    }
+    // Live thinking-token estimate (ephemeral progress).
+    if (raw.subtype === "thinking_tokens") {
+      base.yokeType = "thinking_tokens";
+      base.estimatedTokens = raw.estimated_tokens || 0;
+      base.estimatedTokensDelta = raw.estimated_tokens_delta || 0;
+      return base;
+    }
+    // Informational system message (render-leveled: info/notice/suggestion/warning).
+    if (raw.subtype === "informational") {
+      base.yokeType = "informational";
+      base.level = raw.level || "info";
+      base.content = raw.content || "";
+      base.toolUseId = raw.tool_use_id || null;
+      base.preventContinuation = !!raw.prevent_continuation;
+      return base;
+    }
+    // A tool call was denied (by classifier, rule, mode, or async agent).
+    if (raw.subtype === "permission_denied") {
+      base.yokeType = "permission_denied";
+      base.toolName = raw.tool_name || "";
+      base.toolUseId = raw.tool_use_id || null;
+      base.agentId = raw.agent_id || null;
+      base.reasonType = raw.decision_reason_type || null;
+      base.reason = raw.decision_reason || null;
+      base.message = raw.message || "";
+      return base;
+    }
     // Catch-all system event
     base.yokeType = "system";
     base.subtype = raw.subtype;
@@ -338,6 +406,20 @@ function createQueryHandle(rawQuery, messageQueue, abortController) {
       return Promise.resolve();
     },
 
+    reloadSkills: function() {
+      if (rawQuery && typeof rawQuery.reloadSkills === "function") {
+        return rawQuery.reloadSkills();
+      }
+      return Promise.resolve(null);
+    },
+
+    setMcpPermissionModeOverride: function(serverName, mode) {
+      if (rawQuery && typeof rawQuery.setMcpPermissionModeOverride === "function") {
+        return rawQuery.setMcpPermissionModeOverride(serverName, mode);
+      }
+      return Promise.resolve(null);
+    },
+
     getContextUsage: function() {
       if (rawQuery && typeof rawQuery.getContextUsage === "function") {
         return rawQuery.getContextUsage();
@@ -517,13 +599,16 @@ function spawnWorker(linuxUser, workerScriptPath, cwd) {
     console.log("[yoke/claude] Spawning worker: uid=" + userInfo.uid + " gid=" + userInfo.gid + " cwd=" + cwd + " socket=" + socketPath);
     console.log("[yoke/claude] Worker script: " + workerScriptPath);
     console.log("[yoke/claude] Node: " + process.execPath);
-    worker.process = spawn(process.execPath, [workerScriptPath, socketPath], {
+    // Route through setpriv when group inheritance is enabled so the worker
+    // (and the agent CLI it spawns) inherits the user's supplementary groups.
+    var workerSpawn = require("../../os-users").wrapSpawnAsUser(process.execPath, [workerScriptPath, socketPath], {
       uid: userInfo.uid,
       gid: userInfo.gid,
       env: workerEnv,
       cwd: cwd,
       stdio: ["ignore", "pipe", "pipe"],
     });
+    worker.process = spawn(workerSpawn.command, workerSpawn.args, workerSpawn.options);
 
     worker.process.stdout.on("data", function(data) {
       console.log("[sdk-worker:" + linuxUser + "] " + data.toString().trim());
@@ -681,7 +766,7 @@ function serializeWorkerValue(value, seen) {
 // in-process QueryHandle. This allows processQueryStream to iterate a worker
 // query identically to an in-process query.
 
-function createWorkerQueryHandle(worker, canUseTool, onElicitation, callMcpTool) {
+function createWorkerQueryHandle(worker, canUseTool, onElicitation, callMcpTool, onUserDialog) {
   // Async iterable state
   var iterQueue = [];
   var iterWaiting = null;
@@ -779,6 +864,24 @@ function createWorkerQueryHandle(worker, canUseTool, onElicitation, callMcpTool)
         }
         break;
 
+      case "user_dialog_request":
+        if (onUserDialog) {
+          onUserDialog({
+            dialogKind: msg.dialogKind,
+            payload: msg.payload || {},
+            toolUseID: msg.toolUseId || undefined,
+          }, {
+            signal: { addEventListener: function() {} },
+          }).then(function(result) {
+            worker.send({ type: "user_dialog_response", requestId: msg.requestId, result: result });
+          }).catch(function(e) {
+            console.error("[yoke/claude] user_dialog_response send failed:", e.message || e);
+          });
+        } else {
+          worker.send({ type: "user_dialog_response", requestId: msg.requestId, result: { behavior: "cancelled" } });
+        }
+        break;
+
       case "mcp_tool_call":
         if (callMcpTool) {
           callMcpTool(msg.serverName, msg.toolName, msg.args || {}).then(function(result) {
@@ -916,6 +1019,16 @@ function createWorkerQueryHandle(worker, canUseTool, onElicitation, callMcpTool)
       return Promise.resolve();
     },
 
+    reloadSkills: function() {
+      worker.send({ type: "reload_skills" });
+      return Promise.resolve(null);
+    },
+
+    setMcpPermissionModeOverride: function(serverName, mode) {
+      worker.send({ type: "set_mcp_permission_mode_override", serverName: serverName, mode: mode });
+      return Promise.resolve(null);
+    },
+
     getContextUsage: function() {
       return Promise.resolve(null);
     },
@@ -1215,6 +1328,10 @@ function createClaudeAdapter(opts) {
       if (queryOpts.toolServers) sdkOptions.mcpServers = queryOpts.toolServers;
       if (queryOpts.canUseTool) sdkOptions.canUseTool = queryOpts.canUseTool;
       if (queryOpts.onElicitation) sdkOptions.onElicitation = queryOpts.onElicitation;
+      if (queryOpts.onUserDialog) {
+        sdkOptions.onUserDialog = queryOpts.onUserDialog;
+        sdkOptions.supportedDialogKinds = SUPPORTED_DIALOG_KINDS;
+      }
       if (queryOpts.resumeSessionId) sdkOptions.resume = queryOpts.resumeSessionId;
 
       // Claude-specific options from adapterOptions.CLAUDE
@@ -1363,7 +1480,7 @@ function createClaudeAdapter(opts) {
     }
 
     // Create the worker query handle (sets up message handler on worker)
-    var handle = createWorkerQueryHandle(worker, queryOpts.canUseTool, queryOpts.onElicitation, queryOpts.callMcpTool);
+    var handle = createWorkerQueryHandle(worker, queryOpts.canUseTool, queryOpts.onElicitation, queryOpts.callMcpTool, queryOpts.onUserDialog);
 
     // Wait for worker to be ready before sending query_start
     if (!reusingWorker) {
@@ -1390,6 +1507,7 @@ function createClaudeAdapter(opts) {
     if (claudeOpts.settings) queryOptions.settings = claudeOpts.settings;
 
     if (queryOpts.toolServerDescriptors) queryOptions.mcpServerDescriptors = queryOpts.toolServerDescriptors;
+    if (queryOpts.onUserDialog) queryOptions.supportedDialogKinds = SUPPORTED_DIALOG_KINDS;
     if (queryOpts.model) queryOptions.model = queryOpts.model;
     if (queryOpts.effort) queryOptions.effort = queryOpts.effort;
     if (queryOpts.resumeSessionId) queryOptions.resume = queryOpts.resumeSessionId;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "2.44.1-beta.1",
+  "version": "2.45.0-beta.1",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js",
@@ -48,7 +48,7 @@
   "homepage": "https://github.com/chadbyte/clay#readme",
   "author": "Chad",
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.2.132",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.196",
     "@lydell/node-pty": "^1.2.0-beta.3",
     "@openai/codex": "^0.124.0",
     "imapflow": "^1.3.1",