clay-server 4.4.0 → 4.5.0-beta.1

package/lib/public/modules/session-github.js

@@ -0,0 +1,153 @@
+import { store } from './store.js';
+import { getWs } from './ws-ref.js';
+import { githubLinkTarget } from './github-links.js';
+import { iconHtml, refreshIcons } from './icons.js';
+import { escapeHtml as escapeText } from './utils.js';
+
+function escapeHtml(value) {
+  return escapeText(String(value)).replace(/"/g, '"').replace(/'/g, ''');
+}
+
+function safeLinks(session) {
+  return (session && Array.isArray(session.githubLinks) ? session.githubLinks : []).filter(function (link) {
+    var target = githubLinkTarget(link.url);
+    return target && (target.kind === 'issue' || target.kind === 'pull');
+  });
+}
+function label(link) {
+  return (link.kind === 'pr' ? 'PR #' : 'Issue #') + link.number;
+}
+function anchor(url, title, content, className) {
+  return '<a class="' + className + '" href="' + escapeHtml(url) + '" target="_blank" rel="noopener noreferrer" title="' + escapeHtml(title) + '" aria-label="' + escapeHtml(title) + '">' + content + '</a>';
+}
+export function orderedGithubWork(session) {
+  var links = safeLinks(session).slice().reverse();
+  var latestIssue = links.find(function (link) { return link.kind === 'issue'; });
+  if (latestIssue) links = [latestIssue].concat(links.filter(function (link) { return link !== latestIssue; }));
+  return links;
+}
+export function githubWorkMarkup(session, detailed, expanded) {
+  var links = orderedGithubWork(session);
+  if (!links.length) return '';
+  return '<span class="session-github-links' + (detailed ? ' github-work-details' : '') + '">' + (detailed || expanded ? links : links.slice(0, 1)).map(function (link) {
+    var state = ['open', 'closed', 'merged', 'draft'].indexOf(link.state) >= 0 ? link.state : 'unknown';
+    var icon = link.kind === 'pr' ? (state === 'merged' ? 'git-merge' : state === 'closed' ? 'git-pull-request-closed' : state === 'draft' ? 'git-pull-request-draft' : 'git-pull-request') : (state === 'closed' ? 'circle-check' : 'circle-dot');
+    var description = link.repository + ' · ' + label(link) + ' · ' + link.title + ' · ' + state + (link.checkedAt ? ' · Checked ' + new Date(link.checkedAt).toLocaleString() : '') + (link.stale ? ' (last known status; refresh unavailable)' : '');
+    var html = anchor(link.url, description, iconHtml('github', 'github-work-brand') + iconHtml(icon, 'github-work-status') + '<span><span class="github-work-kind">' + (link.kind === 'pr' ? 'PR ' : 'Issue ') + '</span>#' + escapeHtml(String(link.number)) + '</span>', 'session-github-link github-kind-' + (link.kind === 'pr' ? 'pr' : 'issue') + ' github-state-' + (link.stale ? 'unknown' : state));
+    if (expanded) html = '<span class="github-work-entry">' + html + '<span class="github-work-entry-title">' + escapeHtml(link.title || '') + '</span><span class="github-work-entry-meta">' + escapeHtml(link.repository + ' · ' + state + (link.stale ? ' · Last known status' : '')) + '</span></span>';
+    if (detailed && link.kind === 'pr') {
+      html += anchor(link.url + '/files', 'View PR changes on GitHub', 'Changes', 'github-work-action');
+      html += anchor(link.url + '#pullrequestreview', 'View PR reviews on GitHub', escapeHtml((link.review || 'Reviews').replace(/_/g, ' ').toLowerCase()), 'github-work-action');
+      (link.checks || []).forEach(function (check) {
+        if (/^https:\/\//i.test(check.url)) html += anchor(check.url, check.name + ': ' + check.state, escapeHtml(check.name + ' · ' + check.state.toLowerCase()), 'github-work-action');
+      });
+    }
+    return html;
+  }).join('') + (!detailed && !expanded && links.length > 1 ? '<button type="button" class="github-work-more" aria-label="Show all ' + links.length + ' linked GitHub items" aria-haspopup="dialog" aria-expanded="false" data-github-links="' + escapeHtml(JSON.stringify(safeLinks(session))) + '">+' + (links.length - 1) + '</button>' : '') + '</span>';
+}
+export function appendGithubWork(row, session, title) {
+  var html = githubWorkMarkup(session, false);
+  bindGithubWorkPopover();
+  if (!html) return;
+  var column = document.createElement('span');
+  column.className = 'session-work-column';
+  row.insertBefore(column, title);
+  column.appendChild(title);
+  var links = document.createElement('span');
+  links.innerHTML = html;
+  links.addEventListener('click', function (event) { if (event.target.closest('a')) event.stopPropagation(); });
+  links.addEventListener('contextmenu', function (event) { event.stopPropagation(); });
+  column.appendChild(links);
+}
+export function syncGithubSessions(sessions) {
+  bindGithubWorkPopover();
+  store.set({ githubWorkSessions: sessions || [], githubWorkProject: store.get('currentSlug') });
+  var active = (sessions || []).find(function (session) { return session.active; });
+  var title = document.getElementById('header-title');
+  var old = document.getElementById('header-github-links');
+  var html = title && !store.get('dmMode') && !store.get('splitPanes') && active ? githubWorkMarkup(active, false) : '';
+  if (!html) { if (old) old.remove(); }
+  else if (!old || old.dataset.markup !== html) {
+    var element = old || document.createElement('span');
+    element.id = 'header-github-links';
+    element.dataset.markup = html;
+    element.innerHTML = html;
+    if (!old) title.insertAdjacentElement('afterend', element);
+  }
+  refreshIcons();
+  refreshGithubWork();
+}
+export function currentGithubWorkMarkup() {
+  if (store.get('githubWorkProject') !== store.get('currentSlug')) return '';
+  var session = (store.get('githubWorkSessions') || []).find(function (item) { return item.active; });
+  return githubWorkMarkup(session, true);
+}
+export function refreshGithubWork() {
+  if (document.hidden || store.get('dmMode') || !store.get('connected')) return;
+  if (store.get('githubWorkProject') !== store.get('currentSlug')) return;
+  var session = (store.get('githubWorkSessions') || []).find(function (item) { return item.active; });
+  if (!safeLinks(session).length) return;
+  var key = store.get('currentSlug') + ':' + session.id;
+  var previous = store.get('githubWorkRefresh') || {};
+  if (previous.key === key && Date.now() - previous.at < 60000) return;
+  var ws = getWs();
+  if (!ws || ws.readyState !== 1) return;
+  store.set({ githubWorkRefresh: { key: key, at: Date.now() } });
+  ws.send(JSON.stringify({ type: 'session_github_refresh' }));
+}
+
+export function resetGithubWork() {
+  closeGithubWorkPopover();
+  store.set({ githubWorkSessions: [], githubWorkProject: null, githubWorkRefresh: null });
+  var header = document.getElementById('header-github-links');
+  if (header) header.remove();
+}
+
+function closeGithubWorkPopover() {
+  var popup = document.getElementById('github-work-popover');
+  if (popup) popup.hidePopover();
+}
+function bindGithubWorkPopover() {
+  if (store.get('githubWorkPopoverBound')) return;
+  store.set({ githubWorkPopoverBound: true });
+  document.addEventListener('click', function (event) {
+    var button = event.target.closest('.github-work-more');
+    if (!button) return;
+    event.preventDefault();
+    event.stopPropagation();
+    var existing = document.getElementById('github-work-popover');
+    var same = existing && button.getAttribute('aria-expanded') === 'true';
+    if (existing) { existing.hidePopover(); existing.remove(); }
+    if (same) return;
+    var links;
+    try { links = JSON.parse(button.dataset.githubLinks); } catch (error) { return; }
+    var popup = document.createElement('div');
+    popup.id = 'github-work-popover';
+    popup.className = 'github-work-popover';
+    popup.setAttribute('popover', 'auto');
+    popup.setAttribute('role', 'dialog');
+    popup.setAttribute('aria-label', 'Linked GitHub work');
+    popup.innerHTML = '<strong>Linked GitHub work</strong>' + githubWorkMarkup({ githubLinks: links }, false, true);
+    document.body.appendChild(popup);
+    button.setAttribute('aria-expanded', 'true');
+    popup.addEventListener('toggle', function (toggle) {
+      if (toggle.newState === 'closed') {
+        button.setAttribute('aria-expanded', 'false');
+        if (document.activeElement === document.body && button.isConnected) button.focus();
+        popup.remove();
+      }
+    });
+    popup.showPopover();
+    var rect = button.getBoundingClientRect();
+    var box = popup.getBoundingClientRect();
+    popup.style.left = Math.max(8, Math.min(rect.left, window.innerWidth - box.width - 8)) + 'px';
+    popup.style.top = Math.max(8, rect.bottom + box.height + 8 <= window.innerHeight ? rect.bottom + 6 : rect.top - box.height - 6) + 'px';
+    var first = popup.querySelector('a');
+    if (first) first.focus({ preventScroll: true });
+    refreshIcons();
+  }, true);
+  window.addEventListener('resize', closeGithubWorkPopover);
+  store.subscribe(function (state, previous) {
+    if (state.currentSlug !== previous.currentSlug || state.activeSessionId !== previous.activeSessionId || state.dmMode !== previous.dmMode) closeGithubWorkPopover();
+  });
+}

package/lib/public/modules/sidebar-mobile.js

@@ -1,3 +1,4 @@
+import { appendGithubWork } from './session-github.js';
 // sidebar-mobile.js - Mobile sheet overlays, tab bar, and mobile-specific rendering
 // Extracted from sidebar.js (PR-38)
 
@@ -384,7 +385,7 @@ function renderSheetSessions(listEl) {
 // Helper: create a mobile session item element
 function createMobileSessionItem(s, options) {
   var itemOptions = options || {};
-  var el = document.createElement("button");
+  var el = document.createElement("div");
   el.className = "mobile-session-item" + (s.active ? " active" : "");
   if (itemOptions.worker) el.classList.add("mobile-worker-item");
 
@@ -404,9 +405,15 @@ function createMobileSessionItem(s, options) {
   }
 
   var titleSpan = document.createElement("span");
+  titleSpan.tabIndex = 0;
+  titleSpan.setAttribute("role", "button");
+  titleSpan.addEventListener("keydown", function (event) {
+    if (event.key === "Enter" || event.key === " ") { event.preventDefault(); el.click(); }
+  });
   titleSpan.className = "mobile-session-title";
   titleSpan.appendChild(document.createTextNode(s.title || "New Session"));
   el.appendChild(titleSpan);
+  appendGithubWork(el, s, titleSpan);
 
   if (itemOptions.worker) {
     var generation = document.createElement("span");

package/lib/public/modules/sidebar-sessions.js

@@ -1,3 +1,4 @@
+import { appendGithubWork } from './session-github.js';
 // sidebar-sessions.js - Session list, search, presence, countdown, CLI picker
 // Extracted from sidebar.js (PR-35)
 
@@ -1367,6 +1368,7 @@ function renderSessionItem(s, options) {
   textHtml += highlightMatch(s.title || "New Session", searchQuery);
   textSpan.innerHTML = textHtml;
   el.appendChild(textSpan);
+  appendGithubWork(el, s, textSpan);
 
   if (itemOptions.worker) {
     var workerLabel = document.createElement("span");

package/lib/public/style.css

@@ -1,3 +1,4 @@
+@import url("css/session-github.css");
 @import url("css/issues.css");
 @import url("css/base.css?v=20260828-type1");
 @import url("css/icon-strip.css?v=20260828-surfaces4");

package/lib/sdk-bridge.js

@@ -567,6 +567,17 @@ function createSDKBridge(opts) {
       return { behavior: "allow", updatedInput: input };
     }
 
+    // Session search is read-only; its handler enforces project and session access.
+    if (toolName === "search_other_driver_sessions"
+        || toolName === "mcp__clay-handoff__search_other_driver_sessions") {
+      return { behavior: "allow", updatedInput: input };
+    }
+
+    // Local work associations verify GitHub data but never mutate GitHub.
+    if (["link_session_github", "get_session_github", "unlink_session_github"].some(function (name) {
+      return toolName === name || toolName === "mcp__clay-github__" + name;
+    })) return { behavior: "allow", updatedInput: input };
+
     // Auto-approve safe browser MCP tools.
     // Only watch/unwatch: user explicitly chose which tab to share.
     // Everything else (screenshot, read_page, list_tabs, etc.) can expose

package/lib/session-github.js

@@ -0,0 +1,48 @@
+// Verified GitHub references owned by a work session, never inferred from mentions.
+var execFile = require("child_process").execFile;
+var wrapSpawnAsUser = require("./os-users").wrapSpawnAsUser;
+
+function parseReference(value) {
+  var match = typeof value === "string" && value.match(/^https:\/\/github\.com\/([a-zA-Z0-9][a-zA-Z0-9-]{0,38})\/([a-zA-Z0-9][a-zA-Z0-9._-]{0,99})\/(issues|pull)\/([1-9][0-9]*)(?:[?#].*)?$/);
+  if (!match || !Number.isSafeInteger(Number(match[4]))) throw new Error("Use a GitHub issue or pull request URL.");
+  return { repository: match[1] + "/" + match[2], kind: match[3] === "pull" ? "pr" : "issue", number: Number(match[4]), url: "https://github.com/" + match[1] + "/" + match[2] + "/" + match[3] + "/" + match[4] };
+}
+function runGh(cwd, args, identity) {
+  return new Promise(function (resolve, reject) {
+    var env = Object.assign({}, identity ? require("./build-user-env").buildUserEnv(identity) : process.env, { GH_PROMPT_DISABLED: "1", GH_HOST: "github.com" });
+    if (identity) {
+      // Never let the daemon's GitHub credentials cross an OS-user boundary.
+      delete env.GH_TOKEN; delete env.GITHUB_TOKEN; delete env.GH_ENTERPRISE_TOKEN; delete env.GITHUB_ENTERPRISE_TOKEN;
+      delete env.GH_CONFIG_DIR; delete env.XDG_CONFIG_HOME;
+      env.HOME = identity.home; env.USER = identity.user; env.LOGNAME = identity.user;
+    }
+    var options = { cwd: cwd, env: env, timeout: 15000, maxBuffer: 512 * 1024, encoding: "utf8" };
+    if (identity) { options.uid = identity.uid; options.gid = identity.gid; }
+    var wrapped = wrapSpawnAsUser("gh", args, options);
+    execFile(wrapped.command, wrapped.args, wrapped.options, function (error, stdout) {
+      if (error) return reject(new Error("GitHub is unavailable. Check gh authentication and repository access."));
+      try { resolve(JSON.parse(stdout)); } catch (e) { reject(new Error("GitHub returned an invalid response.")); }
+    });
+  });
+}
+async function readReference(cwd, url, identity, run) {
+  var ref = parseReference(url);
+  var fields = "title,state,url" + (ref.kind === "pr" ? ",isDraft,headRefName,reviewDecision,statusCheckRollup" : "");
+  var data = await (run || runGh)(cwd, [ref.kind === "pr" ? "pr" : "issue", "view", String(ref.number), "--repo", ref.repository, "--json", fields], identity);
+  var verified = parseReference(data.url);
+  if (verified.url.toLowerCase() !== ref.url.toLowerCase()) throw new Error("GitHub returned a different reference.");
+  ref.title = String(data.title || "").slice(0, 200);
+  ref.state = data.state === "MERGED" ? "merged" : data.state === "CLOSED" ? "closed" : data.state === "OPEN" ? (data.isDraft ? "draft" : "open") : "unknown";
+  ref.checkedAt = Date.now();
+  if (ref.kind === "pr") {
+    ref.branch = String(data.headRefName || "").slice(0, 200);
+    ref.review = ["APPROVED", "CHANGES_REQUESTED", "REVIEW_REQUIRED"].indexOf(data.reviewDecision) >= 0 ? data.reviewDecision : "";
+    ref.checks = (data.statusCheckRollup || []).slice(0, 30).map(function (check) {
+      var target = check.detailsUrl || check.targetUrl || "";
+      if (!/^https:\/\//i.test(target)) target = "";
+      return { name: String(check.name || check.context || "Check").slice(0, 100), state: String(check.conclusion || check.state || check.status || "PENDING").slice(0, 40), url: target };
+    });
+  }
+  return ref;
+}
+module.exports = { parseReference: parseReference, readReference: readReference };

package/lib/sessions.js

@@ -176,6 +176,7 @@ function createSessionManager(opts) {
         titleManuallySet: session.titleManuallySet === true,
         createdAt: session.createdAt,
       };
+      if (session.githubLinks) metaObj.githubLinks = session.githubLinks;
       if (session.ownerId) metaObj.ownerId = session.ownerId;
       if (session.vendor) metaObj.vendor = session.vendor;
       if (session.codexDynamicToolCatalogVersion) metaObj.codexDynamicToolCatalogVersion = session.codexDynamicToolCatalogVersion;
@@ -343,6 +344,7 @@ function createSessionManager(opts) {
         title: m.title || "",
         titleProvisional: m.titleProvisional === true,
         titleAutoGenerated: m.titleAutoGenerated === true,
+        githubLinks: Array.isArray(m.githubLinks) ? m.githubLinks.slice(0, 8) : [],
         titleManuallySet: m.titleManuallySet === true || legacyTitleProtected,
         createdAt: m.createdAt || Date.now(),
         lastActivity: loaded[i].mtime || m.createdAt || Date.now(),
@@ -604,6 +606,7 @@ function createSessionManager(opts) {
       id: s.localId,
       cliSessionId: s.cliSessionId || null,
       title: s.title || "New Session",
+      githubLinks: s.githubLinks || [],
       active: isActive,
       isProcessing: s.isProcessing,
       // Sidebar badge: user work only. Ambient housekeeping is surfaced in the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "4.4.0",
+  "version": "4.5.0-beta.1",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js"