clay-server 3.8.1 → 4.0.0-beta.10

package/lib/server.js

@@ -13,10 +13,18 @@ var serverSkills = require("./server-skills");
 var claudeHookInstaller = require("./claude-hook-installer");
 var serverDm = require("./server-dm");
 var serverMates = require("./server-mates");
-var serverClayHome = require("./server-clay-home");
+var serverHomeChat = require("./server-home-chat");
+var shouldSuppressHomeResponse = require("./home-response-notifications").shouldSuppressHomeResponse;
+var serverHomePreferences = require("./server-home-preferences");
+var serverTools = require("./server-tools");
 var serverAdmin = require("./server-admin");
 var serverSettings = require("./server-settings");
 var serverPalette = require("./server-palette");
+var workspaceQueryModule = require("./workspace-query-service");
+var { attachWorkspaceQueryService } = workspaceQueryModule;
+var { attachWorkspaceAssignmentService } = require("./workspace-assignment-service");
+var { attachProjectLogsService } = require("./project-logs-service");
+var { attachMateKnowledgeService } = require("./mate-knowledge-service");
 var serverEmail = require("./server-email");
 var serverGlobalWs = require("./server-global-ws");
 var { parseWsRequestUrl } = require("./ws-request");
@@ -291,6 +299,59 @@ function createServer(opts) {
 
   // --- Project registry ---
   var projects = new Map(); // slug → projectContext
+  var assignmentService = attachWorkspaceAssignmentService({
+    storageDir: path.join(CONFIG_DIR, "workspace-assignments"),
+    getProjects: function () { return projects; },
+    isMultiUser: function () { return users.isMultiUser(); },
+    sessionRef: workspaceQueryModule.sessionRef,
+  });
+  var workspaceQueryService = attachWorkspaceQueryService({
+    getProjects: function () { return projects; },
+    isMultiUser: function () { return users.isMultiUser(); },
+    canAccessProject: function (userId, status) {
+      return users.canAccessProject(userId, {
+        ownerId: status && status.projectOwnerId || null,
+        visibility: status && status.visibility || "public",
+        allowedUsers: status && status.allowedUsers || [],
+      });
+    },
+    resolveMate: function (userId, mateId) {
+      return mates.getMate(mates.buildMateCtx(users.isMultiUser() ? userId : null), mateId);
+    },
+    assignmentService: assignmentService,
+  });
+  // Project access is resolved from the authoritative project record, not from
+  // getStatus(), which carries no visibility or allowedUsers fields.
+  var projectLogsService = attachProjectLogsService({
+    getProjects: function () { return projects; },
+    isMultiUser: function () { return users.isMultiUser(); },
+    canAccessProject: function (userId, status) {
+      if (!status || !status.slug || !onGetProjectAccess) return false;
+      var access = onGetProjectAccess(status.slug);
+      if (!access || access.error) return false;
+      return users.canAccessProject(userId, access) === true;
+    },
+    resolveMate: function (userId, mateId) {
+      return mates.getMate(mates.buildMateCtx(users.isMultiUser() ? userId : null), mateId);
+    },
+    findUserById: function (userId) { return users.findUserById(userId); },
+  });
+  // Mate Knowledge reads the synchronized Knowledge records. The Mate list is
+  // derived from the owning user alone, so a binding can never span users.
+  var mateKnowledgeService = attachMateKnowledgeService({
+    getProjects: function () { return projects; },
+    isMultiUser: function () { return users.isMultiUser(); },
+    resolveMate: function (userId, mateId) {
+      return mates.getMate(mates.buildMateCtx(users.isMultiUser() ? userId : null), mateId);
+    },
+    listMates: function (userId) {
+      var mateCtx = mates.buildMateCtx(users.isMultiUser() ? userId : null);
+      var all = mates.getAllMates(mateCtx) || [];
+      return all.map(function (mate) {
+        return { id: mate.id, name: mate.name || null, createdBy: mate.createdBy || null, dir: mates.getMateDir(mateCtx, mate.id) };
+      });
+    },
+  });
 
   // --- Admin module ---
   var admin = serverAdmin.attachAdmin({
@@ -355,7 +416,7 @@ function createServer(opts) {
     // origin. External sites still cannot frame Clay; frame-ancestors below
     // is the modern equivalent for browsers that honor CSP.
     "X-Frame-Options": "SAMEORIGIN",
-    "Content-Security-Policy": "default-src 'self'; frame-ancestors 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://esm.sh; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; img-src * data: blob:; connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://esm.sh https://api.open-meteo.com https://ipapi.co; font-src 'self' data: https://fonts.gstatic.com https://cdn.jsdelivr.net;",
+    "Content-Security-Policy": "default-src 'self'; frame-ancestors 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://esm.sh; worker-src 'self' blob:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; img-src * data: blob:; connect-src 'self' ws: wss: https://cdn.jsdelivr.net https://esm.sh https://api.open-meteo.com https://ipapi.co; font-src 'self' data: https://fonts.gstatic.com https://cdn.jsdelivr.net;",
   };
   if (tlsOptions) {
     securityHeaders["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains";
@@ -655,7 +716,7 @@ function createServer(opts) {
     // --- Skills routes (delegated to server-skills) ---
     if (skills.handleRequest(req, res, fullUrl)) return;
 
-    // Root path — redirect to first accessible project
+    // Root path — render home while keeping the last accessible project connected.
     if (fullUrl === "/" && req.method === "GET") {
       if (!isRequestAuthed(req)) {
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
@@ -665,9 +726,23 @@ function createServer(opts) {
       if (projects.size > 0) {
         var targetSlug = null;
         var reqUser = users.isMultiUser() ? getMultiUserFromReq(req) : null;
+        var homePreference = typeof users.getHomeSurfacePreference === "function"
+          ? users.getHomeSurfacePreference(reqUser ? reqUser.id : "default")
+          : null;
+        var preferredContextSlug = homePreference && homePreference.projectSlug;
+        if (preferredContextSlug && projects.has(preferredContextSlug)) {
+          if (reqUser && onGetProjectAccess) {
+            var preferredAccess = onGetProjectAccess(preferredContextSlug);
+            if (preferredAccess && !preferredAccess.error && users.canAccessProject(reqUser.id, preferredAccess)) {
+              targetSlug = preferredContextSlug;
+            }
+          } else {
+            targetSlug = preferredContextSlug;
+          }
+        }
         // Check for last-visited project cookie
         var lastProject = parseCookies(req)["clay_last_project"];
-        if (lastProject && projects.has(lastProject)) {
+        if (!targetSlug && lastProject && projects.has(lastProject)) {
           if (reqUser && onGetProjectAccess) {
             var lpAccess = onGetProjectAccess(lastProject);
             if (lpAccess && !lpAccess.error && users.canAccessProject(reqUser.id, lpAccess)) {
@@ -692,8 +767,15 @@ function createServer(opts) {
           });
         }
         if (targetSlug) {
-          res.writeHead(302, { "Location": "/p/" + targetSlug + "/" });
-          res.end();
+          try {
+            var homeHtml = fs.readFileSync(path.join(publicDir, "index.html"), "utf8");
+            homeHtml = homeHtml.replace("<body>", '<body data-home-project-slug="' + targetSlug + '">');
+            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-cache" });
+            res.end(homeHtml);
+          } catch (e) {
+            res.writeHead(500, { "Content-Type": "text/plain" });
+            res.end("App shell missing.");
+          }
           return;
         }
       }
@@ -1028,10 +1110,9 @@ function createServer(opts) {
         unreadMap[wsSlug] = 0;
       }
       ctx.handleConnection(ws, wsUser);
-      // Tear down the home-chat subscription (if any) on socket close so
-      // we don't leak callbacks against Clay's session manager.
+      // Tear down the embedded mate chat subscription on socket close.
       ws.on("close", function () {
-        try { clayHomeHandler.handleDisconnection(ws); } catch (e) {}
+        try { homeChatHandler.handleDisconnection(ws); } catch (e) {}
       });
     });
   });
@@ -1108,6 +1189,24 @@ function createServer(opts) {
   }
 
   // --- Project management ---
+  function refreshVendorAuthEverywhere(vendor, linuxUser) {
+    var refreshes = [];
+    projects.forEach(function (projectCtx) {
+      if (!projectCtx || typeof projectCtx.refreshVendorAuth !== "function") return;
+      try {
+        refreshes.push(Promise.resolve(projectCtx.refreshVendorAuth(vendor, linuxUser)).catch(function (err) {
+          console.error("[server] Cross-project " + vendor + " auth refresh failed:", err && err.message ? err.message : err);
+          return false;
+        }));
+      } catch (err) {
+        console.error("[server] Cross-project " + vendor + " auth refresh threw:", err && err.message ? err.message : err);
+      }
+    });
+    return Promise.all(refreshes).then(function (results) {
+      return results.some(function (refreshed) { return !!refreshed; });
+    });
+  }
+
   function addProject(cwd, slug, title, icon, projectOwnerId, worktreeMeta, extraOpts) {
     if (projects.has(slug)) return false;
     var extra = extraOpts || {};
@@ -1119,8 +1218,22 @@ function createServer(opts) {
       projectOwnerId: projectOwnerId || null,
       worktreeMeta: worktreeMeta || null,
       isMate: extra.isMate || false,
+      mateId: extra.mateId || (extra.isMate ? path.basename(cwd) : null),
       mateDisplayName: extra.mateDisplayName || "",
       isHostAgent: !!extra.isHostAgent,
+      createReadyMate: function (ws, userId, definition) {
+        if (!mateHandler || typeof mateHandler.createReadyMateFromInterview !== "function") throw new Error("Mate creation is unavailable.");
+        return mateHandler.createReadyMateFromInterview(ws, userId, definition);
+      },
+      workspaceQueryService: workspaceQueryService,
+      projectLogsService: projectLogsService,
+      mateKnowledgeService: mateKnowledgeService,
+      getProjectAccess: function () {
+        return onGetProjectAccess ? onGetProjectAccess(slug) : { visibility: "public", ownerId: projectOwnerId || null };
+      },
+      shouldSuppressResponseNotification: function (session) {
+        return shouldSuppressHomeResponse(projects, slug, session);
+      },
       pushModule: pushModule,
       debug: debug,
       dangerouslySkipPermissions: dangerouslySkipPermissions,
@@ -1143,52 +1256,6 @@ function createServer(opts) {
         });
         return list;
       },
-      getAllProjectSessions: function () {
-        var allSessions = [];
-        projects.forEach(function (pCtx, pSlug) {
-          if (pSlug === slug) return; // skip self
-          var status = pCtx.getStatus();
-          if (status.isWorktree) return;
-          var pSm = pCtx.getSessionManager();
-          if (!pSm) return;
-          var projectTitle = status.title || status.project || pSlug;
-          pSm.sessions.forEach(function (s) {
-            if (!s.hidden && s.history && s.history.length > 0) {
-              s._projectTitle = projectTitle;
-              allSessions.push(s);
-            }
-          });
-        });
-        return allSessions;
-      },
-      // Like getAllProjectSessions but returns the per-project grouped
-      // shape that session-search.searchPalette expects. Includes self
-      // (so the host agent can search its own past Clay conversations).
-      // Used by clay-history-mcp-server.
-      getAllProjectsWithSessions: function () {
-        var out = [];
-        projects.forEach(function (pCtx, pSlug) {
-          var status = pCtx.getStatus();
-          if (status.isWorktree) return;
-          var pSm = pCtx.getSessionManager();
-          if (!pSm) return;
-          var sessions = [];
-          pSm.sessions.forEach(function (s) {
-            if (s.hidden) return;
-            sessions.push(s);
-          });
-          if (sessions.length === 0) return;
-          out.push({
-            projectSlug: pSlug,
-            projectTitle: status.title || status.project || pSlug,
-            projectIcon: status.icon || null,
-            isMate: !!status.isMate,
-            mateId: status.mateId || null,
-            sessions: sessions,
-          });
-        });
-        return out;
-      },
       getHubSchedules: function () {
         var allSchedules = [];
         projects.forEach(function (ctx, s) {
@@ -1277,6 +1344,29 @@ function createServer(opts) {
       onSetProjectDefaultMode: onSetProjectDefaultMode,
       onGetProjectLastVendor: onGetProjectLastVendor,
       onSetProjectLastVendor: onSetProjectLastVendor,
+      listControllableTools: function (userId) {
+        return toolsHandler ? toolsHandler.installedManifests(userId) : [];
+      },
+      controlToolForMate: function (userId, mateId, toolId, kind, payload) {
+        if (!toolsHandler) return Promise.reject(new Error("Tool control is unavailable."));
+        return toolsHandler.controlForMate(userId, mateId, toolId, kind, payload);
+      },
+      installToolForMate: function (userId, input) {
+        if (!toolsHandler) return Promise.reject(new Error("Tool installation is unavailable."));
+        return toolsHandler.installForMate(userId, input);
+      },
+      sourceToolForMate: function (userId, toolId) {
+        if (!toolsHandler) return Promise.reject(new Error("Capsule source access is unavailable."));
+        return toolsHandler.sourceForMate(userId, toolId);
+      },
+      updateToolForMate: function (userId, toolId, input) {
+        if (!toolsHandler) return Promise.reject(new Error("Capsule source updates are unavailable."));
+        return toolsHandler.updateForMate(userId, toolId, input);
+      },
+      removeToolForMate: function (userId, toolId) {
+        if (!toolsHandler) return Promise.reject(new Error("Tool removal is unavailable."));
+        return toolsHandler.removeForMate(userId, toolId);
+      },
       onGetProjectMcpServers: onGetProjectMcpServers,
       onSetProjectMcpServers: onSetProjectMcpServers,
       onGetDaemonConfig: onGetDaemonConfig,
@@ -1291,10 +1381,12 @@ function createServer(opts) {
       onDmMessage: handleDmMessage,
       broadcastAll: broadcastAll,
       notificationsModule: _globalNotifications,
+      refreshVendorAuthEverywhere: refreshVendorAuthEverywhere,
       getProject: function (s) { return projects.get(s) || null; },
       isUserOnline: isUserOnline,
     });
     projects.set(slug, ctx);
+    assignmentService.reconcileProject(slug);
     // ctx.warmup() is now deferred to the first websocket connection into
     // this project (see project-connection.js handleConnection). Warming
     // every project at startup spawned a CodexAppServer and an mcp-bridge
@@ -1318,12 +1410,24 @@ function createServer(opts) {
   // --- Email account handler (per-user email account management) ---
   var emailHandler = serverEmail.attachEmail({ users: users });
 
-  // --- Clay home chat handler (host agent chat embedded in home hub) ---
-  var clayHomeHandler = serverClayHome.attachClayHome({
+  // --- Embedded mate chat handler ---
+  var homeChatHandler = serverHomeChat.attachHomeChat({
     users: users,
     mates: mates,
     projects: projects,
     addProject: addProject,
+    workspaceQueryService: workspaceQueryService,
+  });
+
+  var homePreferencesHandler = serverHomePreferences.attachHomePreferences({
+    users: users,
+    projects: projects,
+  });
+
+  // --- User-installed home tools handler ---
+  var toolsHandler = serverTools.attachTools({
+    users: users,
+    projects: projects,
   });
 
   // --- Mate handler ---
@@ -1333,11 +1437,14 @@ function createServer(opts) {
     if (mateHandler) mateHandler.scheduleRegistryRefresh();
   }
 
-  function handleDmMessage(ws, msg) {
+  function handleDmMessage(ws, msg, routedProjectSlug) {
+    if (assignmentService.handleMessage(ws, msg, routedProjectSlug)) return;
     if (dmHandler.handleMessage(ws, msg)) return;
     if (mateHandler && mateHandler.handleMessage(ws, msg)) return;
     if (emailHandler.handleMessage(ws, msg)) return;
-    if (clayHomeHandler.handleMessage(ws, msg)) return;
+    if (homeChatHandler.handleMessage(ws, msg)) return;
+    if (homePreferencesHandler.handleMessage(ws, msg)) return;
+    if (toolsHandler.handleMessage(ws, msg)) return;
   }
 
   function removeProject(slug) {

package/lib/session-pair-mcp-server.js

@@ -6,14 +6,14 @@ function getToolDefs(handlers) {
   return [
     {
       name: "send_to_partner",
-      description: "Delegate one concrete task to the Worker. If this session has no pair yet, Clay creates a real Worker session and opens it visibly in the right pane before starting the task. A completed turn does not end the Worker session: reuse the same Worker for follow-up implementation and corrections instead of taking over its work. Detached completions are pushed back automatically. A delegated turn cannot delegate back, so keep orchestration one hop deep.",
+      description: "Delegate one concrete task to the visible Split Worker. If this session has no pair yet, Clay creates a real Split Worker session and opens it visibly in the right pane before starting the task. A completed turn does not end the Split Worker session: reuse the same Split Worker for follow-up implementation and corrections instead of taking over its work. Detached completions are pushed back automatically. A delegated turn cannot delegate back, so keep orchestration one hop deep.",
       inputSchema: buildShape({
         message: { type: "string", description: "The complete task or question for the partner." },
         wait: { type: "boolean", description: "Wait for the partner's turn to finish. Defaults to true." },
         timeoutSeconds: { type: "number", description: "Maximum wait in seconds, from 1 to 900. Defaults to 300." },
-        workerVendor: { type: "string", description: "Optional Worker vendor to use only when creating a new pair. Defaults to a suitable installed vendor." },
-        workerModel: { type: "string", description: "Optional Worker model to use only when creating a new pair." },
-        workerEffort: { type: "string", description: "Optional Worker reasoning effort to use only when creating a new pair." },
+        workerVendor: { type: "string", description: "Optional Split Worker vendor to use only when creating a new pair. Defaults to a suitable installed vendor." },
+        workerModel: { type: "string", description: "Optional Split Worker model to use only when creating a new pair." },
+        workerEffort: { type: "string", description: "Optional Split Worker reasoning effort to use only when creating a new pair." },
       }, ["message"]),
       handler: function (args) { return handlers.send(args || {}); },
     },
@@ -27,13 +27,13 @@ function getToolDefs(handlers) {
     },
     {
       name: "interrupt_partner",
-      description: "Interrupt the Worker's current task. Use this when the task is going in the wrong direction, needs to be reprioritized, or must stop before the next instruction. The Worker returns any partial result to you for review.",
+      description: "Interrupt the Split Worker's current task. Use this when the task is going in the wrong direction, needs to be reprioritized, or must stop before the next instruction. The Split Worker returns any partial result to you for review.",
       inputSchema: buildShape({}),
       handler: function (args) { return handlers.interrupt(args || {}); },
     },
     {
       name: "close_partner",
-      description: "Close the visible Worker pane and dissolve the Driver/Worker pair while preserving both session histories. If the Worker is still running, Clay interrupts it before closing the pair.",
+      description: "Close the visible Split Worker pane and dissolve the Driver/Split Worker pair while preserving both session histories. If the Split Worker is still running, Clay interrupts it before closing the pair.",
       inputSchema: buildShape({}),
       handler: function (args) { return handlers.close(args || {}); },
     },

package/lib/sessions.js

@@ -5,6 +5,7 @@ var utils = require("./utils");
 var users = require("./users");
 var { CODEX_DEFAULTS } = require("./codex-defaults");
 var hygiene = require("./session-hygiene");
+var backgroundTaskTiming = require("./background-task-timing");
 
 function createSessionManager(opts) {
   var cwd = opts.cwd;
@@ -170,9 +171,15 @@ function createSessionManager(opts) {
       if (session.lastRewindUuid) metaObj.lastRewindUuid = session.lastRewindUuid;
       if (session.loop) metaObj.loop = session.loop;
       if (session.spawn) metaObj.spawn = session.spawn;
+      if (session.assignment) metaObj.assignment = session.assignment;
       if (session.handoff) metaObj.handoff = session.handoff;
       if (session.debateState) metaObj.debateState = session.debateState;
       if (session.debateSetupMode) metaObj.debateSetupMode = true;
+      if (session.homeDebatePlanning) metaObj.homeDebatePlanning = true;
+      if (session.homeDebatePhase) metaObj.homeDebatePhase = session.homeDebatePhase;
+      if (session.homeDebateInitialTopic) metaObj.homeDebateInitialTopic = session.homeDebateInitialTopic;
+      if (session.homeClayEntryRequestId) metaObj.homeClayEntryRequestId = session.homeClayEntryRequestId;
+      if (session.homeClayEntryMode) metaObj.homeClayEntryMode = session.homeClayEntryMode;
       var meta = JSON.stringify(metaObj);
       var lines = [meta];
       for (var i = 0; i < session.history.length; i++) {
@@ -283,9 +290,15 @@ function createSessionManager(opts) {
       session.effort = m.effort || null;
       if (m.loop) session.loop = m.loop;
       if (m.spawn) session.spawn = m.spawn;
+      if (m.assignment) session.assignment = m.assignment;
       if (m.handoff) session.handoff = m.handoff;
       if (m.debateState) session.debateState = m.debateState;
       if (m.debateSetupMode) session.debateSetupMode = true;
+      if (m.homeDebatePlanning) session.homeDebatePlanning = true;
+      if (m.homeDebatePhase) session.homeDebatePhase = m.homeDebatePhase;
+      if (m.homeDebateInitialTopic) session.homeDebateInitialTopic = m.homeDebateInitialTopic;
+      if (m.homeClayEntryRequestId) session.homeClayEntryRequestId = m.homeClayEntryRequestId;
+      if (m.homeClayEntryMode) session.homeClayEntryMode = m.homeClayEntryMode;
       if (m.ownerId) session.ownerId = m.ownerId;
       // Born-TUI session: PTY is gone after restart, but the cliSessionId
       // is still resumable via `claude --resume <id>`. We mark the mode
@@ -496,7 +509,9 @@ function createSessionManager(opts) {
       title: s.title || "New Session",
       active: isActive,
       isProcessing: s.isProcessing,
-      backgroundTaskCount: (s.activeBackgroundTasks || []).length,
+      // Sidebar badge: user work only. Ambient housekeeping is surfaced in the
+      // composer's expanded list, never as a count demanding attention.
+      backgroundTaskCount: backgroundTaskTiming.countUserTasks(s.activeBackgroundTasks),
       lastActivity: s.lastActivity || s.createdAt || 0,
       loop: loop,
       spawn: s.spawn || null,
@@ -865,6 +880,7 @@ function createSessionManager(opts) {
     if (sendEach) {
       var data = JSON.stringify(obj);
       sendEach(function (ws) {
+        if (session.homeDebatePlanning === true) return;
         if (ws._clayActiveSession === session.localId && ws.readyState === 1) {
           ws.send(data);
         }
@@ -881,8 +897,8 @@ function createSessionManager(opts) {
     if (!outgoingObj._ts) outgoingObj._ts = obj._ts;
     session.history.push(obj);
     appendToSessionFile(session, obj);
-    // Per-session out-of-band subscribers (used by home-chat to mirror
-    // Clay session events into a parallel UI without joining the project's
+    // Per-session out-of-band subscribers mirror mate session events into
+    // a parallel UI without joining the project's
     // ws clients set). Subscribers receive the same obj that goes to ws
     // clients; they are responsible for any transform + dispatch.
     if (session._subscribers && session._subscribers.size > 0) {
@@ -895,6 +911,7 @@ function createSessionManager(opts) {
       var data = JSON.stringify(outgoingObj);
       var ioData = null;
       sendEach(function (ws) {
+        if (session.homeDebatePlanning === true) return;
         if (ws._clayActiveSession === session.localId) {
           if (ws.readyState === 1) ws.send(data);
         } else if (session.isProcessing && !session._ioThrottle) {
@@ -993,11 +1010,12 @@ function createSessionManager(opts) {
     activeSessionId = mostRecent.localId;
   }
 
-  function searchSessions(query) {
+  function searchSessions(query, canInclude) {
     if (!query) return [];
     var q = query.toLowerCase();
     var results = [];
     sessions.forEach(function (session) {
+      if (typeof canInclude === "function" && !canInclude(session)) return;
       var titleMatch = (session.title || "New Session").toLowerCase().indexOf(q) !== -1;
       var contentMatch = false;
       for (var i = 0; i < session.history.length; i++) {

package/lib/tool-capsule-source.js

@@ -0,0 +1,142 @@
+var fs = require("fs");
+var path = require("path");
+var crypto = require("crypto");
+
+var METADATA_FILE = ".capsule-metadata.json";
+
+function metadataPath(root) {
+  return path.join(root, METADATA_FILE);
+}
+
+function readMetadata(root) {
+  try {
+    var parsed = JSON.parse(fs.readFileSync(metadataPath(root), "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  } catch (error) {
+    return {};
+  }
+}
+
+function writeFileAtomic(file, value) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  var temporary = file + ".tmp-" + process.pid + "-" + crypto.randomBytes(6).toString("hex");
+  try {
+    fs.writeFileSync(temporary, value, { encoding: "utf8", mode: 0o600 });
+    fs.renameSync(temporary, file);
+  } catch (error) {
+    try { fs.rmSync(temporary, { force: true }); } catch (cleanupError) {}
+    throw error;
+  }
+}
+
+function sanitizedMetadata(root, toolId) {
+  var record = readMetadata(root)[toolId];
+  return { mateEditingAllowed: !!(record && record.mateEditingAllowed === true) };
+}
+
+function setMateEditingAllowed(root, toolId, allowed) {
+  var all = readMetadata(root);
+  all[toolId] = { mateEditingAllowed: allowed === true };
+  writeFileAtomic(metadataPath(root), JSON.stringify(all, null, 2) + "\n");
+  return sanitizedMetadata(root, toolId);
+}
+
+function removeMetadata(root, toolId) {
+  var all = readMetadata(root);
+  if (!Object.prototype.hasOwnProperty.call(all, toolId)) return;
+  delete all[toolId];
+  writeFileAtomic(metadataPath(root), JSON.stringify(all, null, 2) + "\n");
+}
+
+function revisionForParts(manifestSource, uiSource, logicSource) {
+  var hash = crypto.createHash("sha256");
+  var parts = [manifestSource, uiSource, logicSource === null ? "" : logicSource];
+  for (var i = 0; i < parts.length; i++) {
+    var bytes = Buffer.from(parts[i], "utf8");
+    hash.update(String(bytes.length));
+    hash.update(":");
+    hash.update(bytes);
+  }
+  return hash.digest("hex");
+}
+
+function readSource(directory) {
+  var manifestSource = fs.readFileSync(path.join(directory, "manifest.json"), "utf8");
+  var uiSource = fs.readFileSync(path.join(directory, "ui.json"), "utf8");
+  var manifest = JSON.parse(manifestSource);
+  var uiTree = JSON.parse(uiSource);
+  var runtime = manifest.runtime || "worker";
+  var logicSource = runtime === "worker" ? fs.readFileSync(path.join(directory, "logic.js"), "utf8") : null;
+  return {
+    manifest: manifest,
+    uiTree: uiTree,
+    logicSource: logicSource,
+    logicAvailable: runtime === "worker",
+    revision: revisionForParts(manifestSource, uiSource, logicSource),
+  };
+}
+
+function replaceSourceFiles(directory, sources) {
+  var names = ["manifest.json", "ui.json", "logic.js"];
+  var transaction = crypto.randomBytes(6).toString("hex");
+  var staged = [];
+  var backups = [];
+  try {
+    for (var i = 0; i < names.length; i++) {
+      var target = path.join(directory, names[i]);
+      var stage = target + ".next-" + transaction;
+      staged.push({ target: target, stage: stage });
+      fs.writeFileSync(stage, sources[names[i]], "utf8");
+    }
+    for (var j = 0; j < staged.length; j++) {
+      var backup = staged[j].target + ".previous-" + transaction;
+      fs.renameSync(staged[j].target, backup);
+      backups.push({ target: staged[j].target, backup: backup });
+      fs.renameSync(staged[j].stage, staged[j].target);
+    }
+  } catch (error) {
+    for (var ri = backups.length - 1; ri >= 0; ri--) {
+      try {
+        fs.rmSync(backups[ri].target, { force: true });
+        fs.renameSync(backups[ri].backup, backups[ri].target);
+      } catch (rollbackError) {}
+    }
+    for (var si = 0; si < staged.length; si++) {
+      try { fs.rmSync(staged[si].stage, { force: true }); } catch (cleanupError) {}
+    }
+    throw error;
+  }
+  for (var k = 0; k < backups.length; k++) {
+    try { fs.rmSync(backups[k].backup, { force: true }); } catch (cleanupError) {}
+  }
+}
+
+function updateSource(directory, input, validators) {
+  var current = readSource(directory);
+  if (!current.logicAvailable) throw new Error("Server-managed Capsules cannot be edited.");
+  if (!input || typeof input !== "object") throw new Error("Complete Capsule source is required.");
+  if (typeof input.baseRevision !== "string" || input.baseRevision !== current.revision) {
+    throw new Error("Capsule source changed. Read the latest source and retry your update.");
+  }
+  validators.validateManifest(input.manifest, { allowServerRuntime: false });
+  validators.validateUiNode(input.uiTree);
+  if (input.manifest.id !== current.manifest.id) throw new Error("Capsule updates cannot change the Capsule ID.");
+  if ((input.manifest.runtime || "worker") !== "worker") throw new Error("Capsule updates cannot change the runtime.");
+  if (typeof input.logicSource !== "string" || !input.logicSource.trim()) throw new Error("Tool logic source is required.");
+  var manifest = Object.assign({}, input.manifest, { name: input.manifest.name.trim(), runtime: "worker" });
+  replaceSourceFiles(directory, {
+    "manifest.json": JSON.stringify(manifest, null, 2) + "\n",
+    "ui.json": JSON.stringify(input.uiTree, null, 2) + "\n",
+    "logic.js": input.logicSource,
+  });
+  return readSource(directory);
+}
+
+module.exports = {
+  METADATA_FILE: METADATA_FILE,
+  sanitizedMetadata: sanitizedMetadata,
+  setMateEditingAllowed: setMateEditingAllowed,
+  removeMetadata: removeMetadata,
+  readSource: readSource,
+  updateSource: updateSource,
+};