clay-server 4.8.2 → 5.0.0-beta.1

package/lib/plantuml-renderer.js

@@ -0,0 +1,43 @@
+var MAX_SOURCE_BYTES = 100000;
+var MAX_SVG_BYTES = 8 * 1024 * 1024;
+
+function failure(message, status) {
+  var error = new Error(message);
+  error.status = status || 422;
+  return error;
+}
+
+function isPlantUmlFile(file) {
+  return /\.(puml|plantuml|pu|uml|salt)$/i.test(String(file || ""));
+}
+
+function prepareSource(source, file) {
+  source = String(source || "").replace(/^\uFEFF/, "");
+  if (Buffer.byteLength(source) > MAX_SOURCE_BYTES) throw failure("Diagram is too large to preview (100 KB maximum).", 413);
+  if (!source.trim()) throw failure("This diagram is empty.");
+  if (/\.salt$/i.test(file) && !/@start\w+/i.test(source)) source = "@startsalt\n" + source + "\n@endsalt";
+  if (!/^\s*@start\w+\b/im.test(source)) throw failure("Add @startsalt / @endsalt or @startuml / @enduml around the diagram.");
+  if ((source.match(/^\s*@start\w+\b/gim) || []).length > 1) throw failure("Preview supports one diagram per file. Split these diagrams into separate files.");
+  return source;
+}
+
+function renderPlantUml(source, options) {
+  options = options || {};
+  return new Promise(function (resolve, reject) {
+    setImmediate(async function () {
+      try {
+        if (options.signal && options.signal.aborted) throw failure("Diagram rendering cancelled.", 499);
+        source = prepareSource(source, "diagram.puml");
+        var tree = require("./salt-parser").parseSalt(source);
+        await require('./salt-images').resolveImages(tree, options);
+        if (options.signal && options.signal.aborted) throw failure("Diagram rendering cancelled.", 499);
+        var svg = require("./salt-svg").renderSaltSvg(tree);
+        if (Buffer.byteLength(svg) > MAX_SVG_BYTES) throw failure("Rendered wireframe is too large.", 413);
+        resolve(svg);
+      } catch (error) { reject(error); }
+    });
+  });
+}
+
+module.exports = { renderPlantUml: renderPlantUml, prepareSource: prepareSource,
+  isPlantUmlFile: isPlantUmlFile, MAX_SOURCE_BYTES: MAX_SOURCE_BYTES };

package/lib/project-file-http.js

@@ -14,8 +14,10 @@ function attachFileHTTP(ctx) {
   var access = ctx.requestAccess || attachRequestAccess(Object.assign({}, ctx, {
     getOsUserInfoForWs: ctx.getOsUserInfoForReq,
   }));
+  var plantUml = require("./project-plantuml").attachPlantUmlHTTP(Object.assign({}, ctx, { requestAccess: access }));
 
   function handleHTTP(req, res, urlPath) {
+    if (plantUml.handleHTTP(req, res, urlPath)) return true;
     var download = urlPath.startsWith("/api/file/download?");
     if (req.method !== "GET" || (!download && !urlPath.startsWith("/api/file?"))) return false;
     try {

package/lib/project-mcp.js

@@ -1,375 +1,148 @@
-var crypto = require("crypto");
-
-// MCP Bridge module: manages remote MCP servers reported by the Chrome Extension.
-// Creates proxy MCP server objects that forward tool calls over WebSocket.
-// Follows the attachXxx(ctx) pattern per MODULE_MAP.md.
+var crypto = require('crypto');
+var createProxy = require('./mcp-proxy').createProxy;
+var createStore = require('./mcp-connection-store').createConnectionStore;
+var createRemoteConnections = require('./mcp-remote-connections').createRemoteConnections;
 
 function attachMcp(ctx) {
-  var send = ctx.send;
-  var sendTo = ctx.sendTo;
-  var slug = ctx.slug;
-  var isMate = ctx.isMate;
-  var getEnabledMcpServers = ctx.getEnabledMcpServers;
-  var setEnabledMcpServers = ctx.setEnabledMcpServers;
-  var getExtensionWs = ctx.getExtensionWs;
-  var getExtensionId = ctx.getExtensionId || function () { return null; };
-  var localMcp = ctx.localMcp || null; // mcp-local instance for localhost clients
-
-  // Available servers reported by extension: { name -> { name, transport, tools, enabled } }
-  var _availableServers = {};
-
-  // Proxy MCP server objects for the SDK: { name -> sdkMcpServerConfig }
-  var _proxyServers = {};
-
-  // Pending tool calls: { callId -> { resolve, reject, timer } }
-  var _pendingCalls = {};
-
-  var TOOL_TIMEOUT_MS = 30000;
-
-  // ---------- Message Handler ----------
-
+  var devices = new Map(), pending = new Map();
+  function ownerFor(ws) {
+    if (!ctx.canAccess(ws)) throw new Error('MCP access is not permitted.');
+    return ctx.isMultiUser() ? String(ws._clayUser.id) : 'default';
+  }
+  function authorizeOwner(owner) { if (!ctx.canUseOwner(owner)) throw new Error('MCP account is unavailable.'); }
+  function sendOwner(owner, msg) {
+    ctx.clients.forEach(function (ws) {
+      try { if (ws.readyState === 1 && ownerFor(ws) === owner) ctx.sendTo(ws, Object.assign({ slug: ctx.slug }, msg)); } catch (error) {}
+    });
+  }
+  var remote = createRemoteConnections({
+    remoteFetch: ctx.remoteFetch, createLoginBrowser: ctx.createLoginBrowser,
+    storage: ctx.storage || createStore(ctx.root, ctx.slug), authorize: authorizeOwner,
+    changed: function (owner) { broadcast(owner); }, sendOwner: sendOwner, sendTo: function (ws, msg) { ctx.sendTo(ws, Object.assign({ slug: ctx.slug }, msg)); },
+    identity: ctx.identity,
+    canAccess: function (ws, owner) { try { return ownerFor(ws) === owner; } catch (error) { return false; } },
+  });
+  function deviceFor(owner) {
+    var device = devices.get(owner);
+    if (!device || device.ws.readyState !== 1) return null;
+    try { if (ownerFor(device.ws) !== owner) return null; } catch (error) { return null; }
+    return device;
+  }
+  function enabled(owner, name) {
+    var legacy = !ctx.isMultiUser() && (ctx.getEnabledMcpServers() || []).indexOf(name) >= 0;
+    return remote.computerEnabled(owner, name, legacy);
+  }
+  function buildState(owner) {
+    var active = deviceFor(owner), device = devices.get(owner), servers = remote.view(owner);
+    if (device) device.servers.forEach(function (server) {
+      servers.push({ id: server.name, name: server.name, label: server.name, source: 'computer', transport: 'stdio',
+        toolCount: server.tools.length, tools: server.tools, projectEnabled: enabled(owner, server.name),
+        extensionEnabled: server.enabled, status: active && server.enabled && device.hostConnected ? 'ready' : 'unavailable',
+        error: active && device.hostConnected ? '' : 'Reconnect the local bridge on your computer.' });
+    });
+    return { type: 'mcp_servers_state', slug: ctx.slug, servers: servers,
+      hostConnected: !!(active && device.hostConnected), extensionConnected: !!active,
+      extensionId: device ? device.extensionId : null };
+  }
+  function broadcast(owner) {
+    try { sendOwner(owner, buildState(owner)); } catch (error) {}
+  }
+  function sendConnectionState(ws) {
+    try { ctx.sendTo(ws, buildState(ownerFor(ws))); } catch (error) {}
+  }
+  function disconnectDevice(ws) {
+    devices.forEach(function (device, owner) {
+      if (ws && device.ws !== ws) return;
+      if (!ws && device.ws.readyState === 1) return;
+      device.hostConnected = false;
+      pending.forEach(function (call, id) {
+        if (call.ws !== device.ws) return;
+        clearTimeout(call.timer); pending.delete(id); call.reject(new Error('Your computer disconnected.'));
+      });
+      broadcast(owner);
+    });
+  }
   function handleMcpMessage(ws, msg) {
-    if (msg.type === "mcp_servers_available") {
-      handleServersAvailable(ws, msg);
-      return true;
+    if (!msg || typeof msg.type !== 'string' || (msg.type.indexOf('mcp_') !== 0 && msg.type !== 'mcp_toggle_server')) return false;
+    var owner;
+    try { owner = ownerFor(ws); } catch (error) { return true; }
+    if (msg.type === 'mcp_state_request') { sendConnectionState(ws); return true; }
+    if (msg.type === 'mcp_servers_available') {
+      var servers = Array.isArray(msg.servers) ? msg.servers : [];
+      if (servers.length > 100 || JSON.stringify(servers).length > 2 * 1024 * 1024) return true;
+      servers = servers.filter(function (server) { return server && /^[a-zA-Z0-9_-]{1,80}$/.test(server.name) && !/^(clay-|remote-)/.test(server.name) && !Object.prototype.hasOwnProperty.call(Object.prototype, server.name) && !server.url && server.transport !== 'http'; }).map(function (server) {
+        return { name: server.name, enabled: server.enabled !== false, tools: Array.isArray(server.tools) ? server.tools.slice(0, 1000) : [] };
+      });
+      var old = devices.get(owner);
+      if (old && old.ws !== ws) disconnectDevice(old.ws);
+      devices.set(owner, { ws: ws, servers: servers, hostConnected: !!msg.hostConnected, extensionId: ctx.extensionId(ws) });
+      broadcast(owner); return true;
     }
-    if (msg.type === "mcp_tool_result") {
-      handleToolResult(msg);
+    if (msg.type === 'mcp_tool_result' || msg.type === 'mcp_tool_error') {
+      var call = pending.get(msg.callId);
+      if (!call || call.ws !== ws || call.owner !== owner) return true;
+      clearTimeout(call.timer); pending.delete(msg.callId);
+      try { call.authorize(); } catch (error) { call.reject(error); return true; }
+      if (msg.type === 'mcp_tool_error') call.reject(new Error('Computer MCP tool failed.'));
+      else call.resolve(msg.result || { content: [] });
       return true;
     }
-    if (msg.type === "mcp_tool_error") {
-      handleToolError(msg);
+    if (msg.type.indexOf('mcp_login_') === 0) { remote.handleBrowser(owner, ws, msg); return true; }
+    if (msg.type === 'mcp_toggle_server') {
+      var device = deviceFor(owner);
+      if (device && device.servers.some(function (server) { return server.name === msg.name; })) {
+        try { remote.toggleComputer(owner, msg.name, msg.enabled); } catch (error) { ctx.sendTo(ws, { type: 'mcp_action_result', ok: false, error: error.message }); }
+      }
       return true;
     }
-    if (msg.type === "mcp_toggle_server") {
-      handleToggleServer(ws, msg);
+    if (msg.type === 'mcp_connection_action') {
+      remote.command(owner, msg, ws).then(function (id) {
+        if (ownerFor(ws) === owner) ctx.sendTo(ws, { type: 'mcp_action_result', slug: ctx.slug, requestId: msg.requestId, ok: true, id: id, action: msg.action });
+      }).catch(function (error) {
+        try { if (ownerFor(ws) === owner) ctx.sendTo(ws, { type: 'mcp_action_result', slug: ctx.slug, requestId: msg.requestId, ok: false, error: error.message }); } catch (ignored) {}
+      });
       return true;
     }
     return false;
   }
-
-  var _remoteHostConnected = false;
-
-  function handleServersAvailable(ws, msg) {
-    var servers = msg.servers || [];
-    _remoteHostConnected = !!msg.hostConnected;
-    _availableServers = {};
-    for (var i = 0; i < servers.length; i++) {
-      var s = servers[i];
-      _availableServers[s.name] = {
-        name: s.name,
-        transport: s.transport || "stdio",
-        tools: s.tools || [],
-        enabled: s.enabled !== false,
-      };
-    }
-
-    // Rebuild proxy servers based on project-level enabled list
-    rebuildProxyServers();
-
-    // Broadcast updated state to all clients
-    broadcastMcpState();
-  }
-
-  function handleToolResult(msg) {
-    var callId = msg.callId;
-    console.log("[mcp-bridge] Tool result received: " + callId);
-    var pending = _pendingCalls[callId];
-    if (!pending) return;
-    if (pending.timer) clearTimeout(pending.timer);
-    delete _pendingCalls[callId];
-    pending.resolve(msg.result || { content: [{ type: "text", text: "(empty result)" }] });
-  }
-
-  function handleToolError(msg) {
-    var callId = msg.callId;
-    console.log("[mcp-bridge] Tool error received: " + callId + " error=" + (msg.error || "unknown"));
-    var pending = _pendingCalls[callId];
-    if (!pending) return;
-    if (pending.timer) clearTimeout(pending.timer);
-    delete _pendingCalls[callId];
-    pending.reject(new Error(msg.error || "MCP tool call failed"));
-  }
-
-  function handleToggleServer(ws, msg) {
-    var name = msg.name;
-    var enabled = !!msg.enabled;
-
-    var list = getEnabledMcpServers() || [];
-    var idx = list.indexOf(name);
-
-    if (enabled && idx === -1) {
-      list.push(name);
-    } else if (!enabled && idx !== -1) {
-      list.splice(idx, 1);
-    }
-
-    setEnabledMcpServers(list);
-    rebuildProxyServers();
-    broadcastMcpState();
-  }
-
-  // ---------- Proxy Server Builder ----------
-
-  function rebuildProxyServers() {
-    _proxyServers = {};
-
-    var sdk;
-    try {
-      sdk = require("@anthropic-ai/claude-agent-sdk");
-    } catch (e) {
-      console.error("[mcp-bridge] Failed to load SDK:", e.message);
-      return;
-    }
-
-    var createSdkMcpServer = sdk.createSdkMcpServer;
-    var tool = sdk.tool;
-    if (!createSdkMcpServer || !tool) {
-      console.error("[mcp-bridge] SDK missing createSdkMcpServer or tool helper");
-      return;
-    }
-
-    var z;
-    try { z = require("zod").z; } catch (e) {
-      try { z = require("zod"); } catch (e2) {
-        console.error("[mcp-bridge] Failed to load zod:", e2.message);
-        return;
-      }
-    }
-
-    var enabledList = getEnabledMcpServers() || [];
-
-    // --- Remote servers (via Extension) ---
-    var serverNames = Object.keys(_availableServers);
-    for (var si = 0; si < serverNames.length; si++) {
-      var serverName = serverNames[si];
-      var serverInfo = _availableServers[serverName];
-
-      if (!serverInfo.enabled) continue;
-      if (enabledList.indexOf(serverName) === -1) continue;
-
-      var tools = [];
-      var serverTools = serverInfo.tools || [];
-
-      for (var ti = 0; ti < serverTools.length; ti++) {
-        var mcpTool = serverTools[ti];
-        var toolName = mcpTool.name;
-        var toolDesc = mcpTool.description || toolName;
-        var shape = buildZodShape(z, mcpTool.inputSchema);
-
-        tools.push(tool(
-          toolName,
-          toolDesc,
-          shape,
-          createToolHandler(serverName, toolName)
-        ));
-      }
-
-      if (tools.length > 0) {
-        var mcpServer = createSdkMcpServer({
-          name: serverName,
-          version: "1.0.0",
-          tools: tools,
-        });
-        _proxyServers[serverName] = mcpServer;
-      }
-    }
-
-    // --- Local servers (direct process, localhost only) ---
-    if (localMcp && localMcp.isReady()) {
-      var localServers = localMcp.getAvailableServers();
-      for (var li = 0; li < localServers.length; li++) {
-        var ls = localServers[li];
-        if (!ls.ready) continue;
-        if (_proxyServers[ls.name]) continue; // remote takes precedence if same name
-        if (enabledList.indexOf(ls.name) === -1) continue;
-
-        var localTools = [];
-        for (var lti = 0; lti < ls.tools.length; lti++) {
-          var lt = ls.tools[lti];
-          var ltShape = buildZodShape(z, lt.inputSchema);
-          localTools.push(tool(
-            lt.name,
-            lt.description || lt.name,
-            ltShape,
-            createLocalToolHandler(ls.name, lt.name)
-          ));
-        }
-
-        if (localTools.length > 0) {
-          _proxyServers[ls.name] = createSdkMcpServer({
-            name: ls.name,
-            version: "1.0.0",
-            tools: localTools,
-          });
-        }
-      }
-    }
-  }
-
-  function createLocalToolHandler(serverName, toolName) {
-    return function (args) {
-      return localMcp.callTool(serverName, toolName, args);
-    };
-  }
-
-  function createToolHandler(serverName, toolName) {
-    return function (args) {
-      return new Promise(function (resolve, reject) {
-        var extWs = getExtensionWs();
-        if (!extWs || extWs.readyState !== 1) {
-          reject(new Error("Browser extension not connected. Cannot reach MCP server: " + serverName));
-          return;
-        }
-
-        var callId = "mc_" + Date.now() + "_" + crypto.randomUUID().slice(0, 8);
-
-        var timer = setTimeout(function () {
-          console.log("[mcp-bridge] Tool call TIMEOUT: " + callId + " server=" + serverName + " tool=" + toolName);
-          delete _pendingCalls[callId];
-          reject(new Error("MCP tool call timed out after " + (TOOL_TIMEOUT_MS / 1000) + "s"));
-        }, TOOL_TIMEOUT_MS);
-
-        _pendingCalls[callId] = { resolve: resolve, reject: reject, timer: timer };
-
-        console.log("[mcp-bridge] Sending tool call: " + callId + " server=" + serverName + " tool=" + toolName);
-        sendTo(extWs, {
-          type: "mcp_tool_call",
-          callId: callId,
-          server: serverName,
-          method: "tools/call",
-          params: { name: toolName, arguments: args },
-        });
-      });
-    };
-  }
-
-  // Build a Zod shape from MCP JSON Schema inputSchema
-  function buildZodShape(z, inputSchema) {
-    if (!inputSchema || !inputSchema.properties) return {};
-    var shape = {};
-    var props = inputSchema.properties;
-    var required = inputSchema.required || [];
-    var keys = Object.keys(props);
-
-    for (var i = 0; i < keys.length; i++) {
-      var k = keys[i];
-      var p = props[k];
-      var field;
-
-      if (p.type === "number" || p.type === "integer") {
-        field = z.number();
-      } else if (p.type === "boolean") {
-        field = z.boolean();
-      } else if (p.type === "array") {
-        field = z.array(z.any());
-      } else if (p.type === "object") {
-        field = z.record(z.any());
-      } else if (p.enum) {
-        field = z.enum(p.enum);
-      } else {
-        field = z.string();
-      }
-
-      if (p.description) field = field.describe(p.description);
-      if (required.indexOf(k) === -1) field = field.optional();
-      shape[k] = field;
+  function callComputer(owner, server, tool, args, authorize) {
+    return new Promise(function (resolve, reject) {
+      authorize();
+      var device = deviceFor(owner);
+      if (!device || !device.hostConnected || !enabled(owner, server)) throw new Error('Computer connection is unavailable or disabled.');
+      var row = device.servers.find(function (item) { return item.name === server && item.enabled; });
+      if (!row || !row.tools.some(function (item) { return item.name === tool; })) throw new Error('Computer tool is unavailable.');
+      var id = crypto.randomUUID();
+      var timer = setTimeout(function () { pending.delete(id); reject(new Error('Computer tool timed out.')); }, 60000);
+      pending.set(id, { owner: owner, ws: device.ws, resolve: resolve, reject: reject, timer: timer, authorize: function () {
+        authorize(); if (!enabled(owner, server) || deviceFor(owner) !== device) throw new Error('Computer access changed.');
+      } });
+      ctx.sendTo(device.ws, { type: 'mcp_tool_call', callId: id, server: server, method: 'tools/call', params: { name: tool, arguments: args } });
+    });
+  }
+  function getMcpServers(session) {
+    if (!session || !ctx.canUseSession(session)) return {};
+    var owner = ctx.isMultiUser() ? String(session.ownerId) : 'default';
+    function authorize() {
+      authorizeOwner(owner);
+      if (!ctx.canUseSession(session) || (ctx.isMultiUser() && String(session.ownerId) !== owner)) throw new Error('Session MCP access changed.');
     }
-    return shape;
-  }
-
-  // ---------- State Broadcasting ----------
-
-  function broadcastMcpState() {
-    var state = buildMcpState();
-    send(state);
-  }
-
-  function sendConnectionState(ws) {
-    sendTo(ws, buildMcpState());
-  }
-
-  function buildMcpState() {
-    var enabledList = getEnabledMcpServers() || [];
-    var servers = [];
-    var seen = {};
-
-    // Remote servers (from Extension)
-    var names = Object.keys(_availableServers);
-    for (var i = 0; i < names.length; i++) {
-      var name = names[i];
-      var info = _availableServers[name];
-      seen[name] = true;
-      servers.push({
-        name: name,
-        transport: info.transport,
-        toolCount: (info.tools || []).length,
-        extensionEnabled: info.enabled,
-        projectEnabled: enabledList.indexOf(name) !== -1,
-        source: "remote",
-      });
-    }
-
-    // Local servers
-    if (localMcp && localMcp.isReady()) {
-      var localServers = localMcp.getAvailableServers();
-      for (var j = 0; j < localServers.length; j++) {
-        var ls = localServers[j];
-        if (seen[ls.name]) continue;
-        servers.push({
-          name: ls.name,
-          transport: ls.transport || "stdio",
-          toolCount: ls.toolCount || 0,
-          extensionEnabled: true,
-          projectEnabled: enabledList.indexOf(ls.name) !== -1,
-          source: "local",
+    var result = {};
+    buildState(owner).servers.forEach(function (server) {
+      if (!server.projectEnabled || !server.extensionEnabled || !server.tools.length) return;
+      try {
+        result[server.name] = createProxy(server.name, server.tools, function (tool, args) {
+          return server.source === 'url' ? remote.call(owner, server.id, tool, args, authorize) : callComputer(owner, server.name, tool, args, authorize);
         });
-      }
-    }
-
-    return {
-      type: "mcp_servers_state",
-      servers: servers,
-      hostConnected: _remoteHostConnected || !!(localMcp && localMcp.isReady()),
-      extensionId: getExtensionId() || null,
-    };
-  }
-
-  // ---------- Public API ----------
-
-  function getMcpServers() {
-    return _proxyServers;
-  }
-
-  function cancelAllPending() {
-    var ids = Object.keys(_pendingCalls);
-    for (var i = 0; i < ids.length; i++) {
-      var pending = _pendingCalls[ids[i]];
-      if (pending.timer) clearTimeout(pending.timer);
-      pending.reject(new Error("MCP bridge disconnected"));
-    }
-    _pendingCalls = {};
-  }
-
-  function handleExtensionDisconnect() {
-    cancelAllPending();
-    _availableServers = {};
-    _proxyServers = {};
-    broadcastMcpState();
+      } catch (error) { /* Unsupported schemas are not advertised as callable tools. */ }
+    });
+    return result;
   }
-
-  function rebuildAndBroadcast() {
-    rebuildProxyServers();
-    broadcastMcpState();
+  function destroy() {
+    pending.forEach(function (call) { clearTimeout(call.timer); call.reject(new Error('MCP closed.')); }); pending.clear();
+    devices.clear(); remote.destroy();
   }
-
-  return {
-    handleMcpMessage: handleMcpMessage,
-    getMcpServers: getMcpServers,
-    sendConnectionState: sendConnectionState,
-    handleExtensionDisconnect: handleExtensionDisconnect,
-    rebuildAndBroadcast: rebuildAndBroadcast,
-  };
+  return { handleMcpMessage: handleMcpMessage, getMcpServers: getMcpServers, sendConnectionState: sendConnectionState,
+    handleExtensionDisconnect: disconnectDevice, rebuildAndBroadcast: function () { devices.forEach(function (device, owner) { broadcast(owner); }); }, destroy: destroy };
 }
-
 module.exports = { attachMcp: attachMcp };

package/lib/project-plantuml.js

@@ -0,0 +1,48 @@
+var fs = require("fs");
+var filePaths = require("./project-file-path");
+var renderer = require("./plantuml-renderer");
+
+function attachPlantUmlHTTP(ctx) {
+  var wireframes = require("./project-wireframe-http").attachWireframeHTTP(ctx);
+  function handleHTTP(req, res, urlPath) {
+    if (wireframes.handleHTTP(req, res, urlPath)) return true;
+    if (!urlPath.startsWith("/api/file/plantuml?")) return false;
+    function fail(error) {
+      if (res.destroyed) return;
+      var mapped = filePaths.fileError(error);
+      res.writeHead(error.status || mapped.status, { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": "no-store" });
+      res.end(error.status ? error.message : mapped.message);
+    }
+    if (req.method !== "GET") { fail({ status: 405, message: "Use GET to preview a diagram." }); return true; }
+    var scope;
+    var requested;
+    var source;
+    try {
+      scope = ctx.requestAccess.fileScope(req);
+      requested = new URLSearchParams(urlPath.substring(urlPath.indexOf("?"))).get("path");
+      var file = filePaths.resolveFilePath(ctx.cwd, requested, scope);
+      if (!renderer.isPlantUmlFile(file)) throw { status: 415, message: "Select a PlantUML or Salt file to preview." };
+      var stat = scope.identity ? ctx.fsAsUser("stat", { file: file }, scope.identity) : fs.statSync(file);
+      if (stat.size > renderer.MAX_SOURCE_BYTES) throw { status: 413, message: "Diagram is too large to preview (100 KB maximum)." };
+      source = scope.identity ? ctx.fsAsUser("read", { file: file, readContent: true }, scope.identity).content : fs.readFileSync(file, "utf8");
+      source = renderer.prepareSource(source, requested);
+    } catch (error) { fail(error); return true; }
+    var controller = new AbortController();
+    function cancel() { controller.abort(); }
+    if (res.once) res.once("close", cancel);
+    (ctx.renderPlantUml || renderer.renderPlantUml)(source, { signal: controller.signal }).then(function (svg) {
+      if (res.destroyed || controller.signal.aborted) return;
+      try { ctx.requestAccess.fileScope(req); }
+      catch (error) { fail(error); return; }
+      res.writeHead(200, {
+        "Content-Type": "image/svg+xml; charset=utf-8", "Cache-Control": "no-store",
+        "X-Content-Type-Options": "nosniff", "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox",
+      });
+      res.end(svg);
+    }).catch(fail).finally(function () { if (res.removeListener) res.removeListener("close", cancel); });
+    return true;
+  }
+  return { handleHTTP: handleHTTP };
+}
+
+module.exports = { attachPlantUmlHTTP: attachPlantUmlHTTP };

package/lib/project-session-document.js

@@ -2,6 +2,9 @@ var fs = require("fs");
 var path = require("path");
 var sessionDocumentMcp = require("./session-document-mcp-server");
 
+var wireframeRenderer = require("./plantuml-renderer");
+var WIREFRAME_PROMPT = "When the user asks to see a wireframe, visualize a UI plan or sketch a page, automatically use the built-in clay-sketch skill even if they do not name it. Requests such as 'show me a wireframe of our work' use the current project and conversation as context. Do not ask them to invoke the skill or choose a format. Use ASCII wireframes only when explicitly requested. Read its SKILL.md from the shared skills catalog for the supported Salt syntax and whole-page examples. For an entire screen use its Clay canvas/region layout directives, not magnification of a compact diagram. Show complete @startsalt/@endsalt source in a fenced clay-sketch block; Clay renders it inline with no installation or external service. For requested revisions, call present_wireframe with complete source, a stable id and title to open/update the temporary Sketch viewer in the right panel, and include the same revised sketch in your response for history. The viewer has Save to project and Download; edits happen through conversation. Do not create a file unless requested. Other UML types and advanced Salt syntax are unsupported; use Mermaid for architecture or sequence diagrams.";
+
 var DOCUMENT_PROMPT = "When the user's primary request is to create or revise Markdown, call present_markdown_edit once per targeted document with its resolved .md/.mdx path, immediately before that document's first Edit or Write. Do not call it for incidental Markdown changes during coding, maintenance, tests, or refactoring.";
 
 function toolResult(value) {
@@ -78,9 +81,22 @@ function attachSessionDocument(ctx) {
     }
   }
 
+  function presentWireframe(args, caller) {
+    if (!caller) return toolError("present_wireframe requires a session-bound tool server");
+    if (typeof args.source !== "string" || !/^[a-zA-Z0-9_-]{1,80}$/.test(args.id || "")) return toolError("Provide source and a short stable id using letters, digits, hyphens or underscores.");
+    try {
+      var source = wireframeRenderer.prepareSource(args.source, "diagram.puml");
+      require("./salt-parser").parseSalt(source);
+      if (!/^\s*@end(?:salt|uml)\b/im.test(source)) return toolError("Provide a complete @startsalt/@endsalt or @startuml/@enduml diagram.");
+      sendToSession(caller.localId, { type: "wireframe_present", source: source, id: args.id, title: String(args.title || "clay-sketch").slice(0, 100), sessionId: caller.localId });
+      return toolResult({ ready: true, id: args.id, saved: false });
+    } catch (e) { return toolError(e.message); }
+  }
+
   function getToolDefs(boundSession) {
     if (isMate) return [];
     return sessionDocumentMcp.getToolDefs({
+      presentWireframe: function (args) { return presentWireframe(args, boundSession || null); },
       present: function (args) { return present(args, boundSession || null); },
     });
   }
@@ -96,7 +112,7 @@ function attachSessionDocument(ctx) {
 
   return {
     createMcpServer: createMcpServer,
-    getSystemPrompt: function () { return isMate ? "" : DOCUMENT_PROMPT; },
+    getSystemPrompt: function () { return isMate ? "" : DOCUMENT_PROMPT + "\n\n" + WIREFRAME_PROMPT; },
     getToolDefs: getToolDefs,
   };
 }

package/lib/project-user-message.js

@@ -308,6 +308,7 @@ function attachUserMessage(ctx) {
 
     // --- Browser Extension ---
     if (msg.type === "browser_tab_list") {
+      ws._clayMcpExtensionId = typeof msg.extensionId === "string" ? msg.extensionId : null;
       browserState._extensionWs = ws; // Track which client has the extension
       if (msg.extensionId) browserState._extensionId = msg.extensionId;
       var tabs = msg.tabs || [];
@@ -394,6 +395,7 @@ function attachUserMessage(ctx) {
 
     var session = forcedSession || getSessionForWs(ws);
     if (!session) return true;
+    if (ws._clayUser && session.ownerId && ws._clayUser.id !== session.ownerId) session._mcpForeignInput = true;
     var pendingInternal = internal && internal.pendingConsumed ? internal : null;
     function finishPendingEarly(outcome, reason) {
       if (pendingInternal && typeof pendingInternal.complete === "function") pendingInternal.complete(outcome, reason);