clay-server 5.2.0-beta.1 → 5.2.0-beta.10

package/lib/public/modules/vendor-priority.js

@@ -1,4 +1,18 @@
-export var VENDOR_ORDER = ["claude", "codex", "grok", "kimi", "copilot", "qwen", "junie", "antigravity", "opencode", "kiro"];
+export var VENDOR_ORDER = ["claude", "codex", "muse", "grok", "kimi", "copilot", "qwen", "junie", "antigravity", "opencode", "kiro"];
+
+// Availability comes from the caller's server catalog. Unknown providers keep
+// their catalog order within each availability group.
+export function sortVendorEntries(entries) {
+  return entries.map(function (entry, index) { return { entry: entry, index: index }; }).sort(function (a, b) {
+    var installed = Number(!!b.entry.installed) - Number(!!a.entry.installed);
+    if (installed) return installed;
+    var aRank = VENDOR_ORDER.indexOf(a.entry.id);
+    var bRank = VENDOR_ORDER.indexOf(b.entry.id);
+    if (aRank === -1) aRank = VENDOR_ORDER.length;
+    if (bRank === -1) bRank = VENDOR_ORDER.length;
+    return aRank - bRank || a.index - b.index;
+  }).map(function (item) { return item.entry; });
+}
 export var EXPERIMENTAL_VENDORS = ["grok", "kimi", "copilot", "qwen", "junie", "antigravity", "opencode"];
 
 export function isExperimentalVendor(vendor) {

package/lib/public/modules/wireframe-workbench.js

@@ -1,3 +1,4 @@
+import { forwardStudioPresentation, registerStudioPaint } from './clay-studio-render.js';
 import { sketchBrand, sketchCredit } from './wireframe-style.js';
 import { store } from './store.js';
 import { claimRightWorkbench, registerRightWorkbench, releaseRightWorkbench } from './right-workbench.js';
@@ -80,7 +81,7 @@ function createPanel() {
 export function openWireframe(message) {
   if (!message || typeof message.source !== 'string' || new TextEncoder().encode(message.source).length > 100000) return;
   if (store.get('paneMode') && window.parent !== window) {
-    window.parent.postMessage({ type: 'clay-pane-present-wireframe', message: message, projectSlug: store.get('currentSlug'), sessionId: store.get('activeSessionId') }, window.location.origin);
+    forwardStudioPresentation(message, 'clay-pane-present-wireframe');
     return;
   }
   claimRightWorkbench('wireframe');
@@ -92,7 +93,8 @@ export function openWireframe(message) {
   el.querySelector('header strong').textContent = draft.title;
   el.querySelector('.wireframe-save-status').textContent = '';
   el.querySelector('form').hidden = true;
-  draw(draft, el).catch(function () {});
+  var painted = draw(draft, el); registerStudioPaint(Object.assign({}, message, { source: draft.source }), el.querySelector("header"), painted, el.querySelector(".wireframe-workbench-canvas"));
+  painted.catch(function () {});
 }
 function draw(draft, el) {
   var canvas = el.querySelector('.wireframe-workbench-canvas');
@@ -104,6 +106,7 @@ function draw(draft, el) {
     var image = wireframeImage(svg, draft.title);
     canvas.replaceChildren(image);
     mountWireframeViewport(canvas, image, el.querySelector('.wireframe-zoom'));
+    return image.decode ? image.decode() : undefined;
   }).catch(function (error) {
     if (store.get('wireframeDraft') !== active) throw error;
     status.textContent = error.name === 'AbortError' ? 'Rendering was interrupted. Reopen the wireframe to retry.' : error.message;

package/lib/public/muse-avatar.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="Muse Code">
+  <rect width="64" height="64" rx="14" fill="#111827"/>
+  <path d="M14 45V19h7l11 14 10-14h8v26h-7V30L32 45 21 30v15z" fill="#f8fafc"/>
+</svg>

package/lib/public/style.css

@@ -59,6 +59,7 @@
 @import url("css/home-debate-planning.css");
 @import url("css/home-mate-creation.css");
 @import url("css/home-mate-settings.css");
+@import url("css/mate-avatar-gallery.css");
 @import url("css/home-mate-model-picker.css");
 @import url("css/project-mate-creation.css");
 @import url("css/home-debate-live.css");
@@ -87,3 +88,7 @@
 @import url("css/server-settings-system.css");
 
 @import url("css/project-settings-modal.css");
+
+@import url("css/clay-tool-activity.css");
+
+@import url("css/contextual-clay.css");

package/lib/public/sw.js

@@ -1,4 +1,4 @@
-var CACHE_NAME = "clay-offline-v4";
+var CACHE_NAME = "clay-offline-v5";
 
 self.addEventListener("install", function (event) {
   event.waitUntil(self.skipWaiting());
@@ -23,6 +23,8 @@ self.addEventListener("activate", function (event) {
 function shouldCache(request, response) {
   if (request.method !== "GET") return false;
   if (!response || !response.ok) return false;
+  var cacheControl = response.headers && response.headers.get("Cache-Control") || "";
+  if (/(^|,)\s*(private|no-store)(?:\s*=\s*[^,]*)?(?=\s*(?:,|$))/i.test(cacheControl)) return false;
   // Cache same-origin static assets and CDN resources (jsdelivr, fonts)
   var url = new URL(request.url);
   if (url.origin === self.location.origin) return true;

package/lib/safe-bash-commands.js

@@ -115,51 +115,9 @@ function isSafeBashSegment(seg) {
 // Emit the `Bash(...)` permission patterns for ~/.claude/settings.json. Each
 // standalone command gets a bare form (zero-arg) and a space-wildcard form
 // (claude 2.x prefix matching); subcommands and exact commands likewise.
-function buildClayBashAllowPatterns() {
-  var patterns = [];
-  for (var i = 0; i < STANDALONE.length; i++) {
-    patterns.push("Bash(" + STANDALONE[i] + ")");
-    patterns.push("Bash(" + STANDALONE[i] + " *)");
-  }
-  var bins = Object.keys(SUBCOMMAND);
-  for (var b = 0; b < bins.length; b++) {
-    var subs = SUBCOMMAND[bins[b]];
-    for (var s = 0; s < subs.length; s++) {
-      var base = bins[b] + " " + subs[s];
-      patterns.push("Bash(" + base + ")");
-      patterns.push("Bash(" + base + " *)");
-    }
-  }
-  for (var e = 0; e < EXACT.length; e++) {
-    patterns.push("Bash(" + EXACT[e] + ")");
-    patterns.push("Bash(" + EXACT[e] + " *)");
-  }
-  return patterns;
-}
-
-var GENERATED_SET = {};
-(function () {
-  var p = buildClayBashAllowPatterns();
-  for (var i = 0; i < p.length; i++) GENERATED_SET[p[i]] = true;
-})();
-
-// Recognize a `permissions.allow` entry that Clay owns, so the installer can
-// strip stale variants on upgrade (including shapes a previous version wrote)
-// WITHOUT clobbering user-authored patterns. Rules:
-//   - Standalone commands: own every shape of `Bash(ls ...)` (any args), since
-//     a user pattern for a command we manage is redundant with our broad one.
-//   - Subcommand binaries (git, npm, ...) and exact commands: only strip the
-//     precise patterns we generate, so a user's `Bash(git push)` survives.
-// Legacy colon shapes are handled separately by the installer.
-function isClayManagedBashPattern(p) {
-  if (typeof p !== "string") return false;
-  if (p.indexOf("Bash(") !== 0 || p.charAt(p.length - 1) !== ")") return false;
-  if (GENERATED_SET[p]) return true;
-  var inner = p.slice(5, -1).trim();
-  if (!inner) return false;
-  var word = inner.split(/[\s:]/)[0];
-  return STANDALONE_SET[word] === true;
-}
+var patternCodec = require("./yoke/claude-permission-patterns").attachPatterns({ STANDALONE: STANDALONE, SUBCOMMAND: SUBCOMMAND, EXACT: EXACT });
+function buildClayBashAllowPatterns() { return patternCodec.build(); }
+function isClayManagedBashPattern(pattern) { return patternCodec.isManaged(pattern); }
 
 module.exports = {
   STANDALONE: STANDALONE,

package/lib/scheduled-task-records.js

@@ -18,6 +18,7 @@ function createScheduledTaskRecords(ctx) {
     var runs = Array.isArray(record.runs) ? record.runs : [];
     var readiness = ctx.runtimeStatus ? ctx.runtimeStatus(record) : null;
     return {
+      createdBy: record.createdBy || null, updatedBy: record.updatedBy || null,
       id: record.id, revision: Number(record.updatedAt || 0), name: record.name || "",
       instructions: record.task || record.prompt || record.instructions || "",
       cron: record.cron || null, date: record.date || null, time: record.time || null,
@@ -49,7 +50,7 @@ function createScheduledTaskRecords(ctx) {
     return { ok: true, record: publicRecord(record) };
   }
 
-  function update(session, id, revision, patch) {
+  function update(session, id, revision, patch, actor) {
     if (typeof id !== "string" || !ID_PATTERN.test(id)) return { ok: false, error: "Scheduled task id is invalid." };
     var record = ctx.registry.getById(id);
     if (!record) return { ok: false, error: "Scheduled task not found." };
@@ -94,6 +95,7 @@ function createScheduledTaskRecords(ctx) {
     }
     try {
       var updateData = Object.assign({}, checked.value);
+      if (actor) updateData.updatedBy = actor;
       if (claimOwner) { updateData.ownerId = session.ownerId; updateData.enabled = true; }
       if (updateData.cron) {
         updateData.date = record.cron && !record.scheduleRule ? record.date || null : null;

package/lib/scheduler.js

@@ -239,6 +239,7 @@ function createLoopRegistry(opts) {
 
   function register(data) {
     var rec = {
+      createdBy: data.createdBy || null, updatedBy: data.updatedBy || null, creationFingerprint: data.creationFingerprint || null,
       id: data.id || ("loop_" + Date.now() + "_" + require("crypto").randomBytes(3).toString("hex")),
       name: data.name || "Untitled",
       task: data.task || "",
@@ -297,6 +298,7 @@ function createLoopRegistry(opts) {
     if (!rec) return null;
     var previous = Object.assign({}, rec);
 
+    if (data.updatedBy !== undefined) rec.updatedBy = data.updatedBy;
     if (data.name !== undefined) rec.name = data.name;
     if (data.cron !== undefined) rec.cron = data.cron;
     if (data.enabled !== undefined) rec.enabled = data.enabled;