clay-server 4.2.0-beta.1 → 4.2.0-beta.3

package/lib/ws-schema.js

@@ -252,6 +252,7 @@ var schema = {
   "set_server_default_model": { direction: "c2s", handler: "lib/project-sessions.js", description: "Set the server-wide default model" },
   "set_project_default_model": { direction: "c2s", handler: "lib/project-sessions.js", description: "Set the project default model" },
   "set_permission_mode":      { direction: "c2s", handler: "lib/project-sessions.js", description: "Set permission mode for the current session" },
+  "permission_mode_result":   { direction: "s2c", handler: "lib/public/modules/permission-control.js", description: "Correlated result for an exact project/session permission mode change" },
   "set_session_full_access":  { direction: "c2s", handler: "lib/project-sessions.js", description: "Toggle Clay-managed permission skipping for a GUI session" },
   "session_full_access_changed": { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "A session's full-access state changed" },
   "session_full_access_result": { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Result of toggling session full access" },
@@ -269,6 +270,7 @@ var schema = {
   "autonomous_run_state":      { direction: "s2c", handler: "lib/public/modules/autonomous-run.js", description: "Synchronized Until complete run state" },
   "reload_skills":            { direction: "c2s", handler: "lib/project-sessions.js", description: "Hot-reload skills/MCP/agents on the active query without a restart" },
   "set_mcp_permission_mode_override": { direction: "c2s", handler: "lib/project-sessions.js", description: "Override permission mode (default/auto/null) for one MCP server" },
+  "mcp_permission_mode_result": { direction: "s2c", handler: "lib/public/modules/mcp-ui.js", description: "Correlated result for one session MCP AI review policy change" },
   "set_server_default_mode":  { direction: "c2s", handler: "lib/project-sessions.js", description: "Set the server-wide default permission mode" },
   "set_project_default_mode": { direction: "c2s", handler: "lib/project-sessions.js", description: "Set the project default permission mode" },
   "set_effort":               { direction: "c2s", handler: "lib/project-sessions.js", description: "Set effort level for the current session" },

package/lib/yoke/adapters/claude-worker-policy.js

@@ -0,0 +1,67 @@
+// Bounded fail-closed lifecycle for worker PreToolUse policy IPC requests.
+
+function denied(message) {
+  return { behavior: "deny", message: message };
+}
+
+function createPolicyBroker(options) {
+  options = options || {};
+  var send = options.send;
+  var timeoutMs = Number(options.timeoutMs) > 0 ? Number(options.timeoutMs) : 10000;
+  var pending = {};
+
+  function settle(requestId, result) {
+    var record = pending[requestId];
+    if (!record) return false;
+    delete pending[requestId];
+    clearTimeout(record.timer);
+    if (record.signal && record.onAbort && typeof record.signal.removeEventListener === "function") {
+      record.signal.removeEventListener("abort", record.onAbort);
+    }
+    record.resolve(result);
+    return true;
+  }
+
+  function request(message, signal) {
+    return new Promise(function(resolve) {
+      if (signal && signal.aborted) {
+        resolve(denied("Permission policy cancelled."));
+        return;
+      }
+      var requestId = message.requestId;
+      var record = { resolve: resolve, signal: signal || null, onAbort: null, timer: null };
+      pending[requestId] = record;
+      record.onAbort = function() {
+        settle(requestId, denied("Permission policy cancelled."));
+      };
+      if (signal && typeof signal.addEventListener === "function") {
+        signal.addEventListener("abort", record.onAbort, { once: true });
+      }
+      record.timer = setTimeout(function() {
+        settle(requestId, denied("Permission policy timed out."));
+      }, timeoutMs);
+      var sent = false;
+      try { sent = send(message) === true; }
+      catch (error) { sent = false; }
+      if (!sent) settle(requestId, denied("Permission policy IPC is unavailable."));
+    });
+  }
+
+  function respond(message) {
+    var result = message.error ? denied(message.error) : message.result;
+    return settle(message.requestId, result || null);
+  }
+
+  function clear(message) {
+    var ids = Object.keys(pending);
+    for (var i = 0; i < ids.length; i++) settle(ids[i], denied(message || "Permission policy IPC closed."));
+  }
+
+  function pendingCount() {
+    return Object.keys(pending).length;
+  }
+
+  return { request: request, respond: respond, clear: clear, pendingCount: pendingCount };
+}
+
+module.exports = { createPolicyBroker: createPolicyBroker };

package/lib/yoke/adapters/claude-worker.js

@@ -18,6 +18,7 @@ var crypto = require("crypto");
 var path = require("path");
 var claudeContextUsage = require(path.join(__dirname, "../claude-context-usage"));
 var claudeModelSwitch = require(path.join(__dirname, "../claude-model-switch"));
+var createPolicyBroker = require("./claude-worker-policy").createPolicyBroker;
 var fs = require("fs");
 
 var socketPath = process.argv[2];
@@ -244,14 +245,18 @@ function buildMcpServersFromDescriptors(descriptors, sdk) {
 
 // --- IPC helpers ---
 function sendToDaemon(msg) {
-  if (!conn || conn.destroyed) return;
+  if (!conn || conn.destroyed) return false;
   try {
     conn.write(JSON.stringify(msg) + "\n");
+    return true;
   } catch (e) {
     console.error("[sdk-worker] Failed to send message:", e.message);
+    return false;
   }
 }
 
+var preToolPolicyBroker = createPolicyBroker({ send: sendToDaemon, timeoutMs: 10000 });
+
 function handleMessage(msg) {
   try { require("fs").writeSync(2, "[sdk-worker] MSG: " + msg.type + "\n"); } catch (e) {}
   switch (msg.type) {
@@ -294,6 +299,9 @@ function handleMessage(msg) {
     case "permission_response":
       handlePermissionResponse(msg);
       break;
+    case "pre_tool_policy_response":
+      handlePreToolPolicyResponse(msg);
+      break;
     case "ask_user_response":
       handleAskUserResponse(msg);
       break;
@@ -394,6 +402,16 @@ function handlePermissionResponse(msg) {
   }
 }
 
+function handlePreToolPolicyResponse(msg) {
+  preToolPolicyBroker.respond(msg);
+}
+
+function preToolUsePolicy(toolName, input, toolUseId, signal) {
+  var requestId = crypto.randomUUID();
+  return preToolPolicyBroker.request({ type: "pre_tool_policy_request", requestId: requestId, toolName: toolName,
+    input: input || {}, toolUseId: toolUseId || "" }, signal);
+}
+
 function handleAskUserResponse(msg) {
   var resolve = pendingAskUser[msg.toolUseId];
   if (resolve) {
@@ -515,6 +533,22 @@ async function handleQueryStart(msg) {
   };
   var nativeUserInput = options.userInputMode !== "fallback";
   delete options.userInputMode;
+  var usePreToolPolicy = options.clayPreToolUsePolicy === true;
+  delete options.clayPreToolUsePolicy;
+  if (usePreToolPolicy) {
+    options.hooks = options.hooks || {};
+    options.hooks.PreToolUse = (options.hooks.PreToolUse || []).concat([{
+      hooks: [async function(input, toolUseId, hookOpts) {
+        input = input || {};
+        var decision = await preToolUsePolicy(input.tool_name, input.tool_input, toolUseId || input.tool_use_id, hookOpts && hookOpts.signal);
+        if (!decision) return { continue: true };
+        return { hookSpecificOutput: { hookEventName: "PreToolUse",
+          permissionDecision: decision.behavior === "deny" ? "deny" : "allow",
+          permissionDecisionReason: decision.message || "Clay session policy",
+          updatedInput: decision.updatedInput } };
+      }],
+    }]);
+  }
   options.canUseTool = function(toolName, input, toolOpts) {
     // AskUserQuestion is handled specially: we send it as a separate IPC type
     // so the daemon can use its own AskUserQuestion handling logic
@@ -626,6 +660,7 @@ async function handleQueryStart(msg) {
     messageQueue = null;
     abortController = null;
     pendingPermissions = {};
+    preToolPolicyBroker.clear("Permission policy query ended.");
     pendingAskUser = {};
     pendingElicitations = {};
   }
@@ -657,12 +692,12 @@ async function handleSetEffort(msg) {
 }
 
 async function handleSetPermissionMode(msg) {
-  if (!queryInstance) return;
+  if (!queryInstance) { sendToDaemon({ type: "permission_mode_result", requestId: msg.requestId, error: "No active query." }); return; }
   try {
     await queryInstance.setPermissionMode(msg.mode);
-    sendToDaemon({ type: "permission_mode_changed", mode: msg.mode });
+    sendToDaemon({ type: "permission_mode_result", requestId: msg.requestId });
   } catch (e) {
-    sendToDaemon({ type: "worker_error", error: "Failed to set permission mode: " + (e.message || e) });
+    sendToDaemon({ type: "permission_mode_result", requestId: msg.requestId, error: "Failed to set permission mode: " + (e.message || e) });
   }
 }
 
@@ -705,11 +740,15 @@ async function handleReloadSkills(msg) {
 }
 
 async function handleSetMcpPermissionModeOverride(msg) {
-  if (!queryInstance || typeof queryInstance.setMcpPermissionModeOverride !== "function") return;
+  if (!queryInstance || typeof queryInstance.setMcpPermissionModeOverride !== "function") {
+    sendToDaemon({ type: "mcp_permission_mode_result", requestId: msg.requestId, error: "MCP permission controls are unavailable." });
+    return;
+  }
   try {
-    await queryInstance.setMcpPermissionModeOverride(msg.serverName, msg.mode);
+    var result = await queryInstance.setMcpPermissionModeOverride(msg.serverName, msg.mode);
+    sendToDaemon({ type: "mcp_permission_mode_result", requestId: msg.requestId, result: result || null });
   } catch (e) {
-    console.error("[sdk-worker] setMcpPermissionModeOverride error:", e.message);
+    sendToDaemon({ type: "mcp_permission_mode_result", requestId: msg.requestId, error: e.message || String(e) });
   }
 }
 
@@ -789,6 +828,7 @@ async function handleWarmup(msg) {
 // --- Cleanup ---
 var _exitScheduled = false;
 function cleanup() {
+  preToolPolicyBroker.clear("Permission policy worker closed.");
   if (_keepAlive) {
     try { clearInterval(_keepAlive); } catch (e) {}
   }

package/lib/yoke/adapters/claude.js

@@ -67,6 +67,29 @@ function applySystemPromptSnapshot(systemPrompt, enabled) {
   return systemPrompt;
 }
 
+function attachPreToolUsePolicy(options, policy) {
+  if (typeof policy !== "function") return;
+  options.hooks = options.hooks || {};
+  options.hooks.PreToolUse = (options.hooks.PreToolUse || []).concat([{
+    hooks: [async function(input, toolUseId, hookOpts) {
+      input = input || {};
+      var decision = await policy(input.tool_name, input.tool_input || {}, {
+        toolUseID: toolUseId || input.tool_use_id,
+        signal: hookOpts && hookOpts.signal,
+      });
+      if (!decision) return { continue: true };
+      return {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: decision.behavior === "deny" ? "deny" : "allow",
+          permissionDecisionReason: decision.message || "Clay session policy",
+          updatedInput: decision.updatedInput,
+        },
+      };
+    }],
+  }]);
+}
+
 function getSharedSkillPlugins(homeDir, existingPlugins, cwd, env) {
   var plugins = Array.isArray(existingPlugins) ? existingPlugins.slice() : [];
   // undefined means normal in-process Claude and may use the configured
@@ -122,6 +145,7 @@ function buildWorkerQueryOptions(queryOpts, claudeOpts, workerCwd) {
   if (queryOpts.onUserDialog) queryOptions.supportedDialogKinds = SUPPORTED_DIALOG_KINDS;
   queryOptions.perTaskStopAffordance = PER_TASK_STOP_AFFORDANCE;
   if (queryOpts.onModelSwitch) queryOptions.reportModelSwitches = true;
+  if (queryOpts.preToolUsePolicy) queryOptions.clayPreToolUsePolicy = true;
   if (queryOpts.model) queryOptions.model = queryOpts.model;
   if (queryOpts.effort) queryOptions.effort = queryOpts.effort;
   if (queryOpts.resumeSessionId) queryOptions.resume = queryOpts.resumeSessionId;
@@ -316,11 +340,13 @@ function flattenEvent(raw) {
       base.skills = raw.skills;
       base.slashCommands = raw.slash_commands;
       base.fastModeState = raw.fast_mode_state || null;
+      base.permissionMode = raw.permissionMode || raw.permission_mode || null;
       return base;
     }
     if (raw.subtype === "status") {
       base.yokeType = "status";
       base.status = raw.status;
+      base.permissionMode = raw.permissionMode || raw.permission_mode || null;
       return base;
     }
     // API retry notices are transient transport state, not conversation
@@ -1015,7 +1041,7 @@ function serializeWorkerValue(value, seen) {
 // in-process QueryHandle. This allows processQueryStream to iterate a worker
 // query identically to an in-process query.
 
-function createWorkerQueryHandle(worker, canUseTool, onElicitation, callMcpTool, onUserDialog, onUserInputRequest, onModelSwitch) {
+function createWorkerQueryHandle(worker, canUseTool, onElicitation, callMcpTool, onUserDialog, onUserInputRequest, onModelSwitch, preToolUsePolicy) {
   var contextRequests = claudeContextUsage.createRequests(worker);
   var correlation = claudeCorrelation.createCorrelation();
   // Async iterable state
@@ -1028,6 +1054,23 @@ function createWorkerQueryHandle(worker, canUseTool, onElicitation, callMcpTool,
   // result from the worker (e.g. rewindFiles). Each entry is keyed by a
   // requestId and holds { resolve, reject } of the in-flight Promise.
   var pendingRewinds = {};
+  var pendingPermissionModes = {};
+  var pendingMcpPermissionModes = {};
+
+  function rejectPendingPermissionModes(error) {
+    Object.keys(pendingPermissionModes).forEach(function(id) {
+      var pending = pendingPermissionModes[id];
+      delete pendingPermissionModes[id];
+      clearTimeout(pending.timer);
+      pending.reject(error);
+    });
+    Object.keys(pendingMcpPermissionModes).forEach(function(id) {
+      var pending = pendingMcpPermissionModes[id];
+      delete pendingMcpPermissionModes[id];
+      clearTimeout(pending.timer);
+      pending.reject(error);
+    });
+  }
 
   function pushToIter(value) {
     if (iterEnded) return;
@@ -1087,6 +1130,20 @@ function createWorkerQueryHandle(worker, canUseTool, onElicitation, callMcpTool,
         }
         break;
 
+      case "pre_tool_policy_request":
+        if (preToolUsePolicy) {
+          Promise.resolve().then(function() {
+            return preToolUsePolicy(msg.toolName, msg.input || {}, { toolUseID: msg.toolUseId });
+          }).then(function(result) {
+            worker.send({ type: "pre_tool_policy_response", requestId: msg.requestId, result: result || null });
+          }).catch(function(error) {
+            worker.send({ type: "pre_tool_policy_response", requestId: msg.requestId, error: error.message || String(error) });
+          });
+        } else {
+          worker.send({ type: "pre_tool_policy_response", requestId: msg.requestId, result: null });
+        }
+        break;
+
       case "ask_user_request":
         if (onUserInputRequest) {
           claudeUserInput.ask(onUserInputRequest, msg.input, {
@@ -1164,6 +1221,24 @@ function createWorkerQueryHandle(worker, canUseTool, onElicitation, callMcpTool,
       case "context_usage_response":
         contextRequests.receive(msg);
         break;
+      case "permission_mode_result": {
+        var modePending = pendingPermissionModes[msg.requestId];
+        if (!modePending) break;
+        delete pendingPermissionModes[msg.requestId];
+        clearTimeout(modePending.timer);
+        if (msg.error) modePending.reject(new Error(msg.error));
+        else modePending.resolve();
+        break;
+      }
+      case "mcp_permission_mode_result": {
+        var mcpPending = pendingMcpPermissionModes[msg.requestId];
+        if (!mcpPending) break;
+        delete pendingMcpPermissionModes[msg.requestId];
+        clearTimeout(mcpPending.timer);
+        if (msg.error) mcpPending.reject(new Error(msg.error));
+        else mcpPending.resolve(msg.result || null);
+        break;
+      }
       case "context_usage":
       case "model_changed":
       case "effort_changed":
@@ -1184,12 +1259,14 @@ function createWorkerQueryHandle(worker, canUseTool, onElicitation, callMcpTool,
       }
 
       case "query_done":
+        rejectPendingPermissionModes(new Error("Worker query ended while changing permission mode"));
         console.log("[yoke/claude] IPC query_done received, pid=" + (worker.process ? worker.process.pid : "?"));
         worker._queryEnded = true;
         endIter();
         break;
 
       case "query_error": {
+        rejectPendingPermissionModes(new Error(msg.error || "Worker exited while changing permission mode"));
         console.log("[yoke/claude] IPC query_error received, pid=" + (worker.process ? worker.process.pid : "?") + " _fallback=" + !!msg._fallback + " _queryEnded=" + worker._queryEnded + " error=" + (msg.error || "").substring(0, 100));
         // Skip fallback errors from exit handler if we already handled the real one
         if (msg._fallback && worker._queryEnded) break;
@@ -1283,8 +1360,22 @@ function createWorkerQueryHandle(worker, canUseTool, onElicitation, callMcpTool,
     },
 
     setPermissionMode: function(mode) {
-      worker.send({ type: "set_permission_mode", mode: mode });
-      return Promise.resolve();
+      return new Promise(function(resolve, reject) {
+        var requestId = crypto.randomUUID();
+        var timer = setTimeout(function() {
+          if (!pendingPermissionModes[requestId]) return;
+          delete pendingPermissionModes[requestId];
+          reject(new Error("Timed out changing permission mode in worker."));
+        }, worker.permissionModeTimeoutMs || 10000);
+        pendingPermissionModes[requestId] = { resolve: resolve, reject: reject, timer: timer };
+        try {
+          if (worker.send({ type: "set_permission_mode", mode: mode, requestId: requestId }) !== true) {
+            delete pendingPermissionModes[requestId]; clearTimeout(timer); reject(new Error("Worker is unavailable."));
+          }
+        } catch (error) {
+          delete pendingPermissionModes[requestId]; clearTimeout(timer); reject(error);
+        }
+      });
     },
 
     stopTask: function(taskId) {
@@ -1298,8 +1389,22 @@ function createWorkerQueryHandle(worker, canUseTool, onElicitation, callMcpTool,
     },
 
     setMcpPermissionModeOverride: function(serverName, mode) {
-      worker.send({ type: "set_mcp_permission_mode_override", serverName: serverName, mode: mode });
-      return Promise.resolve(null);
+      return new Promise(function(resolve, reject) {
+        var requestId = crypto.randomUUID();
+        var timer = setTimeout(function() {
+          if (!pendingMcpPermissionModes[requestId]) return;
+          delete pendingMcpPermissionModes[requestId];
+          reject(new Error("Timed out changing MCP permission mode in worker."));
+        }, worker.permissionModeTimeoutMs || 10000);
+        pendingMcpPermissionModes[requestId] = { resolve: resolve, reject: reject, timer: timer };
+        try {
+          if (worker.send({ type: "set_mcp_permission_mode_override", serverName: serverName, mode: mode, requestId: requestId }) !== true) {
+            delete pendingMcpPermissionModes[requestId]; clearTimeout(timer); reject(new Error("Worker is unavailable."));
+          }
+        } catch (error) {
+          delete pendingMcpPermissionModes[requestId]; clearTimeout(timer); reject(error);
+        }
+      });
     },
 
     getContextUsage: function(options) {
@@ -1326,6 +1431,7 @@ function createWorkerQueryHandle(worker, canUseTool, onElicitation, callMcpTool,
     },
 
     close: function() {
+      rejectPendingPermissionModes(new Error("Worker query closed while changing permission mode"));
       // End the iterator
       endIter();
       // Send end_messages to worker
@@ -1625,6 +1731,7 @@ function createClaudeAdapter(opts) {
       if (queryOpts.canUseTool || nativeUserInputHandler) {
         sdkOptions.canUseTool = claudeUserInput.canUseTool(Object.assign({}, queryOpts, { onUserInputRequest: nativeUserInputHandler }));
       }
+      attachPreToolUsePolicy(sdkOptions, queryOpts.preToolUsePolicy);
       if (nativeUserInputHandler) {
         sdkOptions.onElicitation = function (request, elicitOpts) { return claudeUserInput.elicitation(nativeUserInputHandler, request, elicitOpts); };
       } else if (queryOpts.userInputMode !== "fallback" && queryOpts.onElicitation) sdkOptions.onElicitation = queryOpts.onElicitation;
@@ -1795,7 +1902,7 @@ function createClaudeAdapter(opts) {
     // Create the worker query handle (sets up message handler on worker)
     var workerUserInputHandler = queryOpts.userInputMode === "fallback" ? null : queryOpts.onUserInputRequest;
     var workerElicitationHandler = queryOpts.userInputMode === "fallback" ? null : queryOpts.onElicitation;
-    var handle = createWorkerQueryHandle(worker, queryOpts.canUseTool, workerElicitationHandler, queryOpts.callMcpTool, queryOpts.onUserDialog, workerUserInputHandler, queryOpts.onModelSwitch);
+    var handle = createWorkerQueryHandle(worker, queryOpts.canUseTool, workerElicitationHandler, queryOpts.callMcpTool, queryOpts.onUserDialog, workerUserInputHandler, queryOpts.onModelSwitch, queryOpts.preToolUsePolicy);
 
     // Wait for worker to be ready before sending query_start
     if (!reusingWorker) {
@@ -2063,5 +2170,6 @@ module.exports = {
     canReuseWorker: canReuseWorker,
     buildWorkerQueryOptions: buildWorkerQueryOptions,
     normalizeEvent: flattenEvent,
+    attachPreToolUsePolicy: attachPreToolUsePolicy,
   },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "4.2.0-beta.1",
+  "version": "4.2.0-beta.3",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js"