clay-server 4.9.0-beta.1 → 5.0.0-beta.1

package/lib/mcp-browser-proxy.js

@@ -0,0 +1,37 @@
+// Pin each sign-in browser tunnel to a checked public address, preventing DNS rebinding.
+var http = require('http');
+var net = require('net');
+var network = require('./mcp-network');
+async function createBrowserProxy() {
+  var sockets = new Set();
+  var server = http.createServer(function (req, res) { res.writeHead(403); res.end(); });
+  server.on('connection', function (socket) {
+    sockets.add(socket); socket.once('close', function () { sockets.delete(socket); });
+    socket.on('error', function () {});
+  });
+  server.on('connect', function (req, socket, head) {
+    Promise.resolve().then(async function () {
+      var url = network.remoteUrl('https://' + req.url);
+      var host = url.hostname.replace(/^\[|\]$/g, '');
+      var addresses = await network.publicLookup(host);
+      if (socket.destroyed) return;
+      var upstream = net.connect({ host: addresses[0].address, family: addresses[0].family, port: Number(url.port || 443), timeout: 15000 });
+      sockets.add(upstream);
+      upstream.once('close', function () { sockets.delete(upstream); socket.destroy(); });
+      upstream.on('error', function () { socket.destroy(); });
+      upstream.once('timeout', function () { upstream.destroy(); });
+      socket.once('close', function () { upstream.destroy(); });
+      upstream.once('connect', function () {
+        upstream.setTimeout(0);
+        socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+        if (head.length) upstream.write(head);
+        upstream.pipe(socket); socket.pipe(upstream);
+      });
+    }).catch(function () { socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n'); });
+  });
+  await new Promise(function (resolve, reject) { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
+  return { server: 'http://127.0.0.1:' + server.address().port, close: function () {
+    server.close(); sockets.forEach(function (socket) { socket.destroy(); });
+  } };
+}
+module.exports = { createBrowserProxy: createBrowserProxy };

package/lib/mcp-connection-store.js

@@ -0,0 +1,39 @@
+// Owner/project-scoped records with encrypted credentials; never sent to the UI.
+var fs = require('fs');
+var path = require('path');
+var crypto = require('crypto');
+function createConnectionStore(root, project) {
+  var directory = path.join(root, 'mcp-connections');
+  function scope(owner) {
+    if (typeof owner !== 'string' || !owner || owner.length > 160) throw new Error('MCP account owner is required.');
+    return JSON.stringify([project, owner]);
+  }
+  function filename(owner) { return path.join(directory, crypto.createHash('sha256').update(scope(owner)).digest('hex') + '.json'); }
+  function key() {
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    var file = path.join(directory, '.key');
+    try { fs.writeFileSync(file, crypto.randomBytes(32), { flag: 'wx', mode: 0o600 }); }
+    catch (error) { if (error.code !== 'EEXIST') throw error; }
+    return fs.readFileSync(file);
+  }
+  function load(owner) {
+    var data;
+    try { data = JSON.parse(fs.readFileSync(filename(owner), 'utf8')); }
+    catch (error) { if (error.code === 'ENOENT') return []; throw new Error('Could not read MCP connections.'); }
+    var parts = data.encrypted.split('.').map(function (part) { return Buffer.from(part, 'base64'); });
+    var cipher = crypto.createDecipheriv('aes-256-gcm', key(), parts[0]);
+    cipher.setAAD(Buffer.from(scope(owner))); cipher.setAuthTag(parts[1]);
+    return JSON.parse(Buffer.concat([cipher.update(parts[2]), cipher.final()]).toString('utf8'));
+  }
+  function save(owner, records) {
+    var iv = crypto.randomBytes(12), cipher = crypto.createCipheriv('aes-256-gcm', key(), iv);
+    cipher.setAAD(Buffer.from(scope(owner)));
+    var bytes = Buffer.concat([cipher.update(JSON.stringify(records), 'utf8'), cipher.final()]);
+    var value = { encrypted: [iv, cipher.getAuthTag(), bytes].map(function (part) { return part.toString('base64'); }).join('.') };
+    var file = filename(owner), temp = file + '.' + crypto.randomBytes(8).toString('hex') + '.tmp';
+    try { fs.writeFileSync(temp, JSON.stringify(value), { mode: 0o600 }); fs.renameSync(temp, file); }
+    finally { try { fs.unlinkSync(temp); } catch (error) { if (error.code !== 'ENOENT') throw error; } }
+  }
+  return { load: load, save: save };
+}
+module.exports = { createConnectionStore: createConnectionStore };

package/lib/mcp-network.js

@@ -0,0 +1,46 @@
+// Remote MCP must not turn a shared Clay host into a private-network proxy.
+var dns = require('dns').promises;
+var ipaddr = require('ipaddr.js');
+var undici = require('undici');
+
+function publicAddress(address) {
+  try { return ipaddr.process(address).range() === 'unicast'; } catch (error) { return false; }
+}
+function remoteUrl(value) {
+  if (typeof value !== 'string' || value.length > 4096) throw new Error('Enter a valid HTTPS MCP address.');
+  var url;
+  try { url = new URL(value.trim()); } catch (error) { throw new Error('Enter a valid HTTPS MCP address.'); }
+  if (url.protocol !== 'https:' || url.username || url.password || url.hash) throw new Error('Use an HTTPS address without embedded credentials or a fragment.');
+  var hostname = url.hostname.replace(/^\[|\]$/g, '');
+  if (hostname === 'localhost' || hostname.endsWith('.localhost') || (ipaddr.isValid(hostname) && !publicAddress(hostname))) {
+    throw new Error('Remote connections require a public server. Use the extension for tools on your computer.');
+  }
+  return url;
+}
+async function publicLookup(hostname) {
+  var records = await dns.lookup(hostname, { all: true, verbatim: true });
+  if (!records.length || records.some(function (item) { return !publicAddress(item.address); })) throw new Error('The server address resolves to a private or reserved network.');
+  return records;
+}
+async function assertPublicUrl(value) {
+  var url = remoteUrl(String(value));
+  await publicLookup(url.hostname.replace(/^\[|\]$/g, ''));
+  return url;
+}
+function createRemoteFetch() {
+  var agent = new undici.Agent({ connect: { timeout: 15000, lookup: function (host, options, callback) {
+    publicLookup(host).then(function (records) {
+      var matching = records.filter(function (item) { return !options.family || item.family === options.family; });
+      if (!matching.length) return callback(new Error('No public address is available.'));
+      if (options.all) callback(null, matching); else callback(null, matching[0].address, matching[0].family);
+    }, callback);
+  } } });
+  async function request(input, init) {
+    var url = await assertPublicUrl(typeof input === 'string' || input instanceof URL ? input : input.url);
+    // No redirect may forward credentials to a different endpoint.
+    return undici.fetch(url, Object.assign({}, init, { dispatcher: agent, redirect: 'error',
+      signal: init && init.signal && typeof AbortSignal.any !== 'function' ? init.signal : (init && init.signal ? AbortSignal.any([init.signal, AbortSignal.timeout(60000)]) : AbortSignal.timeout(60000)) }));
+  }
+  return { fetch: request, close: function () { return agent.destroy(); } };
+}
+module.exports = { remoteUrl: remoteUrl, publicAddress: publicAddress, publicLookup: publicLookup, assertPublicUrl: assertPublicUrl, createRemoteFetch: createRemoteFetch };

package/lib/mcp-oauth.js

@@ -0,0 +1,65 @@
+var crypto = require('crypto');
+var http = require('http');
+var assertPublicUrl = require('./mcp-network').assertPublicUrl;
+
+function createOAuthProvider(record, persist, flow) {
+  record.auth = record.auth || {};
+  var auth = record.auth;
+  function guard() { if (flow && flow.cancelled) throw new Error('Sign-in expired.'); }
+  function save() { persist(); }
+  return {
+    get redirectUrl() { return flow ? flow.redirectUrl : auth.redirectUrl; },
+    get clientMetadata() { return { client_name: 'Clay', redirect_uris: [flow ? flow.redirectUrl : auth.redirectUrl],
+      grant_types: ['authorization_code', 'refresh_token'], response_types: ['code'], token_endpoint_auth_method: 'none' }; },
+    state: function () { return flow ? flow.state : crypto.randomBytes(32).toString('hex'); },
+    clientInformation: function () { return auth.client; },
+    saveClientInformation: function (value) { guard(); auth.client = value; save(); },
+    tokens: function () { return auth.tokens; },
+    saveTokens: function (value) { guard(); auth.tokens = value; save(); },
+    saveCodeVerifier: function (value) { if (flow) flow.verifier = value; },
+    codeVerifier: function () { if (!flow || !flow.verifier) throw new Error('Sign in again.'); return flow.verifier; },
+    redirectToAuthorization: async function (url) {
+      if (!flow) { var required = new Error('Sign in to connect this server.'); required.name = 'UnauthorizedError'; throw required; }
+      await (flow.validateUrl || assertPublicUrl)(url.href);
+      guard();
+      if (url.searchParams.get('state') !== flow.state || url.searchParams.get('redirect_uri') !== flow.redirectUrl || !url.searchParams.get('code_challenge')) throw new Error('Invalid sign-in request.');
+      flow.authorizationUrl = url.href;
+    },
+    discoveryState: function () { return auth.discovery; },
+    saveDiscoveryState: function (value) {
+      // Bind client credentials to the discovered issuer.
+      if (auth.discovery && auth.discovery.authorizationServerUrl !== value.authorizationServerUrl) { delete auth.client; delete auth.tokens; }
+      guard(); auth.discovery = value; save();
+    },
+    invalidateCredentials: function (which) {
+      if (which === 'all' || which === 'client') delete auth.client;
+      if (which === 'all' || which === 'tokens') delete auth.tokens;
+      if (which === 'all' || which === 'discovery') delete auth.discovery;
+      if (flow && (which === 'all' || which === 'verifier')) flow.verifier = null;
+      save();
+    },
+  };
+}
+async function createCallback(onCode) {
+  var flow = { state: crypto.randomBytes(32).toString('hex'), used: false };
+  var server = http.createServer(function (req, res) {
+    var url = new URL(req.url, flow.redirectUrl);
+    res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+    res.setHeader('Cache-Control', 'no-store');
+    res.setHeader('Referrer-Policy', 'no-referrer');
+    if (req.method !== 'GET' || url.pathname !== '/callback' || flow.used || url.searchParams.getAll('state').length !== 1 || url.searchParams.getAll('code').length !== 1 || url.searchParams.getAll('iss').length > 1 || url.searchParams.get('state') !== flow.state) {
+      res.writeHead(400); res.end('Invalid or expired sign-in.'); return;
+    }
+    var code = url.searchParams.get('code');
+    if (!code || code.length > 8192 || url.searchParams.has('error')) { res.writeHead(400); res.end('Sign-in was not completed. Return to Clay and retry.'); return; }
+    flow.used = true;
+    Promise.resolve().then(function () { return onCode(code, url.searchParams.get('iss')); }).then(function () {
+      res.end('Connected. You can return to Clay.');
+    }, function () { res.writeHead(400); res.end('Sign-in failed. Return to Clay and retry.'); });
+  });
+  await new Promise(function (resolve, reject) { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
+  flow.redirectUrl = 'http://127.0.0.1:' + server.address().port + '/callback';
+  flow.close = function () { server.close(); server.closeAllConnections(); flow.verifier = null; };
+  return flow;
+}
+module.exports = { createOAuthProvider: createOAuthProvider, createCallback: createCallback };

package/lib/mcp-proxy.js

@@ -0,0 +1,32 @@
+// Preserve the server's JSON Schema across SDK and stdio projections.
+function validateDefinitions(definitions) {
+  var z = require('zod');
+  var names = new Set();
+  return definitions.map(function (definition) {
+    if (!definition || !/^[a-zA-Z0-9_.-]{1,128}$/.test(definition.name) || names.has(definition.name) || Object.prototype.hasOwnProperty.call(Object.prototype, definition.name)) throw new Error('Unsupported MCP tool catalog.');
+    names.add(definition.name);
+    var parsed = z.fromJSONSchema(definition.inputSchema || { type: 'object', properties: {} });
+    if (!parsed.shape) throw new Error('MCP tools must accept an object.');
+    return parsed;
+  });
+}
+function createProxy(name, definitions, invoke) {
+  var sdk = require('@anthropic-ai/claude-agent-sdk');
+  var schemas = validateDefinitions(definitions);
+  var tools = definitions.map(function (definition, index) {
+    return sdk.tool(definition.name, definition.description || definition.name, schemas[index].shape, function (args) { return invoke(definition.name, args); });
+  });
+  var server = sdk.createSdkMcpServer({ name: name, version: '1.0.0', tools: tools });
+  definitions.forEach(function (definition, index) {
+    var tool = server.instance._registeredTools[definition.name];
+    tool.inputSchema = schemas[index];
+    tool._clayInputSchema = definition.inputSchema || { type: 'object', properties: {} };
+  });
+  server.instance.server.setRequestHandler(require('@modelcontextprotocol/sdk/types.js').ListToolsRequestSchema, function () {
+    return { tools: definitions.map(function (definition) {
+      return { name: definition.name, description: definition.description, inputSchema: definition.inputSchema || { type: 'object', properties: {} } };
+    }) };
+  });
+  return server;
+}
+module.exports = { createProxy: createProxy, validateDefinitions: validateDefinitions };

package/lib/mcp-remote-connections.js

@@ -0,0 +1,215 @@
+var crypto = require('crypto');
+var Client = require('@modelcontextprotocol/sdk/client/index.js').Client;
+var StreamableHTTPClientTransport = require('@modelcontextprotocol/sdk/client/streamableHttp.js').StreamableHTTPClientTransport;
+var network = require('./mcp-network');
+var oauth = require('./mcp-oauth');
+var createLoginBrowser = require('./vendor-login-browser').createLoginBrowser;
+
+function createRemoteConnections(ctx) {
+  var accounts = new Map(), live = new Map(), flows = new Map(), queues = new Map();
+  var remoteFetch = ctx.remoteFetch || network.createRemoteFetch();
+  var closed = false;
+  function records(owner) {
+    ctx.authorize(owner);
+    if (!accounts.has(owner)) accounts.set(owner, ctx.storage.load(owner));
+    return accounts.get(owner);
+  }
+  function persist(owner) { ctx.authorize(owner); if (closed) throw new Error('MCP connections closed.'); ctx.storage.save(owner, records(owner)); }
+  function find(owner, id) {
+    var row = records(owner).find(function (item) { return item.id === id; });
+    if (!row) throw new Error('Connection is unavailable.');
+    return row;
+  }
+  function key(owner, id) { return JSON.stringify([owner, id]); }
+  function check(owner, row) {
+    if (closed || find(owner, row.id) !== row) throw new Error('Connection changed.');
+  }
+  function changed(owner) { if (!closed) ctx.changed(owner); }
+  function view(owner) {
+    return records(owner).filter(function (row) { return row.source === 'url'; }).map(function (row) {
+      var entry = live.get(key(owner, row.id));
+      return { id: row.id, name: row.id, label: row.label, source: 'url', transport: 'http', url: row.url,
+        projectEnabled: !!row.enabled, extensionEnabled: true, tools: row.tools || [], toolCount: (row.tools || []).length,
+        status: entry ? entry.status : (row.tools ? 'idle' : 'unavailable'), error: entry ? entry.error : '', authMode: row.authMode || 'auto' };
+    });
+  }
+  async function disconnect(owner, id) {
+    var entry = live.get(key(owner, id));
+    live.delete(key(owner, id));
+    if (entry && entry.client) await entry.client.close().catch(function () {});
+  }
+  function provider(owner, row, flow) {
+    return oauth.createOAuthProvider(row, function () { check(owner, row); persist(owner); }, flow);
+  }
+  async function connect(owner, row, flow) {
+    check(owner, row);
+    await disconnect(owner, row.id);
+    check(owner, row);
+    if (flow && flow.cancelled) throw new Error('Sign-in expired.');
+    var client = new Client({ name: 'clay', version: '1.0.0' }, { capabilities: {} });
+    var options = { fetch: remoteFetch.fetch };
+    if (row.authMode === 'token' && row.token) options.requestInit = { headers: { Authorization: 'Bearer ' + row.token } };
+    else if (flow || (row.auth && row.auth.tokens)) options.authProvider = provider(owner, row, flow);
+    var transport = new StreamableHTTPClientTransport(new URL(row.url), options);
+    var entry = { client: client, transport: transport, status: 'connecting', error: '' };
+    live.set(key(owner, row.id), entry); changed(owner);
+    try {
+      await client.connect(transport, { timeout: 30000 });
+      var tools = [], cursor, seen = new Set();
+      do {
+        var page = await client.listTools(cursor ? { cursor: cursor } : {}, { timeout: 30000 });
+        tools = tools.concat(page.tools);
+        if (tools.length > 1000 || seen.size >= 100 || (page.nextCursor && seen.has(page.nextCursor))) throw new Error('Tool catalog exceeds the supported limit.');
+        cursor = page.nextCursor; seen.add(cursor);
+      } while (cursor);
+      if (JSON.stringify(tools).length > 2 * 1024 * 1024) throw new Error('Tool catalog exceeds the supported limit.');
+      check(owner, row);
+      if (live.get(key(owner, row.id)) !== entry || (flow && flow.cancelled)) throw new Error('Connection changed.');
+      require('./mcp-proxy').validateDefinitions(tools);
+      row.tools = tools; entry.status = 'ready'; persist(owner);
+      return entry;
+    } catch (error) {
+      var requiresAuth = error.code === 401 || error.code === 403 || error.name === 'UnauthorizedError' || (flow && flow.authorizationUrl);
+      entry.status = requiresAuth ? 'auth_required' : 'unavailable';
+      entry.error = requiresAuth ? 'Sign in or provide an access token to connect.' : 'Could not connect. Check the address and try again.';
+      if (!flow) await client.close().catch(function () {});
+      return entry;
+    } finally { changed(owner); }
+  }
+  function cancelLogin(owner, id) {
+    var idKey = key(owner, id), flow = flows.get(idKey);
+    if (!flow) return;
+    flow.cancelled = true; flows.delete(idKey); clearTimeout(flow.timer);
+    if (flow.browser) { flow.browser.close(); ctx.sendOwner(owner, { type: 'mcp_login_closed', browserId: flow.browser.id }); }
+    flow.close();
+  }
+  async function signIn(owner, row, ws) {
+    cancelLogin(owner, row.id);
+    var identity = ctx.identity(ws);
+    var flow = await oauth.createCallback(async function (code, issuer) {
+      check(owner, row);
+      if (flows.get(key(owner, row.id)) !== flow) throw new Error('Sign-in expired.');
+      var metadata = row.auth && row.auth.discovery;
+      var expected = metadata && metadata.authorizationServerMetadata && metadata.authorizationServerMetadata.issuer;
+      if ((metadata && metadata.authorizationServerMetadata && metadata.authorizationServerMetadata.authorization_response_iss_parameter_supported && !issuer) || (issuer && (!expected || issuer !== expected))) throw new Error('Sign-in issuer mismatch.');
+      var entry = live.get(key(owner, row.id));
+      if (!entry || !entry.transport) throw new Error('Sign in again.');
+      await entry.transport.finishAuth(code);
+      check(owner, row);
+      if (flows.get(key(owner, row.id)) !== flow) throw new Error('Sign-in expired.');
+      var ready = await connect(owner, row);
+      if (ready.status !== 'ready') throw new Error('Connection failed after sign-in.');
+      setTimeout(function () { if (flows.get(key(owner, row.id)) === flow) { cancelLogin(owner, row.id); changed(owner); } }, 500);
+    });
+    flows.set(key(owner, row.id), flow);
+    flow.timer = setTimeout(function () { cancelLogin(owner, row.id); }, 10 * 60 * 1000); flow.timer.unref();
+    row.authMode = 'auto'; delete row.token;
+    // A fresh loopback redirect requires a matching client registration.
+    row.auth = { redirectUrl: flow.redirectUrl }; persist(owner);
+    var entry = await connect(owner, row, flow);
+    if (!flow.authorizationUrl) { cancelLogin(owner, row.id); if (entry.status !== 'ready') throw new Error('This server could not start browser sign-in. Use an access token if supported.'); return; }
+    check(owner, row);
+    if (flow.cancelled) throw new Error('Sign-in expired.');
+    try { flow.browser = (ctx.createLoginBrowser || createLoginBrowser)({ ws: ws, vendor: 'mcp', initialUrl: flow.authorizationUrl,
+      osUserInfo: identity, restrictedNetwork: true,
+      canAccess: function (peer) { return flows.get(key(owner, row.id)) === flow && ctx.canAccess(peer, owner); },
+      sendTo: function (peer, message) { ctx.sendTo(peer, Object.assign({}, message, { type: message.type.replace('vendor_login_', 'mcp_login_'), connectionId: row.id })); } });
+    } catch (error) { cancelLogin(owner, row.id); throw new Error('Could not open the sign-in browser. Retry or use an access token.'); }
+    ctx.sendTo(ws, { type: 'mcp_login_ready', browserId: flow.browser.id, connectionId: row.id, label: row.label });
+  }
+  function serial(owner, task) {
+    var pending = (queues.get(owner) || Promise.resolve()).catch(function () {}).then(task);
+    queues.set(owner, pending);
+    pending.finally(function () { if (queues.get(owner) === pending) queues.delete(owner); }).catch(function () {});
+    return pending;
+  }
+  function command(owner, msg, ws) {
+    // Revocation takes effect before any queued network work completes.
+    if (msg.action === 'remove' || (msg.action === 'enable' && msg.enabled !== true)) {
+      try {
+        var revoked = find(owner, msg.id);
+        if (revoked.source !== 'url') throw new Error('Not a remote connection.');
+        revoked.enabled = false; cancelLogin(owner, revoked.id); persist(owner);
+        disconnect(owner, revoked.id); changed(owner);
+      } catch (error) { return Promise.reject(error); }
+    }
+    return serial(owner, async function () {
+      var row;
+      if (msg.action === 'add') {
+        var url = network.remoteUrl(msg.url).href;
+        if (records(owner).filter(function (item) { return item.source === 'url'; }).length >= 30) throw new Error('You can add up to 30 remote connections per project.');
+        if (records(owner).some(function (item) { return item.url === url; })) throw new Error('This server is already connected. Open it from your connections.');
+        row = { id: 'remote-' + crypto.randomBytes(8).toString('hex'), source: 'url', url: url, label: new URL(url).hostname, enabled: false };
+        records(owner).push(row); persist(owner);
+        await connect(owner, row);
+      } else {
+        row = find(owner, msg.id);
+        if (row.source !== 'url') throw new Error('Not a remote connection.');
+        if (msg.action === 'enable') { row.enabled = msg.enabled === true; persist(owner); }
+        else if (msg.action === 'rename') {
+          if (typeof msg.label !== 'string' || !msg.label.trim() || msg.label.length > 100) throw new Error('Use a name between 1 and 100 characters.');
+          row.label = msg.label.trim(); persist(owner);
+        } else if (msg.action === 'remove') {
+          cancelLogin(owner, row.id); await disconnect(owner, row.id);
+          accounts.set(owner, records(owner).filter(function (item) { return item !== row; })); persist(owner);
+        } else if (msg.action === 'test') { cancelLogin(owner, row.id); await connect(owner, row); }
+        else if (msg.action === 'token') {
+          if (typeof msg.token !== 'string' || !msg.token.trim() || msg.token.length > 8192 || /[\r\n]/.test(msg.token)) throw new Error('Enter a valid access token.');
+          cancelLogin(owner, row.id); row.token = msg.token.trim(); row.authMode = 'token'; delete row.auth; persist(owner); await connect(owner, row);
+        } else if (msg.action === 'signin') await signIn(owner, row, ws);
+        else throw new Error('Unsupported connection action.');
+      }
+      changed(owner);
+      return row.id;
+    });
+  }
+  function handleBrowser(owner, ws, msg) {
+    var flow = flows.get(key(owner, msg.connectionId));
+    if (!flow || !flow.browser || flow.browser.id !== msg.browserId || !ctx.canAccess(ws, owner)) return;
+    if (msg.type === 'mcp_login_cancel') cancelLogin(owner, msg.connectionId);
+    else if (msg.type === 'mcp_login_browser_attach') flow.browser.attach(ws);
+    else if (msg.type === 'mcp_login_browser_input') flow.browser.input(ws, msg.event);
+  }
+  async function call(owner, id, name, args, authorize) {
+    return serial(owner, async function () {
+      authorize(); var row = find(owner, id);
+      if (!row.enabled) throw new Error('Connection is disabled.');
+      var entry = live.get(key(owner, id));
+      if (!entry || entry.status !== 'ready') entry = await connect(owner, row);
+      authorize(); check(owner, row);
+      if (!row.enabled || entry.status !== 'ready') throw new Error('MCP connection is not ready. Open MCP Servers to reconnect.');
+      if (!(row.tools || []).some(function (tool) { return tool.name === name; })) throw new Error('Tool is unavailable.');
+      // Never replay a tools/call after an ambiguous transport failure.
+      var result;
+      try { result = await entry.client.callTool({ name: name, arguments: args || {} }, undefined, { timeout: 60000 }); }
+      catch (error) {
+        if (live.get(key(owner, id)) === entry) {
+          entry.status = error.code === 401 || error.code === 403 || error.name === 'UnauthorizedError' ? 'auth_required' : 'unavailable';
+          entry.error = entry.status === 'auth_required' ? 'Sign in again to reconnect.' : 'The tool call could not complete. Check the service before retrying.';
+          changed(owner);
+        }
+        throw new Error('MCP tool call failed. Open MCP Servers to check the connection.');
+      }
+      authorize(); check(owner, row);
+      if (!row.enabled || live.get(key(owner, id)) !== entry) throw new Error('Connection was disabled or changed.');
+      return result;
+    });
+  }
+  function computerEnabled(owner, name, fallback) {
+    var row = records(owner).find(function (item) { return item.source === 'computer' && item.name === name; });
+    return row ? row.enabled : !!fallback;
+  }
+  function toggleComputer(owner, name, enabled) {
+    var list = records(owner), row = list.find(function (item) { return item.source === 'computer' && item.name === name; });
+    if (!row) { row = { id: crypto.randomUUID(), source: 'computer', name: name }; list.push(row); }
+    row.enabled = !!enabled; persist(owner); changed(owner);
+  }
+  function destroy() {
+    flows.forEach(function (flow, flowKey) { var pair = JSON.parse(flowKey); cancelLogin(pair[0], pair[1]); });
+    closed = true; live.forEach(function (entry) { entry.client.close().catch(function () {}); }); live.clear();
+    remoteFetch.close();
+  }
+  return { view: view, command: command, call: call, handleBrowser: handleBrowser, destroy: destroy,
+    computerEnabled: computerEnabled, toggleComputer: toggleComputer };
+}
+module.exports = { createRemoteConnections: createRemoteConnections };

package/lib/mcp-session-access.js

@@ -0,0 +1,15 @@
+// A shared Driver must not reach personal connections indirectly through its Worker.
+function canUsePersonalConnections(session, sessions) {
+  if (!session || sessions.get(session.localId) !== session || !session.ownerId) return false;
+  if (session.sessionVisibility === 'shared' || session._mcpForeignInput) return false;
+  if ((session.history || []).some(function (entry) { return entry.type === 'user_message' && entry.from && entry.from !== session.ownerId; })) return false;
+  var provenance = session.sessionProvenance;
+  if (provenance && provenance.kind === 'worker') {
+    var parents = Array.from(sessions.values()).filter(function (candidate) { return candidate.sessionOriginId && candidate.sessionOriginId === provenance.parentSessionOriginId; });
+    var parent = parents.length === 1 && parents[0];
+    if (!parent || parent.ownerId !== session.ownerId || (parent.sessionProvenance && parent.sessionProvenance.kind === 'worker')) return false;
+    return canUsePersonalConnections(parent, sessions);
+  }
+  return !session.delegated && !session._delegatedBy && !session._pairDelegation;
+}
+module.exports = { canUsePersonalConnections: canUsePersonalConnections };