clay-server 4.0.0-beta.8 → 4.0.0

package/lib/project-file-watch.js

@@ -5,7 +5,7 @@ var path = require("path");
  * Attach file/directory watcher engine to a project context.
  *
  * ctx fields:
- *   cwd, send, sendTo, safePath, BINARY_EXTS, FS_MAX_SIZE, IGNORED_DIRS
+ *   cwd, send, sendTo, safePath, BINARY_EXTS, FS_MAX_SIZE, IGNORED_DIRS, requestAccess, fsAsUser
  */
 function attachFileWatch(ctx) {
   var cwd = ctx.cwd;
@@ -15,6 +15,19 @@ function attachFileWatch(ctx) {
   var BINARY_EXTS = ctx.BINARY_EXTS;
   var FS_MAX_SIZE = ctx.FS_MAX_SIZE;
   var IGNORED_DIRS = ctx.IGNORED_DIRS;
+  var access = ctx.requestAccess;
+
+  function identityFor(client) {
+    if (!access) return null;
+    if (!access.canUseFiles(client)) throw new Error("File browser access is not permitted");
+    return access.osIdentity(client);
+  }
+
+  function checkedPath(relPath) {
+    var resolved = safePath(cwd, relPath);
+    if (!resolved) throw new Error("Access denied");
+    return resolved;
+  }
 
   // --- File watcher ---
   // One open file per websocket client. A project-wide singleton watcher made
@@ -47,18 +60,21 @@ function attachFileWatch(ctx) {
     }
   }
 
-  function readFileSnapshot(absPath) {
-    var stat = fs.statSync(absPath);
+  function readFileSnapshot(client, relPath) {
+    var identity = identityFor(client);
+    var absPath = checkedPath(relPath);
+    var stat = identity ? ctx.fsAsUser("stat", { file: absPath }, identity) : fs.statSync(absPath);
     var ext = path.extname(absPath).toLowerCase();
     if (stat.size > FS_MAX_SIZE || BINARY_EXTS.has(ext)) return null;
+    if (identity) return ctx.fsAsUser("read", { file: absPath, readContent: true }, identity);
     return { content: fs.readFileSync(absPath, "utf8"), size: stat.size };
   }
 
-  function publishFileChanged(key, client, relPath, absPath) {
+  function publishFileChanged(key, client, relPath) {
     var latest = fileWatchers.get(key);
     if (!latest || latest.relPath !== relPath) return;
     try {
-      var snapshot = readFileSnapshot(absPath);
+      var snapshot = readFileSnapshot(client, relPath);
       if (!snapshot) return;
       if (latest.hasSnapshot && latest.content === snapshot.content && latest.size === snapshot.size) return;
       latest.hasSnapshot = true;
@@ -97,7 +113,9 @@ function attachFileWatch(ctx) {
     var parentPath = path.dirname(absPath);
     var baseName = path.basename(absPath);
     var initialSnapshot = null;
-    try { initialSnapshot = readFileSnapshot(absPath); } catch (e) {}
+    try { initialSnapshot = readFileSnapshot(client, relPath); } catch (e) {
+      return Promise.resolve(false);
+    }
     try {
       var watcher = fs.watch(parentPath, function (eventType, filename) {
         if (filename && String(filename) !== baseName) return;
@@ -105,7 +123,7 @@ function attachFileWatch(ctx) {
         if (!active || active.relPath !== relPath) return;
         clearTimeout(active.debounce);
         active.debounce = setTimeout(function () {
-          publishFileChanged(key, client, relPath, absPath);
+          publishFileChanged(key, client, relPath);
         }, 200);
       });
       var resolveReady = null;
@@ -127,7 +145,7 @@ function attachFileWatch(ctx) {
       // drop them under load. Periodic content reconciliation is the source of
       // truth and also survives atomic replacements with identical metadata.
       entry.pollTimer = setInterval(function () {
-        publishFileChanged(key, client, relPath, absPath);
+        publishFileChanged(key, client, relPath);
       }, 1000);
       // fs.watch has no readiness event. Reconcile once on the next event-loop
       // turn so a change between the initial read and native watcher activation
@@ -135,7 +153,7 @@ function attachFileWatch(ctx) {
       entry.reconcile = setImmediate(function () {
         var active = fileWatchers.get(key);
         if (active) active.reconcile = null;
-        publishFileChanged(key, client, relPath, absPath);
+        publishFileChanged(key, client, relPath);
         if (fileWatchers.get(key) === entry) settleFileWatchReady(entry, true);
       });
       watcher.on("error", function () { closeFileWatch(key); });
@@ -155,55 +173,65 @@ function attachFileWatch(ctx) {
     for (var i = 0; i < keys.length; i++) closeFileWatch(keys[i]);
   }
 
-  // --- Directory watcher ---
-  var dirWatchers = {};  // relPath -> { watcher, debounce }
+  // Directory subscriptions are private to the requesting socket.
+  var dirWatchers = new Map();
 
-  function startDirWatch(relPath) {
-    if (dirWatchers[relPath]) return;
-    var absPath = safePath(cwd, relPath);
-    if (!absPath) return;
+  function readDirectory(client, relPath) {
+    var identity = identityFor(client);
+    var absPath = checkedPath(relPath);
+    var items = identity ? ctx.fsAsUser("list", { dir: absPath }, identity) :
+      fs.readdirSync(absPath, { withFileTypes: true }).map(function (item) {
+        return { name: item.name, isDir: item.isDirectory() };
+      });
+    return items.filter(function (item) {
+      return !item.isDir || !IGNORED_DIRS.has(item.name);
+    }).map(function (item) {
+      return { name: item.name, type: item.isDir ? "dir" : "file",
+        path: path.relative(cwd, path.join(absPath, item.name)).split(path.sep).join("/") };
+    });
+  }
+
+  function startDirWatch(client, relPath) {
+    var subscriptions = dirWatchers.get(client);
+    if (!subscriptions) { subscriptions = new Map(); dirWatchers.set(client, subscriptions); }
+    if (subscriptions.has(relPath)) return;
     try {
-      var debounce = null;
-      var watcher = fs.watch(absPath, function () {
-        clearTimeout(debounce);
-        debounce = setTimeout(function () {
-          // Re-read directory and broadcast to all clients
+      readDirectory(client, relPath);
+      var entry = { watcher: null, debounce: null };
+      entry.watcher = fs.watch(checkedPath(relPath), function () {
+        clearTimeout(entry.debounce);
+        entry.debounce = setTimeout(function () {
           try {
-            var items = fs.readdirSync(absPath, { withFileTypes: true });
-            var entries = [];
-            for (var i = 0; i < items.length; i++) {
-              if (items[i].isDirectory() && IGNORED_DIRS.has(items[i].name)) continue;
-              entries.push({
-                name: items[i].name,
-                type: items[i].isDirectory() ? "dir" : "file",
-                path: path.relative(cwd, path.join(absPath, items[i].name)).split(path.sep).join("/"),
-              });
-            }
-            send({ type: "fs_dir_changed", path: relPath, entries: entries });
-          } catch (e) {
-            stopDirWatch(relPath);
-          }
+            var entries = readDirectory(client, relPath);
+            sendTo(client, { type: "fs_dir_changed", path: relPath, entries: entries });
+          } catch (e) { stopDirWatch(client, relPath); }
         }, 300);
       });
-      watcher.on("error", function () { stopDirWatch(relPath); });
-      dirWatchers[relPath] = { watcher: watcher, debounce: debounce };
-    } catch (e) {}
+      entry.watcher.on("error", function () { stopDirWatch(client, relPath); });
+      subscriptions.set(relPath, entry);
+    } catch (e) {
+      if (!subscriptions.size) dirWatchers.delete(client);
+    }
   }
 
-  function stopDirWatch(relPath) {
-    var entry = dirWatchers[relPath];
-    if (entry) {
-      clearTimeout(entry.debounce);
-      try { entry.watcher.close(); } catch (e) {}
-      delete dirWatchers[relPath];
-    }
+  function stopDirWatch(client, relPath) {
+    var subscriptions = dirWatchers.get(client);
+    var entry = subscriptions && subscriptions.get(relPath);
+    if (!entry) return;
+    clearTimeout(entry.debounce);
+    try { entry.watcher.close(); } catch (e) {}
+    subscriptions.delete(relPath);
+    if (!subscriptions.size) dirWatchers.delete(client);
   }
 
-  function stopAllDirWatches() {
-    var paths = Object.keys(dirWatchers);
-    for (var i = 0; i < paths.length; i++) {
-      stopDirWatch(paths[i]);
-    }
+  function stopAllDirWatches(client) {
+    var clients = arguments.length ? [client] : Array.from(dirWatchers.keys());
+    clients.forEach(function (key) {
+      var subscriptions = dirWatchers.get(key);
+      if (subscriptions) Array.from(subscriptions.keys()).forEach(function (relPath) {
+        stopDirWatch(key, relPath);
+      });
+    });
   }
 
   return {

package/lib/project-filesystem.js

@@ -1,6 +1,7 @@
 var fs = require("fs");
 var path = require("path");
-var execFileSync = require("child_process").execFileSync;
+var attachRequestAccess = require("./project-request-access").attachRequestAccess;
+var attachFileHistory = require("./project-file-history").attachFileHistory;
 
 /**
  * Attach filesystem-related message handlers to a project context.
@@ -20,17 +21,12 @@ var execFileSync = require("child_process").execFileSync;
 function attachFilesystem(ctx) {
   var cwd = ctx.cwd;
   var slug = ctx.slug;
-  var osUsers = ctx.osUsers;
-  var sm = ctx.sm;
-  var send = ctx.send;
   var sendTo = ctx.sendTo;
   var safePath = ctx.safePath;
   var safeAbsPath = ctx.safeAbsPath;
-  var getOsUserInfoForWs = ctx.getOsUserInfoForWs;
   var startFileWatch = ctx.startFileWatch;
   var stopFileWatch = ctx.stopFileWatch;
   var startDirWatch = ctx.startDirWatch;
-  var usersModule = ctx.usersModule;
   var fsAsUser = ctx.fsAsUser;
   var validateEnvString = ctx.validateEnvString;
   var onEnvironmentChanged = ctx.onEnvironmentChanged || function () {};
@@ -40,15 +36,19 @@ function attachFilesystem(ctx) {
   var IMAGE_EXTS = ctx.IMAGE_EXTS;
   var FS_MAX_SIZE = ctx.FS_MAX_SIZE;
 
+  var access = ctx.requestAccess || attachRequestAccess(ctx);
+  var fileHistory = attachFileHistory(ctx, access);
+
   function handleFilesystemMessage(ws, msg) {
-    // --- File browser permission gate ---
-    if (msg.type === "fs_list" || msg.type === "fs_read" || msg.type === "fs_write" || msg.type === "fs_delete" || msg.type === "fs_rename" || msg.type === "fs_mkdir" || msg.type === "fs_upload" || msg.type === "fs_search") {
-      if (ws._clayUser) {
-        var fbPerms = usersModule.getEffectivePermissions(ws._clayUser, osUsers);
-        if (!fbPerms.fileBrowser) {
-          sendTo(ws, { type: msg.type + "_result", error: "File browser access is not permitted" });
-          return true;
-        }
+    // Unsubscription must remain available after permission revocation.
+    if (/^fs_/.test(msg.type) && msg.type !== "fs_unwatch") {
+      if (!access.canUseFiles(ws)) {
+        sendTo(ws, { type: msg.type + "_result", error: "File browser access is not permitted" });
+        return true;
+      }
+      try { access.osIdentity(ws); } catch (e) {
+        sendTo(ws, { type: msg.type + "_result", error: e.message });
+        return true;
       }
     }
 
@@ -56,7 +56,7 @@ function attachFilesystem(ctx) {
     if (msg.type === "fs_list") {
       var fsDir = safePath(cwd, msg.path || ".");
       // In OS user mode, fall back to absolute path resolution (ACL enforces access)
-      if (!fsDir && getOsUserInfoForWs(ws)) {
+      if (!fsDir && access.osIdentity(ws)) {
         fsDir = safeAbsPath(msg.path);
       }
       if (!fsDir) {
@@ -64,7 +64,7 @@ function attachFilesystem(ctx) {
         return true;
       }
       try {
-        var fsListUserInfo = getOsUserInfoForWs(ws);
+        var fsListUserInfo = access.osIdentity(ws);
         var entries = [];
         if (fsListUserInfo) {
           // Run as target OS user to respect Linux file permissions
@@ -92,7 +92,7 @@ function attachFilesystem(ctx) {
         }
         sendTo(ws, { type: "fs_list_result", path: msg.path || ".", entries: entries });
         // Auto-watch the directory for changes
-        startDirWatch(msg.path || ".");
+        startDirWatch(ws, msg.path || ".");
       } catch (e) {
         sendTo(ws, { type: "fs_list_result", path: msg.path, entries: [], error: e.message });
       }
@@ -109,7 +109,7 @@ function attachFilesystem(ctx) {
       try {
         var searchResults = [];
         var MAX_RESULTS = 50;
-        var searchUserInfo = getOsUserInfoForWs(ws);
+        var searchUserInfo = access.osIdentity(ws);
 
         function walkDir(dir, relPrefix) {
           if (searchResults.length >= MAX_RESULTS) return;
@@ -148,7 +148,7 @@ function attachFilesystem(ctx) {
     // --- fs_read ---
     if (msg.type === "fs_read") {
       var fsFile = safePath(cwd, msg.path);
-      if (!fsFile && getOsUserInfoForWs(ws)) {
+      if (!fsFile && access.osIdentity(ws)) {
         fsFile = safeAbsPath(msg.path);
       }
       if (!fsFile) {
@@ -156,7 +156,7 @@ function attachFilesystem(ctx) {
         return true;
       }
       try {
-        var fsReadUserInfo = getOsUserInfoForWs(ws);
+        var fsReadUserInfo = access.osIdentity(ws);
         var ext = path.extname(fsFile).toLowerCase();
         if (fsReadUserInfo) {
           // Run stat and read as target OS user
@@ -197,7 +197,7 @@ function attachFilesystem(ctx) {
     // --- fs_write ---
     if (msg.type === "fs_write") {
       var fsWriteFile = safePath(cwd, msg.path);
-      if (!fsWriteFile && getOsUserInfoForWs(ws)) {
+      if (!fsWriteFile && access.osIdentity(ws)) {
         fsWriteFile = safeAbsPath(msg.path);
       }
       if (!fsWriteFile) {
@@ -205,7 +205,7 @@ function attachFilesystem(ctx) {
         return true;
       }
       try {
-        var fsWriteUserInfo = getOsUserInfoForWs(ws);
+        var fsWriteUserInfo = access.osIdentity(ws);
         if (fsWriteUserInfo) {
           fsAsUser("write", { file: fsWriteFile, content: msg.content || "" }, fsWriteUserInfo);
         } else {
@@ -223,12 +223,12 @@ function attachFilesystem(ctx) {
         msg.type === "read_global_claude_md" || msg.type === "write_global_claude_md" ||
         msg.type === "get_shared_env" || msg.type === "set_shared_env" ||
         msg.type === "transfer_project_owner") {
-      if (ws._clayUser) {
-        var psPerms = usersModule.getEffectivePermissions(ws._clayUser, osUsers);
-        if (!psPerms.projectSettings) {
-          sendTo(ws, { type: "error", text: "Project settings access is not permitted" });
-          return true;
-        }
+      var globalSetting = /^(read_global_claude_md|write_global_claude_md|get_shared_env|set_shared_env)$/.test(msg.type);
+      var targetSlug = msg.slug || slug;
+      if (!access.hasPermission(ws, "projectSettings") ||
+          (globalSetting ? !access.isAdmin(ws) : !access.canAccessProject(ws, targetSlug))) {
+        sendTo(ws, { type: "error", text: "Project settings access is not permitted" });
+        return true;
       }
     }
 
@@ -236,7 +236,7 @@ function attachFilesystem(ctx) {
     if (msg.type === "get_project_env") {
       var envrc = "";
       if (typeof opts.onGetProjectEnv === "function") {
-        var envResult = opts.onGetProjectEnv(msg.slug);
+        var envResult = opts.onGetProjectEnv(targetSlug);
         envrc = envResult.envrc || "";
       }
       sendTo(ws, { type: "project_env_result", slug: msg.slug, envrc: envrc });
@@ -250,7 +250,7 @@ function attachFilesystem(ctx) {
           sendTo(ws, { type: "set_project_env_result", ok: false, slug: msg.slug, error: envError });
           return true;
         }
-        var setResult = opts.onSetProjectEnv(msg.slug, msg.envrc || "");
+        var setResult = opts.onSetProjectEnv(targetSlug, msg.envrc || "");
         if (setResult.ok) onEnvironmentChanged();
         sendTo(ws, { type: "set_project_env_result", ok: setResult.ok, slug: msg.slug, error: setResult.error, timing: setResult.ok ? "Applies to newly created coding-agent processes. Active processes keep their current environment." : undefined });
       } else {
@@ -324,196 +324,7 @@ function attachFilesystem(ctx) {
       return true;
     }
 
-    // --- File edit history ---
-    if (msg.type === "fs_file_history") {
-      var histPath = msg.path;
-      if (!histPath) {
-        sendTo(ws, { type: "fs_file_history_result", path: histPath, entries: [] });
-        return true;
-      }
-      var absHistPath = path.resolve(cwd, histPath);
-      var entries = [];
-
-      // Collect session edits
-      sm.sessions.forEach(function (session) {
-        var sessionLocalId = session.localId;
-        var sessionTitle = session.title || "Untitled";
-        var histLen = session.history.length || 1;
-
-        for (var hi = 0; hi < session.history.length; hi++) {
-          var entry = session.history[hi];
-          if (entry.type !== "tool_executing") continue;
-          if (entry.name !== "Edit" && entry.name !== "Write") continue;
-          if (!entry.input || !entry.input.file_path) continue;
-          if (entry.input.file_path !== absHistPath) continue;
-
-          // Find parent assistant UUID + message snippet by scanning backwards
-          var assistantUuid = null;
-          var uuidIndex = -1;
-          for (var hj = hi - 1; hj >= 0; hj--) {
-            if (session.history[hj].type === "message_uuid" && session.history[hj].messageType === "assistant") {
-              assistantUuid = session.history[hj].uuid;
-              uuidIndex = hj;
-              break;
-            }
-          }
-
-          // Find user prompt by scanning backwards from the assistant uuid
-          var messageSnippet = "";
-          var searchFrom = uuidIndex >= 0 ? uuidIndex : hi;
-          for (var hk = searchFrom - 1; hk >= 0; hk--) {
-            if (session.history[hk].type === "user_message" && session.history[hk].text) {
-              messageSnippet = session.history[hk].text.trim().substring(0, 100);
-              break;
-            }
-          }
-
-          // Collect Claude's explanation: scan backwards from tool_executing
-          // to find the nearest delta text block (skipping tool_start).
-          // If no delta found immediately before this tool, scan past
-          // intervening tool blocks to find the last delta text within
-          // the same assistant turn.
-          var assistantSnippet = "";
-          var deltaChunks = [];
-          for (var hd = hi - 1; hd >= 0; hd--) {
-            var hEntry = session.history[hd];
-            if (hEntry.type === "tool_start") continue;
-            if (hEntry.type === "delta" && hEntry.text) {
-              deltaChunks.unshift(hEntry.text);
-            } else {
-              break;
-            }
-          }
-          if (deltaChunks.length === 0) {
-            // No delta immediately before; scan past tool blocks
-            // to find the nearest preceding delta in the same turn
-            for (var hd2 = hi - 1; hd2 >= 0; hd2--) {
-              var hEntry2 = session.history[hd2];
-              if (hEntry2.type === "tool_start" || hEntry2.type === "tool_executing" || hEntry2.type === "tool_result") continue;
-              if (hEntry2.type === "delta" && hEntry2.text) {
-                // Found a delta before an earlier tool in the same turn.
-                // Collect this contiguous block of deltas.
-                for (var hd3 = hd2; hd3 >= 0; hd3--) {
-                  var hEntry3 = session.history[hd3];
-                  if (hEntry3.type === "tool_start") continue;
-                  if (hEntry3.type === "delta" && hEntry3.text) {
-                    deltaChunks.unshift(hEntry3.text);
-                  } else {
-                    break;
-                  }
-                }
-                break;
-              } else {
-                // Hit message_uuid, user_message, etc. Stop.
-                break;
-              }
-            }
-          }
-          assistantSnippet = deltaChunks.join("").trim().substring(0, 150);
-
-          // Approximate timestamp: interpolate between session creation and last activity
-          var tStart = session.createdAt || 0;
-          var tEnd = session.lastActivity || tStart;
-          var ts = tStart + Math.floor((hi / histLen) * (tEnd - tStart));
-
-          var editRecord = {
-            source: "session",
-            timestamp: ts,
-            sessionLocalId: sessionLocalId,
-            sessionTitle: sessionTitle,
-            assistantUuid: assistantUuid,
-            toolId: entry.id,
-            messageSnippet: messageSnippet,
-            assistantSnippet: assistantSnippet,
-            toolName: entry.name,
-          };
-
-          if (entry.name === "Edit") {
-            editRecord.old_string = entry.input.old_string || "";
-            editRecord.new_string = entry.input.new_string || "";
-          } else {
-            editRecord.isFullWrite = true;
-          }
-
-          entries.push(editRecord);
-        }
-      });
-
-      // Collect git commits
-      try {
-        var gitLog = execFileSync(
-          "git", ["log", "--format=%H|%at|%an|%s", "--follow", "--", histPath],
-          { cwd: cwd, encoding: "utf8", timeout: 5000 }
-        );
-        var gitLines = gitLog.trim().split("\n");
-        for (var gi = 0; gi < gitLines.length; gi++) {
-          if (!gitLines[gi]) continue;
-          var parts = gitLines[gi].split("|");
-          if (parts.length < 4) continue;
-          entries.push({
-            source: "git",
-            hash: parts[0],
-            timestamp: parseInt(parts[1], 10) * 1000,
-            author: parts[2],
-            message: parts.slice(3).join("|"),
-          });
-        }
-      } catch (e) {
-        // Not a git repo or file not tracked, that is fine
-      }
-
-      // Sort by timestamp descending (newest first)
-      entries.sort(function (a, b) { return b.timestamp - a.timestamp; });
-
-      sendTo(ws, { type: "fs_file_history_result", path: histPath, entries: entries });
-      return true;
-    }
-
-    // --- Git diff for file history ---
-    if (msg.type === "fs_git_diff") {
-      var diffPath = msg.path;
-      var hash = msg.hash;
-      var hash2 = msg.hash2 || null;
-      if (!diffPath || !hash) {
-        sendTo(ws, { type: "fs_git_diff_result", hash: hash, path: diffPath, diff: "", error: "Missing params" });
-        return true;
-      }
-      try {
-        var diff;
-        if (hash2) {
-          diff = execFileSync("git", ["diff", hash, hash2, "--", diffPath],
-            { cwd: cwd, encoding: "utf8", timeout: 5000 });
-        } else {
-          diff = execFileSync("git", ["show", hash, "--format=", "--", diffPath],
-            { cwd: cwd, encoding: "utf8", timeout: 5000 });
-        }
-        sendTo(ws, { type: "fs_git_diff_result", hash: hash, hash2: hash2, path: diffPath, diff: diff || "" });
-      } catch (e) {
-        sendTo(ws, { type: "fs_git_diff_result", hash: hash, hash2: hash2, path: diffPath, diff: "", error: e.message });
-      }
-      return true;
-    }
-
-    // --- File content at a git commit ---
-    if (msg.type === "fs_file_at") {
-      var atPath = msg.path;
-      var atHash = msg.hash;
-      if (!atPath || !atHash) {
-        sendTo(ws, { type: "fs_file_at_result", hash: atHash, path: atPath, content: "", error: "Missing params" });
-        return true;
-      }
-      try {
-        // Convert to repo-relative path (git show requires hash:relative/path)
-        var atAbsPath = path.resolve(cwd, atPath);
-        var atRelPath = path.relative(cwd, atAbsPath);
-        var content = execFileSync("git", ["show", atHash + ":" + atRelPath],
-          { cwd: cwd, encoding: "utf8", timeout: 5000 });
-        sendTo(ws, { type: "fs_file_at_result", hash: atHash, path: atPath, content: content });
-      } catch (e) {
-        sendTo(ws, { type: "fs_file_at_result", hash: atHash, path: atPath, content: "", error: e.message });
-      }
-      return true;
-    }
+    if (fileHistory.handleFileHistory(ws, msg)) return true;
 
     return false;
   }

package/lib/project-http.js

@@ -730,7 +730,7 @@ function attachHTTP(ctx) {
     }
 
     // Git panel status and actions
-    var isGitPanelRequest = urlPath === "/api/git/status" ||
+    var isGitPanelRequest = urlPath === "/api/git/status" || urlPath === "/api/git/summary" ||
       urlPath === "/api/git/action" || urlPath.indexOf("/api/git/file-diff?") === 0 ||
       urlPath.indexOf("/api/git/session-diff?") === 0;
     if (isGitPanelRequest && usersModule.isMultiUser()) {
@@ -768,6 +768,20 @@ function attachHTTP(ctx) {
       return true;
     }
 
+    // Compact repository placard data for the always-visible sidebar block.
+    // Same permission gate as the panel, but no file payload and no path.
+    if (req.method === "GET" && urlPath === "/api/git/summary") {
+      try {
+        var gitSummary = gitCli.getSummary(cwd, getOsUserInfoForReq(req));
+        res.writeHead(200, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+        res.end(JSON.stringify(gitSummary));
+      } catch (e) {
+        res.writeHead(500, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: e.message || "Unable to read Git summary" }));
+      }
+      return true;
+    }
+
     if (req.method === "GET" && urlPath.indexOf("/api/git/file-diff?") === 0) {
       var gitDiffParams = new URLSearchParams(urlPath.slice(urlPath.indexOf("?")));
       var gitDiffPath = gitDiffParams.get("path");

package/lib/project-knowledge.js

@@ -1,5 +1,6 @@
 var fs = require("fs");
 var path = require("path");
+var mateSync = require("./mate-knowledge-sync");
 
 /**
  * Attach knowledge file management to a project context.
@@ -75,6 +76,23 @@ function attachKnowledge(ctx) {
     return files;
   }
 
+  // Mirror a Mate-owned knowledge file into the Clay-wide Knowledge backend
+  // after the legacy write has already succeeded. The legacy file stays
+  // authoritative; this only keeps the new scope from going stale.
+  function mirrorMateSource(ws, fileName) {
+    if (!isMate) return;
+    var user = (ws && ws._clayUser) || null;
+    mateSync.syncQuietly({
+      mateDir: cwd,
+      fileName: fileName,
+      actor: {
+        type: user ? "user" : "system",
+        userId: user ? user.id : null,
+        displayName: user ? (user.displayName || user.username) : null,
+      },
+    });
+  }
+
   function handleKnowledgeMessage(ws, msg) {
     if (msg.type === "knowledge_list") {
       sendTo(ws, { type: "knowledge_list", files: listKnowledgeFiles() });
@@ -111,6 +129,7 @@ function attachKnowledge(ctx) {
       var knowledgeDir = path.join(cwd, "knowledge");
       fs.mkdirSync(knowledgeDir, { recursive: true });
       fs.writeFileSync(path.join(knowledgeDir, safeName), msg.content);
+      mirrorMateSource(ws, safeName);
       sendTo(ws, { type: "knowledge_saved", name: safeName });
       sendTo(ws, { type: "knowledge_list", files: listKnowledgeFilesBasic() });
       return true;
@@ -121,6 +140,9 @@ function attachKnowledge(ctx) {
       var safeName = path.basename(msg.name);
       var filePath = path.join(cwd, "knowledge", safeName);
       try { fs.unlinkSync(filePath); } catch (e) {}
+      // Reconciling after the unlink appends a tombstone, so a deleted file
+      // does not stay live in the new backend.
+      mirrorMateSource(ws, safeName);
       sendTo(ws, { type: "knowledge_deleted", name: safeName });
       sendTo(ws, { type: "knowledge_list", files: listKnowledgeFilesBasic() });
       return true;