clay-server 5.2.0-beta.1 → 5.2.0-beta.11

package/lib/project-mate-creation-proposal.js

@@ -1,4 +1,5 @@
 var mateCreationMcp = require("./mate-creation-mcp-server");
+var scheduleInput = require("./mate-schedule-input");
 var selectCatalogModel = require("./project-models").selectCatalogModel;
 
 function attachMateCreationProposal(ctx) {
@@ -19,6 +20,8 @@ function attachMateCreationProposal(ctx) {
       communicationStyle: Array.isArray(source.communicationStyle) ? source.communicationStyle.slice(0, 12) : [],
       autonomy: clean(source.autonomy, 500),
       identityMarkdown: clean(source.identityMarkdown, 30000),
+      scheduleIntent: source.scheduleIntent || null,
+      scheduleTimezone: scheduleInput.timezone(),
     };
   }
 
@@ -30,7 +33,8 @@ function attachMateCreationProposal(ctx) {
     var projectOwnerId = typeof ctx.getProjectOwnerId === "function" ? ctx.getProjectOwnerId() : null;
     var ownerValid = typeof ctx.isMultiUser === "function" && ctx.isMultiUser() ? !!(session && session.ownerId && (!projectOwnerId || session.ownerId === projectOwnerId)) : !!(session && !session.ownerId);
     return !!(session && ctx.isMate === true && ctx.isHostAgent === true && session.mateCreationMode === true
-      && ownerValid);
+      && ownerValid && !session.destroying && !session._mcpForeignInput
+      && (!ctx.isLive || ctx.isLive(session)));
   }
 
   function hasInterviewAnswer(session) {
@@ -44,10 +48,19 @@ function attachMateCreationProposal(ctx) {
     return mateCreationMcp.getToolDefs(function (definition) {
       if (!validateBoundSession(boundSession)) return Promise.resolve({ action: "error", error: "Mate proposals require an owned Clay creation interview." });
       if (!hasInterviewAnswer(boundSession)) return Promise.resolve({ action: "error", error: "Interview the user before proposing a Mate." });
+      if (definition.scheduleIntent && typeof definition.scheduleIntent === "string") {
+        try { definition.scheduleIntent = JSON.parse(definition.scheduleIntent); } catch (error) { return Promise.resolve({ action: "error", error: "scheduleIntent must be valid JSON." }); }
+      }
+      try {
+        if (definition.scheduleIntent) {
+          var checkedIntent = scheduleInput.normalize(definition.scheduleIntent);
+          definition.scheduleIntent = { message: checkedIntent.message, scheduleRule: checkedIntent.rule };
+        }
+      } catch (error) { return Promise.resolve({ action: "error", error: error.message }); }
       return new Promise(function (resolve) {
         var proposalId = "mp_" + Date.now() + "_" + Math.random().toString(36).slice(2, 8);
         definition.proposalId = proposalId;
-        pending[proposalId] = { resolve: resolve, definition: definition, session: boundSession };
+        pending[proposalId] = { resolve: resolve, definition: definition, session: boundSession, generation: Number(boundSession._sdkQueryGeneration || 0) };
         record(boundSession, { type: "mate_creation_proposal", proposal: publicProposal(definition) });
       });
     });
@@ -72,7 +85,8 @@ function attachMateCreationProposal(ctx) {
 
   function handleHomeMessage(ws, msg, session) {
     var entry = msg && msg.proposalId ? pending[msg.proposalId] : null;
-    if (!entry || entry.session !== session || !validateBoundSession(session)) return false;
+    if (!entry || entry.session !== session || !validateBoundSession(session) || entry.generation !== Number(session._sdkQueryGeneration || 0)) return false;
+    if (ctx.isMultiUser && ctx.isMultiUser() && (!ws || !ws._clayUser || ws._clayUser.id !== session.ownerId)) return false;
     delete pending[msg.proposalId];
     if (msg.action !== "create") {
       record(session, { type: "mate_creation_proposal_resolved", proposalId: msg.proposalId, action: "cancel" });
@@ -93,6 +107,7 @@ function attachMateCreationProposal(ctx) {
       return true;
     }
     Promise.resolve(ctx.getVendorModelCatalog(ws, vendor)).then(function (catalog) {
+      if (!validateBoundSession(session) || entry.generation !== Number(session._sdkQueryGeneration || 0)) throw new Error("The Mate creation approval is stale.");
       var selected = catalog && catalog.status === "ready" ? selectCatalogModel(catalog.models || [], catalog.defaultModel, "deep") : null;
       if (!selected) throw new Error((catalog && catalog.error) || "No high-capability Mate model is available for " + vendor + ".");
       return ctx.createReadyMate(ws, session.ownerId || null, Object.assign({}, entry.definition, { vendor: vendor, model: selected.value }));

package/lib/project-mate-interaction.js

@@ -3,6 +3,7 @@ var fs = require("fs");
 var path = require("path");
 var crypto = require("crypto");
 var mateSync = require("./mate-knowledge-sync");
+var dmDigestCursor = require("./dm-digest-cursor");
 
 // Mirror a Mate-owned journal into the Clay-wide Knowledge backend after the
 // legacy append has already succeeded. Reconciling the whole journal keeps the
@@ -294,6 +295,9 @@ function attachMateInteraction(ctx) {
         mirrorMateJournal(mateDir, "session-digests.jsonl", job);
       } catch (e) {
         console.error("[digest-worker] Write failed for " + job.mateId + ":", e.message);
+        if (job.onError) job.onError(e);
+        processDigestQueue();
+        return;
       }
 
       // Write user observations if present
@@ -422,63 +426,19 @@ function attachMateInteraction(ctx) {
   // Delta-based: only collects new turns since the last successful digest.
   // Concurrency debounce: turns that arrive while a digest is in-flight
   // are naturally batched into the next flush.
-  var _dmDigestPending = false;
-  function digestDmTurn(session, responsePreview) {
-    if (!isMate || _dmDigestPending) return;
+  var _dmDigestPending = new WeakSet();
+  function digestDmTurn(session) {
+    if (!isMate || _dmDigestPending.has(session)) return;
     var mateId = path.basename(cwd);
     var mateCtx = matesModule.buildMateCtx(projectOwnerId);
     if (!matesModule.isMate(mateCtx, mateId)) return;
 
-    // Track digest index per session so switching sessions doesn't misalign.
-    // On resumed sessions (after restart), recover index from the last
-    // digest_checkpoint entry in history so undigested turns aren't lost.
-    if (typeof session._dmLastDigestedIndex !== "number") {
-      session._dmLastDigestedIndex = 0;
-      for (var ci = session.history.length - 1; ci >= 0; ci--) {
-        if (session.history[ci].type === "digest_checkpoint") {
-          session._dmLastDigestedIndex = session.history[ci].digestedIndex;
-          break;
-        }
-      }
-    }
-
-    // Collect only new turns since the last successful digest
-    var conversationParts = [];
-    var totalLen = 0;
-    var CONV_CAP = 6000;
-    var startIndex = session._dmLastDigestedIndex;
-    for (var hi = startIndex; hi < session.history.length; hi++) {
-      if (totalLen >= CONV_CAP) break;
-      var entry = session.history[hi];
-      if (entry.type === "user_message" && entry.text) {
-        var uText = entry.text;
-        if (totalLen + uText.length > CONV_CAP) {
-          uText = uText.substring(0, Math.max(200, CONV_CAP - totalLen)) + "...";
-        }
-        conversationParts.push("User: " + uText);
-        totalLen += uText.length;
-      } else if (entry.type === "assistant_message" && entry.text) {
-        var aText = entry.text;
-        if (totalLen + aText.length > CONV_CAP) {
-          aText = aText.substring(0, Math.max(200, CONV_CAP - totalLen)) + "...";
-        }
-        conversationParts.push("Mate: " + aText);
-        totalLen += aText.length;
-      }
-    }
-    // If the latest response hasn't landed in history yet, append it
-    var lastResponseText = responsePreview || "";
-    if (lastResponseText && conversationParts.length > 0) {
-      var lastPart = conversationParts[conversationParts.length - 1];
-      if (lastPart.indexOf("Mate:") !== 0 || lastPart.indexOf(lastResponseText.substring(0, 50)) === -1) {
-        var rText = lastResponseText;
-        if (totalLen + rText.length > CONV_CAP) {
-          rText = rText.substring(0, Math.max(200, CONV_CAP - totalLen)) + "...";
-        }
-        conversationParts.push("Mate: " + rText);
-      }
-    }
-    if (conversationParts.length === 0) return;
+    // Recover the exact next unread position. Legacy index-only checkpoints
+    // remain readable and are treated as fully consumed entries.
+    var digestState = dmDigestCursor.readState(session.history);
+    var startCursor = digestState.cursor;
+    var chunk = dmDigestCursor.collectChunk(session.history, startCursor);
+    if (!chunk.conversationContent) return;
 
     var mateDir = matesModule.getMateDir(mateCtx, mateId);
     var knowledgeDir = path.join(mateDir, "knowledge");
@@ -500,8 +460,8 @@ function attachMateInteraction(ctx) {
       }
     } catch (e) {}
 
-    _dmDigestPending = true;
-    var snapshotIndex = session.history.length;
+    _dmDigestPending.add(session);
+    var checkpointCursor = chunk.cursor;
 
     enqueueDigest({
       mateCtx: mateCtx,
@@ -509,17 +469,27 @@ function attachMateInteraction(ctx) {
       mateId: mateId,
       type: "dm",
       priorSummary: priorSummary || "",
-      conversationContent: conversationParts.join("\n"),
+      conversationContent: chunk.conversationContent,
       onDone: function () {
-        session._dmLastDigestedIndex = snapshotIndex;
-        // Persist checkpoint so resumed sessions know where to continue
-        var checkpoint = { type: "digest_checkpoint", digestedIndex: snapshotIndex };
+        // Journal and checkpoint are separate appends: if this append fails,
+        // retry may duplicate the saved digest, but must never skip its input.
+        var checkpoint = { type: "digest_checkpoint", cursor: checkpointCursor };
+        var saved = false;
+        try { saved = sm.appendToSessionFile(session, checkpoint) !== false; } catch (e) {
+          console.error("[dm-digest] Checkpoint append failed:", e.message);
+        }
+        if (!saved) {
+          _dmDigestPending.delete(session);
+          return;
+        }
         session.history.push(checkpoint);
-        sm.appendToSessionFile(session, checkpoint);
-        _dmDigestPending = false;
+        _dmDigestPending.delete(session);
+        if (dmDigestCursor.hasPending(session.history, checkpointCursor)) {
+          setImmediate(function () { digestDmTurn(session, ""); });
+        }
       },
       onError: function () {
-        _dmDigestPending = false;
+        _dmDigestPending.delete(session);
       },
     });
   }
@@ -570,6 +540,8 @@ function attachMateInteraction(ctx) {
 
     var mateName = (mate.profile && mate.profile.displayName) || mate.name || "Mate";
     var avatarColor = (mate.profile && mate.profile.avatarColor) || "#5857fc";
+    var avatarCatalogId = (mate.profile && mate.profile.avatarCatalogId) || "";
+    var avatarCustom = (mate.profile && mate.profile.avatarCustom) || "";
     var avatarStyle = (mate.profile && mate.profile.avatarStyle) || "imprint";
     var avatarSeed = (mate.profile && mate.profile.avatarSeed) || mate.id;
 
@@ -622,6 +594,8 @@ function attachMateInteraction(ctx) {
       mateName: mateName,
       avatarColor: avatarColor,
       avatarStyle: avatarStyle,
+      avatarCatalogId: avatarCatalogId,
+      avatarCustom: avatarCustom,
       avatarSeed: avatarSeed,
     });
 
@@ -657,6 +631,8 @@ function attachMateInteraction(ctx) {
           text: fullText,
           avatarColor: avatarColor,
           avatarStyle: avatarStyle,
+          avatarCatalogId: avatarCatalogId,
+          avatarCustom: avatarCustom,
           avatarSeed: avatarSeed,
         };
         session.history.push(mentionResponseEntry);
@@ -820,6 +796,8 @@ function attachMateInteraction(ctx) {
       name: (mate.profile && mate.profile.displayName) || mate.name || "Mate",
       avatarColor: (mate.profile && mate.profile.avatarColor) || "#5857fc",
       avatarStyle: (mate.profile && mate.profile.avatarStyle) || "imprint",
+      avatarCatalogId: (mate.profile && mate.profile.avatarCatalogId) || "",
+      avatarCustom: (mate.profile && mate.profile.avatarCustom) || "",
       avatarSeed: (mate.profile && mate.profile.avatarSeed) || mateId,
     };
   }

package/lib/project-mcp.js

@@ -1,10 +1,19 @@
 var crypto = require('crypto');
+var path = require('path');
 var createProxy = require('./mcp-proxy').createProxy;
 var createStore = require('./mcp-connection-store').createConnectionStore;
 var createRemoteConnections = require('./mcp-remote-connections').createRemoteConnections;
+var SHARED_REGISTRIES = new Map();
 
 function attachMcp(ctx) {
-  var devices = new Map(), pending = new Map();
+  var storage = ctx.storage || createStore(ctx.root, ctx.slug, { shared: true });
+  var namespace = storage.namespace || (ctx.root ? path.resolve(ctx.root) : storage);
+  var registry = SHARED_REGISTRIES.get(namespace);
+  if (!registry) { registry = { devices: new Map(), pending: new Map(), managers: new Set() }; SHARED_REGISTRIES.set(namespace, registry); }
+  var devices = registry.devices, pending = registry.pending, manager = {};
+  registry.managers.add(manager);
+  function announce(owner) { registry.managers.forEach(function (source) { source.broadcast(owner); }); }
+  manager.broadcast = broadcast;
   function ownerFor(ws) {
     if (!ctx.canAccess(ws)) throw new Error('MCP access is not permitted.');
     return ctx.isMultiUser() ? String(ws._clayUser.id) : 'default';
@@ -15,17 +24,32 @@ function attachMcp(ctx) {
       try { if (ws.readyState === 1 && ownerFor(ws) === owner) ctx.sendTo(ws, Object.assign({ slug: ctx.slug }, msg)); } catch (error) {}
     });
   }
+  function isSession(subject) { return !!subject && ctx.canUseSession(subject); }
+  function sourceIdentity(subject) { return isSession(subject) ? ctx.ownerIdentity(ctx.isMultiUser() ? String(subject.ownerId) : 'default') : ctx.identity(subject); }
+  var discovery = require('./yoke/mcp-source-discovery').createDiscovery({ cwd: ctx.cwd || process.cwd(), home: ctx.discoveryHome,
+    identity: sourceIdentity, runtimeEnv: function (owner, subject) { return isSession(subject) ? ctx.runtimeEnvForSession(subject) : ctx.runtimeEnv ? ctx.runtimeEnv(owner, subject) : {}; }, authorize: function (owner, subject) {
+      var permitted = isSession(subject) ? (ctx.isMultiUser() ? String(subject.ownerId) : 'default') === owner && ctx.canDiscoverSession(subject) : ownerFor(subject) === owner && ctx.canDiscover && ctx.canDiscover(subject);
+      if (!permitted) throw new Error('Vendor discovery requires your authorized OS user mapping or a sole account installation.');
+      authorizeOwner(owner);
+    }, snapshot: function (owner) { return storage.snapshot(owner); } });
   var remote = createRemoteConnections({
     remoteFetch: ctx.remoteFetch, createLoginBrowser: ctx.createLoginBrowser,
-    storage: ctx.storage || createStore(ctx.root, ctx.slug), authorize: authorizeOwner,
-    changed: function (owner) { broadcast(owner); }, sendOwner: sendOwner, sendTo: function (ws, msg) { ctx.sendTo(ws, Object.assign({ slug: ctx.slug }, msg)); },
+    storage: storage, authorize: authorizeOwner,
+    changed: function (owner) { announce(owner); }, sendOwner: sendOwner, sendTo: function (ws, msg) { ctx.sendTo(ws, Object.assign({ slug: ctx.slug }, msg)); },
+    ownerIdentity: ctx.ownerIdentity, selectImport: discovery.selected,
     identity: ctx.identity,
     canAccess: function (ws, owner) { try { return ownerFor(ws) === owner; } catch (error) { return false; } },
   });
+  var agentTools = require('./mcp-agent-tools').attachMcpAgentTools({
+    available: function (session) { return typeof ctx.canDiscoverSession === "function" && typeof ctx.runtimeEnvForSession === "function" && ctx.canDiscoverSession(session); },
+    clients: ctx.clients, isMultiUser: ctx.isMultiUser, ownerFor: ownerFor, canUseSession: ctx.canUseSession,
+    authorizeOwner: authorizeOwner, discovery: discovery, importConnection: remote.importConnection,
+    userInput: ctx.userInput, consentTimeout: ctx.consentTimeout,
+  });
   function deviceFor(owner) {
     var device = devices.get(owner);
     if (!device || device.ws.readyState !== 1) return null;
-    try { if (ownerFor(device.ws) !== owner) return null; } catch (error) { return null; }
+    try { authorizeOwner(owner); if (!device.authorized()) return null; } catch (error) { return null; }
     return device;
   }
   function enabled(owner, name) {
@@ -59,13 +83,18 @@ function attachMcp(ctx) {
         if (call.ws !== device.ws) return;
         clearTimeout(call.timer); pending.delete(id); call.reject(new Error('Your computer disconnected.'));
       });
-      broadcast(owner);
+      announce(owner);
     });
   }
   function handleMcpMessage(ws, msg) {
     if (!msg || typeof msg.type !== 'string' || (msg.type.indexOf('mcp_') !== 0 && msg.type !== 'mcp_toggle_server')) return false;
     var owner;
     try { owner = ownerFor(ws); } catch (error) { return true; }
+    if (msg.type === 'mcp_discovery_request') {
+      try { ctx.sendTo(ws, Object.assign({ type: 'mcp_discovery_result', slug: ctx.slug, requestId: msg.requestId, ok: true }, discovery.scan(owner, ws, msg.file ? { file: msg.file, vendor: msg.vendor } : null))); }
+      catch (error) { ctx.sendTo(ws, { type: 'mcp_discovery_result', slug: ctx.slug, requestId: msg.requestId, ok: false, error: error.message }); }
+      return true;
+    }
     if (msg.type === 'mcp_state_request') { sendConnectionState(ws); return true; }
     if (msg.type === 'mcp_servers_available') {
       var servers = Array.isArray(msg.servers) ? msg.servers : [];
@@ -75,8 +104,10 @@ function attachMcp(ctx) {
       });
       var old = devices.get(owner);
       if (old && old.ws !== ws) disconnectDevice(old.ws);
-      devices.set(owner, { ws: ws, servers: servers, hostConnected: !!msg.hostConnected, extensionId: ctx.extensionId(ws) });
-      broadcast(owner); return true;
+      devices.set(owner, { ws: ws, servers: servers, hostConnected: !!msg.hostConnected, extensionId: ctx.extensionId(ws), manager: manager,
+        authorized: function () { return ctx.clients.has(ws) && ownerFor(ws) === owner && ctx.canUseOwner(owner); },
+        send: function (message) { ctx.sendTo(ws, Object.assign({ slug: ctx.slug }, message)); } });
+      announce(owner); return true;
     }
     if (msg.type === 'mcp_tool_result' || msg.type === 'mcp_tool_error') {
       var call = pending.get(msg.callId);
@@ -114,35 +145,42 @@ function attachMcp(ctx) {
       if (!row || !row.tools.some(function (item) { return item.name === tool; })) throw new Error('Computer tool is unavailable.');
       var id = crypto.randomUUID();
       var timer = setTimeout(function () { pending.delete(id); reject(new Error('Computer tool timed out.')); }, 60000);
-      pending.set(id, { owner: owner, ws: device.ws, resolve: resolve, reject: reject, timer: timer, authorize: function () {
+      pending.set(id, { owner: owner, ws: device.ws, manager: manager, resolve: resolve, reject: reject, timer: timer, authorize: function () {
         authorize(); if (!enabled(owner, server) || deviceFor(owner) !== device) throw new Error('Computer access changed.');
       } });
-      ctx.sendTo(device.ws, { type: 'mcp_tool_call', callId: id, server: server, method: 'tools/call', params: { name: tool, arguments: args } });
+      device.send({ type: 'mcp_tool_call', callId: id, server: server, method: 'tools/call', params: { name: tool, arguments: args } });
     });
   }
-  function getMcpServers(session) {
-    if (!session || !ctx.canUseSession(session)) return {};
+  function getMcpServers(session, allowManagement) {
+    if (!session || !ctx.canUseSession(session) || !require('./yoke/session-tool-transport').capability(ctx.sessionVendor ? ctx.sessionVendor(session) : session.vendor || 'claude').supported) return {};
     var owner = ctx.isMultiUser() ? String(session.ownerId) : 'default';
     function authorize() {
       authorizeOwner(owner);
       if (!ctx.canUseSession(session) || (ctx.isMultiUser() && String(session.ownerId) !== owner)) throw new Error('Session MCP access changed.');
     }
-    var result = {};
+    var result = {}, management = allowManagement === false ? null : agentTools.getServer(session);
+    if (management) result['clay-mcp-connections'] = management;
     buildState(owner).servers.forEach(function (server) {
       if (!server.projectEnabled || !server.extensionEnabled || !server.tools.length) return;
       try {
         result[server.name] = createProxy(server.name, server.tools, function (tool, args) {
-          return server.source === 'url' ? remote.call(owner, server.id, tool, args, authorize) : callComputer(owner, server.name, tool, args, authorize);
+          return server.source !== 'computer' ? remote.call(owner, server.id, tool, args, authorize) : callComputer(owner, server.name, tool, args, authorize);
         });
       } catch (error) { /* Unsupported schemas are not advertised as callable tools. */ }
     });
     return result;
   }
   function destroy() {
-    pending.forEach(function (call) { clearTimeout(call.timer); call.reject(new Error('MCP closed.')); }); pending.clear();
-    devices.clear(); remote.destroy();
+    var removedSockets = [];
+    devices.forEach(function (device, owner) { if (device.manager === manager) { removedSockets.push(device.ws); devices.delete(owner); } });
+    pending.forEach(function (call, id) {
+      if (call.manager === manager || removedSockets.indexOf(call.ws) >= 0) { clearTimeout(call.timer); call.reject(new Error('MCP closed.')); pending.delete(id); }
+    });
+    agentTools.destroy(); remote.destroy(); discovery.destroy();
+    registry.managers.delete(manager);
+    if (!registry.managers.size) SHARED_REGISTRIES.delete(namespace);
   }
-  return { handleMcpMessage: handleMcpMessage, getMcpServers: getMcpServers, sendConnectionState: sendConnectionState,
+  return { registerConsentViewer: agentTools.registerViewer, handleMcpMessage: handleMcpMessage, getMcpServers: getMcpServers, sendConnectionState: sendConnectionState,
     handleExtensionDisconnect: disconnectDevice, rebuildAndBroadcast: function () { devices.forEach(function (device, owner) { broadcast(owner); }); }, destroy: destroy };
 }
 module.exports = { attachMcp: attachMcp };

package/lib/project-models.js

@@ -331,48 +331,30 @@ function attachModels(ctx) {
     });
   }
 
+  async function selectSessionModel(session, model, vendor, options) {
+    if (!session || sm.sessions.get(session.localId) !== session) throw new Error("Session was deleted or replaced.");
+    var sessionVendor = session.vendor || sm.defaultVendor || "claude";
+    if (vendor && vendor !== sessionVendor) throw new Error("The session vendor changed before model selection.");
+    var models = (sm.modelsByVendor && sm.modelsByVendor[sessionVendor]) || [];
+    if (models.length && !models.some(function (entry) { return modelEntryMatches(entry, model); })) throw new Error("That model is not available for the selected vendor.");
+    return sdk.setModel(session, model, options);
+  }
+
   async function selectModel(ws, msg) {
     var session = getSessionForWs(ws);
     if (!session) {
       sendTo(ws, { type: "model_selection_result", requestId: msg.requestId || null, ok: false, error: "No active session." });
       return;
     }
-    var sessionVendor = session.vendor || sm.defaultVendor || "claude";
-    if (msg.vendor && msg.vendor !== sessionVendor) {
-      sendTo(ws, {
-        type: "model_selection_result",
-        requestId: msg.requestId || null,
-        ok: false,
-        error: "The session vendor changed before the model selection completed.",
-      });
-      return;
-    }
-    var knownModels = (sm.modelsByVendor && sm.modelsByVendor[sessionVendor]) || [];
-    if (knownModels.length > 0) {
-      var known = false;
-      for (var i = 0; i < knownModels.length; i++) {
-        if (modelEntryMatches(knownModels[i], msg.model)) {
-          known = true;
-          break;
-        }
-      }
-      if (!known) {
-        sendTo(ws, {
-          type: "model_selection_result",
-          requestId: msg.requestId || null,
-          ok: false,
-          error: "That model is not available for the selected vendor.",
-        });
-        return;
-      }
-    }
-    var result = await sdk.setModel(session, msg.model);
+    var result;
+    try { result = await selectSessionModel(session, msg.model, msg.vendor); }
+    catch (error) { result = { ok: false, error: error.message }; }
     sendTo(ws, {
       type: "model_selection_result",
       requestId: msg.requestId || null,
       ok: !!(result && result.ok),
       model: result && result.model ? result.model : msg.model,
-      vendor: sessionVendor,
+      vendor: session.vendor || sm.defaultVendor || "claude",
       error: result && result.error ? result.error : "",
     });
   }
@@ -400,6 +382,7 @@ function attachModels(ctx) {
     resolveConfiguredModel: resolveConfiguredModel,
     loadVendorModels: loadVendorModels,
     selectModel: selectModel,
+    selectSessionModel: selectSessionModel,
   };
 }
 

package/lib/project-notifications.js

@@ -154,6 +154,21 @@ function attachNotifications(ctx) {
     return notifications.length;
   }
 
+  function controlProjection(item) { var value = Object.assign({}, item); delete value.controlRevision; return Object.assign(value, { controlRevision: require('./clay-control-target-projection').digest(value) }); }
+  function visible(ws) {
+    return notifications.filter(function (notification) { return !ctx.canView || ctx.canView(ws, notification); }).map(controlProjection);
+  }
+
+  function publish(payload) {
+    if (!ctx.forEachClient) return broadcastAll(payload);
+    ctx.forEachClient(function (ws) {
+      if (ws.readyState !== 1) return;
+      if (payload.notification && !ctx.canView(ws, payload.notification)) return;
+      var list = visible(ws);
+      ws.send(JSON.stringify(Object.assign({}, payload, { notification: payload.notification ? controlProjection(payload.notification) : undefined, unreadCount: list.length })));
+    });
+  }
+
   // --- Core API ---
 
   function notify(event, data) {
@@ -183,12 +198,13 @@ function attachNotifications(ctx) {
     saveNotifications();
     var payload = {
       type: "notification_created",
-      notification: notif,
+      notification: controlProjection(notif),
       unreadCount: getUnreadCount(),
     };
-    // If targeted at a specific user, deliver only to that user's connections.
-    // Otherwise broadcast to everyone (existing behavior).
-    if (notif.targetUserId && typeof sendToUser === "function") {
+    // Project/session previews are projected for each authenticated viewer.
+    if (ctx.forEachClient) {
+      publish(payload);
+    } else if (notif.targetUserId && typeof sendToUser === "function") {
       sendToUser(notif.targetUserId, payload);
     } else {
       broadcastAll(payload);
@@ -196,12 +212,14 @@ function attachNotifications(ctx) {
     return notif;
   }
 
-  function dismiss(ids) {
+  function dismiss(ids, ws) {
+    var permitted = visible(ws).map(function (notification) { return notification.id; });
+    ids = ids.filter(function (id) { return permitted.indexOf(id) !== -1; });
     var before = notifications.length;
     notifications = notifications.filter(function(n) { return ids.indexOf(n.id) === -1; });
     if (notifications.length !== before) {
       saveNotifications();
-      broadcastAll({
+      publish({
         type: "notification_dismissed",
         ids: ids,
         unreadCount: getUnreadCount(),
@@ -209,12 +227,41 @@ function attachNotifications(ctx) {
     }
   }
 
-  function dismissAll() {
-    if (notifications.length > 0) {
-      notifications = [];
-      saveNotifications();
-      broadcastAll({ type: "notification_dismissed_all", unreadCount: 0 });
-    }
+  function canReadOwned(principal, item) {
+    var owner = principal.userId || null;
+    return (owner ? (item.targetUserId === owner || item.ownerId === owner) && (!item.targetUserId || item.targetUserId === owner) : !item.ownerId && !item.targetUserId) &&
+      (!ctx.canViewPrincipal || ctx.canViewPrincipal(principal, item));
+  }
+  function authorizeOwned(principal, items) {
+    if (items.some(function (item) { return !canReadOwned(principal, item); })) throw new Error('Owned notification access changed.');
+  }
+  function listOwned(principal) {
+    return notifications.filter(function (item) { return canReadOwned(principal, item); }).slice(0, 100).map(function (item) { return JSON.parse(JSON.stringify(controlProjection(item))); });
+  }
+  function inspectOwned(principal, ids) {
+    var owned = listOwned(principal);
+    return ids.map(function (id) {
+      var item = owned.find(function (entry) { return entry.id === id; });
+      if (!item) throw new Error('The exact owned notification is absent or inaccessible.');
+      return item;
+    });
+  }
+  function dismissOwned(principal, ids, revalidate) {
+    revalidate(); inspectOwned(principal, ids);
+    var previous = notifications;
+    notifications = notifications.filter(function (item) { return ids.indexOf(item.id) < 0; });
+    var tmp = NOTIF_FILE + '.tmp';
+    try { fs.writeFileSync(tmp, JSON.stringify(notifications, null, 2)); fs.renameSync(tmp, NOTIF_FILE); }
+    catch (error) { notifications = previous; throw error; }
+    // Use the ordinary per-viewer notification state; no private IDs are broadcast.
+    var published = true;
+    if (ctx.forEachClient) ctx.forEachClient(function (ws) { try { sendConnectionState(ws, function (client, payload) { if (client.readyState === 1) client.send(JSON.stringify(payload)); }); } catch (error) { published = false; } });
+    try { revalidate(); } catch (error) { return { status: 'failed', persisted: true, dismissedIds: ids, error: error.message, retrySafe: false }; }
+    return { status: published ? 'completed' : 'failed', persisted: true, dismissedIds: ids, viewerPublication: published ? 'sent' : 'partial', retrySafe: false };
+  }
+
+  function dismissAll(ws) {
+    dismiss(visible(ws).map(function (notification) { return notification.id; }), ws);
   }
 
   // --- Periodic reminder ---
@@ -222,8 +269,15 @@ function attachNotifications(ctx) {
   function startReminder() {
     if (reminderTimer) return;
     reminderTimer = setInterval(function () {
+      if (ctx.canView && ctx.getUsers && pushModule && pushModule.sendPushToUser) {
+        ctx.getUsers().forEach(function (user) {
+          var count = visible({ _clayUser: user }).length;
+          if (count) pushModule.sendPushToUser(user.id, { type: "reminder", title: "Clay", body: count + " unread notification" + (count > 1 ? "s" : ""), tag: "clay-notif-reminder" });
+        });
+        return;
+      }
       var count = getUnreadCount();
-      if (count > 0 && pushModule) {
+      if (count > 0 && pushModule && !ctx.canView) {
         pushModule.sendPush({
           type: "reminder",
           title: "Clay",
@@ -244,10 +298,11 @@ function attachNotifications(ctx) {
 
   function sendConnectionState(ws, sendTo) {
     if (!sendTo) return;
+    var list = visible(ws);
     sendTo(ws, {
       type: "notifications_state",
-      notifications: notifications,
-      unreadCount: getUnreadCount(),
+      notifications: list,
+      unreadCount: list.length,
     });
   }
 
@@ -255,17 +310,21 @@ function attachNotifications(ctx) {
 
   function handleNotificationMessage(ws, msg) {
     if (msg.type === "notification_dismiss") {
-      dismiss(msg.ids || []);
+      dismiss(msg.ids || [], ws);
       return true;
     }
     if (msg.type === "notification_dismiss_all") {
-      dismissAll();
+      dismissAll(ws);
       return true;
     }
     return false;
   }
 
   return {
+    authorizeOwned: authorizeOwned,
+    listOwned: listOwned,
+    inspectOwned: inspectOwned,
+    dismissOwned: dismissOwned,
     notify: notify,
     getUnreadCount: getUnreadCount,
     sendConnectionState: sendConnectionState,