clay-server 5.1.1-beta.1 → 5.2.0-beta.10

package/lib/server-auth.js

@@ -66,71 +66,54 @@ function attachAuth(ctx) {
   // --- Multi-user auth tokens (persisted to disk) ---
   var TOKENS_FILE = path.join(CONFIG_DIR, _isDevMode ? "auth-tokens-dev.json" : "auth-tokens.json");
   var MULTI_USER_COOKIE = _isDevMode ? "relay_auth_user_dev" : "relay_auth_user";
-  var multiUserTokens = {};
-
-  function loadTokens() {
-    try {
-      var raw = fs.readFileSync(TOKENS_FILE, "utf8");
-      var data = JSON.parse(raw);
-      if (data && typeof data === "object") {
-        multiUserTokens = data;
-      }
-    } catch (e) {
-      multiUserTokens = {};
-    }
+  var accountPolicy = require('./account-auth-policy').attachPolicy(users);
+  var transport = require('./account-auth-transport').attachTransport({ users: users, tlsOptions: tlsOptions });
+  var sessionStore = require('./account-session-store').attachSessionStore({
+    file: TOKENS_FILE, managed: accountPolicy.available, clientAddress: transport.clientAddress,
+  });
+  var throttle = require('./account-auth-throttle').attachThrottle({
+    file: path.join(CONFIG_DIR, _isDevMode ? 'auth-attempts-dev.json' : 'auth-attempts.json'), clientAddress: transport.clientAddress,
+  });
+  function sessionToken(req) { return parseCookies(req)[MULTI_USER_COOKIE]; }
+  function createMultiUserSession(userId, credential, passkeyId, secure, req) {
+    var created = sessionStore.create(userId, credential, passkeyId, req, req && sessionToken(req));
+    var age = created.entry.expiresAt ? Math.max(0, Math.floor((created.entry.expiresAt - Date.now()) / 1000)) : 31536000;
+    var cookie = MULTI_USER_COOKIE + '=' + created.token + '; Path=/; HttpOnly; SameSite=Strict; Max-Age=' + age +
+      (tlsOptions || secure || req && transport.info(req).secure ? '; Secure' : '');
+    var rememberedCookie = rememberedAccounts.remember(userId, req);
+    return { token: created.token, cookie: cookie, cookies: rememberedCookie ? [cookie, rememberedCookie] : [cookie] };
   }
-
-  function saveTokens() {
-    try {
-      fs.mkdirSync(path.dirname(TOKENS_FILE), { recursive: true });
-      var tmpPath = TOKENS_FILE + ".tmp";
-      fs.writeFileSync(tmpPath, JSON.stringify(multiUserTokens));
-      fs.renameSync(tmpPath, TOKENS_FILE);
-    } catch (e) {}
+  function validSessionUser(record) {
+    var user = record && users.findUserById(record.userId);
+    if (!user) return null;
+    if (record.passkeyId && (!require('./account-passkey-policy').configured(users.loadUsers()) ||
+      !(user.passkeys || []).some(function (key) { return key.id === record.passkeyId; }))) return null;
+    if (accountPolicy.requiresPassword(user) && (!user.passwordHash || user.mustChangePin ||
+      record.credentialVersion !== require('./account-session-store').digest(user.passwordHash))) return null;
+    return user;
   }
-
-  loadTokens();
-
-  function createMultiUserSession(userId) {
-    var token = users.generateUserAuthToken(userId);
-    multiUserTokens[token] = userId;
-    saveTokens();
-    var cookie = MULTI_USER_COOKIE + "=" + token + "; Path=/; HttpOnly; SameSite=Strict; Max-Age=31536000" + (tlsOptions ? "; Secure" : "");
-    return { token: token, cookie: cookie };
-  }
-
   function getMultiUserFromReq(req) {
-    var cookies = parseCookies(req);
-    var token = cookies[MULTI_USER_COOKIE];
-    if (token) {
-      var userId = multiUserTokens[token];
-      if (userId) {
-        var user = users.findUserById(userId);
-        if (user) return user;
-      }
+    if (accountPolicy.enabled() && !transport.allows(req, false)) return null;
+    var token = sessionToken(req);
+    var record = sessionStore.get(token, false);
+    var user = validSessionUser(record);
+    if (user) {
+      if (!req.claySessionPassive) sessionStore.get(token, true, req);
+      return user;
     }
-    // Solo auto-login: exactly one user with no PIN => frictionless access, no
-    // login wall. Mirrors the old single-user onramp once single-user mode is
-    // absorbed into multi-user. Disabled the moment a PIN is set or a second
-    // user is added (then the normal token/login flow applies).
-    var solo = users.getSoloNoPinUser();
-    if (solo) return solo;
-    return null;
+    return users.getSoloNoPinUser() || null;
   }
-
-  function isMultiUserAuthed(req) {
-    return !!getMultiUserFromReq(req);
+  function touchSession(req) {
+    if (getMultiUserFromReq(req)) sessionStore.get(sessionToken(req), true, req);
   }
-
-  function revokeUserTokens(userId) {
-    var changed = false;
-    for (var token in multiUserTokens) {
-      if (multiUserTokens[token] === userId) {
-        delete multiUserTokens[token];
-        changed = true;
-      }
+  function isMultiUserAuthed(req) { return !!getMultiUserFromReq(req); }
+  function revokeUserTokens(userId) { sessionStore.revokeUser(userId); }
+  function allowAttempt(req, res, username) {
+    try { throttle.consume(req, username); return true; }
+    catch (error) {
+      res.writeHead(error.status || 503, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ error: error.message })); return false;
     }
-    if (changed) saveTokens();
   }
 
   // --- PIN rate limiting (per-instance state) ---
@@ -163,7 +146,7 @@ function attachAuth(ctx) {
   var recovery = null;
 
   function setRecovery(urlPath, password) {
-    recovery = { urlPath: urlPath, password: password };
+    recovery = { urlPath: urlPath, password: password, until: Date.now() + 15 * 60000 };
   }
 
   function clearRecovery() {
@@ -246,14 +229,11 @@ function attachAuth(ctx) {
   // --- Auth page selection ---
   var pinPage = pages.pinPageHtml();
   var adminSetupPage = pages.adminSetupPageHtml();
-  var loginPage = pages.multiUserLoginPageHtml();
-  var smtpLoginPage = pages.smtpLoginPageHtml();
 
   function getAuthPage() {
     if (!users.isMultiUser()) return pinPage;
     if (!users.hasAdmin()) return adminSetupPage;
-    if (smtp.isEmailLoginEnabled()) return smtpLoginPage;
-    return loginPage;
+    return require('./account-login-page').render({ password: accountPolicy.enabled(), email: !accountPolicy.enabled() && smtp.isEmailLoginEnabled() });
   }
 
   function isRequestAuthed(req) {
@@ -268,8 +248,22 @@ function attachAuth(ctx) {
   // --- Route handler ---
 
   function handleRequest(req, res, fullUrl) {
+    if (require('./account-login-page').handleAsset(req, res, fullUrl)) return true;
+    if (accountPolicy.enabled() && transport.info(req).secure && typeof res.setHeader === 'function') res.setHeader('Strict-Transport-Security', 'max-age=31536000');
+    if ((accountPolicy.enabled() || fullUrl === '/api/account-auth-policy' && req.method === 'PUT') && /^(?:\/auth\/(?!passkey-browser\.js)|\/api\/(?:account-auth-policy|passkey-policy|passkeys|account-sessions|account-transport|user\/pin|admin\/users|profile)|\/recover\/)/.test(fullUrl) &&
+      !transport.allows(req, ['GET', 'HEAD', 'OPTIONS'].indexOf(req.method) === -1)) {
+      res.writeHead(403, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ error: 'Use HTTPS and the same Clay address for account requests. Reverse proxies must be explicitly configured.' })); return true;
+    }
+    if (rememberedAccounts.handleRequest(req, res, fullUrl)) return true;
+    if (accountSecurity.handleRequest(req, res, fullUrl)) return true;
+    if (accountPasskeys.handleRequest(req, res, fullUrl)) return true;
+    if (accountPasswords.handleRequest(req, res, fullUrl)) return true;
     // Admin password recovery
     if (recovery && fullUrl === "/recover/" + recovery.urlPath) {
+      if (recovery.until <= Date.now()) {
+        recovery = null; res.writeHead(410, { 'Content-Type': 'application/json' }); res.end('{"error":"Recovery expired. Enable a new recovery link from the server terminal."}'); return true;
+      }
       if (req.method === "GET") {
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
         res.end(recoveryPageHtml());
@@ -288,6 +282,8 @@ function attachAuth(ctx) {
         req.on("end", function () {
           try {
             var data = JSON.parse(body);
+            if (!allowAttempt(req, res, 'admin-recovery')) return;
+            if (!recovery || recovery.until <= Date.now()) throw new Error('Recovery expired.');
             if (data.step === "verify") {
               if (!data.password || data.password !== recovery.password) {
                 recordPinFailure(ip);
@@ -315,7 +311,9 @@ function attachAuth(ctx) {
                 res.end('{"error":"No admin account found"}');
                 return;
               }
-              users.updateUserPin(admin.id, data.pin);
+              var reset = users.updateUserPin(admin.id, data.pin);
+              if (!reset.ok) throw new Error('Could not reset the administrator account.');
+              revokeUserTokens(admin.id);
               recovery = null;
               res.writeHead(200, { "Content-Type": "application/json" });
               res.end('{"ok":true}');
@@ -334,6 +332,11 @@ function attachAuth(ctx) {
 
     // Global auth endpoint (single-user PIN)
     if (req.method === "POST" && req.url === "/auth") {
+      if (users.isMultiUser()) {
+        res.writeHead(403, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+        res.end(JSON.stringify({ ok: false, error: 'Server PIN sign-in is unavailable. Sign in with your account.' }));
+        return true;
+      }
       var ip = req.socket.remoteAddress || "";
       var remaining = checkPinRateLimit(ip);
       if (remaining !== null) {
@@ -439,9 +442,9 @@ function attachAuth(ctx) {
             }
           }
           users.clearSetupCode();
-          var session = createMultiUserSession(result.user.id);
+          var session = createMultiUserSession(result.user.id, null, null, false, req);
           res.writeHead(200, {
-            "Set-Cookie": session.cookie,
+            "Set-Cookie": session.cookies,
             "Content-Type": "application/json",
           });
           res.end(JSON.stringify({ ok: true, user: { id: result.user.id, username: result.user.username, role: result.user.role } }));
@@ -472,6 +475,7 @@ function attachAuth(ctx) {
       req.on("end", function () {
         try {
           var data = JSON.parse(body);
+          if (!allowAttempt(req, res, data.username)) return;
           var user = users.authenticateUser(data.username, data.pin);
           if (!user) {
             recordPinFailure(ip);
@@ -481,11 +485,12 @@ function attachAuth(ctx) {
             return;
           }
           clearPinFailures(ip);
-          var session = createMultiUserSession(user.id);
+          throttle.success(req, data.username);
+          var session = createMultiUserSession(user.id, null, null, false, req);
           var loginResp = { ok: true, user: { id: user.id, username: user.username, role: user.role } };
           if (user.mustChangePin) loginResp.mustChangePin = true;
           res.writeHead(200, {
-            "Set-Cookie": session.cookie,
+            "Set-Cookie": session.cookies,
             "Content-Type": "application/json",
           });
           res.end(JSON.stringify(loginResp));
@@ -528,6 +533,7 @@ function attachAuth(ctx) {
             res.end('{"ok":true}');
             return;
           }
+          if (!allowAttempt(req, res, 'email:' + String(data.email).toLowerCase())) return;
           var result = smtp.requestOtp(data.email);
           if (result.error) {
             res.writeHead(429, { "Content-Type": "application/json" });
@@ -573,6 +579,7 @@ function attachAuth(ctx) {
             res.end('{"error":"Email and code are required"}');
             return;
           }
+          if (!allowAttempt(req, res, 'email:' + String(data.email).toLowerCase())) return;
           var otpResult = smtp.verifyOtp(data.email, data.code);
           if (!otpResult.valid) {
             recordPinFailure(ip);
@@ -587,9 +594,9 @@ function attachAuth(ctx) {
             return;
           }
           clearPinFailures(ip);
-          var session = createMultiUserSession(user.id);
+          var session = createMultiUserSession(user.id, null, null, false, req);
           res.writeHead(200, {
-            "Set-Cookie": session.cookie,
+            "Set-Cookie": session.cookies,
             "Content-Type": "application/json",
           });
           res.end(JSON.stringify({ ok: true, user: { id: user.id, username: user.username, role: user.role } }));
@@ -625,7 +632,7 @@ function attachAuth(ctx) {
             return;
           }
           var result;
-          if (smtp.isEmailLoginEnabled() && !data.pin) {
+          if (smtp.isEmailLoginEnabled() && !data.pin && !accountPasswords.policy.enabled()) {
             // SMTP mode: username + email required, no PIN
             if (!data.email || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(data.email)) {
               res.writeHead(400, { "Content-Type": "application/json" });
@@ -667,9 +674,9 @@ function attachAuth(ctx) {
             }
           }
           users.markInviteUsed(data.inviteCode);
-          var session = createMultiUserSession(result.user.id);
+          var session = createMultiUserSession(result.user.id, null, null, false, req);
           res.writeHead(200, {
-            "Set-Cookie": session.cookie,
+            "Set-Cookie": session.cookies,
             "Content-Type": "application/json",
           });
           res.end(JSON.stringify({ ok: true, user: { id: result.user.id, username: result.user.username, role: result.user.role } }));
@@ -686,17 +693,16 @@ function attachAuth(ctx) {
       if (users.isMultiUser()) {
         var cookies = parseCookies(req);
         var token = cookies[MULTI_USER_COOKIE];
-        if (token && multiUserTokens[token]) {
-          delete multiUserTokens[token];
-          saveTokens();
+        try { sessionStore.revokeToken(token); } catch (error) {
+          res.writeHead(503, { 'Content-Type': 'application/json' }); res.end('{"error":"Could not persist sign-out. Please retry."}'); return true;
         }
         res.writeHead(200, {
-          "Set-Cookie": MULTI_USER_COOKIE + "=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0" + (tlsOptions ? "; Secure" : ""),
+          "Set-Cookie": MULTI_USER_COOKIE + "=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0" + (tlsOptions || transport.info(req).secure ? "; Secure" : ""),
           "Content-Type": "application/json",
         });
       } else {
         res.writeHead(200, {
-          "Set-Cookie": "relay_auth=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0" + (tlsOptions ? "; Secure" : ""),
+          "Set-Cookie": "relay_auth=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0" + (tlsOptions || transport.info(req).secure ? "; Secure" : ""),
           "Content-Type": "application/json",
         });
       }
@@ -722,14 +728,36 @@ function attachAuth(ctx) {
         return true;
       }
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(smtp.isEmailLoginEnabled() ? pages.smtpInvitePageHtml(inviteCode) : pages.invitePageHtml(inviteCode));
+      res.end(smtp.isEmailLoginEnabled() && !accountPasswords.policy.enabled() ? pages.smtpInvitePageHtml(inviteCode) : pages.invitePageHtml(inviteCode));
       return true;
     }
 
     return false;
   }
 
+  var accountPasswords = require('./server-account-passwords').attachAccountPasswords({
+    users: users, devMode: _isDevMode, tlsOptions: tlsOptions, parseCookies: parseCookies,
+    getUser: getMultiUserFromReq, createSession: createMultiUserSession, revokeSessions: revokeUserTokens,
+    onPolicyChanged: ctx.onAccountPolicyChanged, throttle: throttle, transport: transport,
+  });
+  var accountPasskeys = require('./server-account-passkeys').attachAccountPasskeys({
+    users: users, devMode: _isDevMode, parseCookies: parseCookies, http: accountPasswords.http,
+    getUser: getMultiUserFromReq, createSession: createMultiUserSession,
+    sessionToken: sessionToken, clientAddress: transport.clientAddress,
+  });
+
+  var rememberedAccounts = require('./account-remembered').attachRemembered({
+    users: users, devMode: _isDevMode, parseCookies: parseCookies, transport: transport,
+    file: path.join(CONFIG_DIR, _isDevMode ? 'remembered-accounts-dev.json' : 'remembered-accounts.json'), read: accountPasswords.http.read,
+  });
+
+  var accountSecurity = require('./server-account-security').attachAccountSecurity({
+    users: users, getUser: getMultiUserFromReq, sessionToken: sessionToken, sessions: sessionStore,
+    validSessionUser: validSessionUser, http: accountPasswords.http, transport: transport,
+  });
+
   return {
+    touchSession: touchSession,
     handleRequest: handleRequest,
     getMultiUserFromReq: getMultiUserFromReq,
     isRequestAuthed: isRequestAuthed,

package/lib/server-contextual-clay-settings.js

@@ -0,0 +1,40 @@
+// Authenticated personal preferences, using the shared users/config persistence.
+function attachContextualClaySettings(ctx) {
+  function reply(res, status, data) {
+    res.writeHead(status, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    res.end(JSON.stringify(data));
+  }
+  function identity(req) {
+    if (!ctx.isRequestAuthed(req)) return null;
+    return ctx.users.isMultiUser() ? ctx.getMultiUserFromReq(req) : { id: 'default' };
+  }
+  function handleRequest(req, res, url) {
+    if (url !== '/api/user/contextual-clay-geometry') return false;
+    var user = identity(req);
+    if (!user) { reply(res, 401, { error: 'Sign in to manage popover preferences.' }); return true; }
+    if (req.method === 'GET') {
+      try { reply(res, 200, { geometry: ctx.users.getContextualClayGeometry(user.id) }); }
+      catch (error) { reply(res, 500, { error: 'Could not read popover preference.' }); }
+      return true;
+    }
+    if (req.method !== 'PUT') { reply(res, 405, { error: 'Method not allowed.' }); return true; }
+    if (req.headers['x-clay-settings'] !== '1' || (req.headers['sec-fetch-site'] && ['same-origin', 'none'].indexOf(req.headers['sec-fetch-site']) < 0)) {
+      reply(res, 403, { error: 'Save preferences from Clay.' }); return true;
+    }
+    var body = ''; var tooLarge = false;
+    req.setEncoding('utf8');
+    req.on('data', function (chunk) { body += chunk; if (body.length > 1024 && !tooLarge) { tooLarge = true; reply(res, 413, { error: 'Request too large.' }); } });
+    req.on('end', function () {
+      if (tooLarge) return;
+      var live = identity(req);
+      if (!live || live.id !== user.id) { reply(res, 401, { error: 'Sign in again.' }); return; }
+      try {
+        var result = ctx.users.setContextualClayGeometry(live.id, JSON.parse(body));
+        reply(res, result.error ? 400 : 200, result);
+      } catch (error) { reply(res, 400, { error: 'Could not save popover preference.' }); }
+    });
+    return true;
+  }
+  return { handleRequest: handleRequest };
+}
+module.exports = { attachContextualClaySettings: attachContextualClaySettings };

package/lib/server-contextual-mate-sessions.js

@@ -0,0 +1,70 @@
+// Presentation-only session operations share Home's authoritative permissions,
+// model policy, saved-session projection and session manager. No transcript tap.
+function attachContextualMateSessions(ctx) {
+  var receipts = new Map();
+  var lifetime = 30 * 60 * 1000;
+  function stamp(mate) { return JSON.stringify([mate.id, mate.createdBy || null, mate.createdAt || null, mate.builtinKey || null]); }
+  function live(ws, userId, msg, original) {
+    if (!ctx.isActorLive(ws, userId)) throw new Error('Your account is no longer available.');
+    var found = ctx.findMateProject(userId, msg.mateId, true);
+    if (!found || found.mate.archived || found.mate.lifecycleDeletion || found.mate.createdBy && found.mate.createdBy !== userId || stamp(found.mate) !== msg.mateStamp) throw new Error('This Mate is no longer available.');
+    var status = found.ctx.getStatus();
+    if (!status || !status.isMate || status.mateId !== found.mate.id || userId && status.projectOwnerId !== userId) throw new Error('This private Mate workspace is unavailable.');
+    found.contextualManager = found.ctx.getSessionManager();
+    found.contextualRevision = JSON.stringify([status.path, status.projectOwnerId, status.mateId, stamp(found.mate)]);
+    if (original && (found.ctx !== original.ctx || found.contextualRevision !== original.contextualRevision || found.contextualManager !== original.contextualManager)) throw new Error('This Mate conversation changed.');
+    return found;
+  }
+  function reply(ws, msg, data) { ctx.sendMessage(ws, Object.assign({ type: 'contextual_mate_sessions_result', requestId: msg.requestId, mateId: msg.mateId, mateStamp: msg.mateStamp }, data)); }
+  async function perform(ws, userId, msg) {
+    try {
+      if (typeof msg.requestId !== 'string' || !/^mate-conversations-[a-z0-9-]{36}$/.test(msg.requestId)) throw new Error('Invalid conversation request.');
+      var found = live(ws, userId, msg), manager = found.ctx.getSessionManager();
+      if (!manager) throw new Error('Conversation history is unavailable.');
+      if (msg.type === 'home_mate_sessions_list') {
+        var list = ctx.listHomeSessions(found, userId);
+        reply(ws, msg, { ok: true, sessions: list.slice(0, 500), truncated: list.length > 500 }); return;
+      }
+      var session;
+      if (msg.type === 'home_mate_session_open') {
+        session = ctx.resolveHomeSession(found, userId, msg.sessionId);
+        if (!session || typeof msg.sessionOriginId !== 'string' || msg.sessionOriginId !== session.sessionOriginId) throw new Error('This conversation is no longer available.');
+      } else {
+        var now = Date.now();
+        receipts.forEach(function (entry, key) { if (now - entry.at > lifetime) receipts.delete(key); });
+        var key = JSON.stringify([userId, msg.mateId, msg.requestId]);
+        var receipt = receipts.get(key);
+        manager.sessions.forEach(function (candidate) { if (candidate.contextualCreationRequestId === msg.requestId && ctx.ownsSession(candidate, userId)) session = candidate; });
+        if (session && session.contextualCreationMateStamp !== msg.mateStamp) throw new Error('This request belongs to a replaced Mate.');
+        if (receipt && (!session || receipt.origin !== session.sessionOriginId || receipt.stamp !== msg.mateStamp)) throw new Error('The previously created conversation is no longer available.');
+        if (!session && msg.lookupOnly) throw new Error('Creation was not confirmed. Start a new chat explicitly if you still want one.');
+        if (!session) {
+          if (receipts.size >= 1024) throw new Error('Please try starting a conversation later.');
+          var resolved = await ctx.homeModels.resolveMateModel(ws, found, userId);
+          found = live(ws, userId, msg, found);
+          // Recheck after model resolution: concurrent retries select one exact session.
+          manager.sessions.forEach(function (candidate) { if (candidate.contextualCreationRequestId === msg.requestId && ctx.ownsSession(candidate, userId)) session = candidate; });
+          receipt = receipts.get(key);
+          if (receipt && (!session || receipt.origin !== session.sessionOriginId || receipt.stamp !== msg.mateStamp)) throw new Error('The previously created conversation is no longer available.');
+          if (session && session.contextualCreationMateStamp !== msg.mateStamp) throw new Error('This request belongs to a replaced Mate.');
+          if (!session) {
+            if (receipts.size >= 1024) throw new Error('Please try starting a conversation later.');
+            session = manager.createSessionRaw({ ownerId: userId, vendor: resolved.vendor, model: resolved.model, effort: resolved.effort || null });
+            session.contextualCreationRequestId = msg.requestId;
+            session.contextualCreationMateStamp = msg.mateStamp;
+            manager.saveSessionFile(session);
+          }
+        }
+        if (!ctx.ownsSession(session, userId)) throw new Error('This conversation is no longer available.');
+        receipts.set(key, { at: now, origin: session.sessionOriginId, stamp: msg.mateStamp });
+      }
+      live(ws, userId, msg, found);
+      reply(ws, msg, { ok: true, sessionId: session.localId, sessionOriginId: session.sessionOriginId });
+    } catch (error) { reply(ws, msg, { ok: false, error: error.message || 'Conversation unavailable.' }); }
+  }
+  return { handle: function (ws, userId, msg) {
+    if (msg.presentation !== 'contextual' || !/^home_mate_(sessions_list|session_open|new_session)$/.test(msg.type)) return false;
+    perform(ws, userId, msg); return true;
+  } };
+}
+module.exports = { attachContextualMateSessions: attachContextualMateSessions };

package/lib/server-dm.js

@@ -49,7 +49,7 @@ function attachDm(ctx) {
       var mateCtx2 = mates.buildMateCtx(userId);
       if (mates.isMate(mateCtx2, msg.targetUserId)) {
         var mate = mates.getMate(mateCtx2, msg.targetUserId);
-        if (!mate) return true;
+        if (!mate || mate.lifecycleDeletion) return true;
         // Ensure mate project is registered (survives server restarts)
         var mateSlug2 = "mate-" + mate.id;
         if (!projects.has(mateSlug2)) {
@@ -69,6 +69,7 @@ function attachDm(ctx) {
             id: mate.id,
             displayName: mp.displayName || mate.name || "New Mate",
             username: mate.id,
+            avatarCatalogId: mp.avatarCatalogId || "",
             avatarStyle: mp.avatarStyle || "imprint",
             avatarSeed: mp.avatarSeed || mate.id,
             avatarColor: mp.avatarColor || "#5857fc",

package/lib/server-global-ws.js

@@ -63,14 +63,6 @@ function attachGlobalWs(opts) {
     if (msg.type === "browse_dir") {
       var rawPath = (msg.path || "").replace(/^~/, config.REAL_HOME);
       var absTarget = path.resolve(rawPath);
-      // Multi-user mode: non-admins can only browse their home directory.
-      if (osUsers && ws._clayUser && ws._clayUser.role !== "admin") {
-        var browseHome = ws._clayUser.linuxUser ? "/home/" + ws._clayUser.linuxUser : null;
-        if (!browseHome || (absTarget !== browseHome && (absTarget + "/").indexOf(browseHome + "/") !== 0)) {
-          sendTo(ws, { type: "browse_dir_result", path: msg.path, entries: [], error: "Access restricted to your home directory" });
-          return;
-        }
-      }
       var parentDir, prefix;
       try {
         var stat = fs.statSync(absTarget);
@@ -87,12 +79,17 @@ function attachGlobalWs(opts) {
         parentDir = path.dirname(absTarget);
         prefix = path.basename(absTarget).toLowerCase();
       }
+      if (opts.canUsePath && !opts.canUsePath(ws._clayUser && ws._clayUser.id, parentDir)) {
+        sendTo(ws, { type: "browse_dir_result", entries: [], error: "Directory access is not permitted" });
+        return;
+      }
       try {
         var dirItems = fs.readdirSync(parentDir, { withFileTypes: true });
         var dirEntries = [];
         for (var di = 0; di < dirItems.length; di++) {
           var d = dirItems[di];
           if (!d.isDirectory()) continue;
+          if (opts.canUsePath && !opts.canUsePath(ws._clayUser && ws._clayUser.id, path.join(parentDir, d.name))) continue;
           if (d.name.charAt(0) === ".") continue;
           if (IGNORED_DIRS.has(d.name)) continue;
           if (prefix && !d.name.toLowerCase().startsWith(prefix)) continue;
@@ -110,16 +107,9 @@ function attachGlobalWs(opts) {
     if (msg.type === "add_project") {
       var addPath = (msg.path || "").replace(/^~/, config.REAL_HOME);
       var addAbs = path.resolve(addPath);
-      if (osUsers && ws._clayUser && ws._clayUser.role !== "admin") {
-        if (!ws._clayUser.linuxUser) {
-          sendTo(ws, { type: "add_project_result", ok: false, error: "No Linux user assigned" });
-          return;
-        }
-        var userHome = "/home/" + ws._clayUser.linuxUser;
-        if (addAbs !== userHome && (addAbs + "/").indexOf(userHome + "/") !== 0) {
-          sendTo(ws, { type: "add_project_result", ok: false, error: "Path not allowed. You can only add directories under " + userHome });
-          return;
-        }
+      if (opts.canUsePath && !opts.canUsePath(ws._clayUser && ws._clayUser.id, addAbs)) {
+        sendTo(ws, { type: "add_project_result", ok: false, error: "Directory access is not permitted" });
+        return;
       }
       try {
         var addStat = fs.statSync(addAbs);
@@ -133,7 +123,7 @@ function attachGlobalWs(opts) {
       }
       if (typeof onAddProject === "function") {
         var result = onAddProject(addAbs, ws._clayUser);
-        sendTo(ws, { type: "add_project_result", ok: result.ok, slug: result.slug, error: result.error, existing: result.existing });
+        sendTo(ws, Object.assign({}, result, { type: "add_project_result" }));
       } else {
         sendTo(ws, { type: "add_project_result", ok: false, error: "Not supported" });
       }
@@ -159,7 +149,7 @@ function attachGlobalWs(opts) {
       }
       if (typeof onCreateProject === "function") {
         var createResult = onCreateProject(createName, ws._clayUser);
-        sendTo(ws, { type: "add_project_result", ok: createResult.ok, slug: createResult.slug, error: createResult.error });
+        sendTo(ws, Object.assign({}, createResult, { type: "add_project_result" }));
       } else {
         sendTo(ws, { type: "add_project_result", ok: false, error: "Not supported" });
       }

package/lib/server-home-chat-events.js

@@ -3,7 +3,7 @@
 function homeDebateQuestions(input) {
   var source = input && Array.isArray(input.questions) && input.questions[0] ? input.questions[0] : null;
   if (!source) return [];
-  var question = { header: source.header || "", question: source.question || "", multiSelect: false, options: [] };
+  var question = { header: source.header || "", question: source.question || "", multiSelect: false, allowOther: source.allowOther !== false, options: [] };
   var options = Array.isArray(source.options) ? source.options.slice(0, 6) : [];
   for (var i = 0; i < options.length; i++) question.options.push({ label: options[i].label || "Option", description: options[i].description || "" });
   return [question];
@@ -36,6 +36,7 @@ function findDebateTurn(messages, event) {
 function debateIdentity(source, fallback) {
   var prior = fallback || {};
   return {
+    avatarCatalogId: source.avatarCatalogId || prior.avatarCatalogId || "",
     avatarStyle: source.avatarStyle || prior.avatarStyle || "imprint",
     avatarSeed: source.avatarSeed || prior.avatarSeed || source.mateId || "mate",
     avatarColor: source.avatarColor || prior.avatarColor || "",
@@ -112,7 +113,7 @@ function applyAssignmentHistoryEvent(messages, event) {
   messages.push({ role: "assignment", assignment: assignment });
 }
 
-function historyToHomeChat(history, debateSetupMode, mateCreationMode) {
+function historyToHomeChat(history, debateSetupMode, mateCreationMode, pendingAskUser) {
   var messages = [];
   var pending = "";
   var interviewMode = debateSetupMode === true || mateCreationMode === true;
@@ -124,6 +125,12 @@ function historyToHomeChat(history, debateSetupMode, mateCreationMode) {
   for (var i = 0; i < history.length; i++) {
     var event = history[i];
     if (!event) continue;
+    if (event.type === 'tool_executing' && event.name === 'AskUserQuestion' && ['mcp-import', 'mate-schedule', 'mcp_fallback', 'product-control'].indexOf(event.source) >= 0) {
+      flushAssistant();
+      var activeConsent = pendingAskUser === undefined || !!(pendingAskUser && pendingAskUser[event.id]);
+      messages.push({ role: 'question', flow: event.source === 'mcp-import' ? 'mcp_import' : 'mate_question', toolId: event.id, questions: homeDebateQuestions(event.input), status: activeConsent ? 'pending' : 'expired', error: activeConsent ? '' : 'This question is no longer active. Ask for a new review.' });
+      continue;
+    }
     if (event.type === "project_assignment_proposal" || event.type === "project_assignment_status") {
       flushAssistant();
       applyAssignmentHistoryEvent(messages, event);
@@ -185,7 +192,7 @@ function historyToHomeChat(history, debateSetupMode, mateCreationMode) {
     } else if (interviewMode && event.type === "tool_executing" && event.name === "AskUserQuestion" && event.id && event.input) {
       flushAssistant();
       messages.push({ role: "question", flow: mateCreationMode === true ? "mate_creation" : "debate", toolId: event.id, questions: homeDebateQuestions(event.input), status: "pending", error: "" });
-    } else if ((event.type === "ask_user_answered" || event.type === "home_debate_question_expired" || event.type === "home_mate_creation_question_expired") && event.toolId) {
+    } else if ((event.type === "ask_user_answered" || event.type === "home_debate_question_expired" || event.type === "home_mate_creation_question_expired" || event.type === "mcp_import_consent_expired" || event.type === "mate_schedule_question_expired") && event.toolId) {
       for (var k = messages.length - 1; k >= 0; k--) {
         if (messages[k].role === "question" && messages[k].toolId === event.toolId) {
           messages[k].status = event.type === "ask_user_answered" ? "answered" : "expired";
@@ -273,7 +280,7 @@ function transformEvent(event, mateId, session, requestId, stableSessionId) {
   }
   if (session && session.homeDebatePlanning === true && HOME_DEBATE_EVENT_TYPES[event.type]) {
     var live = { type: "home_debate_event", eventType: event.type };
-    var fields = ["turnId", "decisionId", "decision", "toolName", "command", "commandTruncated", "topic", "format", "moderatorId", "moderatorName", "panelists", "mateName", "role", "round", "activity", "delta", "text", "reason", "action", "avatarStyle", "avatarSeed", "avatarColor", "avatarCustom"];
+    var fields = ["turnId", "decisionId", "decision", "toolName", "command", "commandTruncated", "topic", "format", "moderatorId", "moderatorName", "panelists", "mateName", "role", "round", "activity", "delta", "text", "reason", "action", "avatarCatalogId", "avatarStyle", "avatarSeed", "avatarColor", "avatarCustom"];
     for (var fi = 0; fi < fields.length; fi++) if (Object.prototype.hasOwnProperty.call(event, fields[fi])) live[fields[fi]] = event[fields[fi]];
     if (event.mateId) live.speakerMateId = event.mateId;
     return Object.assign(live, metadata);
@@ -298,6 +305,13 @@ function transformEvent(event, mateId, session, requestId, stableSessionId) {
   if (event.type === "debate_proposal_resolved" && event.proposalId) return Object.assign({ type: "home_debate_proposal_resolved", proposalId: event.proposalId, action: event.action || "cancel", error: event.error || "" }, metadata);
   if (session && session.mateCreationMode === true && event.type === "mate_creation_proposal" && event.proposal) return Object.assign({ type: "home_mate_creation_proposal", proposal: event.proposal }, metadata);
   if (session && session.mateCreationMode === true && event.type === "mate_creation_proposal_resolved" && event.proposalId) return Object.assign({ type: "home_mate_creation_proposal_resolved", proposalId: event.proposalId, action: event.action || "cancel", createdMateId: event.mateId || null, mateName: event.mateName || null, error: event.error || "" }, metadata);
+  if (!(session && (session.debateSetupMode === true || session.mateCreationMode === true)) && event.type === 'tool_executing' && event.name === 'AskUserQuestion' && ['mate-schedule', 'mcp_fallback', 'product-control'].indexOf(event.source) >= 0) return Object.assign({ type: 'home_mate_question', toolId: event.id, questions: homeDebateQuestions(event.input) }, metadata);
+  if (session && session.debateSetupMode !== true && session.mateCreationMode !== true && event.type === 'ask_user_answered' && event.toolId && (session.history || []).some(function (item) { return item.id === event.toolId && ['mate-schedule', 'mcp_fallback', 'product-control'].indexOf(item.source) >= 0; })) return Object.assign({ type: 'home_mate_question_resolved', toolId: event.toolId, status: 'answered', answers: event.answers }, metadata);
+  if (event.type === 'tool_executing' && event.name === 'AskUserQuestion' && event.source === 'mcp-import') return Object.assign({ type: 'home_mcp_import_question', toolId: event.id, questions: homeDebateQuestions(event.input) }, metadata);
+  if (event.type === 'product_control_question_expired') return Object.assign({ type: 'home_mate_question_resolved', toolId: event.toolId, status: 'expired', error: event.error }, metadata);
+  if (event.type === 'mate_schedule_question_expired') return Object.assign({ type: 'home_mate_question_resolved', toolId: event.toolId, status: 'expired', error: event.error }, metadata);
+  if (event.type === 'mcp_import_consent_expired') return Object.assign({ type: 'home_mcp_import_question_resolved', toolId: event.toolId, status: 'expired', error: event.error }, metadata);
+  if (session && event.type === 'ask_user_answered' && event.toolId && (session.history || []).some(function (item) { return item.id === event.toolId && item.source === 'mcp-import'; })) return Object.assign({ type: 'home_mcp_import_question_resolved', toolId: event.toolId, status: 'answered', answers: event.answers }, metadata);
   if (session && session.debateSetupMode === true && event.type === "tool_executing" && event.name === "AskUserQuestion" && event.id && event.input) {
     return Object.assign({ type: "home_debate_question", toolId: event.id, questions: homeDebateQuestions(event.input) }, metadata);
   }