clay-server 5.2.0-beta.1 → 5.2.0-beta.11

package/lib/mcp-agent-tools.js

@@ -0,0 +1,117 @@
+// Agent import consent is server-owned, owner-only, exact-query and single-use.
+var crypto = require('crypto');
+var userInput = require('./yoke/user-input');
+var createProxy = require('./mcp-proxy').createProxy;
+var SERVER = 'clay-mcp-connections';
+function result(value, error) { return { content: [{ type: 'text', text: JSON.stringify(value) }], isError: !!error }; }
+function attachMcpAgentTools(ctx) {
+  var viewers = new Map(), pending = new Map(), used = new WeakMap(), closed = false;
+  function ownerOf(session) { return ctx.isMultiUser() ? String(session.ownerId) : 'default'; }
+  function authorized(session, owner, generation) {
+    if (closed || !session || session.youCurator || session._mcpForeignInput || session.sessionVisibility === 'shared' || !ctx.canUseSession(session) || ownerOf(session) !== owner || Number(session._sdkQueryGeneration || 0) !== generation || session.taskStopRequested || session.abortController && session.abortController.signal.aborted) throw new Error('MCP management requires the current authorized private query.');
+    ctx.authorizeOwner(owner);
+  }
+  function canRespond(ws, session, owner) {
+    try {
+      if (!ws || ws.readyState !== 1 || ctx.ownerFor(ws) !== owner) return false;
+      return ctx.clients.has(ws) && ws._clayActiveSession === session.localId || viewers.has(ws) && viewers.get(ws).has(session);
+    } catch (error) { return false; }
+  }
+  function humans(session, owner) {
+    return Array.from(ctx.clients).concat(Array.from(viewers.keys())).some(function (ws) { return canRespond(ws, session, owner); });
+  }
+  function registerViewer(ws, session) {
+    var owner = ownerOf(session);
+    if (closed || !session || !ctx.canUseSession(session) || session._mcpForeignInput || session.sessionVisibility === 'shared') throw new Error('Consent viewer requires an authorized private session.');
+    ctx.authorizeOwner(owner);
+    if (ctx.ownerFor(ws) !== owner || ws.readyState !== 1) throw new Error('Consent viewer must be the authenticated owner.');
+    var sessions = viewers.get(ws) || new Map(), detached = false;
+    sessions.set(session, (sessions.get(session) || 0) + 1); viewers.set(ws, sessions);
+    return function () {
+      if (detached) return; detached = true;
+      var count = sessions.get(session) || 0;
+      if (count <= 1) sessions.delete(session); else sessions.set(session, count - 1);
+      if (!sessions.size && viewers.get(ws) === sessions) viewers.delete(ws);
+    };
+  }
+  function review(candidate, owner, config) {
+    var restrictions = config.enabledTools === null ? 'Tool allowlist: unrestricted' : 'Tool allowlist: ' + JSON.stringify(config.enabledTools || []);
+    restrictions += '\nExcluded tools: ' + JSON.stringify(config.disabledTools || []);
+    if (config.toolPatterns && config.toolPatterns.length) restrictions += '\nExcluded vendor patterns: ' + JSON.stringify(config.toolPatterns);
+    var question = 'Import "' + candidate.name + '" from ' + candidate.vendor + ' (' + candidate.scope + ') ?\nSource: ' + candidate.file + '\nTransport: ' + candidate.transport + '\nDependency: ' + candidate.dependency +
+      '\nDestination: owner ' + owner + ' — private MCP catalog shared across your Clay sessions, project sessions and Mates; other accounts cannot use it.\n' + restrictions + '\nRequired credential names: ' + (candidate.references.join(', ') || 'None') +
+      '\nThe imported copy will be DISABLED. This approval only saves that exact copy. Enable, Test and Sign in require separate actions. Original vendor files stay unchanged. Enter credentials only in MCP management, never in chat.';
+    if (question.length > 2000) throw new Error('This candidate needs a larger policy review than the consent card supports. Review it in MCP management; no import was made.');
+    return question;
+  }
+  function definitions(session) {
+    var owner = ownerOf(session), generation = Number(session._sdkQueryGeneration || 0);
+    function authorize() { authorized(session, owner, generation); }
+    async function discover(args) {
+      authorize();
+      if (Object.keys(args).some(function (key) { return key !== 'vendor' && key !== 'file'; })) throw new Error('Unsupported discovery input.');
+      if (!!args.file !== !!args.vendor) throw new Error('Configured discovery requires both vendor and absolute file path.');
+      var scan = ctx.discovery.scan(owner, session, args.file ? { vendor: args.vendor, file: args.file } : null);
+      authorize(); return result(Object.assign({ status: 'discovered', imported: false }, scan));
+    }
+    async function propose(args) {
+      authorize();
+      if (Object.keys(args).some(function (key) { return key !== 'scanId' && key !== 'candidateId'; })) throw new Error('Import approval cannot be supplied by an agent.');
+      var selected = ctx.discovery.selected(owner, session, args);
+      var key = JSON.stringify([owner, session.localId, generation, args.scanId, args.candidateId]);
+      var attempts = used.get(session);
+      if (!attempts || attempts.scanId !== args.scanId || attempts.generation !== generation) { attempts = { scanId: args.scanId, generation: generation, candidates: new Set() }; used.set(session, attempts); }
+      if (attempts.candidates.has(args.candidateId) || pending.has(key)) throw new Error('This import proposal has already been requested. Scan again for a new review.');
+      var candidate = ctx.discovery.candidate(owner, session, args);
+      if (!humans(session, owner) || session.loop && session.loop.active && session.loop.role !== 'crafting') return result({ status: 'consent_unavailable', imported: false, message: 'An authenticated owner must open this conversation to approve an import. Scheduled or unattended runs cannot approve for the user.' });
+      var question = review(candidate, owner, selected.config), requestId = 'mcp_import_' + crypto.randomUUID();
+      var controller = new AbortController(), timer, timedOut = false, sessionSignal = session.abortController && session.abortController.signal;
+      var entry = { controller: controller, requestId: requestId };
+      pending.set(key, entry); attempts.candidates.add(args.candidateId);
+      var parentAbort = function () { controller.abort(); };
+      if (sessionSignal) sessionSignal.addEventListener('abort', parentAbort, { once: true });
+      try {
+        timer = setTimeout(function () { timedOut = true; controller.abort(); }, Math.min(ctx.consentTimeout || 45000, 45000));
+        var handler = ctx.userInput && ctx.userInput(session);
+        var answer = await userInput.dispatchUserInput(function (request, respond) {
+          request.authorizeResponse = function (ws) {
+            try { authorize(); return pending.get(key) === entry && canRespond(ws, session, owner); } catch (error) { return false; }
+          };
+          if (typeof handler !== 'function') return respond.cancel('Structured owner consent is unavailable.');
+          return handler(request, respond);
+        }, { questions: [{ id: 'mcp_import', header: 'Import MCP', question: question, allowOther: false, options: [{ label: 'Keep unchanged' }, { label: 'Import disabled copy' }] }] }, { source: 'mcp-import', requestId: requestId, signal: controller.signal });
+        if (answer.status !== 'submitted' || !answer.answers.mcp_import || answer.answers.mcp_import.length !== 1 || answer.answers.mcp_import[0] !== 'Import disabled copy') return result({ status: timedOut ? 'expired' : answer.status === 'submitted' ? 'declined' : answer.status, imported: false, message: 'No connection was imported.' });
+        authorize();
+        if (pending.get(key) !== entry || !humans(session, owner)) throw new Error('Import consent is no longer available.');
+        // Consume before entering the queue. Queued mutation revalidates everything again.
+        pending.delete(key);
+        function authorizeImport() { authorize(); if (controller.signal.aborted) throw new Error('Import consent expired before the copy could be saved. Scan again.'); }
+        var id = await ctx.importConnection(owner, function () {
+          authorizeImport();
+          if (!humans(session, owner)) throw new Error('The owner disconnected before import.');
+          var live = ctx.discovery.selected(owner, session, args);
+          if (live.signature !== selected.signature || live.revision !== selected.revision) throw new Error('The reviewed candidate changed. Scan again.');
+          return live;
+        }, authorizeImport);
+        return result({ status: 'imported', imported: true, id: id, enabled: false, label: candidate.name, message: 'Saved a disabled copy in your private catalog. Configure credentials in MCP management; activation, testing and login are separate actions.' });
+      } finally {
+        clearTimeout(timer); pending.delete(key);
+        if (sessionSignal) sessionSignal.removeEventListener('abort', parentAbort);
+      }
+    }
+    function wrap(handler) { return function (args) { return Promise.resolve().then(function () { return handler(args || {}); }).catch(function (error) { return result({ status: 'refused', imported: false, message: error.message }, true); }); }; }
+    return [{ name: 'discover_mcp_connections', description: 'Read-only inspection of your vendor MCP sources. Returns redacted candidate IDs and provenance. Never executes commands, imports, activates, logs in or reads vendor OAuth stores. Use credential entry only in MCP management.', inputSchema: { type: 'object', properties: { vendor: { type: 'string' }, file: { type: 'string' } }, additionalProperties: false }, handler: wrap(discover) },
+      { name: 'propose_mcp_import', description: 'Present one exact discovered candidate to the authenticated owner for structured approval, then save a disabled copy only after explicit approval. Denial, cancellation, timeout or absent owner causes no import. Pass only scanId and candidateId; agent-provided approval is never accepted.', inputSchema: { type: 'object', properties: { scanId: { type: 'string' }, candidateId: { type: 'string' } }, required: ['scanId', 'candidateId'], additionalProperties: false }, handler: wrap(propose) }];
+  }
+  function getServer(session) {
+    try {
+      authorized(session, ownerOf(session), Number(session._sdkQueryGeneration || 0));
+      if (ctx.available && !ctx.available(session)) return null;
+      var tools = definitions(session);
+      return createProxy(SERVER, tools, function (name, args) { var tool = tools.find(function (item) { return item.name === name; }); return tool.handler(args); });
+    } catch (error) { return null; }
+  }
+  function destroy() { closed = true; pending.forEach(function (entry) { entry.controller.abort(); }); pending.clear(); used = new WeakMap(); viewers.clear(); }
+  return { getServer: getServer, registerViewer: registerViewer, destroy: destroy };
+}
+module.exports = { attachMcpAgentTools: attachMcpAgentTools, SERVER: SERVER };

package/lib/mcp-connection-store.js

@@ -1,39 +1,143 @@
-// Owner/project-scoped records with encrypted credentials; never sent to the UI.
+// Owner-scoped remote records and project-scoped computer preferences with encrypted credentials; never sent to the UI.
 var fs = require('fs');
 var path = require('path');
 var crypto = require('crypto');
-function createConnectionStore(root, project) {
+var equal = require('util').isDeepStrictEqual;
+
+function createConnectionStore(root, project, options) {
   var directory = path.join(root, 'mcp-connections');
+  var shared = !!(options && options.shared);
   function scope(owner) {
     if (typeof owner !== 'string' || !owner || owner.length > 160) throw new Error('MCP account owner is required.');
-    return JSON.stringify([project, owner]);
+    return shared ? JSON.stringify([owner]) : JSON.stringify([project, owner]);
   }
   function filename(owner) { return path.join(directory, crypto.createHash('sha256').update(scope(owner)).digest('hex') + '.json'); }
+  function legacyFilename(owner) { return path.join(directory, crypto.createHash('sha256').update(JSON.stringify([project, owner])).digest('hex') + '.json'); }
   function key() {
     fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
-    var file = path.join(directory, '.key');
-    try { fs.writeFileSync(file, crypto.randomBytes(32), { flag: 'wx', mode: 0o600 }); }
-    catch (error) { if (error.code !== 'EEXIST') throw error; }
-    return fs.readFileSync(file);
+    var file = path.join(directory, '.key'), bytes;
+    try { bytes = fs.readFileSync(file); }
+    catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+      var temp = file + '.' + crypto.randomBytes(8).toString('hex') + '.tmp';
+      try {
+        fs.writeFileSync(temp, crypto.randomBytes(32), { flag: 'wx', mode: 0o600 });
+        try { fs.linkSync(temp, file); } catch (publishError) { if (publishError.code !== 'EEXIST') throw publishError; }
+      } finally { fs.unlinkSync(temp); }
+      bytes = fs.readFileSync(file);
+    }
+    if (bytes.length !== 32) throw new Error('MCP encryption key is invalid.');
+    return bytes;
   }
-  function load(owner) {
+  function decode(file, aad) {
     var data;
-    try { data = JSON.parse(fs.readFileSync(filename(owner), 'utf8')); }
-    catch (error) { if (error.code === 'ENOENT') return []; throw new Error('Could not read MCP connections.'); }
+    try { data = JSON.parse(fs.readFileSync(file, 'utf8')); }
+    catch (error) { if (error.code === 'ENOENT') return { records: [], revision: null, migratedProjects: [], retired: [] }; throw new Error('Could not read MCP connections.'); }
     var parts = data.encrypted.split('.').map(function (part) { return Buffer.from(part, 'base64'); });
     var cipher = crypto.createDecipheriv('aes-256-gcm', key(), parts[0]);
-    cipher.setAAD(Buffer.from(scope(owner))); cipher.setAuthTag(parts[1]);
-    return JSON.parse(Buffer.concat([cipher.update(parts[2]), cipher.final()]).toString('utf8'));
+    cipher.setAAD(Buffer.from(aad)); cipher.setAuthTag(parts[1]);
+    var value = JSON.parse(Buffer.concat([cipher.update(parts[2]), cipher.final()]).toString('utf8'));
+    if (Array.isArray(value)) return { records: value, revision: null, migratedProjects: [], retired: [] };
+    return { records: Array.isArray(value.records) ? value.records : [], revision: value.revision || null, migratedProjects: Array.isArray(value.migratedProjects) ? value.migratedProjects : [], retired: value.retired || [] };
   }
-  function save(owner, records) {
+  function encode(owner, state, expectedRevision) {
+    var current = decode(filename(owner), scope(owner));
+    if (expectedRevision !== undefined && current.revision !== expectedRevision) throw new Error('MCP connections changed. Please retry.');
+    var next = { records: state.records, revision: crypto.randomBytes(16).toString('hex'), migratedProjects: state.migratedProjects || [], retired: state.retired || [] };
     var iv = crypto.randomBytes(12), cipher = crypto.createCipheriv('aes-256-gcm', key(), iv);
     cipher.setAAD(Buffer.from(scope(owner)));
-    var bytes = Buffer.concat([cipher.update(JSON.stringify(records), 'utf8'), cipher.final()]);
+    var bytes = Buffer.concat([cipher.update(JSON.stringify(next), 'utf8'), cipher.final()]);
     var value = { encrypted: [iv, cipher.getAuthTag(), bytes].map(function (part) { return part.toString('base64'); }).join('.') };
     var file = filename(owner), temp = file + '.' + crypto.randomBytes(8).toString('hex') + '.tmp';
     try { fs.writeFileSync(temp, JSON.stringify(value), { mode: 0o600 }); fs.renameSync(temp, file); }
     finally { try { fs.unlinkSync(temp); } catch (error) { if (error.code !== 'ENOENT') throw error; } }
+    return next.revision;
   }
-  return { load: load, save: save };
+  function visible(records) { if (!shared) return records; return records.filter(function (record) { return record.source !== 'computer' || record.project === project; }); }
+  function connectionConflict(left, right) { return left.id && left.id === right.id || (left.url && right.url && left.url === right.url); }
+  function migrate(owner, state) {
+    if (!shared || state.migratedProjects.indexOf(project) >= 0) return state;
+    var legacy = decode(legacyFilename(owner), JSON.stringify([project, owner])).records;
+    var merged = state.records.slice();
+    legacy.forEach(function (record) {
+      var copy = Object.assign({}, record);
+      if (copy.source === 'computer') copy.project = project;
+      else if ((state.retired || []).some(function (removed) { return connectionConflict(removed, copy); })) return;
+      var existing = merged.filter(function (current) { return current.source === copy.source && (copy.source === 'computer' ? current.project === project && current.name === copy.name : connectionConflict(current, copy)); });
+      if (existing.length && existing.some(function (current) { return !equal(current, copy); })) throw new Error('MCP connection migration conflict. Resolve the legacy project connection before retrying.');
+      if (!existing.length) merged.push(copy);
+    });
+    state.records = merged;
+    state.migratedProjects = state.migratedProjects.concat([project]);
+    return state;
+  }
+  function readUnlocked(owner) {
+    var state = decode(filename(owner), scope(owner));
+    if (shared) {
+      var unique = [];
+      state.records.forEach(function (record) {
+        var existing = unique.find(function (current) {
+          return record.source === 'computer' ? current.source === 'computer' && record.project === current.project && record.name === current.name : current.source !== 'computer' && connectionConflict(record, current);
+        });
+        if (existing && !equal(existing, record)) throw new Error('Conflicting duplicate MCP records require resolution.');
+        if (!existing) unique.push(record);
+      });
+      if (unique.length !== state.records.length) { state.records = unique; state.revision = encode(owner, state, state.revision); }
+    }
+    if (shared && state.migratedProjects.indexOf(project) < 0) { state = migrate(owner, state); state.revision = encode(owner, state, state.revision); }
+    return state;
+  }
+  // Fail closed on contention. The lock covers migration and the full CAS read/write,
+  // including callers in a second process using the same storage root.
+  function locked(owner, operation) {
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    var file = filename(owner) + '.lock', fd;
+    try { fd = fs.openSync(file, 'wx', 0o600); }
+    catch (error) { if (error.code === 'EEXIST') throw new Error('MCP connections are busy. Please retry.'); throw error; }
+    try { fs.writeFileSync(fd, String(process.pid)); return operation(); }
+    finally { fs.closeSync(fd); fs.unlinkSync(file); }
+  }
+  function snapshot(owner) {
+    return locked(owner, function () {
+      var state = readUnlocked(owner);
+      return { records: visible(state.records), revision: state.revision };
+    });
+  }
+  function load(owner) { return snapshot(owner).records; }
+  function revision(owner) { return snapshot(owner).revision; }
+  function validate(records) {
+    if (!Array.isArray(records)) throw new Error('MCP connection snapshot must be an array.');
+    records.forEach(function (record, index) {
+      if (!record || typeof record !== 'object') throw new Error('Invalid MCP connection record.');
+      if (records.slice(0, index).some(function (previous) {
+        return record.id && previous.id === record.id ||
+          record.source === 'computer' && previous.source === 'computer' && record.name === previous.name ||
+          record.source !== 'computer' && previous.source !== 'computer' && record.url && record.url === previous.url;
+      })) throw new Error('Duplicate MCP connection in snapshot.');
+      if (shared && record.source === 'computer' && record.project && record.project !== project) throw new Error('Foreign project computer preference.');
+    });
+  }
+  // Remote rows are the complete owner snapshot. Computer rows replace only this
+  // project's preferences; omitted remote rows are deleted, never merged back.
+  function save(owner, records, expectedRevision) {
+    validate(records);
+    return locked(owner, function () {
+      var state = readUnlocked(owner);
+      if (expectedRevision !== undefined && state.revision !== expectedRevision) throw new Error('MCP connections changed. Please retry.');
+      if (!shared) return encode(owner, { records: records, migratedProjects: [] }, state.revision);
+      var incomingRemote = records.filter(function (record) { return record.source !== 'computer'; });
+      var currentComputer = records.filter(function (record) { return record.source === 'computer'; }).map(function (record) { return Object.assign({}, record, { project: project }); });
+      var otherComputer = state.records.filter(function (record) { return record.source === 'computer' && record.project !== project; });
+      var removed = state.records.filter(function (record) {
+        return record.source !== 'computer' && !incomingRemote.some(function (incoming) { return connectionConflict(record, incoming); });
+      }).map(function (record) { return { id: record.id, url: record.url }; });
+      state.retired = (state.retired || []).concat(removed).filter(function (record, index, all) {
+        return all.findIndex(function (other) { return other.id === record.id && other.url === record.url; }) === index;
+      });
+      state.records = incomingRemote.concat(otherComputer, currentComputer);
+      return encode(owner, state, state.revision);
+    });
+  }
+  return { load: load, save: save, revision: revision, snapshot: snapshot, namespace: fs.existsSync(root) ? fs.realpathSync(root) : path.resolve(root) };
 }
 module.exports = { createConnectionStore: createConnectionStore };

package/lib/mcp-import-credentials.js

@@ -0,0 +1,31 @@
+function requiredNames(row) {
+  var names = (row.environmentNames || []).filter(function (name) { return !Object.prototype.hasOwnProperty.call(row.env || {}, name); });
+  (row.references || []).forEach(function (reference) {
+    var match = /^(?:\$\{?|\{env:)([A-Za-z_][A-Za-z0-9_]*)/.exec(reference);
+    var name = match ? match[1] : /^[A-Za-z_][A-Za-z0-9_]*$/.test(reference) ? reference : 'Unsupported reference';
+    names.push(name);
+  });
+  return Array.from(new Set(names));
+}
+function applyCredentials(row, values) {
+  var names = requiredNames(row);
+  if (names.indexOf('Unsupported reference') >= 0) throw new Error('This source requires a vendor-specific helper or file reference. Configure a direct Clay connection instead.');
+  names.forEach(function (name) {
+    if (!Object.prototype.hasOwnProperty.call(values, name) || typeof values[name] !== 'string' || !values[name] || values[name].length > 8192 || /[\r\n\0]/.test(values[name])) throw new Error('Enter each required credential value.');
+  });
+  function expand(value) {
+    if (typeof value === 'string') return value.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-[^}]*)?\}|\$([A-Za-z_][A-Za-z0-9_]*)|\{env:([^}]+)\}/g, function (all, first, second, third) {
+      var name = first || second || third; return Object.prototype.hasOwnProperty.call(values, name) ? values[name] : all;
+    });
+    if (Array.isArray(value)) return value.map(expand);
+    if (value && typeof value === 'object') { var next = {}; Object.keys(value).forEach(function (key) { next[key] = expand(value[key]); }); return next; }
+    return value;
+  }
+  var next = {};
+  ['command', 'args', 'env', 'headers', 'url'].forEach(function (field) { if (row[field] !== undefined) next[field] = expand(row[field]); });
+  next.headers = next.headers || {}; next.env = next.env || {};
+  Object.keys(row.envHeaders || {}).forEach(function (name) { next.headers[name] = (name === 'Authorization' && row.bearerTokenEnv === row.envHeaders[name] ? 'Bearer ' : '') + values[row.envHeaders[name]]; });
+  (row.environmentNames || []).forEach(function (name) { if (values[name] !== undefined) next.env[name] = values[name]; });
+  next.envHeaders = {}; next.references = []; return next;
+}
+module.exports = { requiredNames: requiredNames, applyCredentials: applyCredentials };

package/lib/mcp-local-transport.js

@@ -0,0 +1,13 @@
+var StdioClientTransport = require('@modelcontextprotocol/sdk/client/stdio.js').StdioClientTransport;
+var wrapSpawnAsUser = require('./os-users').wrapSpawnAsUser;
+var os = require('os');
+function localTransport(row, identity) {
+  if ((row.references || []).length || (row.environmentNames || []).some(function (name) { return !Object.prototype.hasOwnProperty.call(row.env || {}, name); })) throw new Error('Configure required environment values before connecting.');
+  var home = identity ? identity.home : os.homedir();
+  var env = Object.assign({ HOME: home, USER: identity ? identity.user : os.userInfo().username, LOGNAME: identity ? identity.user : os.userInfo().username, SHELL: identity ? identity.shell || '/bin/sh' : '/bin/sh', PATH: '/usr/local/bin:/usr/bin:/bin:/opt/homebrew/bin' }, row.env || {});
+  var wrapped = wrapSpawnAsUser(row.command, row.args, identity ? { uid: identity.uid, gid: identity.gid, env: env } : { env: env });
+  // The SDK cannot apply uid/gid itself; never fall back to spawning as the daemon.
+  if (wrapped.options.uid != null || wrapped.options.gid != null) throw new Error('Install util-linux setpriv to run MCP as the account OS user.');
+  return new StdioClientTransport({ command: wrapped.command, args: wrapped.args, env: env, cwd: row.cwd, stderr: 'ignore' });
+}
+module.exports = { localTransport: localTransport };

package/lib/mcp-oauth.js

@@ -2,21 +2,21 @@ var crypto = require('crypto');
 var http = require('http');
 var assertPublicUrl = require('./mcp-network').assertPublicUrl;
 
-function createOAuthProvider(record, persist, flow) {
+function createOAuthProvider(record, persist, flow, authorize) {
   record.auth = record.auth || {};
   var auth = record.auth;
-  function guard() { if (flow && flow.cancelled) throw new Error('Sign-in expired.'); }
+  function guard() { if (flow && flow.cancelled) throw new Error('Sign-in expired.'); if (authorize) authorize(); }
   function save() { persist(); }
   return {
     get redirectUrl() { return flow ? flow.redirectUrl : auth.redirectUrl; },
     get clientMetadata() { return { client_name: 'Clay', redirect_uris: [flow ? flow.redirectUrl : auth.redirectUrl],
       grant_types: ['authorization_code', 'refresh_token'], response_types: ['code'], token_endpoint_auth_method: 'none' }; },
     state: function () { return flow ? flow.state : crypto.randomBytes(32).toString('hex'); },
-    clientInformation: function () { return auth.client; },
+    clientInformation: function () { guard(); return auth.client; },
     saveClientInformation: function (value) { guard(); auth.client = value; save(); },
-    tokens: function () { return auth.tokens; },
+    tokens: function () { guard(); return auth.tokens; },
     saveTokens: function (value) { guard(); auth.tokens = value; save(); },
-    saveCodeVerifier: function (value) { if (flow) flow.verifier = value; },
+    saveCodeVerifier: function (value) { guard(); if (flow) flow.verifier = value; },
     codeVerifier: function () { if (!flow || !flow.verifier) throw new Error('Sign in again.'); return flow.verifier; },
     redirectToAuthorization: async function (url) {
       if (!flow) { var required = new Error('Sign in to connect this server.'); required.name = 'UnauthorizedError'; throw required; }
@@ -25,13 +25,15 @@ function createOAuthProvider(record, persist, flow) {
       if (url.searchParams.get('state') !== flow.state || url.searchParams.get('redirect_uri') !== flow.redirectUrl || !url.searchParams.get('code_challenge')) throw new Error('Invalid sign-in request.');
       flow.authorizationUrl = url.href;
     },
-    discoveryState: function () { return auth.discovery; },
+    discoveryState: function () { guard(); return auth.discovery; },
     saveDiscoveryState: function (value) {
+      guard();
       // Bind client credentials to the discovered issuer.
       if (auth.discovery && auth.discovery.authorizationServerUrl !== value.authorizationServerUrl) { delete auth.client; delete auth.tokens; }
       guard(); auth.discovery = value; save();
     },
     invalidateCredentials: function (which) {
+      guard();
       if (which === 'all' || which === 'client') delete auth.client;
       if (which === 'all' || which === 'tokens') delete auth.tokens;
       if (which === 'all' || which === 'discovery') delete auth.discovery;

package/lib/mcp-proxy.js

@@ -1,32 +1,2 @@
-// Preserve the server's JSON Schema across SDK and stdio projections.
-function validateDefinitions(definitions) {
-  var z = require('zod');
-  var names = new Set();
-  return definitions.map(function (definition) {
-    if (!definition || !/^[a-zA-Z0-9_.-]{1,128}$/.test(definition.name) || names.has(definition.name) || Object.prototype.hasOwnProperty.call(Object.prototype, definition.name)) throw new Error('Unsupported MCP tool catalog.');
-    names.add(definition.name);
-    var parsed = z.fromJSONSchema(definition.inputSchema || { type: 'object', properties: {} });
-    if (!parsed.shape) throw new Error('MCP tools must accept an object.');
-    return parsed;
-  });
-}
-function createProxy(name, definitions, invoke) {
-  var sdk = require('@anthropic-ai/claude-agent-sdk');
-  var schemas = validateDefinitions(definitions);
-  var tools = definitions.map(function (definition, index) {
-    return sdk.tool(definition.name, definition.description || definition.name, schemas[index].shape, function (args) { return invoke(definition.name, args); });
-  });
-  var server = sdk.createSdkMcpServer({ name: name, version: '1.0.0', tools: tools });
-  definitions.forEach(function (definition, index) {
-    var tool = server.instance._registeredTools[definition.name];
-    tool.inputSchema = schemas[index];
-    tool._clayInputSchema = definition.inputSchema || { type: 'object', properties: {} };
-  });
-  server.instance.server.setRequestHandler(require('@modelcontextprotocol/sdk/types.js').ListToolsRequestSchema, function () {
-    return { tools: definitions.map(function (definition) {
-      return { name: definition.name, description: definition.description, inputSchema: definition.inputSchema || { type: 'object', properties: {} } };
-    }) };
-  });
-  return server;
-}
-module.exports = { createProxy: createProxy, validateDefinitions: validateDefinitions };
+// Compatibility export for the YOKE SDK/stdio tool projection.
+module.exports = require("./yoke/mcp-proxy");

package/lib/mcp-query-bridge.js

@@ -0,0 +1,30 @@
+var descriptors = require('./yoke/sdk-mcp-descriptors').extractMcpDescriptors;
+function createQueryBridge(ctx) {
+  function valid() {
+    if (!ctx.valid()) throw new Error('MCP tools require the current authorized query.');
+  }
+  function list() {
+    if (!ctx.valid()) return [];
+    var servers = descriptors(ctx.getServers()) || [], tools = [];
+    servers.forEach(function (server) {
+      server.tools.forEach(function (tool) { tools.push(Object.assign({ server: server.serverName }, tool)); });
+    });
+    return tools;
+  }
+  async function call(serverName, toolName, args) {
+    valid();
+    var server = ctx.getServers()[serverName], tool = server && server.instance && server.instance._registeredTools[toolName];
+    if (!tool || typeof (tool.handler || tool.callback) !== 'function') throw new Error('MCP tool is unavailable.');
+    var result = await (tool.handler || tool.callback)(args || {});
+    valid(); return result;
+  }
+  function dynamicDefs() {
+    return list().map(function (tool) {
+      return { name: 'mcp__' + tool.server + '__' + tool.name, permissionName: 'mcp__' + tool.server + '__' + tool.name,
+        description: tool.description, inputSchema: tool.inputSchema, queryBound: true,
+        handler: function (args) { return call(tool.server, tool.name, args); } };
+    });
+  }
+  return { list: list, call: call, dynamicDefs: dynamicDefs };
+}
+module.exports = { createQueryBridge: createQueryBridge };