clay-server 4.9.0-beta.1 → 5.0.0-beta.2

package/lib/sdk-bridge.js

@@ -44,7 +44,7 @@ function callMcpToolHandler(mcpServers, serverName, toolName, args) {
 
 // Merge in-process MCP servers with remote (extension-bridged) MCP servers.
 // Returns the merged object, or null if no servers exist.
-function mergeMcpServers(localServers, getRemoteFn) {
+function mergeMcpServers(localServers, getRemoteFn, session) {
   var merged = {};
   var hasAny = false;
   if (localServers) {
@@ -58,7 +58,7 @@ function mergeMcpServers(localServers, getRemoteFn) {
     console.log("[mergeMcpServers] local servers: null");
   }
   if (typeof getRemoteFn === "function") {
-    var remote = getRemoteFn();
+    var remote = getRemoteFn(session);
     if (remote) {
       var rk = Object.keys(remote);
       console.log("[mergeMcpServers] remote servers:", rk.join(", ") || "(none)");
@@ -537,7 +537,7 @@ function createSDKBridge(opts) {
     // Auto-approve read-only tools for ALL sessions.
     // These tools only inspect files and fetch data — no side effects.
     var readOnlyTools = { Read: true, Glob: true, Grep: true, WebFetch: true, WebSearch: true };
-    if (readOnlyTools[toolName]) {
+    if (readOnlyTools[toolName] === true) {
       return { behavior: "allow", updatedInput: input };
     }
 
@@ -569,7 +569,7 @@ function createSDKBridge(opts) {
     var safeBrowserTools = { browser_watch_tab: true, browser_unwatch_tab: true };
     if (toolName.indexOf("mcp__") === 0 && toolName.indexOf("__browser_") !== -1) {
       var mcpToolName = toolName.substring(toolName.lastIndexOf("__") + 2);
-      if (safeBrowserTools[mcpToolName]) {
+      if (safeBrowserTools[mcpToolName] === true) {
         return { behavior: "allow", updatedInput: input };
       }
     }
@@ -610,7 +610,7 @@ function createSDKBridge(opts) {
       clay_tool_source: true,
     };
     if (toolName.indexOf("mcp__clay-tools__") === 0
-        && safeCapsuleTools[toolName.substring(toolName.lastIndexOf("__") + 2)]) {
+        && safeCapsuleTools[toolName.substring(toolName.lastIndexOf("__") + 2)] === true) {
       return { behavior: "allow", updatedInput: input };
     }
 
@@ -678,10 +678,10 @@ function createSDKBridge(opts) {
     };
     if (toolName.indexOf("mcp__") === 0) {
       if (toolName.indexOf(PAIR_MCP_PREFIX) === 0
-          && pairMcpTools[toolName.slice(PAIR_MCP_PREFIX.length)]) {
+          && pairMcpTools[toolName.slice(PAIR_MCP_PREFIX.length)] === true) {
         return { behavior: "allow", updatedInput: input };
       }
-    } else if (pairDynamicTools[toolName]) {
+    } else if (pairDynamicTools[toolName] === true) {
       return { behavior: "allow", updatedInput: input };
     }
 
@@ -698,7 +698,7 @@ function createSDKBridge(opts) {
       remove_note: true,
     };
     if (toolName.indexOf(NOTES_MCP_PREFIX) === 0
-        && notesTools[toolName.slice(NOTES_MCP_PREFIX.length)]) {
+        && notesTools[toolName.slice(NOTES_MCP_PREFIX.length)] === true) {
       return { behavior: "allow", updatedInput: input };
     }
 
@@ -710,12 +710,19 @@ function createSDKBridge(opts) {
       return { behavior: "allow", updatedInput: input };
     }
 
-    // This tool only prepares a read-only UI projection for the document the
-    // agent is about to edit. The subsequent Edit/Write keeps its own normal
-    // permission behavior.
-    if (toolName === "mcp__clay-documents__present_wireframe" || toolName === "clay-documents__present_wireframe" ||
-        toolName.indexOf("mcp__clay-documents__present_markdown_edit") === 0 ||
-        toolName.indexOf("clay-documents__present_markdown_edit") !== -1) {
+    // These exact session-bound tools only prepare visible UI projections.
+    // The Markdown Edit/Write and the wireframe Save/Download flows retain
+    // their own normal authorization. Include Codex's resumed-session wrapper
+    // without trusting lookalike tools or another MCP server.
+    var safeDocumentPresentationTools = {
+      "mcp__clay-documents__present_markdown_edit": true,
+      "clay-documents__present_markdown_edit": true,
+      "mcp__clay-session-tools__clay-documents__present_markdown_edit": true,
+      "mcp__clay-documents__present_wireframe": true,
+      "clay-documents__present_wireframe": true,
+      "mcp__clay-session-tools__clay-documents__present_wireframe": true,
+    };
+    if (safeDocumentPresentationTools[toolName] === true) {
       return { behavior: "allow", updatedInput: input };
     }
 
@@ -730,7 +737,7 @@ function createSDKBridge(opts) {
     };
     if (toolName.indexOf("mcp__clay-email__") === 0) {
       var emailToolName = toolName.substring(toolName.lastIndexOf("__") + 2);
-      if (safeEmailTools[emailToolName]) {
+      if (safeEmailTools[emailToolName] === true) {
         return { behavior: "allow", updatedInput: input };
       }
     }
@@ -748,23 +755,10 @@ function createSDKBridge(opts) {
       "mcp__clay-workspace__propose_project_follow_up": true,
       "mcp__clay-workspace__get_assignment_status": true,
     };
-    if (safeWorkspaceTools[toolName] || toolName.indexOf("mcp__clay-history__") === 0) {
+    if (safeWorkspaceTools[toolName] === true || toolName.indexOf("mcp__clay-history__") === 0) {
       return { behavior: "allow", updatedInput: input };
     }
 
-    // Auto-approve remote MCP tools that the user explicitly enabled in project settings.
-    // These are user-owned local MCP servers, so no additional permission prompt needed.
-    if (toolName.indexOf("mcp__") === 0 && getRemoteMcpServers) {
-      var _rmcp = getRemoteMcpServers();
-      if (_rmcp) {
-        var _mcpParts = toolName.split("__");
-        var _mcpServerName = _mcpParts.length >= 2 ? _mcpParts[1] : "";
-        if (_rmcp[_mcpServerName]) {
-          return { behavior: "allow", updatedInput: input };
-        }
-      }
-    }
-
     // Auto-approve safe Bash commands (read-only, non-destructive)
     // Applies to ALL sessions (mates and regular projects alike).
     // These are purely read-only commands that cannot modify files, install
@@ -1897,7 +1891,7 @@ function createSDKBridge(opts) {
         localMcpServers[userInputServer.name || "yoke-user-input"] = userInputServer;
       }
     }
-    var mergedMcpServers = mergeMcpServers(localMcpServers, getRemoteMcpServers) || undefined;
+    var mergedMcpServers = mergeMcpServers(localMcpServers, getRemoteMcpServers, session) || undefined;
     if (selectedUserInputMode === "fallback") {
       sessionToolDefs = sessionToolDefs.concat(yoke.userInput.fallbackToolDefs(sessionUserInputHandler, { maxQuestions: scheduleQuestionLimit }));
     }

package/lib/sdk-mcp-descriptors.js

@@ -18,7 +18,8 @@ function extractMcpDescriptors(mcpServers) {
       var toolDef = server.instance._registeredTools[toolName];
       var inputSchema = { type: "object", properties: {} };
       try {
-        if (toolDef.inputSchema) inputSchema = toJSONSchema(toolDef.inputSchema);
+        if (toolDef._clayInputSchema) inputSchema = toolDef._clayInputSchema;
+        else if (toolDef.inputSchema) inputSchema = toJSONSchema(toolDef.inputSchema);
       } catch (e) {
         throw new Error("Cannot serialize MCP tool schema " + serverName + "/" + toolName + ": " + e.message);
       }

package/lib/vendor-login-browser-worker.js

@@ -3,6 +3,7 @@ var readline = require("readline");
 var spawn = require("child_process").spawn;
 var chromium = require("playwright").chromium;
 var browser = null;
+var loginProxy = null;
 var page = null;
 var installing = null;
 var viewing = true;
@@ -22,7 +23,7 @@ async function launch() {
   var channels = ["chrome", "msedge", null];
   for (var i = 0; i < channels.length; i++) {
     try {
-      return await chromium.launch({ channel: channels[i] || undefined, headless: true, chromiumSandbox: true, timeout: 20000 });
+      return await chromium.launch({ channel: channels[i] || undefined, headless: true, chromiumSandbox: true, timeout: 20000, proxy: loginProxy ? { server: loginProxy.server } : undefined, args: loginProxy ? ["--force-webrtc-ip-handling-policy=disable_non_proxied_udp"] : [] });
     } catch (e) {
       if (closing) throw e;
     }
@@ -39,7 +40,7 @@ async function launch() {
     });
   });
   if (closing) throw new Error("Closed");
-  return chromium.launch({ headless: true, chromiumSandbox: true, timeout: 20000 });
+  return chromium.launch({ headless: true, chromiumSandbox: true, timeout: 20000, proxy: loginProxy ? { server: loginProxy.server } : undefined, args: loginProxy ? ["--force-webrtc-ip-handling-policy=disable_non_proxied_udp"] : [] });
 }
 
 async function capture() {
@@ -55,7 +56,8 @@ async function capture() {
   if (!closing) captureTimer = setTimeout(capture, 250);
 }
 
-async function start(url) {
+async function start(url, restrictedNetwork) {
+  if (restrictedNetwork) loginProxy = await require("./mcp-browser-proxy").createBrowserProxy();
   browser = await launch();
   if (closing) { await browser.close(); return; }
   var session = await browser.newBrowserCDPSession();
@@ -64,12 +66,19 @@ async function start(url) {
   finally { await session.detach(); }
   // Preserve the native version/platform and replace only the headless product token.
   var userAgent = version.userAgent.replace("HeadlessChrome/", "Chrome/");
-  var context = await browser.newContext({ viewport: viewport, acceptDownloads: false, userAgent: userAgent });
+  var context = await browser.newContext({ viewport: viewport, acceptDownloads: false, serviceWorkers: "block", userAgent: userAgent });
+  if (restrictedNetwork) await context.routeWebSocket("**/*", function (socket) { socket.close(); });
   await context.addInitScript(require("./vendor-login-browser-passkeys").disableLoginPasskeys);
   var callback = new URL(new URL(url).searchParams.get("redirect_uri"));
-  await context.route("**/*", function (route) {
+  await context.route("**/*", async function (route) {
     var target = new URL(route.request().url());
-    if (target.protocol === "https:" || (target.origin === callback.origin && target.pathname === callback.pathname)) return route.continue();
+    if (target.origin === callback.origin && target.pathname === callback.pathname) return route.continue();
+    if (target.protocol === "https:") {
+      if (restrictedNetwork) {
+        try { await require("./mcp-network").assertPublicUrl(target.href); } catch (error) { return route.abort(); }
+      }
+      return route.continue();
+    }
     return route.abort();
   });
   context.on("page", function (opened) {
@@ -120,6 +129,7 @@ async function close() {
   clearTimeout(captureTimer);
   if (installing) installing.kill();
   if (browser) await browser.close().catch(function () {});
+  if (loginProxy) loginProxy.close();
   process.exit(0);
 }
 
@@ -131,8 +141,8 @@ lines.on("line", function (line) {
   try { message = JSON.parse(line); } catch (e) { return; }
   if (message.type === "start" && !started) {
     started = true;
-    start(message.url).catch(function () {
-      status("Unable to open the sign-in browser. The host may need browser libraries or sandbox support. Use terminal sign-in to continue.", "error");
+    start(message.url, message.restrictedNetwork).catch(function () {
+      status("Unable to open the sign-in browser. The host may need browser libraries or sandbox support." + (message.restrictedNetwork ? " Retry or use an access token." : " Use terminal sign-in to continue."), "error");
     });
   } else if (message.type === "viewing") {
     viewing = !!message.value;

package/lib/vendor-login-browser.js

@@ -20,6 +20,12 @@ function loginUrl(value, vendor) {
 }
 
 function createLoginBrowser(options) {
+  var initial = null;
+  if (options.initialUrl) {
+    initial = new URL(options.initialUrl);
+    var callback = new URL(initial.searchParams.get("redirect_uri"));
+    if (options.vendor !== "mcp" || !options.restrictedNetwork || initial.protocol !== "https:" || initial.username || initial.password || !initial.searchParams.get("state") || !initial.searchParams.get("code_challenge") || callback.protocol !== "http:" || callback.hostname !== "127.0.0.1" || callback.pathname !== "/callback") throw new Error("Invalid MCP sign-in URL");
+  }
   var id = crypto.randomUUID();
   var dir = fs.mkdtempSync(path.join(os.tmpdir(), "clay-login-"));
   fs.chmodSync(dir, 0o700);
@@ -98,17 +104,17 @@ function createLoginBrowser(options) {
     });
     child.on("error", function () {
       statusPhase = "error";
-      status = "The sign-in browser could not start. Use terminal sign-in to continue.";
+      status = "The sign-in browser could not start." + (options.vendor === "mcp" ? " Retry or use an access token." : " Use terminal sign-in to continue.");
       send({ type: "vendor_login_browser_status", text: status, phase: statusPhase });
     });
     child.on("exit", function () {
       if (closed) return;
       statusPhase = "error";
-      status = "The sign-in browser closed. You can retry or use terminal sign-in.";
+      status = "The sign-in browser closed. You can retry.";
       send({ type: "vendor_login_browser_status", text: status, phase: statusPhase });
     });
     child.stdin.on("error", function () {});
-    write({ type: "start", url: url });
+    write({ type: "start", url: url, restrictedNetwork: !!options.restrictedNetwork });
   }
   function acceptUrl(value) {
     var url = loginUrl(value, options.vendor);
@@ -123,6 +129,7 @@ function createLoginBrowser(options) {
     });
   }, 250);
   timer.unref();
+  if (initial) start(initial.href);
   return {
     id: id,
     env: { BROWSER: wrapper, CLAY_LOGIN_URL_FILE: urlFile },

package/lib/yoke/adapters/codex.js

@@ -43,9 +43,9 @@ var CODEX_NOTE_TOOLS = {
 };
 
 function canonicalDynamicPermissionToolName(toolName) {
-  if (CODEX_NOTE_TOOLS[toolName]) return "mcp__clay-notes__" + toolName;
+  if (CODEX_NOTE_TOOLS[toolName] === true) return "mcp__clay-notes__" + toolName;
   if (toolName === "send_to_partner" || toolName === "read_partner") return "mcp__clay-sessions__" + toolName;
-  if (toolName === "present_markdown_edit") return "mcp__clay-documents__" + toolName;
+  if (toolName === "present_markdown_edit" || toolName === "present_wireframe") return "mcp__clay-documents__" + toolName;
   return toolName;
 }
 
@@ -1853,25 +1853,8 @@ function createCodexAdapter(opts) {
           if (co.config) serverOpts.config = Object.assign(serverOpts.config, co.config);
         }
 
-        // Track 1: Read local MCP server definitions from ~/.clay/mcp.json
-        // and inject into Codex config so Codex manages them natively.
+        // Clay-managed external MCP runs through the owner-bound bridge.
         var mcpServerConfig = Object.assign({}, serverOpts.config.mcp_servers || {});
-        try {
-          var mcpLocal = require("../../mcp-local");
-          var localMcpServers = mcpLocal.readMergedServers();
-          var mcpNames = Object.keys(localMcpServers);
-          for (var mi = 0; mi < mcpNames.length; mi++) {
-            var ms = localMcpServers[mcpNames[mi]];
-            if (ms.command) {
-              mcpServerConfig[mcpNames[mi]] = { command: ms.command, args: ms.args || [] };
-              if (ms.env && Object.keys(ms.env).length > 0) {
-                mcpServerConfig[mcpNames[mi]].env = ms.env;
-              }
-            }
-          }
-        } catch (e) {
-          console.error("[codex] Failed to read local MCP config:", e.message);
-        }
 
         // Track 2: Add clay-tools bridge server for in-app + remote MCP tools.
         var bridgePath = require("path").join(__dirname, "..", "mcp-bridge-server.js");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "4.9.0-beta.1",
+  "version": "5.0.0-beta.2",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js"
@@ -49,14 +49,18 @@
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.287",
     "@lydell/node-pty": "^1.2.0-beta.3",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "@openai/codex": "^0.160.0",
     "@seald-io/nedb": "^4.1.2",
     "imapflow": "^1.7.8",
+    "ipaddr.js": "^2.5.0",
     "nodemailer": "^9.1.1",
     "playwright": "1.63.0",
     "qrcode-terminal": "^0.12.0",
+    "undici": "^6.13.0",
     "web-push": "^3.6.7",
-    "ws": "^8.18.0"
+    "ws": "^8.18.0",
+    "zod": "^4.6.5"
   },
   "license": "AGPL-3.0-only",
   "engines": {