clay-server 5.0.0-beta.1 → 5.0.0-beta.2

package/lib/project-session-document.js

@@ -84,13 +84,19 @@ function attachSessionDocument(ctx) {
   function presentWireframe(args, caller) {
     if (!caller) return toolError("present_wireframe requires a session-bound tool server");
     if (typeof args.source !== "string" || !/^[a-zA-Z0-9_-]{1,80}$/.test(args.id || "")) return toolError("Provide source and a short stable id using letters, digits, hyphens or underscores.");
+    var source;
     try {
-      var source = wireframeRenderer.prepareSource(args.source, "diagram.puml");
-      require("./salt-parser").parseSalt(source);
+      source = wireframeRenderer.prepareSource(args.source, "diagram.puml");
       if (!/^\s*@end(?:salt|uml)\b/im.test(source)) return toolError("Provide a complete @startsalt/@endsalt or @startuml/@enduml diagram.");
+    } catch (e) {
+      return toolError(e.message || String(e));
+    }
+    return wireframeRenderer.renderPlantUml(source).then(function () {
       sendToSession(caller.localId, { type: "wireframe_present", source: source, id: args.id, title: String(args.title || "clay-sketch").slice(0, 100), sessionId: caller.localId });
       return toolResult({ ready: true, id: args.id, saved: false });
-    } catch (e) { return toolError(e.message); }
+    }).catch(function (e) {
+      return toolError(e && e.message ? e.message : String(e));
+    });
   }
 
   function getToolDefs(boundSession) {

package/lib/sdk-bridge.js

@@ -537,7 +537,7 @@ function createSDKBridge(opts) {
     // Auto-approve read-only tools for ALL sessions.
     // These tools only inspect files and fetch data — no side effects.
     var readOnlyTools = { Read: true, Glob: true, Grep: true, WebFetch: true, WebSearch: true };
-    if (readOnlyTools[toolName]) {
+    if (readOnlyTools[toolName] === true) {
       return { behavior: "allow", updatedInput: input };
     }
 
@@ -569,7 +569,7 @@ function createSDKBridge(opts) {
     var safeBrowserTools = { browser_watch_tab: true, browser_unwatch_tab: true };
     if (toolName.indexOf("mcp__") === 0 && toolName.indexOf("__browser_") !== -1) {
       var mcpToolName = toolName.substring(toolName.lastIndexOf("__") + 2);
-      if (safeBrowserTools[mcpToolName]) {
+      if (safeBrowserTools[mcpToolName] === true) {
         return { behavior: "allow", updatedInput: input };
       }
     }
@@ -610,7 +610,7 @@ function createSDKBridge(opts) {
       clay_tool_source: true,
     };
     if (toolName.indexOf("mcp__clay-tools__") === 0
-        && safeCapsuleTools[toolName.substring(toolName.lastIndexOf("__") + 2)]) {
+        && safeCapsuleTools[toolName.substring(toolName.lastIndexOf("__") + 2)] === true) {
       return { behavior: "allow", updatedInput: input };
     }
 
@@ -678,10 +678,10 @@ function createSDKBridge(opts) {
     };
     if (toolName.indexOf("mcp__") === 0) {
       if (toolName.indexOf(PAIR_MCP_PREFIX) === 0
-          && pairMcpTools[toolName.slice(PAIR_MCP_PREFIX.length)]) {
+          && pairMcpTools[toolName.slice(PAIR_MCP_PREFIX.length)] === true) {
         return { behavior: "allow", updatedInput: input };
       }
-    } else if (pairDynamicTools[toolName]) {
+    } else if (pairDynamicTools[toolName] === true) {
       return { behavior: "allow", updatedInput: input };
     }
 
@@ -698,7 +698,7 @@ function createSDKBridge(opts) {
       remove_note: true,
     };
     if (toolName.indexOf(NOTES_MCP_PREFIX) === 0
-        && notesTools[toolName.slice(NOTES_MCP_PREFIX.length)]) {
+        && notesTools[toolName.slice(NOTES_MCP_PREFIX.length)] === true) {
       return { behavior: "allow", updatedInput: input };
     }
 
@@ -710,12 +710,19 @@ function createSDKBridge(opts) {
       return { behavior: "allow", updatedInput: input };
     }
 
-    // This tool only prepares a read-only UI projection for the document the
-    // agent is about to edit. The subsequent Edit/Write keeps its own normal
-    // permission behavior.
-    if (toolName === "mcp__clay-documents__present_wireframe" || toolName === "clay-documents__present_wireframe" ||
-        toolName.indexOf("mcp__clay-documents__present_markdown_edit") === 0 ||
-        toolName.indexOf("clay-documents__present_markdown_edit") !== -1) {
+    // These exact session-bound tools only prepare visible UI projections.
+    // The Markdown Edit/Write and the wireframe Save/Download flows retain
+    // their own normal authorization. Include Codex's resumed-session wrapper
+    // without trusting lookalike tools or another MCP server.
+    var safeDocumentPresentationTools = {
+      "mcp__clay-documents__present_markdown_edit": true,
+      "clay-documents__present_markdown_edit": true,
+      "mcp__clay-session-tools__clay-documents__present_markdown_edit": true,
+      "mcp__clay-documents__present_wireframe": true,
+      "clay-documents__present_wireframe": true,
+      "mcp__clay-session-tools__clay-documents__present_wireframe": true,
+    };
+    if (safeDocumentPresentationTools[toolName] === true) {
       return { behavior: "allow", updatedInput: input };
     }
 
@@ -730,7 +737,7 @@ function createSDKBridge(opts) {
     };
     if (toolName.indexOf("mcp__clay-email__") === 0) {
       var emailToolName = toolName.substring(toolName.lastIndexOf("__") + 2);
-      if (safeEmailTools[emailToolName]) {
+      if (safeEmailTools[emailToolName] === true) {
         return { behavior: "allow", updatedInput: input };
       }
     }
@@ -748,7 +755,7 @@ function createSDKBridge(opts) {
       "mcp__clay-workspace__propose_project_follow_up": true,
       "mcp__clay-workspace__get_assignment_status": true,
     };
-    if (safeWorkspaceTools[toolName] || toolName.indexOf("mcp__clay-history__") === 0) {
+    if (safeWorkspaceTools[toolName] === true || toolName.indexOf("mcp__clay-history__") === 0) {
       return { behavior: "allow", updatedInput: input };
     }
 

package/lib/yoke/adapters/codex.js

@@ -43,9 +43,9 @@ var CODEX_NOTE_TOOLS = {
 };
 
 function canonicalDynamicPermissionToolName(toolName) {
-  if (CODEX_NOTE_TOOLS[toolName]) return "mcp__clay-notes__" + toolName;
+  if (CODEX_NOTE_TOOLS[toolName] === true) return "mcp__clay-notes__" + toolName;
   if (toolName === "send_to_partner" || toolName === "read_partner") return "mcp__clay-sessions__" + toolName;
-  if (toolName === "present_markdown_edit") return "mcp__clay-documents__" + toolName;
+  if (toolName === "present_markdown_edit" || toolName === "present_wireframe") return "mcp__clay-documents__" + toolName;
   return toolName;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "5.0.0-beta.1",
+  "version": "5.0.0-beta.2",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js"