clay-server 4.8.2 → 5.0.0-beta.1

package/lib/bundled-skills/clay-sketch/SKILL.md

@@ -0,0 +1,198 @@
+---
+name: clay-sketch
+description: Draw and revise UI wireframes directly in Clay chat with the built-in clay-sketch renderer. Automatically use for requests to see a wireframe, sketch a screen, visualize a page layout or UI plan, or revise an existing sketch, including entire webpages and the current project. The user does not need to name clay-sketch. Also use for /clay-sketch or $clay-sketch. Do not substitute this for implementing a working website, generating artwork, or drawing architecture and sequence diagrams.
+---
+
+# clay-sketch
+
+Use clay-sketch to make UI ideas visible while keeping design changes in the
+conversation. It ships with Clay: no installation, browser automation, external
+renderer, or generated image is needed. Its markup is a supported subset of
+PlantUML Salt with optional Clay screen-layout extensions, not the full PlantUML language.
+
+Treat ordinary requests such as "show me a wireframe of our work", "sketch this
+screen", or "what would this page look like?" in a UI planning conversation as
+requests for clay-sketch. Do not require the feature name or ask the user to
+choose a rendering format. Use the current project and conversation as context.
+Default to a rendered sketch; use ASCII wireframes only when explicitly requested.
+
+## Draw in chat
+
+1. Use the user's requirements and existing conversation to choose a sensible
+   first layout. Ask a structured question only when a missing decision would
+   materially change the design. Avoid setup questions or requiring a file.
+2. Show a complete sketch in a fenced `clay-sketch` block. Include `@startsalt`
+   and `@endsalt`. Clay renders the block inline and retains its source.
+3. For a whole page, use the screen-layout mode below with an explicit canvas
+   and region tracks. Default to 1440 × 900 for desktop unless context suggests
+   another size. Do not simulate a screen by increasing scale, font sizes or
+   padding labels with spaces. Use realistic labels and a clear primary action.
+4. Briefly explain the important layout decisions. The controls are drawings,
+   not interactive application controls. Keep the sketch focused on structure.
+
+Use one sketch per block. Existing `plantuml`, `puml`, and `salt` fences also
+work. Prefer `clay-sketch` for new responses. Don't replace a rendered sketch
+with a screenshot or unsolicited ASCII art.
+
+## Revise together
+
+When the user requests changes or wants to work together on a sketch, call
+`present_wireframe` (or its available `clay-documents` qualified equivalent)
+with the complete revised Salt source, a short title, and a stable design id
+such as `account-settings`. Reuse that id for revisions of the same design.
+This opens or updates clay-sketch in Sketch viewer, the right-side viewer. It only presents the
+sketch; it does not save a file.
+
+Include the same complete revised source in a `clay-sketch` response block so
+the revision remains in chat history. Preserve requirements from earlier turns.
+Do not send a patch or a fragment as the diagram source.
+
+All editing happens through conversation. The user
+can choose **Save to project** to create a `.puml` file, or **Download** to save
+the source to their device. Do not create files automatically. If explicitly
+asked to save through your file tools, use the requested path and normal file
+permissions. Do not silently overwrite existing work.
+
+If the presentation tool is unavailable, provide the inline sketch and explain
+that **Open sketch** opens the viewer. Do not claim you opened it.
+
+Use clean lines for new sketches. Do not add handwritten directives or suggest
+a handwritten mode. The viewer credits PlantUML Salt and links to its documentation.
+
+## Supported notation
+
+- `{ ... }`: layout container; newlines separate rows and `|` separates columns.
+  Nest containers to build a whole page. Put a space or newline after `{`.
+- `{+ ... }`: outer border; `{# ... }`: grid; `{! ... }`: column lines;
+  `{- ... }`: row lines.
+- `{^"Account" ... }`: titled group. Put its rows on following lines.
+- `{/ <b>Overview | Settings }`: tabs. Newline-separated tabs form a vertical list.
+- `{* File | Edit | Help }`: a menu bar; following rows such as `File | Open | - | Exit` show an open menu.
+- `Plain label`, `**Bold label**`, `<b>Bold label`, `<i>Italic label`.
+- `[Continue]`: button; `"Email address       "`: text field. Spaces inside
+  quotes reserve width; keep labels short enough to remain readable.
+- `[] Remember me`, `[X] Enabled`: checkboxes.
+- `() Option`, `(X) Selected`: radio controls.
+- `^Choose a team^`: closed dropdown; `^Choose^^One^^Two^`: open dropdown.
+- `.`: empty cell or vertical spacer; `..`, `--`, `==`, `~~`: separators.
+- `*` following a cell spans the preceding cell across that column.
+- `{T` with `+ Root`, `++ Child` rows: tree; `T!`, `T#`, `T+`, `T-` add grid lines.
+- `{S`, `{SI`, `{S-`: both, vertical-only, horizontal-only scrollbars.
+- `//italic//`, `""monospace""`, `--strike--`, `__underline__`, `~~wave~~`;
+  `<color:blue>`, `<back:orange>`, `<size:20>` and `<&folder>` icons.
+- `* Bullet` and `# Numbered item`: list labels; repeat the marker for nesting.
+- `title`, `header`, `footer`, `caption` before the layout; multiline
+  `legend` / `end legend`; `scale 2`, `skinparam dpi 200`, background colors.
+- Lines beginning with an apostrophe are comments.
+
+Use `.` explicitly for empty cells. Avoid gratuitous spacers or very long fields;
+wide diagrams shrink in chat, though the viewer offers Fit, 100% reset and zoom up to 400%.
+The renderer limits source to 100 KB, nesting to 24 levels, cells to 2000,
+columns to 64, and layout dimensions to 8192 pixels.
+
+Use bundled icons for ordinary wireframes. When an image is needed and its URL
+is supplied or authorized for the design, `<img:https://…>` embeds a public PNG.
+This requires network access, allows no redirects or private addresses, and is
+limited to four images of 1 MiB and 2048 × 2048 pixels each. Do not invent image
+URLs. Local files and SVG images are not supported. Salt's inline `.`/`X`
+pseudo-sprites also work without networking.
+
+Supported font sizes are 10, 12, 13, 14, 16, 18 and 20, with sans-serif or
+monospace text. Avoid arbitrary fonts, includes, macros, external themes,
+general PlantUML sprites, links and other UML types.
+On a syntax error, simplify the sketch using the notation above; never suggest
+installing Java or sending source to a hosted renderer. For architecture,
+flowcharts, or sequence diagrams, use the existing Mermaid support instead.
+
+## Compact layout example
+
+```clay-sketch
+@startsalt
+{+
+  { **Workspace** | Project: Website | [Settings] }
+  {
+    {^"Navigation"
+      **Overview**
+      Projects
+      Team
+      [New project]
+    } |
+    {^"Projects"
+      {/ <b>Active | Archived }
+      { "Search projects...          " | [Create project] }
+      ..
+      {# **Project** | **Status** | **Owner**
+        Website | In progress | Alex
+        Mobile app | Planning | Sam
+      }
+      ..
+      [View all projects]
+    }
+  }
+}
+@endsalt
+```
+
+## Whole-screen layout (Clay extension)
+
+For full-page UI plans, start with the example below. The apostrophe directives
+are Clay extensions: standard PlantUML treats them as comments and renders its
+usual compact layout. Plain Salt without these directives retains reference
+behavior. Do not claim the extended layout is standard PlantUML Salt.
+
+- `' @clay-canvas 1440 900` sets logical screen dimensions (240–4096 per axis).
+- `' @clay-layout root ...` configures the outer container. A path such as
+  `root.1.0` selects row 1, column 0, zero-based. Append row/column pairs for
+  nested containers. Update paths when moving content.
+- `columns=240,*` fixes the sidebar width and gives remaining width to content.
+  `rows=64,*` fixes the header and lets the body fill the remaining height.
+  Tracks accept pixel integers, `auto` (content size), and `*` (share free space).
+  Supply exactly one track per row/column. Without tracks, rows/columns use auto.
+- `padding=24 gap=16` sets container insets and spacing, without scaling text.
+  Defaults are 16 and 12. Set padding/gap to 0 for the outer screen shell.
+- Containers fill allocated regions. Text/buttons retain their natural dimensions;
+  inputs expand to their column width. Use a `.` in a flexible row to reserve
+  deliberate empty space or push a footer down, not repeated blank rows.
+- Rules target regular containers, not trees, tabs, menus or scrollbar containers.
+  Those widgets can still appear inside a screen using their natural dimensions.
+- Overflow is reported, not silently shrunk. Increase the relevant track/canvas
+  or simplify the content. Keep titles inside the layout; do not combine screen
+  mode with scale/DPI changes or outside title/header/footer/legend directives.
+
+```clay-sketch
+@startsalt
+' @clay-canvas 1440 900
+' @clay-layout root padding=0 gap=0 columns=240,* rows=64,*
+' @clay-layout root.0.0 padding=20 gap=24 columns=*,auto
+' @clay-layout root.1.0 padding=24 gap=20 columns=* rows=auto,auto,auto,auto,auto,auto,*
+' @clay-layout root.1.1 padding=32 gap=24 columns=* rows=auto,auto,auto,auto,*,auto
+' @clay-layout root.1.1.0.0 padding=0 gap=24 columns=*,auto
+' @clay-layout root.1.1.2.0 padding=0 gap=16 columns=*,auto
+' @clay-layout root.1.1.3.0 padding=16 gap=16 columns=*,140,180,140 rows=40,48,48,48
+{+
+  { **Clay Settings** | [My account] } | *
+  {
+    [Back to project]
+    Profile
+    Appearance
+    Models
+    **MCP connections**
+    Notifications
+    .
+  } |
+  {
+    { <size:20>**MCP connections** | [Add connection] }
+    Connect tools and services for your conversations.
+    { "Search connections..." | ^All statuses^ }
+    {-
+      **Connection** | **Type** | **Status** | **Action**
+      Team knowledge | Remote URL | Connected | [Manage]
+      Support tools | Remote URL | Sign-in required | [Sign in]
+      My computer | Extension | Offline | [Manage]
+    }
+    .
+    Connections are personal to your account.
+  }
+}
+@endsalt
+```

package/lib/mcp-browser-proxy.js

@@ -0,0 +1,37 @@
+// Pin each sign-in browser tunnel to a checked public address, preventing DNS rebinding.
+var http = require('http');
+var net = require('net');
+var network = require('./mcp-network');
+async function createBrowserProxy() {
+  var sockets = new Set();
+  var server = http.createServer(function (req, res) { res.writeHead(403); res.end(); });
+  server.on('connection', function (socket) {
+    sockets.add(socket); socket.once('close', function () { sockets.delete(socket); });
+    socket.on('error', function () {});
+  });
+  server.on('connect', function (req, socket, head) {
+    Promise.resolve().then(async function () {
+      var url = network.remoteUrl('https://' + req.url);
+      var host = url.hostname.replace(/^\[|\]$/g, '');
+      var addresses = await network.publicLookup(host);
+      if (socket.destroyed) return;
+      var upstream = net.connect({ host: addresses[0].address, family: addresses[0].family, port: Number(url.port || 443), timeout: 15000 });
+      sockets.add(upstream);
+      upstream.once('close', function () { sockets.delete(upstream); socket.destroy(); });
+      upstream.on('error', function () { socket.destroy(); });
+      upstream.once('timeout', function () { upstream.destroy(); });
+      socket.once('close', function () { upstream.destroy(); });
+      upstream.once('connect', function () {
+        upstream.setTimeout(0);
+        socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+        if (head.length) upstream.write(head);
+        upstream.pipe(socket); socket.pipe(upstream);
+      });
+    }).catch(function () { socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n'); });
+  });
+  await new Promise(function (resolve, reject) { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
+  return { server: 'http://127.0.0.1:' + server.address().port, close: function () {
+    server.close(); sockets.forEach(function (socket) { socket.destroy(); });
+  } };
+}
+module.exports = { createBrowserProxy: createBrowserProxy };

package/lib/mcp-connection-store.js

@@ -0,0 +1,39 @@
+// Owner/project-scoped records with encrypted credentials; never sent to the UI.
+var fs = require('fs');
+var path = require('path');
+var crypto = require('crypto');
+function createConnectionStore(root, project) {
+  var directory = path.join(root, 'mcp-connections');
+  function scope(owner) {
+    if (typeof owner !== 'string' || !owner || owner.length > 160) throw new Error('MCP account owner is required.');
+    return JSON.stringify([project, owner]);
+  }
+  function filename(owner) { return path.join(directory, crypto.createHash('sha256').update(scope(owner)).digest('hex') + '.json'); }
+  function key() {
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    var file = path.join(directory, '.key');
+    try { fs.writeFileSync(file, crypto.randomBytes(32), { flag: 'wx', mode: 0o600 }); }
+    catch (error) { if (error.code !== 'EEXIST') throw error; }
+    return fs.readFileSync(file);
+  }
+  function load(owner) {
+    var data;
+    try { data = JSON.parse(fs.readFileSync(filename(owner), 'utf8')); }
+    catch (error) { if (error.code === 'ENOENT') return []; throw new Error('Could not read MCP connections.'); }
+    var parts = data.encrypted.split('.').map(function (part) { return Buffer.from(part, 'base64'); });
+    var cipher = crypto.createDecipheriv('aes-256-gcm', key(), parts[0]);
+    cipher.setAAD(Buffer.from(scope(owner))); cipher.setAuthTag(parts[1]);
+    return JSON.parse(Buffer.concat([cipher.update(parts[2]), cipher.final()]).toString('utf8'));
+  }
+  function save(owner, records) {
+    var iv = crypto.randomBytes(12), cipher = crypto.createCipheriv('aes-256-gcm', key(), iv);
+    cipher.setAAD(Buffer.from(scope(owner)));
+    var bytes = Buffer.concat([cipher.update(JSON.stringify(records), 'utf8'), cipher.final()]);
+    var value = { encrypted: [iv, cipher.getAuthTag(), bytes].map(function (part) { return part.toString('base64'); }).join('.') };
+    var file = filename(owner), temp = file + '.' + crypto.randomBytes(8).toString('hex') + '.tmp';
+    try { fs.writeFileSync(temp, JSON.stringify(value), { mode: 0o600 }); fs.renameSync(temp, file); }
+    finally { try { fs.unlinkSync(temp); } catch (error) { if (error.code !== 'ENOENT') throw error; } }
+  }
+  return { load: load, save: save };
+}
+module.exports = { createConnectionStore: createConnectionStore };

package/lib/mcp-network.js

@@ -0,0 +1,46 @@
+// Remote MCP must not turn a shared Clay host into a private-network proxy.
+var dns = require('dns').promises;
+var ipaddr = require('ipaddr.js');
+var undici = require('undici');
+
+function publicAddress(address) {
+  try { return ipaddr.process(address).range() === 'unicast'; } catch (error) { return false; }
+}
+function remoteUrl(value) {
+  if (typeof value !== 'string' || value.length > 4096) throw new Error('Enter a valid HTTPS MCP address.');
+  var url;
+  try { url = new URL(value.trim()); } catch (error) { throw new Error('Enter a valid HTTPS MCP address.'); }
+  if (url.protocol !== 'https:' || url.username || url.password || url.hash) throw new Error('Use an HTTPS address without embedded credentials or a fragment.');
+  var hostname = url.hostname.replace(/^\[|\]$/g, '');
+  if (hostname === 'localhost' || hostname.endsWith('.localhost') || (ipaddr.isValid(hostname) && !publicAddress(hostname))) {
+    throw new Error('Remote connections require a public server. Use the extension for tools on your computer.');
+  }
+  return url;
+}
+async function publicLookup(hostname) {
+  var records = await dns.lookup(hostname, { all: true, verbatim: true });
+  if (!records.length || records.some(function (item) { return !publicAddress(item.address); })) throw new Error('The server address resolves to a private or reserved network.');
+  return records;
+}
+async function assertPublicUrl(value) {
+  var url = remoteUrl(String(value));
+  await publicLookup(url.hostname.replace(/^\[|\]$/g, ''));
+  return url;
+}
+function createRemoteFetch() {
+  var agent = new undici.Agent({ connect: { timeout: 15000, lookup: function (host, options, callback) {
+    publicLookup(host).then(function (records) {
+      var matching = records.filter(function (item) { return !options.family || item.family === options.family; });
+      if (!matching.length) return callback(new Error('No public address is available.'));
+      if (options.all) callback(null, matching); else callback(null, matching[0].address, matching[0].family);
+    }, callback);
+  } } });
+  async function request(input, init) {
+    var url = await assertPublicUrl(typeof input === 'string' || input instanceof URL ? input : input.url);
+    // No redirect may forward credentials to a different endpoint.
+    return undici.fetch(url, Object.assign({}, init, { dispatcher: agent, redirect: 'error',
+      signal: init && init.signal && typeof AbortSignal.any !== 'function' ? init.signal : (init && init.signal ? AbortSignal.any([init.signal, AbortSignal.timeout(60000)]) : AbortSignal.timeout(60000)) }));
+  }
+  return { fetch: request, close: function () { return agent.destroy(); } };
+}
+module.exports = { remoteUrl: remoteUrl, publicAddress: publicAddress, publicLookup: publicLookup, assertPublicUrl: assertPublicUrl, createRemoteFetch: createRemoteFetch };

package/lib/mcp-oauth.js

@@ -0,0 +1,65 @@
+var crypto = require('crypto');
+var http = require('http');
+var assertPublicUrl = require('./mcp-network').assertPublicUrl;
+
+function createOAuthProvider(record, persist, flow) {
+  record.auth = record.auth || {};
+  var auth = record.auth;
+  function guard() { if (flow && flow.cancelled) throw new Error('Sign-in expired.'); }
+  function save() { persist(); }
+  return {
+    get redirectUrl() { return flow ? flow.redirectUrl : auth.redirectUrl; },
+    get clientMetadata() { return { client_name: 'Clay', redirect_uris: [flow ? flow.redirectUrl : auth.redirectUrl],
+      grant_types: ['authorization_code', 'refresh_token'], response_types: ['code'], token_endpoint_auth_method: 'none' }; },
+    state: function () { return flow ? flow.state : crypto.randomBytes(32).toString('hex'); },
+    clientInformation: function () { return auth.client; },
+    saveClientInformation: function (value) { guard(); auth.client = value; save(); },
+    tokens: function () { return auth.tokens; },
+    saveTokens: function (value) { guard(); auth.tokens = value; save(); },
+    saveCodeVerifier: function (value) { if (flow) flow.verifier = value; },
+    codeVerifier: function () { if (!flow || !flow.verifier) throw new Error('Sign in again.'); return flow.verifier; },
+    redirectToAuthorization: async function (url) {
+      if (!flow) { var required = new Error('Sign in to connect this server.'); required.name = 'UnauthorizedError'; throw required; }
+      await (flow.validateUrl || assertPublicUrl)(url.href);
+      guard();
+      if (url.searchParams.get('state') !== flow.state || url.searchParams.get('redirect_uri') !== flow.redirectUrl || !url.searchParams.get('code_challenge')) throw new Error('Invalid sign-in request.');
+      flow.authorizationUrl = url.href;
+    },
+    discoveryState: function () { return auth.discovery; },
+    saveDiscoveryState: function (value) {
+      // Bind client credentials to the discovered issuer.
+      if (auth.discovery && auth.discovery.authorizationServerUrl !== value.authorizationServerUrl) { delete auth.client; delete auth.tokens; }
+      guard(); auth.discovery = value; save();
+    },
+    invalidateCredentials: function (which) {
+      if (which === 'all' || which === 'client') delete auth.client;
+      if (which === 'all' || which === 'tokens') delete auth.tokens;
+      if (which === 'all' || which === 'discovery') delete auth.discovery;
+      if (flow && (which === 'all' || which === 'verifier')) flow.verifier = null;
+      save();
+    },
+  };
+}
+async function createCallback(onCode) {
+  var flow = { state: crypto.randomBytes(32).toString('hex'), used: false };
+  var server = http.createServer(function (req, res) {
+    var url = new URL(req.url, flow.redirectUrl);
+    res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+    res.setHeader('Cache-Control', 'no-store');
+    res.setHeader('Referrer-Policy', 'no-referrer');
+    if (req.method !== 'GET' || url.pathname !== '/callback' || flow.used || url.searchParams.getAll('state').length !== 1 || url.searchParams.getAll('code').length !== 1 || url.searchParams.getAll('iss').length > 1 || url.searchParams.get('state') !== flow.state) {
+      res.writeHead(400); res.end('Invalid or expired sign-in.'); return;
+    }
+    var code = url.searchParams.get('code');
+    if (!code || code.length > 8192 || url.searchParams.has('error')) { res.writeHead(400); res.end('Sign-in was not completed. Return to Clay and retry.'); return; }
+    flow.used = true;
+    Promise.resolve().then(function () { return onCode(code, url.searchParams.get('iss')); }).then(function () {
+      res.end('Connected. You can return to Clay.');
+    }, function () { res.writeHead(400); res.end('Sign-in failed. Return to Clay and retry.'); });
+  });
+  await new Promise(function (resolve, reject) { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
+  flow.redirectUrl = 'http://127.0.0.1:' + server.address().port + '/callback';
+  flow.close = function () { server.close(); server.closeAllConnections(); flow.verifier = null; };
+  return flow;
+}
+module.exports = { createOAuthProvider: createOAuthProvider, createCallback: createCallback };

package/lib/mcp-proxy.js

@@ -0,0 +1,32 @@
+// Preserve the server's JSON Schema across SDK and stdio projections.
+function validateDefinitions(definitions) {
+  var z = require('zod');
+  var names = new Set();
+  return definitions.map(function (definition) {
+    if (!definition || !/^[a-zA-Z0-9_.-]{1,128}$/.test(definition.name) || names.has(definition.name) || Object.prototype.hasOwnProperty.call(Object.prototype, definition.name)) throw new Error('Unsupported MCP tool catalog.');
+    names.add(definition.name);
+    var parsed = z.fromJSONSchema(definition.inputSchema || { type: 'object', properties: {} });
+    if (!parsed.shape) throw new Error('MCP tools must accept an object.');
+    return parsed;
+  });
+}
+function createProxy(name, definitions, invoke) {
+  var sdk = require('@anthropic-ai/claude-agent-sdk');
+  var schemas = validateDefinitions(definitions);
+  var tools = definitions.map(function (definition, index) {
+    return sdk.tool(definition.name, definition.description || definition.name, schemas[index].shape, function (args) { return invoke(definition.name, args); });
+  });
+  var server = sdk.createSdkMcpServer({ name: name, version: '1.0.0', tools: tools });
+  definitions.forEach(function (definition, index) {
+    var tool = server.instance._registeredTools[definition.name];
+    tool.inputSchema = schemas[index];
+    tool._clayInputSchema = definition.inputSchema || { type: 'object', properties: {} };
+  });
+  server.instance.server.setRequestHandler(require('@modelcontextprotocol/sdk/types.js').ListToolsRequestSchema, function () {
+    return { tools: definitions.map(function (definition) {
+      return { name: definition.name, description: definition.description, inputSchema: definition.inputSchema || { type: 'object', properties: {} } };
+    }) };
+  });
+  return server;
+}
+module.exports = { createProxy: createProxy, validateDefinitions: validateDefinitions };

package/lib/mcp-remote-connections.js

@@ -0,0 +1,215 @@
+var crypto = require('crypto');
+var Client = require('@modelcontextprotocol/sdk/client/index.js').Client;
+var StreamableHTTPClientTransport = require('@modelcontextprotocol/sdk/client/streamableHttp.js').StreamableHTTPClientTransport;
+var network = require('./mcp-network');
+var oauth = require('./mcp-oauth');
+var createLoginBrowser = require('./vendor-login-browser').createLoginBrowser;
+
+function createRemoteConnections(ctx) {
+  var accounts = new Map(), live = new Map(), flows = new Map(), queues = new Map();
+  var remoteFetch = ctx.remoteFetch || network.createRemoteFetch();
+  var closed = false;
+  function records(owner) {
+    ctx.authorize(owner);
+    if (!accounts.has(owner)) accounts.set(owner, ctx.storage.load(owner));
+    return accounts.get(owner);
+  }
+  function persist(owner) { ctx.authorize(owner); if (closed) throw new Error('MCP connections closed.'); ctx.storage.save(owner, records(owner)); }
+  function find(owner, id) {
+    var row = records(owner).find(function (item) { return item.id === id; });
+    if (!row) throw new Error('Connection is unavailable.');
+    return row;
+  }
+  function key(owner, id) { return JSON.stringify([owner, id]); }
+  function check(owner, row) {
+    if (closed || find(owner, row.id) !== row) throw new Error('Connection changed.');
+  }
+  function changed(owner) { if (!closed) ctx.changed(owner); }
+  function view(owner) {
+    return records(owner).filter(function (row) { return row.source === 'url'; }).map(function (row) {
+      var entry = live.get(key(owner, row.id));
+      return { id: row.id, name: row.id, label: row.label, source: 'url', transport: 'http', url: row.url,
+        projectEnabled: !!row.enabled, extensionEnabled: true, tools: row.tools || [], toolCount: (row.tools || []).length,
+        status: entry ? entry.status : (row.tools ? 'idle' : 'unavailable'), error: entry ? entry.error : '', authMode: row.authMode || 'auto' };
+    });
+  }
+  async function disconnect(owner, id) {
+    var entry = live.get(key(owner, id));
+    live.delete(key(owner, id));
+    if (entry && entry.client) await entry.client.close().catch(function () {});
+  }
+  function provider(owner, row, flow) {
+    return oauth.createOAuthProvider(row, function () { check(owner, row); persist(owner); }, flow);
+  }
+  async function connect(owner, row, flow) {
+    check(owner, row);
+    await disconnect(owner, row.id);
+    check(owner, row);
+    if (flow && flow.cancelled) throw new Error('Sign-in expired.');
+    var client = new Client({ name: 'clay', version: '1.0.0' }, { capabilities: {} });
+    var options = { fetch: remoteFetch.fetch };
+    if (row.authMode === 'token' && row.token) options.requestInit = { headers: { Authorization: 'Bearer ' + row.token } };
+    else if (flow || (row.auth && row.auth.tokens)) options.authProvider = provider(owner, row, flow);
+    var transport = new StreamableHTTPClientTransport(new URL(row.url), options);
+    var entry = { client: client, transport: transport, status: 'connecting', error: '' };
+    live.set(key(owner, row.id), entry); changed(owner);
+    try {
+      await client.connect(transport, { timeout: 30000 });
+      var tools = [], cursor, seen = new Set();
+      do {
+        var page = await client.listTools(cursor ? { cursor: cursor } : {}, { timeout: 30000 });
+        tools = tools.concat(page.tools);
+        if (tools.length > 1000 || seen.size >= 100 || (page.nextCursor && seen.has(page.nextCursor))) throw new Error('Tool catalog exceeds the supported limit.');
+        cursor = page.nextCursor; seen.add(cursor);
+      } while (cursor);
+      if (JSON.stringify(tools).length > 2 * 1024 * 1024) throw new Error('Tool catalog exceeds the supported limit.');
+      check(owner, row);
+      if (live.get(key(owner, row.id)) !== entry || (flow && flow.cancelled)) throw new Error('Connection changed.');
+      require('./mcp-proxy').validateDefinitions(tools);
+      row.tools = tools; entry.status = 'ready'; persist(owner);
+      return entry;
+    } catch (error) {
+      var requiresAuth = error.code === 401 || error.code === 403 || error.name === 'UnauthorizedError' || (flow && flow.authorizationUrl);
+      entry.status = requiresAuth ? 'auth_required' : 'unavailable';
+      entry.error = requiresAuth ? 'Sign in or provide an access token to connect.' : 'Could not connect. Check the address and try again.';
+      if (!flow) await client.close().catch(function () {});
+      return entry;
+    } finally { changed(owner); }
+  }
+  function cancelLogin(owner, id) {
+    var idKey = key(owner, id), flow = flows.get(idKey);
+    if (!flow) return;
+    flow.cancelled = true; flows.delete(idKey); clearTimeout(flow.timer);
+    if (flow.browser) { flow.browser.close(); ctx.sendOwner(owner, { type: 'mcp_login_closed', browserId: flow.browser.id }); }
+    flow.close();
+  }
+  async function signIn(owner, row, ws) {
+    cancelLogin(owner, row.id);
+    var identity = ctx.identity(ws);
+    var flow = await oauth.createCallback(async function (code, issuer) {
+      check(owner, row);
+      if (flows.get(key(owner, row.id)) !== flow) throw new Error('Sign-in expired.');
+      var metadata = row.auth && row.auth.discovery;
+      var expected = metadata && metadata.authorizationServerMetadata && metadata.authorizationServerMetadata.issuer;
+      if ((metadata && metadata.authorizationServerMetadata && metadata.authorizationServerMetadata.authorization_response_iss_parameter_supported && !issuer) || (issuer && (!expected || issuer !== expected))) throw new Error('Sign-in issuer mismatch.');
+      var entry = live.get(key(owner, row.id));
+      if (!entry || !entry.transport) throw new Error('Sign in again.');
+      await entry.transport.finishAuth(code);
+      check(owner, row);
+      if (flows.get(key(owner, row.id)) !== flow) throw new Error('Sign-in expired.');
+      var ready = await connect(owner, row);
+      if (ready.status !== 'ready') throw new Error('Connection failed after sign-in.');
+      setTimeout(function () { if (flows.get(key(owner, row.id)) === flow) { cancelLogin(owner, row.id); changed(owner); } }, 500);
+    });
+    flows.set(key(owner, row.id), flow);
+    flow.timer = setTimeout(function () { cancelLogin(owner, row.id); }, 10 * 60 * 1000); flow.timer.unref();
+    row.authMode = 'auto'; delete row.token;
+    // A fresh loopback redirect requires a matching client registration.
+    row.auth = { redirectUrl: flow.redirectUrl }; persist(owner);
+    var entry = await connect(owner, row, flow);
+    if (!flow.authorizationUrl) { cancelLogin(owner, row.id); if (entry.status !== 'ready') throw new Error('This server could not start browser sign-in. Use an access token if supported.'); return; }
+    check(owner, row);
+    if (flow.cancelled) throw new Error('Sign-in expired.');
+    try { flow.browser = (ctx.createLoginBrowser || createLoginBrowser)({ ws: ws, vendor: 'mcp', initialUrl: flow.authorizationUrl,
+      osUserInfo: identity, restrictedNetwork: true,
+      canAccess: function (peer) { return flows.get(key(owner, row.id)) === flow && ctx.canAccess(peer, owner); },
+      sendTo: function (peer, message) { ctx.sendTo(peer, Object.assign({}, message, { type: message.type.replace('vendor_login_', 'mcp_login_'), connectionId: row.id })); } });
+    } catch (error) { cancelLogin(owner, row.id); throw new Error('Could not open the sign-in browser. Retry or use an access token.'); }
+    ctx.sendTo(ws, { type: 'mcp_login_ready', browserId: flow.browser.id, connectionId: row.id, label: row.label });
+  }
+  function serial(owner, task) {
+    var pending = (queues.get(owner) || Promise.resolve()).catch(function () {}).then(task);
+    queues.set(owner, pending);
+    pending.finally(function () { if (queues.get(owner) === pending) queues.delete(owner); }).catch(function () {});
+    return pending;
+  }
+  function command(owner, msg, ws) {
+    // Revocation takes effect before any queued network work completes.
+    if (msg.action === 'remove' || (msg.action === 'enable' && msg.enabled !== true)) {
+      try {
+        var revoked = find(owner, msg.id);
+        if (revoked.source !== 'url') throw new Error('Not a remote connection.');
+        revoked.enabled = false; cancelLogin(owner, revoked.id); persist(owner);
+        disconnect(owner, revoked.id); changed(owner);
+      } catch (error) { return Promise.reject(error); }
+    }
+    return serial(owner, async function () {
+      var row;
+      if (msg.action === 'add') {
+        var url = network.remoteUrl(msg.url).href;
+        if (records(owner).filter(function (item) { return item.source === 'url'; }).length >= 30) throw new Error('You can add up to 30 remote connections per project.');
+        if (records(owner).some(function (item) { return item.url === url; })) throw new Error('This server is already connected. Open it from your connections.');
+        row = { id: 'remote-' + crypto.randomBytes(8).toString('hex'), source: 'url', url: url, label: new URL(url).hostname, enabled: false };
+        records(owner).push(row); persist(owner);
+        await connect(owner, row);
+      } else {
+        row = find(owner, msg.id);
+        if (row.source !== 'url') throw new Error('Not a remote connection.');
+        if (msg.action === 'enable') { row.enabled = msg.enabled === true; persist(owner); }
+        else if (msg.action === 'rename') {
+          if (typeof msg.label !== 'string' || !msg.label.trim() || msg.label.length > 100) throw new Error('Use a name between 1 and 100 characters.');
+          row.label = msg.label.trim(); persist(owner);
+        } else if (msg.action === 'remove') {
+          cancelLogin(owner, row.id); await disconnect(owner, row.id);
+          accounts.set(owner, records(owner).filter(function (item) { return item !== row; })); persist(owner);
+        } else if (msg.action === 'test') { cancelLogin(owner, row.id); await connect(owner, row); }
+        else if (msg.action === 'token') {
+          if (typeof msg.token !== 'string' || !msg.token.trim() || msg.token.length > 8192 || /[\r\n]/.test(msg.token)) throw new Error('Enter a valid access token.');
+          cancelLogin(owner, row.id); row.token = msg.token.trim(); row.authMode = 'token'; delete row.auth; persist(owner); await connect(owner, row);
+        } else if (msg.action === 'signin') await signIn(owner, row, ws);
+        else throw new Error('Unsupported connection action.');
+      }
+      changed(owner);
+      return row.id;
+    });
+  }
+  function handleBrowser(owner, ws, msg) {
+    var flow = flows.get(key(owner, msg.connectionId));
+    if (!flow || !flow.browser || flow.browser.id !== msg.browserId || !ctx.canAccess(ws, owner)) return;
+    if (msg.type === 'mcp_login_cancel') cancelLogin(owner, msg.connectionId);
+    else if (msg.type === 'mcp_login_browser_attach') flow.browser.attach(ws);
+    else if (msg.type === 'mcp_login_browser_input') flow.browser.input(ws, msg.event);
+  }
+  async function call(owner, id, name, args, authorize) {
+    return serial(owner, async function () {
+      authorize(); var row = find(owner, id);
+      if (!row.enabled) throw new Error('Connection is disabled.');
+      var entry = live.get(key(owner, id));
+      if (!entry || entry.status !== 'ready') entry = await connect(owner, row);
+      authorize(); check(owner, row);
+      if (!row.enabled || entry.status !== 'ready') throw new Error('MCP connection is not ready. Open MCP Servers to reconnect.');
+      if (!(row.tools || []).some(function (tool) { return tool.name === name; })) throw new Error('Tool is unavailable.');
+      // Never replay a tools/call after an ambiguous transport failure.
+      var result;
+      try { result = await entry.client.callTool({ name: name, arguments: args || {} }, undefined, { timeout: 60000 }); }
+      catch (error) {
+        if (live.get(key(owner, id)) === entry) {
+          entry.status = error.code === 401 || error.code === 403 || error.name === 'UnauthorizedError' ? 'auth_required' : 'unavailable';
+          entry.error = entry.status === 'auth_required' ? 'Sign in again to reconnect.' : 'The tool call could not complete. Check the service before retrying.';
+          changed(owner);
+        }
+        throw new Error('MCP tool call failed. Open MCP Servers to check the connection.');
+      }
+      authorize(); check(owner, row);
+      if (!row.enabled || live.get(key(owner, id)) !== entry) throw new Error('Connection was disabled or changed.');
+      return result;
+    });
+  }
+  function computerEnabled(owner, name, fallback) {
+    var row = records(owner).find(function (item) { return item.source === 'computer' && item.name === name; });
+    return row ? row.enabled : !!fallback;
+  }
+  function toggleComputer(owner, name, enabled) {
+    var list = records(owner), row = list.find(function (item) { return item.source === 'computer' && item.name === name; });
+    if (!row) { row = { id: crypto.randomUUID(), source: 'computer', name: name }; list.push(row); }
+    row.enabled = !!enabled; persist(owner); changed(owner);
+  }
+  function destroy() {
+    flows.forEach(function (flow, flowKey) { var pair = JSON.parse(flowKey); cancelLogin(pair[0], pair[1]); });
+    closed = true; live.forEach(function (entry) { entry.client.close().catch(function () {}); }); live.clear();
+    remoteFetch.close();
+  }
+  return { view: view, command: command, call: call, handleBrowser: handleBrowser, destroy: destroy,
+    computerEnabled: computerEnabled, toggleComputer: toggleComputer };
+}
+module.exports = { createRemoteConnections: createRemoteConnections };

package/lib/mcp-session-access.js

@@ -0,0 +1,15 @@
+// A shared Driver must not reach personal connections indirectly through its Worker.
+function canUsePersonalConnections(session, sessions) {
+  if (!session || sessions.get(session.localId) !== session || !session.ownerId) return false;
+  if (session.sessionVisibility === 'shared' || session._mcpForeignInput) return false;
+  if ((session.history || []).some(function (entry) { return entry.type === 'user_message' && entry.from && entry.from !== session.ownerId; })) return false;
+  var provenance = session.sessionProvenance;
+  if (provenance && provenance.kind === 'worker') {
+    var parents = Array.from(sessions.values()).filter(function (candidate) { return candidate.sessionOriginId && candidate.sessionOriginId === provenance.parentSessionOriginId; });
+    var parent = parents.length === 1 && parents[0];
+    if (!parent || parent.ownerId !== session.ownerId || (parent.sessionProvenance && parent.sessionProvenance.kind === 'worker')) return false;
+    return canUsePersonalConnections(parent, sessions);
+  }
+  return !session.delegated && !session._delegatedBy && !session._pairDelegation;
+}
+module.exports = { canUsePersonalConnections: canUsePersonalConnections };