clay-server 5.2.0-beta.4 → 5.2.0-beta.6

package/lib/project-admin-overview.js

@@ -0,0 +1,51 @@
+// This projection is an allowlist. Never add runtime/session/path objects here.
+function projectMetadata(status, access, users) {
+  if (!status || status.isMate || !access || access.error) return null;
+  var owner = access.ownerId && users.findUserById(access.ownerId);
+  return {
+    slug: status.slug,
+    project: status.title || status.project || status.slug,
+    title: status.title || status.project || status.slug,
+    projectOwnerId: owner ? owner.id : null,
+    ownerName: owner ? (owner.displayName || owner.username) : "Ownership needs recovery",
+    visibility: access.visibility,
+    contentAccess: false,
+    administrativeAccess: true,
+    ownershipRecovery: access.ownershipRecovery === "required" || !owner,
+    runtimeHealth: "Registered",
+  };
+}
+
+function metadataFor(user, status, access, users) {
+  if (!user || !users.findUserById(user.id) || user.role !== "admin" || !status || status.isMate || /^mate-/.test(status.slug)) return null;
+  return projectMetadata(status, access, users);
+}
+
+function escape(value) {
+  return String(value || "").replace(/[&<>"']/g, function (character) {
+    return { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[character];
+  });
+}
+
+function page(metadata, projects) {
+  var privacyText = metadata.ownershipRecovery
+    ? "Content remains restricted because no verified owner is available. Ask the server operator to verify the account’s OS UID and real home/project mapping, then run the documented ownership repair."
+    : "Conversations, files and terminals are private. Ask the owner to share project access.";
+  var accessText = metadata.ownershipRecovery
+    ? "Ownership needs recovery. The server operator must independently verify or repair the authoritative account-to-OS mapping before ownership repair can succeed. Ambiguous records stay restricted; administrator status cannot claim this project. See the Project ownership and administrator access guide."
+    : "Only the project owner can change ownership, visibility and sharing. Administrator status does not grant access to private content.";
+  var strip = projects.filter(function (project) { return !project.isMate; }).map(function (project) {
+    return '<a class="icon-strip-item' + (project.slug === metadata.slug ? ' active' : '') + '" href="/p/' + encodeURIComponent(project.slug) + '/" title="' + escape(project.title || project.project) + '"><span class="icon-strip-name">' + escape((project.title || project.project || project.slug).substring(0, 2)) + '</span></a>';
+  }).join("");
+  return '<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>' + escape(metadata.title) + ' · Clay</title>' +
+    '<script src="/appearance-bootstrap.js"></script><link rel="stylesheet" href="/style.css"><link rel="stylesheet" href="/css/project-admin-overview.css"></head><body>' +
+    '<div id="layout"><header id="top-bar"><a href="/" class="top-bar-brand-link" aria-label="Clay home"><span class="top-bar-brand-wordmark"></span></a></header>' +
+    '<div id="layout-body"><nav id="icon-strip" aria-label="Projects"><div class="icon-strip-projects">' + strip + '</div></nav>' +
+    '<main id="main-area" class="project-admin-overview"><div class="project-admin-canvas"><h1>' + escape(metadata.title) + '</h1>' +
+    '<div role="tablist" aria-label="Project information"><button type="button" role="tab" aria-selected="true" id="overview-tab" aria-controls="overview-panel">Overview</button><button type="button" role="tab" aria-selected="false" id="access-tab" aria-controls="access-panel">Access</button></div>' +
+    '<section id="overview-panel" role="tabpanel" aria-labelledby="overview-tab"><dl><dt>Owner</dt><dd>' + escape(metadata.ownerName) + '</dd><dt>Visibility</dt><dd>' + escape(metadata.visibility) + '</dd><dt>Status</dt><dd>' + (metadata.ownershipRecovery ? 'Ownership needs recovery' : escape(metadata.runtimeHealth)) + '</dd><dt>Your access</dt><dd>Administrative metadata only</dd></dl><p>' + escape(privacyText) + '</p><p class="project-admin-secondary">Resource usage is unavailable for this project.</p></section>' +
+    '<section id="access-panel" role="tabpanel" aria-labelledby="access-tab" hidden><h2>Administrative metadata only</h2><p>' + escape(accessText) + '</p></section></div></main></div></div>' +
+    '<script type="module" src="/modules/project-admin-overview.js"></script></body></html>';
+}
+
+module.exports = { metadataFor: metadataFor, page: page };

package/lib/project-ask-user.js

@@ -25,7 +25,7 @@ function attachAskUser(ctx) {
       respond.cancel("Autonomous mode. Make your own decision.");
       return;
     }
-    var questions = request.source === "mcp-import" ? request.questions : planningQuestions(boundSession, request.questions);
+    var questions = ["mcp-import", "product-control"].indexOf(request.source) >= 0 ? request.questions : planningQuestions(boundSession, request.questions);
     var input = { questions: questions };
     if (request.source === 'mcp-import') input.source = 'mcp-import';
     if (!boundSession.pendingAskUser) boundSession.pendingAskUser = {};
@@ -40,6 +40,8 @@ function attachAskUser(ctx) {
     boundSession.pendingAskUser[request.id] = pending;
     if (respond && typeof respond.onSettle === "function") {
       respond.onSettle(function (result) {
+        if (request.source === 'product-control' && result.status !== 'submitted') ctx.record(boundSession, { type: 'product_control_question_expired', toolId: request.id, error: 'This exact change review expired or was cancelled. No change was authorized.' });
+        if (request.source === 'mate-schedule' && result.status !== 'submitted') ctx.record(boundSession, { type: 'mate_schedule_question_expired', toolId: request.id, error: 'This schedule review expired. Request a new review.' });
         if (request.source === 'mcp-import' && result.status !== 'submitted') ctx.record(boundSession, { type: 'mcp_import_consent_expired', toolId: request.id, source: 'mcp-import', error: 'Import consent expired or was cancelled. No connection was imported.' });
         if (boundSession.pendingAskUser && boundSession.pendingAskUser[request.id] === pending) delete boundSession.pendingAskUser[request.id];
       });
@@ -48,7 +50,7 @@ function attachAskUser(ctx) {
       ctx.record(boundSession, { type: "tool_executing", id: request.id, name: "AskUserQuestion", input: input, source: request.source });
     }
     var router = ctx.getWorkerQuestionRouter && ctx.getWorkerQuestionRouter();
-    if (router && request.source !== "mcp-import") router.routeQuestion(boundSession, request, respond, function (answers, driverId) {
+    if (router && request.source !== "mcp-import" && request.source !== "mate-schedule" && request.source !== "product-control") router.routeQuestion(boundSession, request, respond, function (answers, driverId) {
       var displayAnswers = {};
       request.questions.forEach(function (question, index) { displayAnswers[index] = answers[question.id].join(", "); });
       ctx.record(boundSession, { type: "ask_user_answered", toolId: request.id, answers: displayAnswers, answeredByDriver: driverId });

package/lib/project-connection.js

@@ -3,7 +3,7 @@ var path = require("path");
 var usersModule = require("./users");
 var userPresence = require("./user-presence");
 var emailAccounts = require("./email-accounts");
-var { getCodexConfig } = require("./codex-defaults");
+var providerSettings = require("./yoke/settings");
 var yoke = require("./yoke");
 var permissionModes = require("./session-permission-mode");
 var sessionProvenance = require("./session-provenance");
@@ -217,7 +217,7 @@ function attachConnection(ctx) {
       sm.saveSessionFile(restoredActive);
     }
     var initialModels = (sm.modelsByVendor && sm.modelsByVendor[initialVendor]) || sm.availableModels || [];
-    sendTo(ws, { type: "info", cwd: cwd, slug: slug, project: title || project, version: currentVersion, debug: !!debug, dangerouslySkipPermissions: dangerouslySkipPermissions, osUsers: osUsers, lanHost: lanHost, projectCount: _filteredProjects.length, projects: _filteredProjects, projectOwnerId: projectOwnerId, ownerLocked: ownerLocked, vendors: yoke.VENDOR_REGISTRY, isMate: isMate, mateId: isMate ? mateId : null, mateDisplayName: isMate ? (mateDisplayName || title || project || "Mate") : "" });
+    sendTo(ws, { type: "info", cwd: cwd, slug: slug, project: title || project, version: currentVersion, debug: !!debug, dangerouslySkipPermissions: dangerouslySkipPermissions, osUsers: osUsers, lanHost: lanHost, projectCount: _filteredProjects.length, projects: _filteredProjects, projectOwnerId: projectOwnerId, ownerLocked: ownerLocked, vendors: require("./yoke/vendor-registry").publicInfo(), isMate: isMate, mateId: isMate ? mateId : null, mateDisplayName: isMate ? (mateDisplayName || title || project || "Mate") : "" });
     if (typeof sendCursorSharingState === "function") sendCursorSharingState(ws);
     // Update notifications are pushed on a scheduled interval (see
     // scheduleUpdateBroadcast). We no longer push on connect to avoid
@@ -234,7 +234,7 @@ function attachConnection(ctx) {
     var initialPermissionState = permissionModes.clientState(restoredActive, sm.currentPermissionMode, sm.defaultVendor);
     sendTo(ws, { type: "config_state", model: initialModelInfo.model, vendor: initialVendor, sessionId: restoredActive ? restoredActive.localId : null, mode: initialPermissionState.requestedPermissionMode, effectivePermissionMode: initialPermissionState.effectivePermissionMode, permissionCapabilities: initialPermissionState.permissionCapabilities, mcpPermissionModeOverrides: initialPermissionState.mcpPermissionModeOverrides, effort: initialEffort || "medium", betas: sm.currentBetas || [], thinking: sm.currentThinking || "adaptive", thinkingBudget: sm.currentThinkingBudget || 10000 });
     sendTo(ws, { type: "last_vendor", vendor: sm.lastVendor || "" });
-    sendTo(ws, Object.assign({ type: "codex_config" }, getCodexConfig(sm)));
+    providerSettings.messages(sm).forEach(function(message) { sendTo(ws, message); });
     sendTo(ws, { type: "term_list", terminals: tm.list() });
     // Any login flow already running in this project, so a reconnecting client
     // re-attaches to the existing login terminal instead of starting another.
@@ -301,12 +301,13 @@ function attachConnection(ctx) {
       }
       sendTo(ws, { type: "history_meta", total: total, from: fromIndex });
       for (var i = fromIndex; i < total; i++) {
-        sendTo(ws, Object.assign({}, hydrateImageRefs(active.history[i]), { _historyIndex: i }));
+        sendTo(ws, Object.assign({}, hydrateImageRefs(require("./yoke/usage").clientEvent(active.history[i], active.vendor || "claude")), { _historyIndex: i }));
       }
-      var _lastUsage = null, _lastModelUsage = null, _lastCost = null, _lastStreamInputTokens = null;
+      var _lastContext = null, _lastUsage = null, _lastModelUsage = null, _lastCost = null, _lastStreamInputTokens = null;
       for (var _ri = total - 1; _ri >= 0; _ri--) {
         if (active.history[_ri].type === "result") {
-          var _r = active.history[_ri];
+          var _r = require("./yoke/usage").clientEvent(active.history[_ri], active.vendor || "claude");
+          _lastContext = _r.context;
           _lastUsage = _r.usage || null;
           _lastModelUsage = _r.modelUsage || null;
           _lastCost = _r.cost != null ? _r.cost : null;
@@ -314,7 +315,7 @@ function attachConnection(ctx) {
           break;
         }
       }
-      sendTo(ws, { type: "history_done", lastUsage: _lastUsage, lastModelUsage: _lastModelUsage, lastCost: _lastCost, lastStreamInputTokens: _lastStreamInputTokens, contextUsage: active.lastContextUsage || null });
+      sendTo(ws, { type: "history_done", lastUsage: _lastUsage, lastModelUsage: _lastModelUsage, lastCost: _lastCost, lastStreamInputTokens: _lastStreamInputTokens, context: _lastContext, contextUsage: require("./yoke/usage").context(active.lastContextUsage, active.vendor || "claude") });
       if (scheduledMessages) scheduledMessages.sendState(active, ws);
       if (pairResultRecovery) pairResultRecovery.sendState(active, ws);
 

package/lib/project-delegated-follow-up.js

@@ -12,7 +12,7 @@ function unsafeReason(session, isPaired) {
   if (session.homeDebatePlanning || session.homeDebatePhase || session.debateSetupMode || session.debateState || session._debate) return "Debate sessions cannot receive project follow-ups.";
   if (session.loop || session.spawn || session.handoff || session.assignment || session.singleTurn || session._pairDelegation || isPaired) return "Orchestrated sessions cannot receive project follow-ups.";
   if (session.dangerouslySkipPermissions || session.permissionMode === "bypassPermissions") return "Full-access sessions cannot receive project follow-ups.";
-  if (session.destroying || session.scheduledMessage || session.rateLimitAutoContinuePending || session.taskStopRequested || session._runtimeRefreshRequested || session.pendingPush && session.pendingPush.length) return "Target session is not safely resumable right now.";
+  if (session.destroying || session.scheduledMessage || session.rateLimitAutoContinuePending || session.taskStopRequested || session._pendingMessageDrainPaused || session._runtimeRefreshRequested || session.pendingPush && session.pendingPush.length) return "Target session is not safely resumable right now.";
   return "";
 }
 
@@ -36,6 +36,7 @@ function attachDelegatedFollowUp(ctx) {
     var paired = !!(ctx.isPairedSession && ctx.isPairedSession(session));
     var reason = unsafeReason(session, paired);
     if (reason) throw new Error(reason);
+    if (ctx.isPendingQueuePaused && ctx.isPendingQueuePaused(session)) throw new Error("The Driver queue is stopped; explicit owner resume is required.");
     if (!ctx.canResumeVendor(session.vendor)) throw new Error("Target session provider cannot safely resume this conversation.");
     return { session: session, sessionRef: targetSessionRef, title: session.title || "Existing session" };
   }

package/lib/project-directory-claim.js

@@ -0,0 +1,65 @@
+// Reserve a new project directory before running Git or changing ownership.
+// Filesystem identity checks also keep failed attempts from deleting targets
+// replaced by another actor. Hostile OS/root mutation is outside this boundary.
+var fs = require("fs");
+var path = require("path");
+
+function canonical(candidate) {
+  var current = path.resolve(candidate);
+  var missing = [];
+  while (true) {
+    try { return path.join.apply(path, [fs.realpathSync(current)].concat(missing)); }
+    catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      // A dangling symlink is an existing object, not a missing directory.
+      try { fs.lstatSync(current); throw new Error("A project path contains a dangling symlink."); }
+      catch (statError) { if (statError.code !== "ENOENT") throw statError; }
+      var parent = path.dirname(current);
+      if (parent === current) throw error;
+      missing.unshift(path.basename(current));
+      current = parent;
+    }
+  }
+}
+
+function inside(root, candidate) {
+  var relative = path.relative(root, candidate);
+  return relative !== ".." && relative.indexOf(".." + path.sep) !== 0 && !path.isAbsolute(relative);
+}
+
+function rejectIntersection(target, projects, userId) {
+  (projects || []).forEach(function (project) {
+    var root = canonical(project.path);
+    if (target === root || inside(target, root) || (project.ownerId !== userId && inside(root, target))) {
+      throw new Error("The destination intersects a registered project.");
+    }
+  });
+}
+
+function claim(options) {
+  var slug = options.slug;
+  if (!slug || slug === "." || slug === ".." || path.basename(slug) !== slug) throw new Error("Invalid project directory name.");
+  var base = canonical(options.baseDir);
+  var target = path.join(base, slug);
+  rejectIntersection(target, options.projects, options.userId);
+  fs.mkdirSync(base, { recursive: true });
+  if (fs.realpathSync(options.baseDir) !== base) throw new Error("The project base directory changed.");
+  rejectIntersection(target, options.projects, options.userId);
+  // EEXIST rejects directories, files, symlinks and concurrent claims alike.
+  fs.mkdirSync(target, { mode: 0o700 });
+  var identity = fs.lstatSync(target);
+  function assertOwned() {
+    var current = fs.lstatSync(target);
+    if (!current.isDirectory() || current.isSymbolicLink() || current.dev !== identity.dev || current.ino !== identity.ino || fs.realpathSync(base) !== base) {
+      throw new Error("The claimed project directory changed.");
+    }
+  }
+  function cleanup() {
+    try { assertOwned(); } catch (error) { return false; }
+    fs.rmSync(target, { recursive: true });
+    return true;
+  }
+  return { path: target, assertOwned: assertOwned, cleanup: cleanup };
+}
+
+module.exports = { claim: claim, canonical: canonical };

package/lib/project-file-operations.js

@@ -0,0 +1,61 @@
+// Shared file-viewer effects. Authority and scope are derived by each caller.
+var fs = require('fs'), path = require('path'), crypto = require('crypto');
+var resolve = require('./project-file-path').resolveFilePath;
+function hash(content) { return crypto.createHash('sha256').update(content).digest('hex'); }
+function attachFileOperations(ctx) {
+  function list(scope, requested) {
+    var dir = resolve(ctx.cwd, requested || '.', scope);
+    var items = scope.identity ? ctx.fsAsUser('list', { dir: dir }, scope.identity) : fs.readdirSync(dir, { withFileTypes: true }).map(function (item) { return { name: item.name, isDir: item.isDirectory() }; });
+    return items.filter(function (item) { return !item.isDir || !ctx.IGNORED_DIRS.has(item.name); }).map(function (item) { return { name: item.name, type: item.isDir ? 'dir' : 'file', path: path.relative(ctx.cwd, path.join(dir, item.name)).split(path.sep).join('/') }; });
+  }
+  function read(scope, requested) {
+    var file = resolve(ctx.cwd, requested, scope), identity = scope.identity;
+    var stat = identity ? ctx.fsAsUser('stat', { file: file }, identity) : fs.statSync(file);
+    if (stat.size > ctx.FS_MAX_SIZE) return { binary: true, size: stat.size, error: 'File too large (' + (stat.size / 1024 / 1024).toFixed(1) + ' MB)' };
+    var ext = path.extname(file).toLowerCase();
+    if (ctx.BINARY_EXTS.has(ext)) {
+      var binary = { binary: true, size: stat.size };
+      if (ctx.IMAGE_EXTS.has(ext)) binary.imageUrl = 'api/file?path=' + encodeURIComponent(requested);
+      return binary;
+    }
+    return { content: identity ? ctx.fsAsUser('read', { file: file, readContent: true }, identity).content : fs.readFileSync(file, 'utf8'), size: stat.size };
+  }
+  function snapshot(scope, requested) {
+    var file = resolve(ctx.cwd, requested, scope), stat = fs.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > 65536) throw new Error('Select a regular, singly linked text file of at most 64 KB.');
+    var result = read(scope, requested);
+    if (result.binary || typeof result.content !== 'string' || result.content.indexOf('\0') >= 0) throw new Error('Binary files are unavailable for canonical editing.');
+    return { dev: stat.dev, ino: stat.ino, mode: stat.mode, uid: stat.uid, gid: stat.gid, size: stat.size, mtime: stat.mtimeMs, hash: hash(result.content) };
+  }
+  function write(scope, requested, content, control) {
+    var file = resolve(ctx.cwd, requested, scope), attempted = false;
+    if (!control) {
+      if (scope.identity) ctx.fsAsUser('write', { file: file, content: content }, scope.identity);
+      else fs.writeFileSync(file, content, 'utf8');
+      return { ok: true };
+    }
+    if (typeof fs.constants.O_NOFOLLOW !== 'number') throw new Error('Canonical editing requires no-follow file descriptors on this platform.');
+    control.revalidate();
+    if (JSON.stringify(snapshot(scope, requested)) !== JSON.stringify(control.expected)) throw new Error('The exact file revision changed.');
+    try {
+      attempted = true;
+      if (scope.identity) ctx.fsAsUser('write_exact', { file: file, content: content, expected: control.expected, root: fs.realpathSync(ctx.cwd) }, scope.identity);
+      else {
+        var fd = fs.openSync(file, fs.constants.O_RDWR | fs.constants.O_NOFOLLOW);
+        try {
+          var stat = fs.fstatSync(fd), expected = control.expected;
+          if (!stat.isFile() || stat.nlink !== 1 || stat.dev !== expected.dev || stat.ino !== expected.ino || stat.mode !== expected.mode || stat.uid !== expected.uid || stat.gid !== expected.gid || stat.size !== expected.size || stat.mtimeMs !== expected.mtime || hash(fs.readFileSync(fd, 'utf8')) !== expected.hash) throw new Error('The open file revision changed.');
+          control.revalidate();
+          fs.ftruncateSync(fd, 0);
+          var bytes = Buffer.from(content, 'utf8'), offset = 0;
+          while (offset < bytes.length) { var written = fs.writeSync(fd, bytes, offset, bytes.length - offset, offset); if (!written) throw new Error('File write made no progress.'); offset += written; }
+          fs.fsyncSync(fd);
+        } finally { fs.closeSync(fd); }
+      }
+      control.revalidate();
+      return { status: 'completed', persisted: true, path: requested };
+    } catch (error) { error.productControlResult = { persisted: attempted ? 'unknown' : false, retrySafe: false, error: error.message }; throw error; }
+  }
+  return { list: list, read: read, write: write, snapshot: snapshot };
+}
+module.exports = { attachFileOperations: attachFileOperations };

package/lib/project-filesystem.js

@@ -37,6 +37,7 @@ function attachFilesystem(ctx) {
 
   var access = ctx.requestAccess || attachRequestAccess(ctx);
   var fileHistory = attachFileHistory(ctx, access);
+  var operations = require("./project-file-operations").attachFileOperations(ctx);
 
   function handleFilesystemMessage(ws, msg) {
     var fileScope;
@@ -57,40 +58,11 @@ function attachFilesystem(ctx) {
 
     // --- fs_list ---
     if (msg.type === "fs_list") {
-      var fsListIdentity = fileScope.identity;
-      var fsDir = fileTarget;
       try {
-        var fsListUserInfo = fsListIdentity;
-        var entries = [];
-        if (fsListUserInfo) {
-          // Run as target OS user to respect Linux file permissions
-          var rawEntries = fsAsUser("list", { dir: fsDir }, fsListUserInfo);
-          for (var fi = 0; fi < rawEntries.length; fi++) {
-            var re = rawEntries[fi];
-            if (re.isDir && IGNORED_DIRS.has(re.name)) continue;
-            entries.push({
-              name: re.name,
-              type: re.isDir ? "dir" : "file",
-              path: path.relative(cwd, path.join(fsDir, re.name)).split(path.sep).join("/"),
-            });
-          }
-        } else {
-          var items = fs.readdirSync(fsDir, { withFileTypes: true });
-          for (var fi = 0; fi < items.length; fi++) {
-            var item = items[fi];
-            if (item.isDirectory() && IGNORED_DIRS.has(item.name)) continue;
-            entries.push({
-              name: item.name,
-              type: item.isDirectory() ? "dir" : "file",
-              path: path.relative(cwd, path.join(fsDir, item.name)).split(path.sep).join("/"),
-            });
-          }
-        }
-        sendTo(ws, { type: "fs_list_result", path: msg.path || ".", entries: entries });
-        // Auto-watch the directory for changes
-        startDirWatch(ws, msg.path || ".");
+        sendTo(ws, { type: 'fs_list_result', path: msg.path || '.', entries: operations.list(fileScope, msg.path || '.') });
+        startDirWatch(ws, msg.path || '.');
       } catch (e) {
-        sendTo(ws, { type: "fs_list_result", path: msg.path, entries: [], error: fileError(e).message, errorCode: fileError(e).code });
+        sendTo(ws, { type: 'fs_list_result', path: msg.path, entries: [], error: fileError(e).message, errorCode: fileError(e).code });
       }
       return true;
     }
@@ -143,62 +115,15 @@ function attachFilesystem(ctx) {
 
     // --- fs_read ---
     if (msg.type === "fs_read") {
-      var fsReadIdentity = fileScope.identity;
-      var fsFile = fileTarget;
-      try {
-        var fsReadUserInfo = fsReadIdentity;
-        var ext = path.extname(fsFile).toLowerCase();
-        if (fsReadUserInfo) {
-          // Run stat and read as target OS user
-          var statResult = fsAsUser("stat", { file: fsFile }, fsReadUserInfo);
-          if (statResult.size > FS_MAX_SIZE) {
-            sendTo(ws, { type: "fs_read_result", path: msg.path, requestId: msg.requestId, projectSlug: msg.projectSlug, sessionId: msg.sessionId, accountId: msg.accountId, binary: true, size: statResult.size, error: "File too large (" + (statResult.size / 1024 / 1024).toFixed(1) + " MB)" });
-            return true;
-          }
-          if (BINARY_EXTS.has(ext)) {
-            var result = { type: "fs_read_result", path: msg.path, requestId: msg.requestId, projectSlug: msg.projectSlug, sessionId: msg.sessionId, accountId: msg.accountId, binary: true, size: statResult.size };
-            if (IMAGE_EXTS.has(ext)) result.imageUrl = "api/file?path=" + encodeURIComponent(msg.path);
-            sendTo(ws, result);
-            return true;
-          }
-          var readResult = fsAsUser("read", { file: fsFile, readContent: true }, fsReadUserInfo);
-          sendTo(ws, { type: "fs_read_result", path: msg.path, requestId: msg.requestId, projectSlug: msg.projectSlug, sessionId: msg.sessionId, accountId: msg.accountId, content: readResult.content, size: statResult.size });
-        } else {
-          var stat = fs.statSync(fsFile);
-          if (stat.size > FS_MAX_SIZE) {
-            sendTo(ws, { type: "fs_read_result", path: msg.path, requestId: msg.requestId, projectSlug: msg.projectSlug, sessionId: msg.sessionId, accountId: msg.accountId, binary: true, size: stat.size, error: "File too large (" + (stat.size / 1024 / 1024).toFixed(1) + " MB)" });
-            return true;
-          }
-          if (BINARY_EXTS.has(ext)) {
-            var result = { type: "fs_read_result", path: msg.path, requestId: msg.requestId, projectSlug: msg.projectSlug, sessionId: msg.sessionId, accountId: msg.accountId, binary: true, size: stat.size };
-            if (IMAGE_EXTS.has(ext)) result.imageUrl = "api/file?path=" + encodeURIComponent(msg.path);
-            sendTo(ws, result);
-            return true;
-          }
-          var content = fs.readFileSync(fsFile, "utf8");
-          sendTo(ws, { type: "fs_read_result", path: msg.path, requestId: msg.requestId, projectSlug: msg.projectSlug, sessionId: msg.sessionId, accountId: msg.accountId, content: content, size: stat.size });
-        }
-      } catch (e) {
-        sendTo(ws, { type: "fs_read_result", path: msg.path, requestId: msg.requestId, projectSlug: msg.projectSlug, sessionId: msg.sessionId, accountId: msg.accountId, error: fileError(e).message, errorCode: fileError(e).code });
-      }
+      var metadata = { type: 'fs_read_result', path: msg.path, requestId: msg.requestId, projectSlug: msg.projectSlug, sessionId: msg.sessionId, accountId: msg.accountId };
+      try { sendTo(ws, Object.assign(metadata, operations.read(fileScope, msg.path))); }
+      catch (e) { sendTo(ws, Object.assign(metadata, { error: fileError(e).message, errorCode: fileError(e).code })); }
       return true;
     }
 
-    // --- fs_write ---
-    if (msg.type === "fs_write") {
-      var fsWriteIdentity = fileScope.identity;
-      var fsWriteFile = fileTarget;
-      try {
-        var fsWriteUserInfo = fsWriteIdentity;
-        if (fsWriteUserInfo) {
-          fsAsUser("write", { file: fsWriteFile, content: msg.content || "" }, fsWriteUserInfo);
-        } else {
-          fs.writeFileSync(fsWriteFile, msg.content || "", "utf8");
-        }
-        sendTo(ws, { type: "fs_write_result", path: msg.path, ok: true });
-      } catch (e) {
-        sendTo(ws, { type: "fs_write_result", path: msg.path, ok: false, error: fileError(e).message, errorCode: fileError(e).code });
-      }
+    if (msg.type === 'fs_write') {
+      try { sendTo(ws, Object.assign({ type: 'fs_write_result', path: msg.path }, operations.write(fileScope, msg.path, msg.content || ''))); }
+      catch (e) { sendTo(ws, { type: 'fs_write_result', path: msg.path, ok: false, error: fileError(e).message, errorCode: fileError(e).code }); }
       return true;
     }
 
@@ -239,8 +164,8 @@ function attachFilesystem(ctx) {
         var setResult;
         try { setResult = opts.onSetProjectEnv(targetSlug, msg.envrc || ""); }
         catch (error) { sendTo(ws, { type: "set_project_env_result", slug: targetSlug, requestId: msg.requestId, ok: false, error: error.message }); return true; }
-        if (setResult.ok) onEnvironmentChanged();
-        sendTo(ws, { type: "set_project_env_result", ok: setResult.ok, slug: targetSlug, requestId: msg.requestId, error: setResult.error, timing: setResult.ok ? "Applies to newly created coding-agent processes. Active processes keep their current environment." : undefined });
+        if (setResult.ok && !setResult.runtimeRefreshed) onEnvironmentChanged();
+        sendTo(ws, Object.assign({}, setResult, { type: "set_project_env_result", slug: targetSlug, requestId: msg.requestId, timing: setResult.ok ? "Applies to newly created coding-agent processes. Active processes keep their current environment." : undefined }));
       } else {
         sendTo(ws, { type: "set_project_env_result", slug: targetSlug, requestId: msg.requestId, ok: false, error: "Not supported" });
       }
@@ -297,6 +222,7 @@ function attachFilesystem(ctx) {
 
   return {
     handleFilesystemMessage: handleFilesystemMessage,
+    productOperations: operations,
   };
 }
 

package/lib/project-full-access.js

@@ -16,7 +16,7 @@ function createFullAccessService(ctx) {
       enabled: session.permissionMode === "bypassPermissions" };
   }
   function persist(session) {
-    sm.saveSessionFile(session);
+    if (sm.saveSessionFile(session) === false) throw new Error("Could not persist permission mode.");
     sm.broadcastSessionList();
     if (typeof sm.sendToSession === "function") sm.sendToSession(session, { type: "session_full_access_changed", id: session.localId,
       enabled: session.permissionMode === "bypassPermissions", permissionMode: session.permissionMode });
@@ -55,7 +55,28 @@ function createFullAccessService(ctx) {
       throw error;
     }
   }
-  function setMode(session, mode) { return serialize(session, function () { return applyMode(session, mode); }); }
+  function setMode(session, mode, options) {
+    return serialize(session, function () {
+      if (!options || typeof options.revalidate !== "function") return applyMode(session, mode);
+      options.revalidate();
+      var observed = { revision: Number(session._permissionObservationRevision || 0), mode: session.effectivePermissionMode, reason: session.permissionModeFallbackReason };
+      return require("./session-config-transition").applySessionConfig({
+        sm: sm, session: session, revalidate: options.revalidate, method: "setPermissionMode", nativeValue: mode === "bypassPermissions" ? "default" : mode,
+        changes: function () {
+          var newer = Number(session._permissionObservationRevision || 0) !== observed.revision || session.effectivePermissionMode !== observed.mode || session.permissionModeFallbackReason !== observed.reason;
+          return { permissionMode: mode, permissionModeBeforeFullAccess: mode === "bypassPermissions" ? (session.permissionMode || sm.currentPermissionMode || "default") : null,
+            effectivePermissionMode: newer ? session.effectivePermissionMode : null, permissionModeFallbackReason: newer ? session.permissionModeFallbackReason : null };
+        },
+        publish: function () {
+          sm.broadcastSessionList();
+          if (typeof sm.sendToSession === "function") {
+            sm.sendToSession(session, { type: "session_full_access_changed", id: session.localId, enabled: mode === "bypassPermissions", permissionMode: mode });
+            sm.sendToSession(session, { type: "config_state", sessionId: session.localId, mode: mode, effectivePermissionMode: session.effectivePermissionMode || null, vendor: session.vendor || sm.defaultVendor || "claude" });
+          }
+        },
+      });
+    });
+  }
   function setEnabled(session, enabled) {
     return serialize(session, function () {
       return applyMode(session, enabled ? "bypassPermissions" : (session.permissionModeBeforeFullAccess || "default"));

package/lib/project-http.js

@@ -419,9 +419,9 @@ function attachHTTP(ctx) {
         var uninstallUserInfo = getOsUserInfoForReq(req);
         var baseDir = scope === "global" ? (uninstallUserInfo ? uninstallUserInfo.home : require("./config").REAL_HOME) : cwd;
         if (osUsers && !uninstallUserInfo) throw new Error("A mapped OS user is required to uninstall skills");
-        var skillDir = claySkillStorage.isClaySkill(skill) ? path.join(claySkillStorage.privateRoot(baseDir), skill) : path.join(baseDir, ".claude", "skills", skill);
+        var skillDir = claySkillStorage.isClaySkill(skill) ? path.join(claySkillStorage.privateRoot(baseDir), skill) : path.join(require("./yoke/source-locations").legacySkillRoot(baseDir), skill);
         // Safety: keep removal inside the selected skill storage root.
-        var expectedParent = claySkillStorage.isClaySkill(skill) ? claySkillStorage.privateRoot(baseDir) : path.join(baseDir, ".claude", "skills");
+        var expectedParent = claySkillStorage.isClaySkill(skill) ? claySkillStorage.privateRoot(baseDir) : require("./yoke/source-locations").legacySkillRoot(baseDir);
         var resolved = path.resolve(skillDir);
         if (!resolved.startsWith(expectedParent + path.sep)) {
           res.writeHead(403, { "Content-Type": "application/json" });
@@ -528,8 +528,8 @@ function attachHTTP(ctx) {
           var sui = getOsUserInfoForReq(req);
           return sui ? sui.home : require("./config").REAL_HOME;
         })();
-        var globalSkillsDir = path.join(skillUserHome, ".claude", "skills");
-        var projectSkillsDir = path.join(cwd, ".claude", "skills");
+        var globalSkillsDir = require("./yoke/source-locations").legacySkillRoot(skillUserHome);
+        var projectSkillsDir = require("./yoke/source-locations").legacySkillRoot(cwd);
         var results = [];
         var pending = skills.length;
 

package/lib/project-knowledge.js

@@ -44,21 +44,30 @@ function attachKnowledge(ctx) {
     return { type: user ? "user" : "system", userId: user ? user.id : null, displayName: user ? (user.displayName || user.username) : null };
   }
 
-  function mirror(ws, name) {
+  function mirrorActor(who, name) {
     if (!isMate) return { ok: true, names: [] };
-    var summary = mateSync.syncMateSource({ mateDir: cwd, fileName: name, baseDir: ctx.knowledgeBaseDir, actor: actor(ws) });
+    var summary = mateSync.syncMateSource({ mateDir: cwd, fileName: name, baseDir: ctx.knowledgeBaseDir, actor: who });
     return { ok: !!summary && summary.failed === 0, names: [name], error: summary && summary.errors[0] ? summary.errors[0].message : "Knowledge index synchronization failed." };
   }
 
-  function mirrorMany(ws, names) {
+  function mirror(ws, name) { return mirrorActor(actor(ws), name); }
+
+  function mirrorManyActor(who, names) {
     var failures = [];
     for (var i = 0; i < names.length; i++) {
-      var mirrored = mirror(ws, names[i]);
+      var mirrored = mirrorActor(who, names[i]);
       if (!mirrored.ok) failures.push(mirrored.error);
     }
     return { ok: failures.length === 0, names: names.slice(), error: failures[0] || null };
   }
 
+  function mirrorMany(ws, names) { return mirrorManyActor(actor(ws), names); }
+
+  function controlMirror(who, names) {
+    try { var state = mirrorManyActor(who, names); return { indexSyncPending: !state.ok, syncNames: names, syncError: state.ok ? null : state.error }; }
+    catch (error) { return { indexSyncPending: true, syncNames: names, syncError: error.message }; }
+  }
+
   function addSyncState(payload, sync) {
     if (sync.ok) return payload;
     return Object.assign(payload, { indexSyncPending: true, syncNames: sync.names, syncError: sync.error });
@@ -188,6 +197,22 @@ function attachKnowledge(ctx) {
     return databaseReady.then(function () { return combineSearch(databases.listCached({})); });
   }
 
+  function renameDocument(msg, who) {
+    var beforeMoveState = documentIndex(); var beforeMove = beforeMoveState.documents; var moveTarget = findDocument(beforeMove, msg.from, msg.documentId); var linkChanges = moveTarget ? rewriteMoveLinks(beforeMove, moveTarget, msg.name) : [];
+    var renamed = files.rename(msg.from, msg.name, msg.expectedRevision || null); var linkUpdateFailures = []; var updatedLinks = 0;
+    var updatedDocuments = []; var mirrorNames = [msg.from, renamed.name];
+    for (var u = 0; u < linkChanges.length; u++) {
+      var change = linkChanges[u]; var writeName = change.id === renamed.id ? renamed.name : change.name; var expected = change.id === renamed.id ? renamed.revision : change.revision;
+      try { var rewritten = files.save(writeName, change.content, expected); updatedLinks += change.count; updatedDocuments.push(rewritten); mirrorNames.push(rewritten.name); }
+      catch (linkError) { linkUpdateFailures.push({ name: writeName, error: linkError.message }); }
+    }
+    renamed = files.read(renamed.name);
+    var uniqueMirrorNames = mirrorNames.filter(function (name, at) { return mirrorNames.indexOf(name) === at; }); var renameSync = mirrorManyActor(who, uniqueMirrorNames);
+    return addSyncState({ type: "knowledge_renamed", id: renamed.id, from: msg.from, name: renamed.name, revision: renamed.revision,
+      content: renamed.content, updatedLinks: updatedLinks, linkUpdateFailures: linkUpdateFailures,
+      updatedDocuments: updatedDocuments.map(function (item) { return { id: item.id, name: item.name, content: item.content, revision: item.revision }; }) }, renameSync);
+  }
+
   function handleKnowledgeMessage(ws, msg) {
     if (msg.type === "knowledge_list") {
       try { var listed = listKnowledgeItems(ws); if (listed && typeof listed.then === "function") listed.then(function (items) { response(ws, msg, { type: "knowledge_list", files: items, drafts: drafts.list(ws && ws._clayUser && ws._clayUser.id || "system") }); }).catch(function (error) { failure(ws, msg, error); }); else response(ws, msg, { type: "knowledge_list", files: listed, drafts: drafts.list(ws && ws._clayUser && ws._clayUser.id || "system") }); } catch (error) { failure(ws, msg, error); }
@@ -236,19 +261,7 @@ function attachKnowledge(ctx) {
     if (msg.type === "knowledge_rename") {
       if (!requireWrite(ws, msg)) return true;
       try {
-        var beforeMoveState = documentIndex(); var beforeMove = beforeMoveState.documents; var moveTarget = findDocument(beforeMove, msg.from, msg.documentId); var linkChanges = moveTarget ? rewriteMoveLinks(beforeMove, moveTarget, msg.name) : [];
-        var renamed = files.rename(msg.from, msg.name, msg.expectedRevision || null); var linkUpdateFailures = []; var updatedLinks = 0;
-        var updatedDocuments = []; var mirrorNames = [msg.from, renamed.name];
-        for (var u = 0; u < linkChanges.length; u++) {
-          var change = linkChanges[u]; var writeName = change.id === renamed.id ? renamed.name : change.name; var expected = change.id === renamed.id ? renamed.revision : change.revision;
-          try { var rewritten = files.save(writeName, change.content, expected); updatedLinks += change.count; updatedDocuments.push(rewritten); mirrorNames.push(rewritten.name); }
-          catch (linkError) { linkUpdateFailures.push({ name: writeName, error: linkError.message }); }
-        }
-        renamed = files.read(renamed.name);
-        var uniqueMirrorNames = mirrorNames.filter(function (name, at) { return mirrorNames.indexOf(name) === at; }); var renameSync = mirrorMany(ws, uniqueMirrorNames);
-        response(ws, msg, addSyncState({ type: "knowledge_renamed", id: renamed.id, from: msg.from, name: renamed.name, revision: renamed.revision,
-          content: renamed.content, updatedLinks: updatedLinks, linkUpdateFailures: linkUpdateFailures,
-          updatedDocuments: updatedDocuments.map(function (item) { return { id: item.id, name: item.name, content: item.content, revision: item.revision }; }) }, renameSync));
+        response(ws, msg, renameDocument(msg, actor(ws)));
         sendTo(ws, { type: "knowledge_list", files: listKnowledgeFiles() });
       } catch (error) { failure(ws, msg, error); }
       return true;
@@ -357,7 +370,8 @@ function attachKnowledge(ctx) {
     return false;
   }
 
-  return { handleKnowledgeMessage: handleKnowledgeMessage, listKnowledgeFiles: listKnowledgeFiles, databases: databases };
+  var productOperations = require('./knowledge-product-operations').createKnowledgeProductOperations({ files: files, mirror: controlMirror, rename: renameDocument });
+  return { productOperations: productOperations, handleKnowledgeMessage: handleKnowledgeMessage, listKnowledgeFiles: listKnowledgeFiles, databases: databases };
 }
 
 module.exports = { attachKnowledge: attachKnowledge };