clay-server 5.2.0-beta.1 → 5.2.0-beta.11

package/lib/yoke/codex-app-server.js

@@ -17,9 +17,9 @@ var { wrapSpawnAsUser } = require("../os-users");
 //
 // The bundled @openai/codex platform package is the default. Set the
 // CLAY_CODEX_PATH env var to an existing executable to run a different codex
-// build (local dev build, system install, pinned older release); the chosen
-// binary is logged on every resolution. An unset or non-existent
-// CLAY_CODEX_PATH silently falls back to the bundled resolution.
+// build (local dev build, system install, pinned older release). An unset
+// override uses bundled resolution; an explicitly invalid override fails
+// closed without selecting a different installation.
 
 var PLATFORM_PACKAGE_BY_TARGET = {
   "aarch64-apple-darwin": "@openai/codex-darwin-arm64",
@@ -45,14 +45,9 @@ function getTargetTriple() {
 }
 
 function findCodexPath() {
-  var override = process.env.CLAY_CODEX_PATH;
-  if (override) {
-    if (fs.existsSync(override)) {
-      console.log("[codex-app-server] Using CLAY_CODEX_PATH binary:", override);
-      return override;
-    }
-    console.warn("[codex-app-server] CLAY_CODEX_PATH does not exist, falling back to bundled codex:", override);
-  }
+  var discovery = require("./discovery");
+  var override = discovery.explicitEntry(process.env, "CLAY_CODEX_PATH", false);
+  if (override !== undefined) return override;
 
   var triple = getTargetTriple();
   if (!triple) throw new Error("Unsupported platform: " + process.platform + "/" + process.arch);
@@ -74,7 +69,7 @@ function findCodexPath() {
       path.join(vendorRoot, triple, "codex", binaryName),
     ];
     for (var i = 0; i < candidates.length; i++) {
-      if (fs.existsSync(candidates[i])) {
+      if (discovery.validEntry(candidates[i], false)) {
         console.log("[codex-app-server] Using bundled codex binary:", candidates[i]);
         return candidates[i];
       }

package/lib/yoke/codex-dynamic-tool-names.js

@@ -0,0 +1,80 @@
+// Reversible Codex transport names for Clay dynamic tools.
+//
+// Codex app-server (rust-v0.162.1 validate_dynamic_tools) rejects a
+// thread/start whose dynamic tool names do not match ^[a-zA-Z0-9_-]+$, exceed
+// 128 characters, repeat, or are "mcp" / start with "mcp__". Clay keeps its
+// original names (for example mcp__server__tool) for dispatch, permissions and
+// activity, and only the Codex wire uses a deterministic alias. Determinism
+// lets a resumed thread's persisted catalog resolve against a rebuilt catalog.
+
+var crypto = require("crypto");
+
+var MAX_NAME_LENGTH = 128;
+var ALIAS_PREFIX = "clay__";
+var HASH_LENGTH = 16;
+var IDENTIFIER = /^[A-Za-z0-9_-]+$/;
+
+function isReserved(name) {
+  return name === "mcp" || name.indexOf("mcp__") === 0;
+}
+
+// True when Codex accepts the name as-is and it cannot be mistaken for an alias.
+function isPlainName(name) {
+  return typeof name === "string" && name.length > 0 && name.length <= MAX_NAME_LENGTH
+    && IDENTIFIER.test(name) && !isReserved(name) && name.indexOf(ALIAS_PREFIX) !== 0;
+}
+
+function transportName(name) {
+  if (typeof name !== "string" || !name) throw new Error("Dynamic tool names must be non-empty strings.");
+  if (isPlainName(name)) return name;
+  var hash = crypto.createHash("sha256").update(name, "utf8").digest("hex").slice(0, HASH_LENGTH);
+  var readable = name.replace(/^mcp__/, "").replace(/[^A-Za-z0-9_-]/g, "_");
+  var room = MAX_NAME_LENGTH - ALIAS_PREFIX.length - 2 - HASH_LENGTH;
+  return ALIAS_PREFIX + readable.slice(0, room) + "__" + hash;
+}
+
+// Build the exact alias map for one query's catalog. Repeated identical
+// originals resolve to the same handler, so they are advertised once. Two
+// different originals sharing an alias fail closed instead of guessing.
+function createCatalog(defs) {
+  var byTransport = new Map();
+  var byOriginal = new Map();
+  var advertised = [];
+  (defs || []).forEach(function (def) {
+    var original = def && def.name;
+    var alias = transportName(original);
+    if (byOriginal.has(original)) return;
+    if (byTransport.has(alias)) {
+      throw new Error("Codex dynamic tool names collide: " + byTransport.get(alias) + " and " + original);
+    }
+    byTransport.set(alias, original);
+    byOriginal.set(original, alias);
+    advertised.push({ def: def, name: alias });
+  });
+
+  // Map a Codex call back to the original Clay name. Plain names keep the
+  // existing live-catalog lookup; aliases must belong to this catalog.
+  function resolve(tool, namespace) {
+    if (namespace !== undefined && namespace !== null && namespace !== "") {
+      return { error: "Clay does not register namespaced dynamic tools: " + namespace };
+    }
+    if (typeof tool !== "string" || !tool) return { error: "Dynamic tool call has no tool name." };
+    if (byTransport.has(tool)) return { name: byTransport.get(tool) };
+    if (isPlainName(tool)) return { name: tool };
+    return { error: "Session tool is not in this conversation's current catalog: " + tool };
+  }
+
+  function displayName(tool) {
+    return byTransport.has(tool) ? byTransport.get(tool) : tool;
+  }
+
+  return { advertised: advertised, resolve: resolve, displayName: displayName };
+}
+
+module.exports = {
+  MAX_NAME_LENGTH: MAX_NAME_LENGTH,
+  ALIAS_PREFIX: ALIAS_PREFIX,
+  isPlainName: isPlainName,
+  transportName: transportName,
+  createCatalog: createCatalog,
+};

package/lib/yoke/codex-idle-recovery.js

@@ -49,4 +49,84 @@ async function retireIdleQueries(entries, server, checkCurrent) {
   return true;
 }
 
-module.exports = { retireIdleQueries: retireIdleQueries, checkAbort: checkAbort };
+// A separate process may resume a different thread only after the shared
+// process proves it has no writer for that thread. Never infer this from the
+// number of query handles: Codex can retain a loaded thread after input ends.
+async function loadedThreads(server, checkCurrent) {
+  var cursor = null;
+  var threads = [];
+  var deadline = Date.now() + 5000;
+  for (var page = 0; page < 20; page++) {
+    var remaining = deadline - Date.now();
+    if (remaining <= 0) return null;
+    var result;
+    try {
+      result = await server.send('thread/loaded/list', { cursor: cursor, limit: 100 }, remaining);
+    } catch (error) {
+      checkCurrent();
+      if (!server.started) throw error;
+      return null;
+    }
+    checkCurrent();
+    if (!result || !Array.isArray(result.data) || !result.data.every(function(id) { return typeof id === 'string'; })) return null;
+    threads = threads.concat(result.data);
+    if (!result.nextCursor) return threads;
+    if (result.nextCursor === cursor) return null;
+    cursor = result.nextCursor;
+  }
+  return null;
+}
+
+async function threadIsAbsent(server, threadId, checkCurrent) {
+  var threads = await loadedThreads(server, checkCurrent);
+  return !!threads && threads.indexOf(threadId) === -1;
+}
+
+async function runtimeCanStop(server, retiredThreads, checkCurrent) {
+  var threads = await loadedThreads(server, checkCurrent);
+  return !!threads && threads.every(function(threadId) { return retiredThreads.indexOf(threadId) !== -1; });
+}
+
+async function releaseThread(entries, server, threadId, checkCurrent) {
+  if (!server || !server.started) throw new Error('Codex disconnected while checking recovery admission');
+  var matching = entries.filter(function(entry) {
+    return entry.handle && entry.handle.getRecoveryThreadId() === threadId;
+  });
+  if (!matching.length && await threadIsAbsent(server, threadId, checkCurrent)) return true;
+  if (matching.length) {
+    if (!await retireIdleQueries(matching, server, checkCurrent)) return false;
+    checkCurrent();
+  } else {
+    // A closed SDK handle can leave a loaded provider thread behind. Only an
+    // explicitly idle provider thread with verified terminal state may unload.
+    try {
+      var status = await server.send('thread/read', { threadId: threadId, includeTurns: false }, 5000);
+      checkCurrent();
+      if (!status || !status.thread || status.thread.id !== threadId
+          || !status.thread.status || status.thread.status.type !== 'idle') return false;
+      var terminals = await server.send('thread/backgroundTerminals/list', { threadId: threadId }, 5000);
+      checkCurrent();
+      if (!terminalsAreIdle(terminals)) return false;
+    } catch (error) { checkCurrent(); if (!server.started) throw error; return false; }
+  }
+  try { await server.send('thread/unsubscribe', { threadId: threadId }, 5000); }
+  catch (error) { checkCurrent(); if (!server.started) throw error; return false; }
+  return threadIsAbsent(server, threadId, checkCurrent);
+}
+
+// Poll the lifecycle without holding the admission lock. Also check Stop and
+// shutdown while a provider probe, initialization, or process exit is pending.
+function wait(promise, checkCurrent) {
+  return new Promise(function(resolve, reject) {
+    var timer = setInterval(function() {
+      try { checkCurrent(); } catch (error) { clearInterval(timer); reject(error); }
+    }, 25);
+    Promise.resolve(promise).then(function(value) {
+      clearInterval(timer);
+      try { checkCurrent(); resolve(value); } catch (error) { reject(error); }
+    }, function(error) { clearInterval(timer); reject(error); });
+  });
+}
+
+module.exports = { retireIdleQueries: retireIdleQueries, checkAbort: checkAbort,
+  releaseThread: releaseThread, runtimeCanStop: runtimeCanStop, wait: wait };

package/lib/yoke/codex-model-catalog.js

@@ -1,5 +1,16 @@
 // Runtime catalogs are scoped to the adapter's OS user and provider configuration.
-var FALLBACK = ["gpt-6-astra", "gpt-6.1-sol", "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.5", "gpt-5.2"];
+// The runtime model/list is authoritative. This offline fallback mirrors the
+// picker-visible presets bundled with @openai/codex 0.162.1, in their priority
+// order, minus models the official Codex models page lists as retired for
+// ChatGPT sign-in or deprecated (gpt-5.5, gpt-5.2). Verified 2026-10-17:
+// https://learn.chatgpt.com/docs/models
+var FALLBACK = ["gpt-6.1-sol", "gpt-6-astra", "gpt-6-sol", "gpt-6-luna", "gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"];
+// Codex marks its highest-priority picker-visible preset as default; for the
+// bundled 0.162.1 presets that is gpt-6.1-sol. Used only without a runtime flag.
+var DEFAULT_MODEL = "gpt-6.1-sol";
+// Fast, low-cost models for title generation, newest first (gpt-5.6-luna's
+// bundled upgrade target is gpt-6-luna).
+var TITLE_MODELS = ["gpt-6-luna", "gpt-5.6-luna"];
 
 function fallback() {
   return FALLBACK.slice();
@@ -21,6 +32,8 @@ async function load(server) {
         if (!entry || entry.hidden || typeof entry.model !== "string" || !entry.model || seen.has(entry.model)) return;
         seen.add(entry.model);
         var model = { value: entry.model, displayName: entry.displayName || entry.model, description: entry.description || "" };
+        if (typeof entry.defaultReasoningEffort === "string" && entry.defaultReasoningEffort) model.defaultReasoningEffort = entry.defaultReasoningEffort;
+        if (entry.isDefault === true) model.isDefault = true;
         if (Array.isArray(entry.supportedReasoningEfforts)) {
           model.supportedEffortLevels = entry.supportedReasoningEfforts.map(function (option) { return option.reasoningEffort; }).filter(function (effort) { return typeof effort === "string" && effort.length > 0; });
         }
@@ -37,11 +50,32 @@ async function load(server) {
   return fallback();
 }
 
+// The runtime's own default wins. Without a flag, never name a model the
+// catalog does not offer: use the static default only when it is listed,
+// otherwise the first valid row. An empty catalog keeps the static default.
+function defaultModel(models) {
+  var values = [];
+  var flagged = null;
+  (models || []).forEach(function (entry) {
+    var value = typeof entry === "string" ? entry : entry && typeof entry === "object" ? entry.value : null;
+    if (typeof value !== "string" || !value.trim()) return;
+    values.push(value);
+    if (!flagged && typeof entry === "object" && entry.isDefault === true) flagged = value;
+  });
+  if (flagged) return flagged;
+  if (values.indexOf(DEFAULT_MODEL) !== -1 || values.length === 0) return DEFAULT_MODEL;
+  return values[0];
+}
+
 function selectTitleModel(models, sessionModel) {
   var entries = models.map(function (entry) {
     return typeof entry === "string" ? { value: entry } : entry;
   }).filter(function (entry) { return entry && typeof entry.value === "string" && entry.value.trim(); });
-  var selected = entries.find(function (entry) { return entry.value === "gpt-5.6-luna"; })
+  var selected = null;
+  for (var ti = 0; ti < TITLE_MODELS.length && !selected; ti++) {
+    selected = entries.find(function (entry) { return entry.value === TITLE_MODELS[ti]; }) || null;
+  }
+  selected = selected
     || entries.find(function (entry) { return entry.value === sessionModel; }) || entries[0];
   if (!selected) throw new Error("No supported Codex title model is available");
   var efforts = selected.supportedEffortLevels;
@@ -49,4 +83,4 @@ function selectTitleModel(models, sessionModel) {
   return { model: selected.value, effort: effort };
 }
 
-module.exports = { fallback: fallback, load: load, selectTitleModel: selectTitleModel };
+module.exports = { DEFAULT_MODEL: DEFAULT_MODEL, fallback: fallback, load: load, defaultModel: defaultModel, selectTitleModel: selectTitleModel };

package/lib/yoke/codex-recovery-admission.js

@@ -0,0 +1,164 @@
+var idleRecovery = require('./codex-idle-recovery');
+
+// Serialize decisions, not whole model turns. Waiting for a target must release
+// the gate so an unrelated Driver can still answer its Worker's permissions.
+function attachRecoveryAdmission(ctx) {
+  var handoff = null;
+  var runtimes = [];
+  var targets = new Map();
+  var cleanupTasks = new Map();
+  var cleanupFailures = new Map();
+  var cleanup = Promise.resolve();
+  var unconfirmedSharedProcess = null;
+
+  function checkSharedExit() {
+    if (!unconfirmedSharedProcess) return;
+    if (unconfirmedSharedProcess.exitCode === null && unconfirmedSharedProcess.signalCode === null) {
+      throw new Error('Codex shared runtime exit could not be confirmed; recovery remains reserved.');
+    }
+    unconfirmedSharedProcess = null;
+  }
+
+  function checker(queryOpts) {
+    var epoch = ctx.state().epoch;
+    return function() {
+      idleRecovery.checkAbort(queryOpts);
+      var state = ctx.state();
+      if ((state.shuttingDown && !state.retiring) || state.epoch !== epoch) throw ctx.shutdownError();
+    };
+  }
+
+  function cleanupRuntime(runtime) {
+    if (cleanupTasks.has(runtime)) return cleanupTasks.get(runtime);
+    var task = cleanup.catch(function() { return null; }).then(function() {
+      return runtime.shutdownForRecovery();
+    }).then(function() {
+      runtimes = runtimes.filter(function(current) { return current !== runtime; });
+      targets.forEach(function(current, threadId) { if (current === runtime) targets.delete(threadId); });
+      cleanupTasks.delete(runtime);
+      return true;
+    }, function(error) {
+      console.error('[yoke/codex] Isolated recovery runtime shutdown failed:', error.message || error);
+      // Retain ownership after an unconfirmed exit. In particular, never admit
+      // a second writer just because bounded process cleanup reached its limit.
+      cleanupFailures.set(runtime, error);
+      return false;
+    });
+    cleanupTasks.set(runtime, task);
+    cleanup = task;
+    return task;
+  }
+
+  async function withAdmission(checkCurrent, action) {
+    var release;
+    var prior = handoff;
+    var own = new Promise(function(resolve) { release = resolve; });
+    var tail = Promise.resolve(prior).then(function() { return own; });
+    handoff = tail;
+    tail.then(function() { if (handoff === tail) handoff = null; });
+    try {
+      await idleRecovery.wait(prior || Promise.resolve(), checkCurrent);
+      await idleRecovery.wait(cleanup, checkCurrent);
+      checkSharedExit();
+      return await action();
+    } finally {
+      // An aborted waiter still links to its predecessor. Releasing its own
+      // slot cannot let a later caller overtake a probe that is still running.
+      release();
+    }
+  }
+
+  async function releaseTarget(threadId, checkCurrent) {
+    var prior = targets.get(threadId);
+    if (!prior) return true;
+    if (cleanupFailures.has(prior)) throw cleanupFailures.get(prior);
+    await prior.retireIdleForRecovery(checkCurrent);
+    await cleanup;
+    checkCurrent();
+    if (cleanupFailures.has(prior)) throw cleanupFailures.get(prior);
+    return !targets.has(threadId);
+  }
+
+  async function prepareShared(threadId, checkCurrent) {
+    var state = ctx.state();
+    if (state.initializing) return false;
+    var retiredThreads = [];
+    if (state.refCount > 0) {
+      var snapshots = state.entries.map(function(entry) { return entry.handle && entry.handle.getIdleRecoverySnapshot(); });
+      if (await idleRecovery.retireIdleQueries(state.entries, state.server, checkCurrent)) {
+        retiredThreads = snapshots.filter(Boolean).map(function(snapshot) { return snapshot.threadId; });
+      }
+    }
+    state = ctx.state();
+    if (!state.server) return true;
+    if (!state.refCount && await idleRecovery.runtimeCanStop(state.server, retiredThreads, checkCurrent)) {
+      var proc = state.server.proc;
+      var stopped = await ctx.stopIdle();
+      if (stopped) { unconfirmedSharedProcess = proc || null; checkSharedExit(); }
+      return stopped;
+    }
+    return idleRecovery.releaseThread(state.entries, state.server, threadId, checkCurrent);
+  }
+
+  async function waitUntilAvailable(queryOpts, action) {
+    var checkCurrent = checker(queryOpts);
+    var waiting = false;
+    if (typeof queryOpts.onRecoveryAdmission === 'function') queryOpts.onRecoveryAdmission(true);
+    try {
+      while (true) {
+        checkCurrent();
+        // Cancellation returns to the caller immediately, but an in-flight
+        // unsubscribe or shutdown retains the gate until its bounded RPC settles.
+        var result = await idleRecovery.wait(withAdmission(checkCurrent, action.bind(null, checkCurrent)), checkCurrent);
+        if (result) {
+          if (waiting && typeof queryOpts.onRecoveryWaiting === 'function') queryOpts.onRecoveryWaiting(false);
+          return result;
+        }
+        if (!waiting && typeof queryOpts.onRecoveryWaiting === 'function') queryOpts.onRecoveryWaiting(true);
+        waiting = true;
+        await idleRecovery.wait(new Promise(function(resolve) { setTimeout(resolve, 50); }), checkCurrent);
+      }
+    } finally {
+      if (typeof queryOpts.onRecoveryAdmission === 'function') queryOpts.onRecoveryAdmission(false);
+    }
+  }
+
+  function createQuery(queryOpts) {
+    return waitUntilAvailable(queryOpts, async function(checkCurrent) {
+      if (!await releaseTarget(queryOpts.resumeSessionId, checkCurrent)) return false;
+      if (!await prepareShared(queryOpts.resumeSessionId, checkCurrent)) return false;
+      checkCurrent();
+      var runtime = ctx.createRuntime(queryOpts);
+      runtimes.push(runtime);
+      targets.set(queryOpts.resumeSessionId, runtime);
+      try {
+        return await runtime.createQuery(Object.assign({}, queryOpts, {
+          isolatedRecovery: true,
+          onRuntimeFinished: function() { return cleanupRuntime(runtime); },
+        }));
+      } catch (error) {
+        await cleanupRuntime(runtime);
+        throw error;
+      }
+    });
+  }
+
+  return {
+    createQuery: createQuery,
+    pending: function() { return handoff; },
+    checkSharedExit: checkSharedExit,
+    hasTarget: function(threadId) { return targets.has(threadId); },
+    waitForTarget: function(queryOpts) {
+      return waitUntilAvailable(queryOpts, function(checkCurrent) { return releaseTarget(queryOpts.resumeSessionId, checkCurrent); });
+    },
+    shutdown: function() {
+      return Promise.all(runtimes.slice().map(cleanupRuntime)).then(function(results) {
+        checkSharedExit();
+        if (results.indexOf(false) !== -1) throw new Error('Codex recovery runtime cleanup could not be confirmed.');
+        return cleanup;
+      });
+    },
+  };
+}
+
+module.exports = { attachRecoveryAdmission: attachRecoveryAdmission };

package/lib/yoke/configuration.js

@@ -0,0 +1,13 @@
+// Serializable descriptions of implemented provider controls. Legacy setting
+// keys and message names describe persistence compatibility, never authority.
+var claude = {
+  auto: true,
+  permissionModes: [{ value: 'default', label: 'Ask' }, { value: 'plan', label: 'Plan' }, { value: 'acceptEdits', label: 'Auto-accept edits' }],
+  thinking: { options: ['disabled', 'adaptive', 'budget'], budget: true },
+};
+var codex = {
+  approval: { options: [{ value: 'never', label: 'Auto' }, { value: 'untrusted', label: 'Untrusted' }, { value: 'on-request', label: 'Ask' }], state: 'codexApproval', message: 'set_codex_approval', key: 'approval' },
+  sandbox: { options: [{ value: 'read-only', label: 'Read Only' }, { value: 'workspace-write', label: 'Workspace' }, { value: 'danger-full-access', label: 'Full Access' }], state: 'codexSandbox', message: 'set_codex_sandbox', key: 'sandbox' },
+  webSearch: { options: [{ value: 'disabled', label: 'Off' }, { value: 'cached', label: 'Cached' }, { value: 'live', label: 'Live' }], state: 'codexWebSearch', message: 'set_codex_websearch', key: 'webSearch' },
+};
+module.exports = { claude: claude, codex: codex };

package/lib/yoke/discovery.js

@@ -0,0 +1,70 @@
+// Installation resolution shared by adapter creation, startup and product UI.
+// This never starts a provider; callers may replace resolvers for isolated tests.
+var fs = require('fs');
+var cp = require('child_process');
+function onPath(binary, user) {
+  try {
+    if (user && !/^[a-z_][a-z0-9_-]*\$?$/i.test(user)) return null;
+    var command = user ? 'su' : process.platform === 'win32' ? 'where' : 'which';
+    var args = user ? ['-', user, '-c', 'which ' + binary] : [binary];
+    if (!/^[a-zA-Z0-9_.-]+$/.test(binary)) return null;
+    var result = cp.execFileSync(command, args, { encoding: 'utf8', timeout: 3000, stdio: ['pipe', 'pipe', 'pipe'] });
+    return String(result || '').trim().split(/\r?\n/)[0] || null;
+  } catch (error) { return null; }
+}
+// Native commands require an executable regular file. SDK-owned JavaScript
+// entries are readable files launched through Node, not native executables.
+function validEntry(file, script) {
+  try {
+    if (typeof file !== 'string' || !file || !fs.statSync(file).isFile()) return false;
+    fs.accessSync(file, script && /\.(?:c|m)?js$/i.test(file) ? fs.constants.R_OK : fs.constants.X_OK);
+    return true;
+  } catch (error) { return false; }
+}
+function explicitEntry(env, name, script) {
+  if (!Object.prototype.hasOwnProperty.call(env, name)) return undefined;
+  if (!validEntry(env[name], script)) throw new Error('Invalid explicit provider executable: ' + name);
+  return env[name];
+}
+function pathResolver(binary, override) {
+  return function(options) {
+    options = options || {};
+    var env = options.env || process.env;
+    if (!options.user && override) {
+      var explicit = explicitEntry(env, override, false);
+      if (explicit !== undefined) return explicit;
+    }
+    var resolved = onPath(binary, options.user);
+    return options.user || validEntry(resolved, false) ? resolved : null;
+  };
+}
+function bundledResolver(find, binary) {
+  return function(options) {
+    options = options || {};
+    // The mapped account cannot inherit the daemon account's installation.
+    if (options.user) return onPath(binary, options.user);
+    // The runtime resolver owns all fallback policy. Adding a discovery-only
+    // PATH fallback would advertise a runtime that its adapter cannot start.
+    return find();
+  };
+}
+function acpResolver(vendor) {
+  return function(options) {
+    if (options && options.user) return null;
+    var profiles = require('./acp-agent-profiles');
+    return profiles.findAcpAgentPath(profiles.getAcpAgentProfile(vendor));
+  };
+}
+function installed(options) {
+  var registry = options && options.registry || require('./vendor-registry').VENDOR_REGISTRY;
+  var result = {};
+  Object.keys(registry).forEach(function(vendor) {
+    var info = registry[vendor];
+    result[vendor] = false;
+    if (options && options.user && info.osUserIsolation !== true) return;
+    if (typeof info.resolveExecutable !== 'function') return;
+    try { result[vendor] = !!info.resolveExecutable(options || {}); } catch (error) {}
+  });
+  return result;
+}
+module.exports = { installed: installed, pathResolver: pathResolver, bundledResolver: bundledResolver, acpResolver: acpResolver, validEntry: validEntry, explicitEntry: explicitEntry };

package/lib/yoke/errors.js

@@ -0,0 +1,8 @@
+function classify(provider, text) {
+  var service = require('./provider-contract').resolve(provider).classifyError;
+  return typeof service === 'function' ? service(text) : null;
+}
+function contextOverflow(error) {
+  return /prompt is too long|context_length|maximum context length/i.test(String(error || ""));
+}
+module.exports = { contextOverflow: contextOverflow, classify: classify };

package/lib/yoke/host-environment.js

@@ -0,0 +1,7 @@
+// Provider compatibility at the host boundary. No effects occur on import.
+function prepare(env) { delete env.CLAUDECODE; }
+function reaper(env) {
+  return { idleMs: Number(env.CLAY_ADAPTER_IDLE_MS) || Number(env.CLAY_CODEX_IDLE_MS) || 5 * 60 * 1000,
+    reapMs: Number(env.CLAY_ADAPTER_REAPER_MS) || Number(env.CLAY_CODEX_REAPER_MS) || 60 * 1000 };
+}
+module.exports = { prepare: prepare, reaper: reaper };

package/lib/yoke/index.js

@@ -16,11 +16,12 @@ var createGrokAdapter = require("./adapters/grok").createGrokAdapter;
 var createCopilotAdapter = require("./adapters/copilot").createCopilotAdapter;
 var createQwenAdapter = require("./adapters/qwen").createQwenAdapter;
 var createJunieAdapter = require("./adapters/junie").createJunieAdapter;
+var createMuseAdapter = require("./adapters/muse").createMuseAdapter;
 var createKiroAdapter = require("./adapters/kiro").createKiroAdapter;
 
 // Keep the first session in a new project predictable. This order is also
 // used by the UI when a project has no remembered vendor yet.
-var DEFAULT_VENDOR_ORDER = ["claude", "codex", "grok", "kimi", "copilot", "qwen", "junie", "antigravity", "opencode", "kiro"];
+var DEFAULT_VENDOR_ORDER = ["claude", "codex", "muse", "grok", "kimi", "copilot", "qwen", "junie", "antigravity", "opencode", "kiro"];
 
 function resolveDefaultVendor(availableVendors) {
   availableVendors = availableVendors || {};
@@ -97,6 +98,8 @@ function createAdapter(opts) {
     adapter = createJunieAdapter(opts);
   } else if (vendor === "kiro") {
     adapter = createKiroAdapter(opts);
+  } else if (vendor === "muse") {
+    adapter = createMuseAdapter(opts);
   } else {
     throw new Error("[YOKE] Unknown adapter vendor: " + vendor);
   }
@@ -262,6 +265,7 @@ function checkAuth() {
     qwen: !!lookupBinary("qwen"),
     junie: !!lookupBinary("junie"),
     kiro: checkKiro(),
+    muse: null,
   };
   logAuthCheck(_authCache);
   return _authCache;
@@ -280,54 +284,8 @@ function checkAuth() {
 var _installedCache = null;
 
 function checkInstalled() {
-  if (_installedCache) return _installedCache;
-
-  var fs = require("fs");
-  var execFileSync = require("child_process").execFileSync;
-  var result = { claude: false, codex: false, antigravity: false, opencode: false, kimi: false, grok: false, copilot: false, qwen: false, junie: false, kiro: false };
-  try {
-    if (process.platform === "win32") execFileSync("where", ["claude"], { timeout: 3000, stdio: ["pipe", "pipe", "pipe"] });
-    else execFileSync("which", ["claude"], { timeout: 3000, stdio: ["pipe", "pipe", "pipe"] });
-    result.claude = true;
-  } catch (e) {}
-  try {
-    var findKiroPath = require("./kiro-acp-server").findKiroPath;
-    var kiroBin = findKiroPath();
-    if (kiroBin && fs.existsSync(kiroBin)) result.kiro = true;
-  } catch (e) {}
-  try {
-    var codexBin = null;
-    try {
-      var findCodexPath = require("./codex-app-server").findCodexPath;
-      codexBin = findCodexPath();
-      if (codexBin && fs.existsSync(codexBin)) {
-        result.codex = true;
-      }
-    } catch (e) {}
-
-    if (!result.codex) {
-      var whichOut = process.platform === "win32"
-        ? execFileSync("where", ["codex"], { timeout: 3000, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] })
-        : execFileSync("which", ["codex"], { timeout: 3000, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] });
-      if (whichOut.trim()) result.codex = true;
-    }
-  } catch (e) {}
-  try {
-    var antigravityBinary = process.platform === "win32"
-      ? execFileSync("where", ["agy"], { timeout: 3000, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] })
-      : execFileSync("which", ["agy"], { timeout: 3000, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] });
-    result.antigravity = !!antigravityBinary.trim();
-  } catch (e) {}
-  var acpVendorKeys = ["opencode", "kimi", "grok", "copilot", "qwen", "junie"];
-  for (var acpIndex = 0; acpIndex < acpVendorKeys.length; acpIndex++) {
-    try {
-      var acpProfiles = require("./acp-agent-profiles");
-      var acpVendor = acpVendorKeys[acpIndex];
-      result[acpVendor] = !!acpProfiles.findAcpAgentPath(acpProfiles.getAcpAgentProfile(acpVendor));
-    } catch (e) {}
-  }
-  _installedCache = result;
-  return result;
+  if (!_installedCache) _installedCache = require("./discovery").installed();
+  return _installedCache;
 }
 
 function invalidateAuthCache() {
@@ -352,7 +310,7 @@ function createAdapters(opts) {
   // Tests can supply a fixed installation snapshot without probing or spawning
   // vendor binaries; production callers always use the cached host scan.
   var installed = opts._installed || checkInstalled();
-  var auth = { claude: false, codex: false, antigravity: false, opencode: false, kimi: false, grok: false, copilot: false, qwen: false, junie: false, kiro: false };
+  var auth = { claude: false, codex: false, antigravity: false, opencode: false, kimi: false, grok: false, copilot: false, qwen: false, junie: false, kiro: false, muse: false };
   var adapters = {};
 
   function supportsConfiguredIsolation(vendor) {
@@ -390,7 +348,7 @@ function createAdapters(opts) {
     }
   }
 
-  var subprocessVendors = ["antigravity", "opencode", "kimi", "grok", "copilot", "qwen", "junie"];
+  var subprocessVendors = ["antigravity", "opencode", "kimi", "grok", "copilot", "qwen", "junie", "muse"];
   for (var subprocessIndex = 0; subprocessIndex < subprocessVendors.length; subprocessIndex++) {
     var subprocessVendor = subprocessVendors[subprocessIndex];
     var subprocessInfo = vendorRegistry.getVendorInfo(subprocessVendor);