clay-server 4.0.0-beta.2 → 4.0.0-beta.21

package/lib/sessions.js

@@ -5,6 +5,9 @@ var utils = require("./utils");
 var users = require("./users");
 var { CODEX_DEFAULTS } = require("./codex-defaults");
 var hygiene = require("./session-hygiene");
+var backgroundTaskTiming = require("./background-task-timing");
+var sessionProvenance = require("./session-provenance");
+var sessionVisibility = require("./session-visibility");
 
 function createSessionManager(opts) {
   var cwd = opts.cwd;
@@ -164,7 +167,8 @@ function createSessionManager(opts) {
       if (session.dangerouslySkipPermissions) metaObj.dangerouslySkipPermissions = true;
       if (session.permissionMode) metaObj.permissionMode = session.permissionMode;
       if (session.permissionModeBeforeFullAccess) metaObj.permissionModeBeforeFullAccess = session.permissionModeBeforeFullAccess;
-      if (session.sessionVisibility) metaObj.sessionVisibility = session.sessionVisibility;
+      metaObj.sessionVisibility = sessionVisibility.normalize(session.sessionVisibility);
+      if (session.sessionVisibilityExplicit) metaObj.sessionVisibilityExplicit = true;
       if (session.bookmarked) metaObj.bookmarked = true;
       if (typeof session.favoriteOrder === "number") metaObj.favoriteOrder = session.favoriteOrder;
       if (session.lastRewindUuid) metaObj.lastRewindUuid = session.lastRewindUuid;
@@ -179,6 +183,9 @@ function createSessionManager(opts) {
       if (session.homeDebateInitialTopic) metaObj.homeDebateInitialTopic = session.homeDebateInitialTopic;
       if (session.homeClayEntryRequestId) metaObj.homeClayEntryRequestId = session.homeClayEntryRequestId;
       if (session.homeClayEntryMode) metaObj.homeClayEntryMode = session.homeClayEntryMode;
+      var provenanceMeta = sessionProvenance.metadata(session);
+      metaObj.sessionOriginId = provenanceMeta.sessionOriginId;
+      if (provenanceMeta.sessionProvenance) metaObj.sessionProvenance = provenanceMeta.sessionProvenance;
       var meta = JSON.stringify(metaObj);
       var lines = [meta];
       for (var i = 0; i < session.history.length; i++) {
@@ -299,6 +306,8 @@ function createSessionManager(opts) {
       if (m.homeClayEntryRequestId) session.homeClayEntryRequestId = m.homeClayEntryRequestId;
       if (m.homeClayEntryMode) session.homeClayEntryMode = m.homeClayEntryMode;
       if (m.ownerId) session.ownerId = m.ownerId;
+      session.sessionOriginId = m.sessionOriginId || null;
+      session._provenanceMigrationNeeded = sessionProvenance.restore(m, session);
       // Born-TUI session: PTY is gone after restart, but the cliSessionId
       // is still resumable via `claude --resume <id>`. We mark the mode
       // here so it shows up in the sidebar with the right icon; the
@@ -314,11 +323,26 @@ function createSessionManager(opts) {
       session.terminalId = null;
       session.runtimeMode = null;
       session.runtimeTerminalId = null;
-      session.sessionVisibility = m.sessionVisibility || "shared";
+      session.sessionVisibility = sessionVisibility.restore(m);
+      session.sessionVisibilityExplicit = m.sessionVisibilityExplicit === true;
       session.bookmarked = !!m.bookmarked;
       session.favoriteOrder = typeof m.favoriteOrder === "number" ? m.favoriteOrder : null;
       sessions.set(localId, session);
     }
+
+    // Versionless legacy records are safe top-level Drivers. Assigning an
+    // opaque origin ID is the only migration: no title, slug or active split
+    // state is used to invent historical parentage.
+    sessions.forEach(function (session) {
+      if (!session.cliSessionId || !session._provenanceMigrationNeeded) return;
+      var activityTime = session.lastActivity;
+      saveSessionFile(session);
+      try {
+        var preservedTime = new Date(activityTime);
+        fs.utimesSync(sessionFilePath(session.cliSessionId), preservedTime, preservedTime);
+      } catch (e) {}
+      delete session._provenanceMigrationNeeded;
+    });
   }
 
   // Adopt orphaned CLI sessions from ~/.claude/projects/<encoded-cwd>/ as
@@ -426,7 +450,7 @@ function createSessionManager(opts) {
         terminalId: null,
         runtimeMode: null,
         runtimeTerminalId: null,
-        sessionVisibility: "shared",
+        sessionVisibility: "private",
         bookmarked: false,
         favoriteOrder: null,
       };
@@ -508,12 +532,14 @@ function createSessionManager(opts) {
       title: s.title || "New Session",
       active: isActive,
       isProcessing: s.isProcessing,
-      backgroundTaskCount: (s.activeBackgroundTasks || []).length,
+      // Sidebar badge: user work only. Ambient housekeeping is surfaced in the
+      // composer's expanded list, never as a count demanding attention.
+      backgroundTaskCount: backgroundTaskTiming.countUserTasks(s.activeBackgroundTasks),
       lastActivity: s.lastActivity || s.createdAt || 0,
       loop: loop,
       spawn: s.spawn || null,
       ownerId: s.ownerId || null,
-      sessionVisibility: s.sessionVisibility || "shared",
+      sessionVisibility: sessionVisibility.normalize(s.sessionVisibility),
       bookmarked: !!s.bookmarked,
       favoriteOrder: typeof s.favoriteOrder === "number" ? s.favoriteOrder : null,
       unread: unreadMap[s.localId] || 0,
@@ -529,6 +555,19 @@ function createSessionManager(opts) {
     };
   }
 
+  function mapSessionsForClient(source, clientActiveId, wsUnread) {
+    var hierarchy = sessionProvenance.hierarchyFor(source);
+    return source.map(function (session) {
+      var mapped = mapSessionForClient(session, clientActiveId, wsUnread);
+      var node = hierarchy[session.localId];
+      mapped.sessionRole = node.role;
+      mapped.parentSessionId = node.parentSessionId;
+      mapped.parentAvailable = node.parentAvailable;
+      mapped.workerGeneration = node.generation;
+      return mapped;
+    });
+  }
+
   function getVisibleSessions() {
     var multiUser = users.isMultiUser();
     return [...sessions.values()].filter(function (s) {
@@ -551,14 +590,14 @@ function createSessionManager(opts) {
         if (ws.readyState === 1) {
           ws.send(JSON.stringify({
             type: "session_list",
-            sessions: filtered.map(function (s) { return mapSessionForClient(s, clientActiveId, wsUnread); }),
+            sessions: mapSessionsForClient(filtered, clientActiveId, wsUnread),
           }));
         }
       });
     } else {
       send({
         type: "session_list",
-        sessions: allVisible.map(function (s) { return mapSessionForClient(s); }),
+        sessions: mapSessionsForClient(allVisible),
       });
     }
   }
@@ -584,7 +623,8 @@ function createSessionManager(opts) {
       history: [],
       messageUUIDs: [],
       ownerId: (sessionOpts && sessionOpts.ownerId) || null,
-      sessionVisibility: (sessionOpts && sessionOpts.sessionVisibility) || "shared",
+      sessionVisibility: sessionVisibility.normalize(sessionOpts && sessionOpts.sessionVisibility),
+      sessionVisibilityExplicit: !!(sessionOpts && sessionOpts.sessionVisibility === "shared"),
       bookmarked: false,
       favoriteOrder: null,
       vendor: (sessionOpts && sessionOpts.vendor) || null,
@@ -595,7 +635,9 @@ function createSessionManager(opts) {
       permissionMode: (sessionOpts && sessionOpts.permissionMode) || null,
       permissionModeBeforeFullAccess: null,
       terminalId: null,
+      sessionOriginId: null,
     };
+    sessionProvenance.ensureOrigin(session);
     sessions.set(localId, session);
     switchSession(localId, targetWs);
     return session;
@@ -623,7 +665,8 @@ function createSessionManager(opts) {
       history: [],
       messageUUIDs: [],
       ownerId: (sessionOpts && sessionOpts.ownerId) || null,
-      sessionVisibility: (sessionOpts && sessionOpts.sessionVisibility) || "shared",
+      sessionVisibility: sessionVisibility.normalize(sessionOpts && sessionOpts.sessionVisibility),
+      sessionVisibilityExplicit: !!(sessionOpts && sessionOpts.sessionVisibility === "shared"),
       bookmarked: false,
       favoriteOrder: null,
       vendor: (sessionOpts && sessionOpts.vendor) || null,
@@ -634,7 +677,9 @@ function createSessionManager(opts) {
       permissionMode: (sessionOpts && sessionOpts.permissionMode) || null,
       permissionModeBeforeFullAccess: null,
       terminalId: null,
+      sessionOriginId: null,
     };
+    sessionProvenance.ensureOrigin(session);
     sessions.set(localId, session);
     return session;
   }
@@ -876,7 +921,8 @@ function createSessionManager(opts) {
     // Send to active clients without recording to history/disk (ephemeral data)
     if (sendEach) {
       var data = JSON.stringify(obj);
-      sendEach(function (ws) {
+      sendEach(function (ws, filterFn) {
+        if (filterFn && !filterFn(session)) return;
         if (session.homeDebatePlanning === true) return;
         if (ws._clayActiveSession === session.localId && ws.readyState === 1) {
           ws.send(data);
@@ -907,7 +953,8 @@ function createSessionManager(opts) {
       // Multi-user: send to clients whose active session matches this one
       var data = JSON.stringify(outgoingObj);
       var ioData = null;
-      sendEach(function (ws) {
+      sendEach(function (ws, filterFn) {
+        if (filterFn && !filterFn(session)) return;
         if (session.homeDebatePlanning === true) return;
         if (ws._clayActiveSession === session.localId) {
           if (ws.readyState === 1) ws.send(data);
@@ -1245,11 +1292,14 @@ function createSessionManager(opts) {
     searchSessionContent: searchSessionContent,
     setResolveLoopInfo: setResolveLoopInfo,
     mapSessionForClient: mapSessionForClient,
+    mapSessionsForClient: mapSessionsForClient,
     migrateSessionTitles: migrateSessionTitles,
     setSessionVisibility: function (localId, visibility) {
       var session = sessions.get(localId);
       if (!session) return { error: "Session not found" };
+      if (visibility !== "shared" && visibility !== "private") return { error: "Invalid session visibility" };
       session.sessionVisibility = visibility;
+      session.sessionVisibilityExplicit = true;
       saveSessionFile(session);
       broadcastSessionList();
       return { ok: true };

package/lib/tools-registry.js

@@ -3,9 +3,10 @@ var path = require("path");
 var config = require("./config");
 var toolUiSpec = require("./tool-ui-spec");
 var toolCapsuleSource = require("./tool-capsule-source");
+var capsuleFloor = require("./capsule-display-floor");
 
 var CAPSULES_ROOT = path.join(__dirname, "capsules");
-var SEED_MARKER = ".capsules-v7";
+var SEED_MARKER = ".capsules-v10";
 var REMOVED_BUILTIN_IDS = ["board", "translator", "scratchpad"];
 var UI_NODE_TYPES = toolUiSpec.UI_NODE_TYPES;
 var DISCOVERY_FIELD_MAX_LENGTH = 240;
@@ -98,6 +99,11 @@ function validateManifest(manifest, opts) {
   if (manifest.skills !== undefined && typeof manifest.skills !== "string") {
     throw new Error("Tool skills must be markdown text.");
   }
+  // The floor gate always validates the Display itself, so a manifest may
+  // never carry a claim about it.
+  if (manifest.displayFloor !== undefined) {
+    throw new Error("Tool displayFloor cannot be authored; Clay validates the Display itself.");
+  }
   validateDiscoveryField(manifest, "description", "description");
   validateDiscoveryField(manifest, "useWhen", "useWhen");
   if (manifest.permissions !== undefined) {
@@ -129,33 +135,90 @@ function toolDirectory(ctx, id) {
   return path.join(resolveToolsRoot(ctx), id);
 }
 
+function hasAnySeedMarker(root) {
+  try {
+    return fs.readdirSync(root).some(function (name) { return /^\.capsules-v\d+$/.test(name); });
+  } catch (e) {
+    return false;
+  }
+}
+
 function seedBuiltInCapsules(ctx) {
   var root = resolveToolsRoot(ctx);
   var marker = path.join(root, SEED_MARKER);
   if (fs.existsSync(marker)) return;
+  // The removed-built-in cleanup is a one-time migration. Any earlier marker
+  // means it already ran, so a later marker bump must not delete a Capsule the
+  // user has since authored under one of those IDs.
+  var migrated = hasAnySeedMarker(root);
   fs.mkdirSync(root, { recursive: true });
-  for (var ri = 0; ri < REMOVED_BUILTIN_IDS.length; ri++) {
+  for (var ri = 0; !migrated && ri < REMOVED_BUILTIN_IDS.length; ri++) {
     fs.rmSync(path.join(root, REMOVED_BUILTIN_IDS[ri]), { recursive: true, force: true });
   }
-  // Clay ships no built-in Capsules any more, so lib/capsules/ is absent from a
-  // fresh checkout and from the npm tarball (neither git nor npm carries an
-  // empty directory). Seeding still owns the removed-built-in migration above
-  // and the marker below, so an absent root means "nothing to copy" rather than
-  // a failure. Anything other than a missing root is still a real error.
+  // lib/capsules/ holds the shipped Capsules, currently the Pig validation
+  // Capsule. It may still be absent from an older checkout or tarball, and
+  // seeding also owns the removed-built-in migration above and the marker
+  // below, so a missing root means "nothing to copy" rather than a failure.
+  // Anything other than a missing root is still a real error.
   var entries = [];
   try {
     entries = fs.readdirSync(CAPSULES_ROOT, { withFileTypes: true });
   } catch (e) {
     if (e.code !== "ENOENT") throw e;
   }
+  // A previously seeded server-runtime Capsule that is no longer shipped is
+  // always a stale copy: the server runtime is reserved for lib/capsules/, so
+  // no user-authored Capsule can ever match this test. Remove it, or it would
+  // linger as a dead entry with no Logic behind it.
+  var shippedIds = Object.create(null);
+  for (var si = 0; si < entries.length; si++) {
+    if (entries[si].isDirectory()) shippedIds[entries[si].name] = true;
+  }
+  var rootEntries = [];
+  try {
+    rootEntries = fs.readdirSync(root, { withFileTypes: true });
+  } catch (e) {
+    if (e.code !== "ENOENT") throw e;
+  }
+  for (var re = 0; re < rootEntries.length; re++) {
+    if (!rootEntries[re].isDirectory() || shippedIds[rootEntries[re].name]) continue;
+    try {
+      var staleManifest = JSON.parse(fs.readFileSync(path.join(root, rootEntries[re].name, "manifest.json"), "utf8"));
+      if (staleManifest && staleManifest.runtime === "server") {
+        fs.rmSync(path.join(root, rootEntries[re].name), { recursive: true, force: true });
+      }
+    } catch (e) { /* not a capsule directory; leave it alone */ }
+  }
+
   var seeded = [];
+  var SOURCE_FILES = ["manifest.json", "ui.json", "logic.js", "display.js", "skills.md"];
   for (var i = 0; i < entries.length; i++) {
     if (!entries[i].isDirectory()) continue;
     var destination = path.join(root, entries[i].name);
     if (!fs.existsSync(destination)) {
       fs.cpSync(path.join(CAPSULES_ROOT, entries[i].name), destination, { recursive: true });
       seeded.push(entries[i].name);
+      continue;
+    }
+    var shippedManifestPath = path.join(CAPSULES_ROOT, entries[i].name, "manifest.json");
+    var shippedRuntime = "worker";
+    try {
+      shippedRuntime = JSON.parse(fs.readFileSync(shippedManifestPath, "utf8")).runtime || "worker";
+    } catch (e) { /* fall through to the conservative worker path */ }
+    if (shippedRuntime === "server") {
+      // Server-runtime Capsules are Clay-owned: their source is not editable
+      // by users or Mates, so a marker bump syncs the shipped source files
+      // exactly, dropping ones the shipped set no longer carries. The
+      // Capsule's datastore and anything else in the directory is preserved.
+      for (var sf = 0; sf < SOURCE_FILES.length; sf++) {
+        var shippedFile = path.join(CAPSULES_ROOT, entries[i].name, SOURCE_FILES[sf]);
+        var localFile = path.join(destination, SOURCE_FILES[sf]);
+        if (fs.existsSync(shippedFile)) fs.copyFileSync(shippedFile, localFile);
+        else fs.rmSync(localFile, { force: true });
+      }
     } else {
+      // Worker Capsules may have been edited by the user, so only files the
+      // local copy is missing entirely are filled in.
       var sourceFiles = fs.readdirSync(path.join(CAPSULES_ROOT, entries[i].name));
       for (var fi = 0; fi < sourceFiles.length; fi++) {
         var sourceFile = path.join(CAPSULES_ROOT, entries[i].name, sourceFiles[fi]);
@@ -185,6 +248,11 @@ function getTool(ctx, id) {
     manifest: Object.assign({}, manifest, { runtime: runtime }),
     logicSource: runtime === "worker" ? fs.readFileSync(logicPath, "utf8") : null,
     uiTree: uiTree,
+    // Rich Display is opted into by shipping a display.js next to the floor,
+    // the same way logic.js opts into the worker runtime. Only the flag
+    // travels; the source is served solely by the isolated frame origin, so
+    // it can never leak into a manifest, a prompt, or a Mate surface.
+    hasRichDisplay: fs.existsSync(path.join(directory, "display.js")),
     metadata: toolCapsuleSource.sanitizedMetadata(resolveToolsRoot(ctx), id),
   };
 }
@@ -199,8 +267,14 @@ function listTools(ctx) {
     if (entries[i].name.charAt(0) === ".") continue;
     try {
       var tool = getTool(ctx, entries[i].name);
-      if (tool) manifests.push(tool.manifest);
-      else manifests.push({ id: entries[i].name, error: "Capsule requires manifest.json and ui.json." });
+      if (tool) {
+        // The flat manifest carries its own Display alongside it, so a
+        // Mate-facing gate can validate the real tree without a second read
+        // and without trusting a claim. Non-enumerable, so the tree never
+        // leaks into a projection, a prompt, or a serialized message.
+        Object.defineProperty(tool.manifest, "uiTree", { value: tool.uiTree, enumerable: false, configurable: true });
+        manifests.push(tool.manifest);
+      } else manifests.push({ id: entries[i].name, error: "Capsule requires manifest.json and ui.json." });
     } catch (e) {
       manifests.push({ id: entries[i].name, error: e.message });
     }
@@ -216,6 +290,7 @@ function installTool(ctx, input) {
     throw new Error("Tool logic source is required.");
   }
   validateUiTreeForManifest(input.uiTree, input.manifest);
+  capsuleFloor.assertFloor(input.uiTree, input.manifest);
   var manifest = Object.assign({}, input.manifest, { name: input.manifest.name.trim(), runtime: "worker" });
   var directory = toolDirectory(ctx, manifest.id);
   if (fs.existsSync(directory)) throw new Error("A Capsule with this ID already exists. Read its source and use the update tool instead.");
@@ -253,7 +328,10 @@ function updateTool(ctx, id, input) {
   if (!tool) throw new Error("Tool not found.");
   toolCapsuleSource.updateSource(toolDirectory(ctx, id), input, {
     validateManifest: validateManifest,
-    validateUiNode: function (uiTree) { return validateUiTreeForManifest(uiTree, input.manifest); },
+    validateUiNode: function (uiTree) {
+      validateUiTreeForManifest(uiTree, input.manifest);
+      return capsuleFloor.assertFloor(uiTree, input.manifest);
+    },
   });
   return getTool(ctx, id);
 }
@@ -268,6 +346,7 @@ function removeTool(ctx, id) {
 
 module.exports = {
   CAPSULES_ROOT: CAPSULES_ROOT,
+  SEED_MARKER: SEED_MARKER,
   UI_NODE_TYPES: UI_NODE_TYPES,
   resolveToolsRoot: resolveToolsRoot,
   validateToolId: validateToolId,