clay-server 3.0.0 → 3.1.0-beta.1

package/lib/sdk-bridge.js

@@ -136,7 +136,7 @@ function createSDKBridge(opts) {
       "--port", String(clayPort),
       "--slug", slug,
       "--session", String(session.localId),
-      "--pair-only",
+      "--session-only",
     ];
     if (clayTls) bridgeArgs.push("--tls");
     var env = [];
@@ -553,6 +553,30 @@ function createSDKBridge(opts) {
       return { behavior: "allow", updatedInput: input };
     }
 
+    // Auto-approve split-pair partner tools. The pair itself is
+    // user-constructed (the user created the split and its roles and
+    // watches both panes live), the target is structurally confined to the
+    // split partner, and a prompt on every delegation hop defeats the
+    // driver/worker workflow. spawn_sessions is NOT here: it creates new
+    // sessions and keeps its prompt.
+    var pairPartnerTools = { send_to_partner: true, read_partner: true };
+    if (toolName.indexOf("mcp__clay-sessions__") === 0) {
+      var sessionsToolName = toolName.substring(toolName.lastIndexOf("__") + 2);
+      if (pairPartnerTools[sessionsToolName]) {
+        return { behavior: "allow", updatedInput: input };
+      }
+    }
+
+    // Sticky-note reads and writes are immediately visible on the shared
+    // board. Deletion stays outside the whitelist and therefore prompts;
+    // its session ownership is enforced again inside the server handler.
+    var notesToolName = toolName.substring(toolName.lastIndexOf("__") + 2);
+    var isClayNotesTool = toolName.indexOf("mcp__clay-notes__") === 0
+      || toolName.indexOf("clay-notes__") !== -1;
+    if (isClayNotesTool && (notesToolName === "list_notes" || notesToolName === "write_note")) {
+      return { behavior: "allow", updatedInput: input };
+    }
+
     // Auto-approve read-only email MCP tools.
     // These only read data from accounts the user explicitly checked.
     // Write operations (send, reply, mark_read) still require permission.

package/lib/session-notes-mcp-server.js

@@ -0,0 +1,39 @@
+// Sticky-note memory tools for project sessions.
+
+var buildShape = require("./session-spawn-mcp-server").buildShape;
+
+var MEMORY_CONTRACT = "Shared project memory on the user's board. One note = one fact, decision, or reminder, written like a real sticky note: a phrase or at most two short sentences. It must be worth a human's attention a week later and stand on its own without the current conversation. Never paragraphs, lists of steps, logs, or announcement notes about your own activity. Update an existing note instead of adding a near-duplicate; delete notes that stop being true.";
+
+function getToolDefs(handlers) {
+  return [
+    {
+      name: "list_notes",
+      description: MEMORY_CONTRACT + " List the active notes before writing when you need to avoid duplicates or inspect full memory beyond the injected summary.",
+      inputSchema: buildShape({}),
+      handler: function (args) { return handlers.list(args || {}); },
+    },
+    {
+      name: "write_note",
+      description: MEMORY_CONTRACT + " Create a new note, or update an existing note by id. Long board notes are allowed, with a 2000-character abuse guard.",
+      inputSchema: buildShape({
+        id: { type: "string", description: "Existing note id to update. Omit to create a note." },
+        text: { type: "string", description: "Sticky-note text. Keep the register concise even though the board permits up to 2000 characters." },
+        color: { type: "string", enum: ["yellow", "blue", "green", "pink", "orange", "purple"], description: "Optional sticky-note color." },
+      }, ["text"]),
+      handler: function (args) { return handlers.write(args || {}); },
+    },
+    {
+      name: "remove_note",
+      description: MEMORY_CONTRACT + " Remove a note created by this same session when it is no longer true. Notes created by users or other sessions cannot be removed.",
+      inputSchema: buildShape({
+        id: { type: "string", description: "Id of the note to remove." },
+      }, ["id"]),
+      handler: function (args) { return handlers.remove(args || {}); },
+    },
+  ];
+}
+
+module.exports = {
+  MEMORY_CONTRACT: MEMORY_CONTRACT,
+  getToolDefs: getToolDefs,
+};

package/lib/ws-schema.js

@@ -355,6 +355,7 @@ var schema = {
   // -----------------------------------------------------------------------
   "note_create":              { direction: "c2s", handler: "lib/project-user-message.js", description: "Create a new sticky note" },
   "note_created":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Sticky note was created" },
+  "note_written":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Agent created or updated a sticky note" },
   "note_update":              { direction: "c2s", handler: "lib/project-user-message.js", description: "Update a sticky note" },
   "note_updated":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Sticky note was updated" },
   "note_delete":              { direction: "c2s", handler: "lib/project-user-message.js", description: "Delete a sticky note" },

package/lib/yoke/adapters/codex.js

@@ -97,6 +97,18 @@ function normalizePlanStatus(status) {
   return "pending";
 }
 
+function dynamicInputSchema(inputSchema) {
+  if (inputSchema && typeof inputSchema.type === "string") return inputSchema;
+  try {
+    var zod = require("zod");
+    if (zod.toJSONSchema && inputSchema) {
+      var schema = inputSchema.safeParse ? inputSchema : zod.object(inputSchema);
+      return zod.toJSONSchema(schema);
+    }
+  } catch (e) {}
+  return { type: "object", properties: {} };
+}
+
 // Detect Codex "not logged in" errors. Codex surfaces auth failures several
 // ways depending on transport: a clean error event with
 // codexErrorInfo:"unauthorized", or a turn/failed / item error whose message
@@ -813,15 +825,39 @@ function createCodexQueryHandle(appServer, queryOpts) {
         });
         return;
       }
-      Promise.resolve(callDynamicTool(dynamicParams.tool, dynamicParams.arguments || {})).then(function (result) {
-        var content = result && Array.isArray(result.content) ? result.content : [];
-        var contentItems = content.map(function (item) {
-          return { type: "inputText", text: item && item.text ? item.text : JSON.stringify(item) };
+      function executeDynamicTool() {
+        return Promise.resolve(callDynamicTool(dynamicParams.tool, dynamicParams.arguments || {})).then(function (result) {
+          var content = result && Array.isArray(result.content) ? result.content : [];
+          var contentItems = content.map(function (item) {
+            return { type: "inputText", text: item && item.text ? item.text : JSON.stringify(item) };
+          });
+          if (contentItems.length === 0) {
+            contentItems.push({ type: "inputText", text: typeof result === "string" ? result : JSON.stringify(result) });
+          }
+          appServer.respond(msg.id, { contentItems: contentItems, success: !(result && result.isError) });
         });
-        if (contentItems.length === 0) {
-          contentItems.push({ type: "inputText", text: typeof result === "string" ? result : JSON.stringify(result) });
+      }
+      var permissionToolName = dynamicParams.tool;
+      if (permissionToolName === "list_notes" || permissionToolName === "write_note" || permissionToolName === "remove_note") {
+        permissionToolName = "mcp__clay-notes__" + permissionToolName;
+      } else if (permissionToolName === "send_to_partner" || permissionToolName === "read_partner") {
+        permissionToolName = "mcp__clay-sessions__" + permissionToolName;
+      }
+      var permission = canUseTool
+        ? Promise.resolve(canUseTool(permissionToolName, dynamicParams.arguments || {}, {
+          toolUseID: dynamicParams.callId || String(msg.id),
+          signal: abortController ? abortController.signal : null,
+        }))
+        : Promise.resolve({ behavior: "allow" });
+      permission.then(function (decision) {
+        if (!isApproved(decision)) {
+          appServer.respond(msg.id, {
+            contentItems: [{ type: "inputText", text: "Tool use was not approved" }],
+            success: false,
+          });
+          return;
         }
-        appServer.respond(msg.id, { contentItems: contentItems, success: !(result && result.isError) });
+        return executeDynamicTool();
       }).catch(function (err) {
         appServer.respond(msg.id, {
           contentItems: [{ type: "inputText", text: "Error: " + (err.message || String(err)) }],
@@ -963,7 +999,7 @@ function createCodexQueryHandle(appServer, queryOpts) {
             type: "function",
             name: tool.name,
             description: tool.description || tool.name,
-            inputSchema: tool.inputSchema || { type: "object", properties: {} },
+            inputSchema: dynamicInputSchema(tool.inputSchema),
           };
         });
       }

package/lib/yoke/mcp-bridge-server.js

@@ -6,7 +6,7 @@
 // list/call requests to Clay's project-scoped HTTP endpoint
 // (/p/{slug}/api/mcp-bridge) when a slug is provided.
 //
-// Usage: node mcp-bridge-server.js --port 2633 --slug my-project [--session 42] [--pair-only]
+// Usage: node mcp-bridge-server.js --port 2633 --slug my-project [--session 42] [--session-only]
 //
 // Lifecycle:
 //   1. The vendor CLI spawns this process
@@ -25,7 +25,7 @@ var clayPort = 2633;
 var claySlug = "";
 var clayTls = false;
 var claySessionId = null;
-var pairOnly = false;
+var sessionOnly = false;
 
 for (var i = 0; i < args.length; i++) {
   if (args[i] === "--port" && args[i + 1]) {
@@ -40,8 +40,8 @@ for (var i = 0; i < args.length; i++) {
     i++;
   } else if (args[i] === "--tls") {
     clayTls = true;
-  } else if (args[i] === "--pair-only") {
-    pairOnly = true;
+  } else if (args[i] === "--session-only") {
+    sessionOnly = true;
   }
 }
 
@@ -119,7 +119,7 @@ function postJson(urlPath, body) {
 
 // --- Fetch tools from Clay ---
 function fetchTools() {
-  return postJson(CLAY_MCP_PATH, { action: "list_tools", sessionId: claySessionId, pairOnly: pairOnly }).then(function (resp) {
+  return postJson(CLAY_MCP_PATH, { action: "list_tools", sessionId: claySessionId, sessionOnly: sessionOnly }).then(function (resp) {
     if (resp.error) {
       log("Failed to fetch tools: " + resp.error);
       return [];
@@ -146,7 +146,7 @@ function callTool(serverName, toolName, args) {
     tool: toolName,
     args: args || {},
     sessionId: claySessionId,
-    pairOnly: pairOnly,
+    sessionOnly: sessionOnly,
   });
 }
 
@@ -308,4 +308,4 @@ process.stdin.on("error", function () {
 process.on("SIGTERM", function () { process.exit(0); });
 process.on("SIGINT", function () { process.exit(0); });
 
-log("Started: port=" + clayPort + " slug=" + claySlug + " session=" + (claySessionId === null ? "none" : claySessionId) + " pairOnly=" + pairOnly);
+log("Started: port=" + clayPort + " slug=" + claySlug + " session=" + (claySessionId === null ? "none" : claySessionId) + " sessionOnly=" + sessionOnly);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "3.0.0",
+  "version": "3.1.0-beta.1",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js",

package/lib/public/modules/branch-switcher.js

@@ -1,178 +0,0 @@
-// Title-bar branch switcher for a project and its worktrees.
-
-import { store } from './store.js';
-import { iconHtml, refreshIcons } from './icons.js';
-import { escapeHtml } from './utils.js';
-import { familyOf } from './worktree-family.js';
-import { switchProject, confirmRemoveProject } from './app-projects.js';
-import { showWorktreeModal } from './sidebar-projects.js';
-
-var chip = null;
-var label = null;
-var menu = null;
-var menuOpen = false;
-var defaultBranches = {};
-// slug -> true/false once /api/branches answers; undefined while unknown.
-// Non-git projects hide the chip (no worktrees to manage there).
-var gitRepoBySlug = {};
-
-function projectName(project) {
-  return project ? (project.title || project.project || project.name || project.slug) : "";
-}
-
-function currentProject(projects) {
-  var slug = store.get('currentSlug');
-  for (var i = 0; i < projects.length; i++) {
-    if (projects[i].slug === slug) return projects[i];
-  }
-  return null;
-}
-
-function defaultBranch(parent) {
-  return defaultBranches[parent.slug] || "default";
-}
-
-function requestDefaultBranch(parent) {
-  if (!parent || Object.prototype.hasOwnProperty.call(defaultBranches, parent.slug)) return;
-  defaultBranches[parent.slug] = null;
-  fetch("/p/" + encodeURIComponent(parent.slug) + "/api/branches")
-    .then(function (response) { return response.json(); })
-    .then(function (data) {
-      defaultBranches[parent.slug] = data.defaultBranch || "default";
-      gitRepoBySlug[parent.slug] = data.isGitRepo !== false;
-      renderBranchSwitcher();
-    })
-    .catch(function () {
-      defaultBranches[parent.slug] = "default";
-      renderBranchSwitcher();
-    });
-}
-
-function closeMenu() {
-  menuOpen = false;
-  if (menu) menu.classList.add("hidden");
-  if (chip) {
-    chip.classList.remove("open");
-    chip.setAttribute("aria-expanded", "false");
-  }
-}
-
-function positionMenu() {
-  if (!chip || !menu || !menuOpen) return;
-  var rect = chip.getBoundingClientRect();
-  var left = Math.min(rect.left, window.innerWidth - menu.offsetWidth - 8);
-  var top = rect.bottom + 6;
-  if (top + menu.offsetHeight > window.innerHeight - 8) top = rect.top - menu.offsetHeight - 6;
-  menu.style.left = Math.max(8, left) + "px";
-  menu.style.top = Math.max(8, top) + "px";
-}
-
-function branchLabel(project, parent) {
-  return project.isWorktree ? (project.branch || projectName(project)) : defaultBranch(parent);
-}
-
-function appendProjectRow(container, project, parent, isCurrent) {
-  var row = document.createElement("div");
-  row.className = "branch-chip-row" + (isCurrent ? " current" : "");
-  var inaccessible = project.isWorktree && project.worktreeAccessible === false;
-  var main = document.createElement("button");
-  main.className = "branch-chip-row-main";
-  main.disabled = inaccessible;
-  if (inaccessible) main.title = "Outside project path";
-  main.innerHTML = iconHtml("git-branch") + '<span class="branch-chip-row-label">' +
-    escapeHtml(branchLabel(project, parent)) + "</span>";
-  if (project.isProcessing) {
-    var dot = document.createElement("span");
-    dot.className = "branch-chip-processing";
-    main.appendChild(dot);
-  }
-  if (project.pendingPermissions > 0) {
-    var badge = document.createElement("span");
-    badge.className = "branch-chip-pending";
-    badge.textContent = project.pendingPermissions > 99 ? "99+" : String(project.pendingPermissions);
-    main.appendChild(badge);
-  }
-  if (isCurrent) main.insertAdjacentHTML("beforeend", iconHtml("check"));
-  if (!inaccessible) {
-    main.addEventListener("click", function () { closeMenu(); switchProject(project.slug); });
-  }
-  row.appendChild(main);
-
-  if (project.isWorktree && (!store.get('permissions') || store.get('permissions').deleteProject !== false)) {
-    var remove = document.createElement("button");
-    remove.className = "branch-chip-row-action";
-    remove.title = "Remove worktree";
-    remove.innerHTML = iconHtml("trash-2");
-    remove.addEventListener("click", function (event) {
-      event.stopPropagation();
-      closeMenu();
-      confirmRemoveProject(project.slug, projectName(project));
-    });
-    row.appendChild(remove);
-  }
-  container.appendChild(row);
-}
-
-function renderMenu(family, current) {
-  menu.innerHTML = "";
-  if (family.parent) appendProjectRow(menu, family.parent, family.parent, current.slug === family.parent.slug);
-  for (var i = 0; i < family.worktrees.length; i++) {
-    appendProjectRow(menu, family.worktrees[i], family.parent || family.worktrees[i], current.slug === family.worktrees[i].slug);
-  }
-  if (family.parent) {
-    var footer = document.createElement("button");
-    footer.className = "branch-chip-new";
-    footer.innerHTML = iconHtml("plus") + " <span>New worktree...</span>";
-    footer.addEventListener("click", function () {
-      closeMenu();
-      showWorktreeModal(family.parent.slug, projectName(family.parent));
-    });
-    menu.appendChild(footer);
-  }
-  refreshIcons();
-  positionMenu();
-}
-
-export function renderBranchSwitcher() {
-  if (!chip) return;
-  var projects = store.get('projects') || [];
-  var current = currentProject(projects);
-  var family = current ? familyOf(projects, current.slug) : { parent: null, worktrees: [] };
-  // The chip is the project's worktree management surface, so it shows even
-  // with zero worktrees (the menu then offers the default branch and "New
-  // worktree"). Hidden where there is no project context to manage, and for
-  // non-git projects (optimistically visible until /api/branches answers).
-  var gateSlug = family.parent ? family.parent.slug : (current ? current.slug : null);
-  var hidden = !current || store.get('dmMode') || store.get('mateProjectSlug') ||
-    store.get('homeHubVisible') || (gateSlug && gitRepoBySlug[gateSlug] === false);
-  chip.classList.toggle("hidden", hidden);
-  if (hidden) { closeMenu(); return; }
-  if (family.parent) requestDefaultBranch(family.parent);
-  label.textContent = branchLabel(current, family.parent || current);
-  if (menuOpen) renderMenu(family, current);
-}
-
-export function initBranchSwitcher() {
-  chip = document.getElementById("branch-chip");
-  label = document.getElementById("branch-chip-label");
-  menu = document.getElementById("branch-chip-menu");
-  if (!chip || !label || !menu) return;
-  chip.addEventListener("click", function (event) {
-    event.stopPropagation();
-    menuOpen = !menuOpen;
-    chip.classList.toggle("open", menuOpen);
-    chip.setAttribute("aria-expanded", menuOpen ? "true" : "false");
-    menu.classList.toggle("hidden", !menuOpen);
-    renderBranchSwitcher();
-  });
-  document.addEventListener("click", function (event) {
-    if (menuOpen && !menu.contains(event.target) && !chip.contains(event.target)) closeMenu();
-  });
-  window.addEventListener("resize", positionMenu);
-  store.subscribe(function (state, prev) {
-    if (state.projects !== prev.projects || state.currentSlug !== prev.currentSlug ||
-        state.dmMode !== prev.dmMode || state.mateProjectSlug !== prev.mateProjectSlug ||
-        state.homeHubVisible !== prev.homeHubVisible) renderBranchSwitcher();
-  });
-  renderBranchSwitcher();
-}

package/lib/public/modules/worktree-family.js

@@ -1,60 +0,0 @@
-// Pure helpers for presenting worktree projects as branches of one family.
-
-function projectName(project) {
-  return project ? (project.title || project.project || project.name || project.slug) : "";
-}
-
-export function familyOf(projects, slug) {
-  var list = projects || [];
-  var current = null;
-  for (var i = 0; i < list.length; i++) {
-    if (list[i].slug === slug) { current = list[i]; break; }
-  }
-  if (!current) return { parent: null, worktrees: [] };
-
-  var parentSlug = current.isWorktree ? current.parentSlug : current.slug;
-  var parent = current.isWorktree ? null : current;
-  var worktrees = [];
-  for (var j = 0; j < list.length; j++) {
-    var project = list[j];
-    if (!parent && project.slug === parentSlug && !project.isWorktree) parent = project;
-    if (project.isWorktree && project.parentSlug === parentSlug) worktrees.push(project);
-  }
-  if (current.isWorktree && worktrees.indexOf(current) === -1) worktrees.push(current);
-  worktrees.sort(function (a, b) { return projectName(a).localeCompare(projectName(b)); });
-  return { parent: parent, worktrees: worktrees };
-}
-
-export function parentProjects(projects) {
-  return (projects || []).filter(function (project) { return !project.isWorktree; });
-}
-
-export function displayProject(projects, slug) {
-  var family = familyOf(projects, slug);
-  if (family.parent) return family.parent;
-  for (var i = 0; i < (projects || []).length; i++) {
-    if (projects[i].slug === slug) return projects[i];
-  }
-  return null;
-}
-
-export function aggregateFamily(parent, worktrees) {
-  var result = Object.assign({}, parent);
-  var children = worktrees || [];
-  result.isProcessing = !!result.isProcessing;
-  result.unread = result.unread || 0;
-  result.pendingPermissions = result.pendingPermissions || 0;
-  for (var i = 0; i < children.length; i++) {
-    result.isProcessing = result.isProcessing || !!children[i].isProcessing;
-    result.unread += children[i].unread || 0;
-    result.pendingPermissions += children[i].pendingPermissions || 0;
-  }
-  return result;
-}
-
-export function switcherProjectName(projects, project) {
-  if (!project || !project.isWorktree) return projectName(project);
-  var family = familyOf(projects, project.slug);
-  var parentName = family.parent ? projectName(family.parent) : (project.parentSlug || "Project");
-  return parentName + " \u2387 " + (project.branch || projectName(project));
-}