clay-server 5.2.0-beta.10 → 5.2.0-beta.11

package/lib/server.js

@@ -507,6 +507,8 @@ function createServer(opts) {
   var linear = require('./server-linear').attachLinear({ users: users, getMultiUserFromReq: getMultiUserFromReq,
     isRequestAuthed: isRequestAuthed, CONFIG_DIR: CONFIG_DIR });
 
+  var githubStars = require('./server-github-stars').attachGithubStars({ isRequestAuthed: isRequestAuthed });
+
   var speech = serverSpeech.attachSpeech({ users: users, getMultiUserFromReq: getMultiUserFromReq,
     isRequestAuthed: isRequestAuthed, CONFIG_DIR: CONFIG_DIR, getAllowedOrigins: getAllowedOrigins });
 
@@ -925,6 +927,7 @@ function createServer(opts) {
 
     if (linear.handleRequest(req, res, fullUrl)) return;
     if (speech.handleRequest(req, res, fullUrl)) return;
+    if (githubStars.handleRequest(req, res, fullUrl)) return;
     if (networkSettings.handleRequest(req, res, fullUrl)) return;
     if (storageSettings.handleRequest(req, res, fullUrl)) return;
     if (settings.handleRequest(req, res, fullUrl)) return;
@@ -1590,6 +1593,7 @@ function createServer(opts) {
         return ctx.getSchedules().length;
       },
       canAccessProjectSlug: canUserAccessSlug,
+      onGetProjectAccess: onGetProjectAccess,
       canUsePath: canUsePath,
       onPresenceChange: broadcastPresenceChange,
       onProcessingChanged: broadcastProcessingChange,

package/lib/session-notes-mcp-server.js

@@ -1,6 +1,8 @@
 // Sticky-note memory tools for project sessions.
 
 var buildShape = require("./session-spawn-mcp-server").buildShape;
+var z;
+try { z = require("zod"); } catch (e) { z = null; }
 
 var MEMORY_CONTRACT =
   "The sticky-note board persists across sessions and is a user-facing artifact shared with people and Clay agents, not private agent scratch space. " +
@@ -8,15 +10,28 @@ var MEMORY_CONTRACT =
   "Use Sticky Notes for preferences, reminders, undeveloped ideas, or an explicit request to remember something; confirmed Issues also get short link notes as described below. For concrete actionable bugs, improvements, or deferred implementation, an authorized Project Driver should use Project Issues. If you lack Issues authority, route the work through an eligible Project Driver. Check active notes first when a duplicate is plausible. " +
   require("./issues-filing-guidance").NOTE_GUIDANCE +
   "Never create a note merely because work is important, lengthy, spans agents or restarts, or might help another agent. Do not record completed work, implementation details, test results, investigation logs, transient blockers, conversation summaries, or announcements of your own activity. When uncertain, do not write. " +
+  "One exception: when the user explicitly asks for a working checklist, keep that one native checklist note and check its items off as they are done; never start a checklist the user did not ask for. " +
   "Updates are visible too: update only when durable state materially changes. " +
   "A note is an attention item, so finishing it means closing it, never erasing it: call close_note once the thing it is asking for is done, and the note leaves the active board while the record stays and can be reopened. Do not turn a note into a completion log instead of closing it. " +
   "Put a concise plain-text title on the first line, stay focused on one topic, and include only the context needed for future action.";
 
+var CHECKLIST_USAGE =
+  " Native checklists: pass checklist: true to create one. The first line is the title and every later non-empty, non-heading line is an item; write items as '- [ ] task' and '- [x] task' for items already done. " +
+  "To check or uncheck items, call list_notes, then pass id, that note's current version and checks with the exact item keys it returned. " +
+  "Any change to a checklist note, switching checklist mode, or changing checks needs the current version; a stale version or unknown item is refused, so list again and retry. " +
+  "Text, saved checks and colour you do not change are kept, and switching mode never erases content. Change text and checks in separate calls. " +
+  "When rewriting a checklist's text, start from checklist.effectiveText so each line's - [x] marker carries its real completion; droppedSavedChecks lists saved checks whose exact line no longer exists.";
+
+var CHECK_ENTRY = z ? z.object({
+  item: z.string().describe("Exact item key from list_notes checklist.items[].item."),
+  checked: z.boolean().describe("true marks the item done; false marks it not done."),
+}) : null;
+
 function getToolDefs(handlers) {
   return [
     {
       name: "list_notes",
-      description: MEMORY_CONTRACT + " List the notes before writing when you need to avoid duplicates or inspect full memory beyond the injected summary. Lists open notes by default; pass state to see closed ones.",
+      description: MEMORY_CONTRACT + " List the notes before writing when you need to avoid duplicates or inspect full memory beyond the injected summary. Lists open notes by default; pass state to see closed ones. Each note includes its version and checklistMode; checklist notes also include checklist.items with exact item keys, each item's effective checked value (a saved check overrides the Markdown marker), its saved value, and completed/total counts.",
       inputSchema: buildShape({
         state: { type: "string", enum: ["open", "closed", "all"], description: "Which notes to list. Defaults to open, the notes still asking for action." },
       }),
@@ -24,12 +39,16 @@ function getToolDefs(handlers) {
     },
     {
       name: "write_note",
-      description: MEMORY_CONTRACT + " Create a new note, or update an existing note by id. For notes other than confirmed Issue link notes, apply this test: would the user likely choose to keep this visible on their board next week? If the answer is unclear, do not call this tool. The 20000-character limit is an abuse guard, not a target.",
+      description: MEMORY_CONTRACT + " Create a new note, or update an existing note by id. For notes other than confirmed Issue link notes and a working checklist the user explicitly asked for, apply this test: would the user likely choose to keep this visible on their board next week? If the answer is unclear, do not call this tool. The 20000-character limit is an abuse guard, not a target." + CHECKLIST_USAGE,
       inputSchema: buildShape({
         id: { type: "string", description: "Existing note id to update. Omit to create a note." },
-        text: { type: "string", description: "User-facing sticky-note text with a concise title on the first line and only durable, action-relevant context below it." },
+        text: { type: "string", description: "User-facing sticky-note text with a concise title on the first line and only durable, action-relevant context below it. Required when creating; omit on update to keep the current text." },
         color: { type: "string", enum: ["yellow", "blue", "green", "pink", "orange", "purple"], description: "Optional sticky-note color." },
-      }, ["text"]),
+        checklist: { type: "boolean", description: "true creates or switches to a native checklist, false switches back to an ordinary note. Switching keeps the text and saved checks." },
+        version: { type: "number", description: "The note's current version from list_notes. Required for any change to a checklist note, a checklist mode switch, or checks." },
+        // buildShape returns no fields when zod is unavailable.
+        checks: { schema: CHECK_ENTRY && z.array(CHECK_ENTRY).min(1).max(1000), description: "Checklist items to check or uncheck on an existing checklist note, using exact item keys from list_notes." },
+      }),
       handler: function (args) { return handlers.write(args || {}); },
     },
     {
@@ -60,6 +79,9 @@ function getToolDefs(handlers) {
 }
 
 module.exports = {
+  // 2: native checklist fields. Conversation-scoped catalogs older than this
+  // receive the current schema through exact-query recovery.
+  CATALOG_VERSION: 2,
   MEMORY_CONTRACT: MEMORY_CONTRACT,
   getToolDefs: getToolDefs,
 };

package/lib/session-notes-writes.js

@@ -0,0 +1,88 @@
+// Pure planning for agent sticky-note updates, including native checklists.
+// Every checklist-affecting write must name the note's current version and
+// exact item keys, so a stale view can never overwrite newer content or marks.
+
+var checklist = require("./notes-checklist");
+
+var MAX_CHECKS = 1000;
+
+function validateArgs(args) {
+  if (args.checklist !== undefined && typeof args.checklist !== "boolean") return "checklist must be true or false";
+  if (args.version !== undefined && !Number.isFinite(args.version)) return "version must be the number returned by list_notes";
+  if (args.checks === undefined) return null;
+  if (!Array.isArray(args.checks) || args.checks.length === 0 || args.checks.length > MAX_CHECKS) {
+    return "checks must be a non-empty array of at most " + MAX_CHECKS + " { item, checked } entries";
+  }
+  for (var i = 0; i < args.checks.length; i++) {
+    var entry = args.checks[i];
+    if (!entry || typeof entry !== "object" || typeof entry.item !== "string" || typeof entry.checked !== "boolean") {
+      return "each checks entry needs an item key from list_notes and checked true or false";
+    }
+  }
+  return null;
+}
+
+function staleError(note) {
+  return "note " + note.id + " has changed or the version is missing; call list_notes, review its current text and items, and retry with that version";
+}
+
+// Saved marks whose exact item line no longer exists after a text change.
+function droppedChecks(note, nextText) {
+  var kept = checklist.normalizeState(note.checklistState, nextText);
+  return checklist.describe(note).filter(function (entry) {
+    return entry.saved !== null && kept[decodeURIComponent(entry.item)] === undefined;
+  }).map(function (entry) {
+    return { text: entry.text, checked: entry.saved };
+  });
+}
+
+function planUpdate(note, args, text, color) {
+  var isChecklist = note.checklistMode === true;
+  var modeChange = typeof args.checklist === "boolean" && args.checklist !== isChecklist;
+  var hasText = typeof args.text === "string";
+  var hasChecks = Array.isArray(args.checks);
+  var needsVersion = isChecklist || modeChange || hasChecks;
+  if ((needsVersion || args.version !== undefined) && args.version !== note.updatedAt) return { error: staleError(note) };
+  if (hasText && !text) return { error: "text must not be empty; close the note instead of erasing it" };
+  if (hasText && hasChecks) return { error: "change text and checks in separate calls so item keys refer to one exact version" };
+
+  var changes = {};
+  var dropped = [];
+  if (hasText && text !== note.text) {
+    changes.text = text;
+    dropped = droppedChecks(note, text);
+    if (isChecklist && !modeChange) {
+      // Storage repeats the same exact-source and version guard atomically.
+      changes.checklistEdit = true;
+      changes.checklistSource = note.text;
+      changes.checklistVersion = note.updatedAt;
+    }
+  }
+  if (color && color !== note.color) changes.color = color;
+  if (modeChange) changes.checklistMode = args.checklist;
+
+  if (hasChecks) {
+    var resultMode = modeChange ? args.checklist : isChecklist;
+    if (!resultMode) return { error: "checks apply only to checklist notes; pass checklist: true to switch this note to a checklist without changing its text" };
+    var state = checklist.normalizeState(note.checklistState, note.text);
+    var requested = Object.create(null);
+    for (var i = 0; i < args.checks.length; i++) {
+      var found = checklist.findItem(note, args.checks[i].item);
+      if (!found) return { error: "checklist item not found in note " + note.id + "; call list_notes and use its current item keys" };
+      if (requested[found.key] !== undefined && requested[found.key] !== args.checks[i].checked) {
+        return { error: "checks names the same item more than once with different values" };
+      }
+      requested[found.key] = args.checks[i].checked;
+      state[found.key] = args.checks[i].checked;
+    }
+    changes.checklistState = state;
+  }
+
+  if (!hasText && !hasChecks && !color && args.checklist === undefined) {
+    return { error: "nothing to change; pass text, color, checklist, or checks" };
+  }
+  // An identical request is acknowledged without bumping the version.
+  return { changes: Object.keys(changes).length ? changes : null, droppedSavedChecks: dropped };
+}
+
+module.exports = { validateArgs: validateArgs, planUpdate: planUpdate, MAX_CHECKS: MAX_CHECKS };

package/lib/session-visibility.js

@@ -36,16 +36,29 @@ function handleDefaultChange(ctx, ws, msg) {
     defaultChangeResult(ctx, ws, msg || {}, { ok: false, error: "Session visibility default must be private or shared." });
     return true;
   }
-  if (msg.slug && msg.slug !== ctx.slug) {
-    defaultChangeResult(ctx, ws, msg, { ok: false, error: "Project settings access is not permitted" });
-    return true;
+  var denied = { ok: false, error: "Project settings access is not permitted" };
+  // The target is named by the client, so it is authorised here, never trusted:
+  // another project must be accessible to this account and its own access
+  // record (owner, worktree, Mate) is the one checked below.
+  var target = msg.slug && typeof msg.slug === "string" ? msg.slug : ctx.slug;
+  var access;
+  if (target === ctx.slug) {
+    if (ctx.isMate === true) { defaultChangeResult(ctx, ws, msg, { ok: false, error: "Not supported" }); return true; }
+    access = ctx.getProjectAccess ? ctx.getProjectAccess() : null;
+  } else {
+    if (/^mate-/.test(target) || typeof ctx.getTargetAccess !== "function" ||
+        typeof ctx.canAccessProjectSlug !== "function" || ctx.canAccessProjectSlug(ws, target) !== true) {
+      defaultChangeResult(ctx, ws, msg, denied);
+      return true;
+    }
+    access = ctx.getTargetAccess(target);
+    if (!access || access.error || access.isMate === true) { defaultChangeResult(ctx, ws, msg, denied); return true; }
   }
-  if (ctx.isMate === true || !ctx.usersModule || !ctx.usersModule.isMultiUser || !ctx.usersModule.isMultiUser()) {
+  if (!ctx.usersModule || !ctx.usersModule.isMultiUser || !ctx.usersModule.isMultiUser()) {
     defaultChangeResult(ctx, ws, msg, { ok: false, error: "Not supported" });
     return true;
   }
   var user = ws && ws._clayUser && ctx.usersModule.findUserById(ws._clayUser.id);
-  var access = ctx.getProjectAccess ? ctx.getProjectAccess() : null;
   if (access && access.isWorktree === true) {
     defaultChangeResult(ctx, ws, msg, { ok: false, error: "Worktrees inherit this setting from their parent project." });
     return true;
@@ -53,16 +66,15 @@ function handleDefaultChange(ctx, ws, msg) {
   var permissions = user && ctx.usersModule.getEffectivePermissions
     ? ctx.usersModule.getEffectivePermissions(user, ctx.osUsers) : {};
   var isOwner = !!(user && access && access.ownerId && access.ownerId === user.id);
-  var isAdmin = !!(user && user.role === "admin");
   if (!user || !permissions.projectSettings || !isOwner) {
-    defaultChangeResult(ctx, ws, msg, { ok: false, error: "Project settings access is not permitted" });
+    defaultChangeResult(ctx, ws, msg, denied);
     return true;
   }
   if (typeof ctx.opts.onSetProjectSessionVisibilityDefault !== "function") {
     defaultChangeResult(ctx, ws, msg, { ok: false, error: "Not supported" });
     return true;
   }
-  var result = ctx.opts.onSetProjectSessionVisibilityDefault(ctx.slug, msg.visibility);
+  var result = ctx.opts.onSetProjectSessionVisibilityDefault(target, msg.visibility);
   defaultChangeResult(ctx, ws, msg, { ok: !!(result && result.ok), visibility: result && result.visibility, error: result && result.error });
   return true;
 }

package/lib/sessions.js

@@ -166,6 +166,7 @@ function createSessionManager(opts) {
       if (session.codexLinearToolCatalogVersion) metaObj.codexLinearToolCatalogVersion = session.codexLinearToolCatalogVersion;
       if (session.codexSharedBrowserToolCatalogVersion) metaObj.codexSharedBrowserToolCatalogVersion = session.codexSharedBrowserToolCatalogVersion;
       if (session.codexIssuesToolCatalogVersion) metaObj.codexIssuesToolCatalogVersion = session.codexIssuesToolCatalogVersion;
+      if (session.codexNotesToolCatalogVersion) metaObj.codexNotesToolCatalogVersion = session.codexNotesToolCatalogVersion;
       if (session.model) metaObj.model = session.model;
       if (session.effort) metaObj.effort = session.effort;
       // Persist the session's "born" mode so TUI sessions reappear after a
@@ -358,6 +359,7 @@ function createSessionManager(opts) {
       session.codexLinearToolCatalogVersion = Number(m.codexLinearToolCatalogVersion || 0);
       session.codexSharedBrowserToolCatalogVersion = Number(m.codexSharedBrowserToolCatalogVersion || 0);
       session.codexIssuesToolCatalogVersion = Number(m.codexIssuesToolCatalogVersion || 0);
+      session.codexNotesToolCatalogVersion = Number(m.codexNotesToolCatalogVersion || 0);
       session.model = m.model || deriveSessionModel(loaded[i].history);
       session.effort = m.effort || null;
       if (m.loop) session.loop = m.loop;

package/lib/vendor-usage-acp-readers.js

@@ -0,0 +1,97 @@
+// Kiro account usage through Kiro's own ACP server.
+//
+// Source (verified against the installed kiro-cli 2.32.0, not a web snippet):
+// `kiro-cli acp` advertises `/usage` ("Show billing and usage information") in
+// its available commands, and `_kiro.dev/commands/execute` with command "usage"
+// answers with { success, message, data: { planName, billingCycleReset,
+// overagesEnabled, usageBreakdowns: [{ resourceType, displayName, used, limit,
+// percentage, hasLimit, currency, overageCharges, ... }] } }. The probe made no
+// model turn. It does create an empty local Kiro session record (session/new is
+// required before a command can run), under a neutral temp directory.
+//
+// A short-lived process is started per read, as the server user, with a hard
+// timeout and kill; nothing is retained. Because the credential belongs to the
+// server user, the capability table restricts it to single-user mode.
+
+var m = require("./vendor-usage-metrics");
+var failure = require("./vendor-usage-native-readers").failure;
+
+function rpc(child, onFrame) {
+  var next = 0;
+  var pending = Object.create(null);
+  var buffer = "";
+  child.stdout.on("data", function (chunk) {
+    buffer += chunk;
+    if (buffer.length > 4 * 1024 * 1024) { buffer = ""; return; }
+    var lines = buffer.split("\n");
+    buffer = lines.pop();
+    lines.forEach(function (line) {
+      var frame;
+      try { frame = JSON.parse(line); } catch (e) { return; }
+      if (frame && frame.id !== undefined && pending[frame.id]) {
+        var entry = pending[frame.id];
+        delete pending[frame.id];
+        if (frame.error) entry.reject(failure("server", "Kiro rejected the usage request."));
+        else entry.resolve(frame.result);
+      } else if (onFrame) onFrame(frame);
+    });
+  });
+  return {
+    request: function (method, params) {
+      var id = ++next;
+      return new Promise(function (resolve, reject) {
+        pending[id] = { resolve: resolve, reject: reject };
+        child.stdin.write(JSON.stringify({ jsonrpc: "2.0", id: id, method: method, params: params }) + "\n");
+      });
+    },
+    failAll: function (error) { Object.keys(pending).forEach(function (id) { pending[id].reject(error); delete pending[id]; }); },
+  };
+}
+
+function mapUsage(data) {
+  var metrics = [];
+  var reset = typeof data.billingCycleReset === "string" ? Date.parse(data.billingCycleReset) : NaN;
+  var resetsAtMs = Number.isFinite(reset) ? reset : null;
+  (Array.isArray(data.usageBreakdowns) ? data.usageBreakdowns : []).forEach(function (item, index) {
+    if (!item || item.hasLimit !== true) return;
+    var used = m.num(item.used);
+    var limit = m.num(item.limit);
+    if (used === null || limit === null || limit <= 0) return;
+    var label = typeof item.displayName === "string" && item.displayName ? item.displayName : "Credits";
+    metrics.push(m.metric("credits", "kiro:" + (item.resourceType || index), label, { used: used, limit: limit, balance: null, unlimited: false, resetsAtMs: resetsAtMs }));
+    var charges = m.num(item.overageCharges);
+    if (data.overagesEnabled === true && charges !== null && typeof item.currency === "string" && item.currency) {
+      metrics.push(m.metric("currency", "kiro:overage:" + (item.resourceType || index), "Overage charges", { used: charges, limit: null, balance: null, currencyCode: item.currency, resetsAtMs: resetsAtMs }));
+    }
+  });
+  return { metrics: metrics, planType: typeof data.planName === "string" ? data.planName : null };
+}
+
+// deps: { binary(): path|null, spawn(command, args, options), tmpdir(), signal }
+async function kiro(context, deps) {
+  var binary = deps.binary();
+  if (!binary) throw failure("unavailable", "The Kiro CLI was not found.");
+  var child = deps.spawn(binary, ["acp"], { stdio: ["pipe", "pipe", "ignore"], cwd: deps.tmpdir(), env: deps.env });
+  var link = rpc(child);
+  var died = new Promise(function (resolve, reject) {
+    child.on("error", function () { reject(failure("unavailable", "The Kiro CLI could not be started.")); });
+    child.on("exit", function () { reject(failure("unavailable", "The Kiro CLI exited before answering.")); });
+  });
+  died.catch(function () {});
+  var abort = context && context.signal;
+  var stop = function () { try { child.kill("SIGKILL"); } catch (e) {} link.failAll(failure("timeout", "The usage read was cancelled.")); };
+  if (abort) { if (abort.aborted) stop(); else abort.addEventListener("abort", stop, { once: true }); }
+  try {
+    await Promise.race([link.request("initialize", { protocolVersion: 1, clientCapabilities: {} }), died]);
+    var session = await Promise.race([link.request("session/new", { cwd: deps.tmpdir(), mcpServers: [] }), died]);
+    if (!session || typeof session.sessionId !== "string") throw failure("parse", "Kiro returned no session.");
+    var reply = await Promise.race([link.request("_kiro.dev/commands/execute", { sessionId: session.sessionId, command: { command: "usage", args: {} } }), died]);
+    if (!reply || reply.success !== true || !reply.data || typeof reply.data !== "object") throw failure("unavailable", "Kiro did not report usage for this account.");
+    return mapUsage(reply.data);
+  } finally {
+    if (abort) abort.removeEventListener("abort", stop);
+    try { child.kill("SIGKILL"); } catch (e) {}
+  }
+}
+
+module.exports = { kiro: kiro, mapUsage: mapUsage };

package/lib/vendor-usage-capabilities.js

@@ -0,0 +1,88 @@
+// Per-vendor usage capability for all eleven Clay vendors.
+//
+// mode:
+//   query         Clay asks the vendor's own native source for account figures
+//                 (a reader exists in lib/vendor-usage-*-readers.js).
+//   event         The vendor pushes quota into a session; only the latest
+//                 observed snapshot of the owner's own sessions is shown.
+//   unintegrated  A source may exist, but it is not verified safe or not
+//                 reachable from Clay's integration, so Clay does not read it.
+//                 This is "not integrated", never "the provider has none".
+//
+// `observed` is true when session-observed quota can also be displayed (the
+// existing rate-limit snapshot path). `units` lists the metric kinds the reader
+// returns; they are never converted to each other. `identity` states what a
+// direct account read needs: "owner-os-user" (the runtime runs as the owner's
+// mapped OS user), "owner-session" (answered by one of the owner's own live
+// sessions), "single-user" (the credential is the server user's; refused in
+// account mode because no owner can be proven), or null.
+//
+// Evidence kinds in `source`/`reason`: "installed" = observed on the installed
+// CLI/SDK in this repository's environment; "primary doc" = the vendor's own
+// documentation; "Orca" = Orca@17a2bced code only (not independently run here).
+
+var CAPABILITIES = {
+  claude: {
+    mode: "query", observed: true, units: ["percent", "credits", "currency"], identity: "owner-session",
+    source: "Claude SDK account usage call on one of your live sessions (installed SDK 0.3.x; the SDK marks it experimental, so it is capability-guarded and shape-checked); session rate_limit_event otherwise",
+  },
+  codex: {
+    mode: "query", observed: true, units: ["percent", "credits"], identity: "owner-os-user",
+    source: "codex app-server account/rateLimits/read (installed protocol schema) and account/rateLimits/updated events",
+  },
+  muse: {
+    mode: "query", observed: true, units: ["percent"], identity: "single-user",
+    source: "Muse Code usage/read (installed adapter) and usage/changed events",
+  },
+  antigravity: {
+    mode: "unintegrated", observed: false, units: [], identity: null,
+    reason: "Not integrated: the only known read is print-mode `agy -p /usage` (Orca), which Orca documents as spending a model turn on versions that answer it as a prompt. Stays disabled until a non-billable path is proven.",
+  },
+  opencode: {
+    mode: "unintegrated", observed: false, units: [], identity: null,
+    reason: "Not integrated: OpenCode Go quota exists (Orca reads it with an OpenCode Go key) but OpenCode hosts many backends and Clay cannot tell which one a session uses; ACP exposes context tokens only.",
+  },
+  kimi: {
+    mode: "query", observed: false, units: ["count"], identity: "single-user",
+    source: "Kimi Code GET /usages with the CLI's saved token (Orca; Kimi CLI not installed here). Counts only: the response does not name a period or unit.",
+  },
+  grok: {
+    mode: "query", observed: false, units: ["percent", "amount"], identity: "single-user",
+    source: "Grok CLI chat proxy GET /billing with the CLI's saved token (Orca; Grok CLI not installed here). Money fields carry no currency, so they stay unit-less amounts.",
+  },
+  copilot: {
+    mode: "unintegrated", observed: false, units: [], identity: null,
+    reason: "Not integrated: GitHub's Copilot SDK documents account.getQuota (entitlement, used requests, remaining %, reset date), but Clay talks to the Copilot CLI over ACP and ships no SDK client; ACP exposure of it is unverified.",
+  },
+  qwen: {
+    mode: "unintegrated", observed: false, units: [], identity: null,
+    reason: "Not integrated: Qwen Code's documented /stats and /context report session token and call metrics; no account quota read is documented (primary doc, checked this task).",
+  },
+  junie: {
+    mode: "unintegrated", observed: false, units: [], identity: null,
+    reason: "Not integrated: Junie CLI documents a /usage slash command (session cost and remaining balance), but running it through ACP could be treated as a prompt; side effects are unverified.",
+  },
+  kiro: {
+    mode: "query", observed: false, units: ["credits", "currency"], identity: "single-user",
+    source: "Kiro ACP `_kiro.dev/commands/execute` command usage (installed kiro-cli 2.32.0: structured credits used/limit and billing-cycle reset; no model turn observed). Creates an empty local session record.",
+  },
+};
+
+var VENDORS = Object.keys(CAPABILITIES);
+
+function capabilityFor(vendor) {
+  var entry = CAPABILITIES[vendor];
+  if (!entry) return { mode: "unintegrated", observed: false, units: [], identity: null, reason: "Not integrated: no usage source has been reviewed for this vendor." };
+  return entry;
+}
+
+// Serializable form for the client; never includes functions.
+function publicCapability(vendor) {
+  var entry = capabilityFor(vendor);
+  var result = { mode: entry.mode, observed: entry.observed === true, units: entry.units.slice() };
+  if (entry.source) result.source = entry.source;
+  if (entry.reason) result.reason = entry.reason;
+  return result;
+}
+
+module.exports = { VENDORS: VENDORS, capabilityFor: capabilityFor, publicCapability: publicCapability };