clay-server 5.2.0-beta.5 → 5.2.0-beta.6

package/lib/mcp-source-context.js

@@ -1,42 +1 @@
-var path = require('path');
-var crypto = require('crypto');
-var adapters = require('./mcp-source-adapters').adapters;
-var KEYS = ['CODEX_HOME', 'CLAUDE_CONFIG_DIR', 'OPENCODE_CONFIG', 'OPENCODE_CONFIG_DIR', 'OPENCODE_CONFIG_CONTENT', 'XDG_CONFIG_HOME', 'KIMI_CODE_HOME', 'COPILOT_HOME', 'GROK_HOME', 'QWEN_HOME', 'QWEN_CODE_SYSTEM_SETTINGS_PATH', 'QWEN_CODE_SYSTEM_DEFAULTS_PATH'];
-function resolve(ctx, owner, ws, home, identity) {
-  // Only the production runtime resolver may supply mapped-user overrides.
-  var env = ctx.runtimeEnv ? ctx.runtimeEnv(owner, ws) : identity ? {} : ctx.home ? {} : process.env;
-  var selected = {};
-  KEYS.forEach(function (key) { if (env[key] !== undefined) selected[key] = env[key]; });
-  function qwenRoot(value) { if (!value) return path.join(home, '.qwen'); return path.resolve(ctx.cwd, value.replace(/^~(?=\/|$)/, home)); }
-  var roots = { copilot: path.resolve(home, env.COPILOT_HOME || '.copilot'), grok: path.resolve(home, env.GROK_HOME || '.grok'), qwen: qwenRoot(env.QWEN_HOME), codex: path.resolve(home, env.CODEX_HOME || '.codex'), claude: path.resolve(home, env.CLAUDE_CONFIG_DIR || '.claude'),
-    opencode: path.resolve(home, env.XDG_CONFIG_HOME || '.config', 'opencode'), kimi: path.resolve(home, env.KIMI_CODE_HOME || '.kimi-code') };
-  var sources = [];
-  function add(vendor, file, scope, extra) { sources.push(Object.assign({ vendor: vendor, file: file, scope: scope, cwd: ctx.cwd }, extra)); }
-  Object.keys(adapters).forEach(function (vendor) {
-    var files = adapters[vendor].user;
-    if (vendor === 'codex') files = [path.join(roots.codex, 'config.toml')];
-    if (vendor === 'claude') files = [env.CLAUDE_CONFIG_DIR ? path.join(roots.claude, '.claude.json') : path.join(home, '.claude.json')];
-    if (vendor === 'opencode') files = ['opencode.json', 'opencode.jsonc'].map(function (file) { return path.join(roots.opencode, file); });
-    if (vendor === 'copilot') files = [path.join(roots.copilot, 'mcp-config.json')];
-    if (vendor === 'grok') files = [path.join(roots.grok, 'config.toml')];
-    if (vendor === 'qwen') files = [path.join(roots.qwen, 'settings.json')];
-    if (vendor === 'kimi' && env.KIMI_CODE_HOME) files = [path.join(roots.kimi, 'mcp.json')];
-    files.forEach(function (file) { add(vendor, path.resolve(home, file), 'user'); });
-    adapters[vendor].project.forEach(function (file) { add(vendor, path.join(ctx.cwd, file), 'project'); });
-  });
-  ['opencode.json', 'opencode.jsonc'].forEach(function (file) { add('opencode', path.join(ctx.cwd, '.opencode', file), 'runtime', { configDirectory: true }); });
-  if (env.OPENCODE_CONFIG) add('opencode', path.resolve(ctx.cwd, env.OPENCODE_CONFIG), 'runtime');
-  if (env.OPENCODE_CONFIG_DIR) ['opencode.json', 'opencode.jsonc'].forEach(function (file) { add('opencode', path.resolve(ctx.cwd, env.OPENCODE_CONFIG_DIR, file), 'runtime', { configDirectory: true }); });
-  if (env.OPENCODE_CONFIG_CONTENT) add('opencode', 'runtime:OPENCODE_CONFIG_CONTENT', 'runtime-inline', { inline: env.OPENCODE_CONFIG_CONTENT });
-  return { roots: roots, policyPaths: { qwenSettings: env.QWEN_CODE_SYSTEM_SETTINGS_PATH && path.resolve(ctx.cwd, env.QWEN_CODE_SYSTEM_SETTINGS_PATH), qwenDefaults: env.QWEN_CODE_SYSTEM_DEFAULTS_PATH && path.resolve(ctx.cwd, env.QWEN_CODE_SYSTEM_DEFAULTS_PATH) }, sources: sources, fingerprint: crypto.createHash('sha256').update(JSON.stringify(selected)).digest('hex') };
-}
-function priority(source) {
-  if (source.scope === 'runtime-inline') return 80;
-  if (source.scope === 'configured') return 70;
-  if (source.scope === 'runtime') return source.configDirectory ? 65 : 30;
-  if (source.scope === 'local') return 60;
-  if (source.scope === 'project') return 50 + (source.vendor === 'copilot' && path.basename(source.file) === '.mcp.json' ? 1 : 0);
-  if (source.scope === 'project-ancestor') return 40 + source.file.split(path.sep).length * 0.01 + (path.basename(source.file) === '.mcp.json' ? 0.001 : 0);
-  return source.scope.indexOf('plugin') === 0 ? 10 : 20;
-}
-module.exports = { resolve: resolve, priority: priority };
+module.exports = require("./yoke/mcp-source-context");

package/lib/mcp-source-discovery.js

@@ -1,169 +1 @@
-var fs = require('fs');
-var path = require('path');
-var os = require('os');
-var crypto = require('crypto');
-var adapters = require('./mcp-source-adapters');
-var sourceContext = require('./mcp-source-context');
-var restrictions = require('./mcp-source-restrictions');
-var fsAsUser = require('./os-users').fsAsUser;
-function createDiscovery(ctx) {
-  var scans = new Map(), publicScans = new Map();
-  function read(file, identity) {
-    if (identity) {
-      var stat = fsAsUser('stat', { file: file }, identity);
-      if (stat.size > 2 * 1024 * 1024 || stat.isDir) throw new Error('Source exceeds size limit.');
-      return fsAsUser('read', { file: file, readContent: true }, identity).content;
-    }
-    var info = fs.statSync(file);
-    if (!info.isFile() || info.size > 2 * 1024 * 1024) throw new Error('Source exceeds size limit.');
-    return fs.readFileSync(file, 'utf8');
-  }
-  function list(directory, identity) {
-    try { return identity ? fsAsUser('list', { dir: directory }, identity) : fs.readdirSync(directory, { withFileTypes: true }).map(function (entry) { return { name: entry.name, isDir: entry.isDirectory() }; }); }
-    catch (error) { return []; }
-  }
-  function scan(owner, ws, explicit) {
-    ctx.authorize(owner, ws);
-    var identity = ctx.identity(ws), home = identity ? identity.home : ctx.home || os.homedir();
-    var context = sourceContext.resolve(ctx, owner, ws, home, identity);
-    var rows = [], diagnostics = [], sources = context.sources, files = new Map(), directories = new Map();
-    function listing(directory) { var entries = list(directory, identity); directories.set(directory, JSON.stringify(entries.slice().sort(function (left, right) { return left.name.localeCompare(right.name); }))); return entries; }
-    function source(vendor, file, scope, pluginRoot, extra) { sources.push(Object.assign({ vendor: vendor, file: file, scope: scope, cwd: ctx.cwd, pluginRoot: pluginRoot }, extra)); }
-    Object.keys(adapters.adapters).forEach(function (vendor) {
-      var adapter = adapters.adapters[vendor];
-      if (adapter.agents) [home, ctx.cwd].forEach(function (base) {
-        var directory = path.join(base, adapter.agents);
-        listing(directory).slice(0, 100).forEach(function (entry) { if (!entry.isDir && /\.(json|md)$/.test(entry.name)) source(vendor, path.join(directory, entry.name), 'agent'); });
-      });
-      if (adapter.plugins) {
-        var directory = path.join(home, adapter.plugins);
-        listing(directory).slice(0, 100).forEach(function (entry) { if (entry.isDir) source(vendor, path.join(directory, entry.name, 'mcp_config.json'), 'plugin', path.join(directory, entry.name), { blocked: 'This plugin has no locally resolved activation registry. Review its active configuration before importing.' }); });
-      }
-    });
-    // Copilot reads nearer project definitions before ancestors up to the Git root.
-    var parents = [], repository = false;
-    var currentDirectory = ctx.cwd;
-    while (true) {
-      try { if (identity) fsAsUser('stat', { file: path.join(currentDirectory, '.git') }, identity); else fs.statSync(path.join(currentDirectory, '.git')); repository = true; break; } catch (error) {}
-      var parent = path.dirname(currentDirectory);
-      if (parent === currentDirectory) break;
-      parents.push(parent); currentDirectory = parent;
-    }
-    if (repository) parents.forEach(function (directory) {
-      source('copilot', path.join(directory, '.mcp.json'), 'project-ancestor');
-      source('copilot', path.join(directory, '.github/mcp.json'), 'project-ancestor');
-    });
-    diagnostics.push({ vendor: 'all', scope: 'plugins', message: 'Remote bundles are not downloaded. Unresolved installed plugin activation and local managed policies block import; credentials and vendor OAuth stores are never inspected.' });
-    if (explicit) {
-      if (!adapters.adapters[explicit.vendor] || typeof explicit.file !== 'string' || !path.isAbsolute(explicit.file)) throw new Error('Choose a supported format and an absolute source file path.');
-      source(explicit.vendor, explicit.file, 'configured');
-    }
-    function load(file) {
-      if (files.has(file)) { var cached = files.get(file); if (cached.error) throw cached.error; return cached.value; }
-      try {
-        var content = read(file, identity), value = adapters.parse(file, content);
-        files.set(file, { value: value, digest: crypto.createHash('sha256').update(content).digest('hex') }); return value;
-      } catch (error) { files.set(file, { error: error, digest: null }); throw error; }
-    }
-    require('./mcp-source-plugins').discover({ load: load, source: source, list: listing, roots: context.roots, cwd: ctx.cwd, diagnostics: diagnostics });
-    var blockedVendors = restrictions.inspect({ load: load, roots: context.roots, policyPaths: context.policyPaths, cwd: ctx.cwd, home: home, username: identity ? identity.username : process.env.USER });
-    var openCodeTools = {}, openCodeDefinitions = {};
-    function collect(source, definitions, root) {
-      if (!definitions || typeof definitions !== 'object') return;
-      var names = Array.isArray(definitions) ? definitions.map(function (definition) { return definition.name; }) : Object.keys(definitions);
-      names.slice(0, 100).forEach(function (name, index) {
-        if (typeof name !== 'string' || !name || name.length > 100) return;
-        try {
-          var definition = Array.isArray(definitions) ? definitions[index] : definitions[name];
-          if (source.vendor === 'opencode') {
-            definition = Object.assign({}, openCodeDefinitions[name] || {}, definition);
-            openCodeDefinitions[name] = definition;
-          }
-          if (source.overrides && source.overrides[name]) definition = Object.assign({}, definition, source.overrides[name]);
-          var provenance = Object.assign({}, source); delete provenance.inline; delete provenance.overrides;
-          var config = adapters.normalize(source.vendor, name, definition, provenance);
-          var blocked = source.blocked || blockedVendors[source.vendor];
-          if (root && Object.keys(root).some(function (key) { return restrictions.securityKey(key); })) blocked = 'This source contains runtime or agent restrictions Clay cannot resolve. Review its effective policy before importing.';
-          if (root && root.tools !== undefined && source.vendor !== 'opencode') blocked = 'This source contains runtime tool restrictions Clay cannot resolve. Review its effective policy before importing.';
-          var known = ['type', 'transport', 'command', 'args', 'env', 'environment', 'cwd', 'url', 'httpUrl', 'serverUrl', 'headers', 'http_headers', 'env_http_headers', 'bearer_token_env_var', 'bearerTokenEnvVar', 'includeTools', 'excludeTools', 'env_vars', 'enabled', 'disabled', 'autoApprove', 'disabledTools', 'disabled_tools', 'enabledTools', 'enabled_tools', 'timeout', 'startup_timeout_sec', 'tool_timeout_sec', 'oauth', 'oauthScopes', 'trust', 'name', 'description', 'tools', 'startupTimeoutMs'];
-          var unknown = Object.keys(definition).filter(function (key) { return known.indexOf(key) < 0; });
-          if (unknown.length) blocked = 'Unrecognized server fields require deliberate review in a direct Clay connection: ' + unknown.slice(0, 10).join(', ');
-          if (unknown.length) diagnostics.push({ vendor: source.vendor, scope: source.scope, name: name, message: 'Unrecognized fields are not imported: ' + unknown.slice(0, 10).join(', ') });
-          var hash = adapters.signature(config);
-          rows.push({ id: crypto.randomUUID(), name: name, config: config, signature: hash, blocked: blocked });
-        } catch (error) { diagnostics.push({ vendor: source.vendor, scope: source.scope, name: name, message: error.message }); }
-      });
-    }
-    if (sources.length > 500) diagnostics.push({ vendor: 'all', scope: 'discovery', message: 'Source limit reached; inspect additional files individually.' });
-    sources.sort(function (left, right) { return sourceContext.priority(left) - sourceContext.priority(right); });
-    sources.slice(0, 500).forEach(function (source) {
-      try {
-        var value = source.inline ? adapters.parse('inline.json', source.inline) : load(source.file), adapter = adapters.adapters[source.vendor];
-        if (Object.keys(value).some(function (key) { return restrictions.securityKey(key); })) blockedVendors[source.vendor] = 'A configuration layer contains unresolved security restrictions. Review the effective vendor policy before importing.';
-        if (source.vendor === 'opencode' && value.agent && Object.keys(value.agent).some(function (name) { return Object.keys(value.agent[name] || {}).some(function (key) { return restrictions.securityKey(key) || key === 'tools'; }); })) blockedVendors.opencode = 'OpenCode agent-specific restrictions require review. Configure a direct Clay connection with the intended restrictions.';
-        collect(source, source.scope === 'plugin-inline' ? value.mcpServers : value[adapter.key] || (source.vendor === 'codex' && !source.file.endsWith('.toml') ? value.mcpServers || value : source.vendor === 'copilot' || source.scope === 'plugin' ? value : null), value);
-        if (source.vendor === 'opencode' && value.tools !== undefined) {
-          if (!value.tools || typeof value.tools !== 'object' || Array.isArray(value.tools) || Object.values(value.tools).some(function (enabled) { return typeof enabled !== 'boolean'; })) blockedVendors.opencode = 'Invalid OpenCode tool policy. Review the runtime configuration before importing.';
-          else Object.assign(openCodeTools, value.tools);
-        }
-        if (source.vendor === 'claude' && source.scope === 'user' && value.projects && value.projects[ctx.cwd]) collect(Object.assign({}, source, { scope: 'local' }), value.projects[ctx.cwd].mcpServers, value.projects[ctx.cwd]);
-      } catch (error) {
-        if (error.code !== 'ENOENT' && !(identity && /ENOENT|no such file/i.test(error.message))) diagnostics.push({ vendor: source.vendor, scope: source.scope, message: 'Could not read or parse source; check permissions and format.' });
-      }
-    });
-    rows.forEach(function (row) {
-      var source = row.config.provenance;
-      row.blocked = row.blocked || blockedVendors[source.vendor];
-      if (source.vendor === 'opencode') {
-        row.config.toolPrefix = row.name + '_';
-        row.config.toolPatterns = Object.keys(openCodeTools).filter(function (pattern) { return openCodeTools[pattern] === false; });
-        row.signature = adapters.signature(row.config);
-      }
-      var effective = rows.filter(function (other) { return other.name === row.name && other.config.provenance.vendor === source.vendor && other.config.provenance.scope !== 'agent' && other.config.provenance.scope.indexOf('plugin') !== 0; }).pop();
-      if (source.scope !== 'agent' && source.scope.indexOf('plugin') !== 0 && effective && effective !== row) row.blocked = 'Shadowed by the effective ' + effective.config.provenance.scope + ' source. Import that definition instead.';
-    });
-    var current = ctx.snapshot(owner);
-    rows.forEach(function (row) {
-      var same = rows.filter(function (other) { return other !== row && (other.name === row.name || row.config.url && other.config.url === row.config.url); });
-      row.duplicate = rows.some(function (other) { return other !== row && other.signature === row.signature; });
-      row.conflict = same.some(function (other) { return other.signature !== row.signature; });
-      row.imported = current.records.some(function (saved) { return saved.importSignature === row.signature || row.config.url && saved.url === row.config.url; });
-    });
-    var scanId = crypto.randomUUID();
-    scans.set(owner, { id: scanId, ws: ws, rows: rows, files: files, directories: directories, identity: identity, revision: current.revision, context: context.fingerprint, home: home, created: Date.now() });
-    var publicScan = { scanId: scanId, candidates: rows.map(function (row) {
-      return { id: row.id, name: row.name, vendor: row.config.provenance.vendor, scope: row.config.provenance.scope, file: row.config.provenance.file,
-        blocked: row.blocked || null, pluginName: row.config.provenance.pluginName, pluginVersion: row.config.provenance.pluginVersion, transport: row.config.transport, dependency: row.config.command ? (/^[a-zA-Z0-9_./\\-]+$/.test(row.config.command) ? path.basename(row.config.command) : 'Configured executable') : new URL(row.config.url).hostname,
-        references: require('./mcp-import-credentials').requiredNames(row.config), environmentNames: row.config.environmentNames, sourceEnabled: row.config.sourceEnabled,
-        duplicate: row.duplicate, conflict: row.conflict, imported: row.imported };
-    }), diagnostics: diagnostics };
-    publicScans.set(owner, publicScan); return publicScan;
-  }
-  function selected(owner, ws, msg) {
-    ctx.authorize(owner, ws);
-    var scan = scans.get(owner);
-    if (!scan || scan.ws !== ws || scan.id !== msg.scanId || Date.now() - scan.created > 10 * 60 * 1000) throw new Error('Discovery expired. Scan again.');
-    if (JSON.stringify(ctx.identity(ws)) !== JSON.stringify(scan.identity)) throw new Error('OS identity changed. Scan again.');
-    if (sourceContext.resolve(ctx, owner, ws, scan.home, scan.identity).fingerprint !== scan.context) throw new Error('Runtime configuration changed. Scan again.');
-    scan.directories.forEach(function (state, directory) {
-      var entries = list(directory, scan.identity).slice().sort(function (left, right) { return left.name.localeCompare(right.name); });
-      if (JSON.stringify(entries) !== state) throw new Error('Installed source selection changed. Scan again.');
-    });
-    scan.files.forEach(function (state, file) {
-      var hash = null;
-      try { hash = crypto.createHash('sha256').update(read(file, scan.identity)).digest('hex'); } catch (error) {
-        if (!state.error || (error.code || error.message) !== (state.error.code || state.error.message)) throw new Error('Vendor configuration changed. Scan again.');
-      }
-      if (hash !== state.digest) throw new Error('Vendor configuration changed. Scan again.');
-    });
-    var row = scan.rows.find(function (candidate) { return candidate.id === msg.candidateId; });
-    if (row && row.blocked) throw new Error(row.blocked);
-    if (!row || row.imported) throw new Error('Source is unavailable or already imported.');
-    return { config: JSON.parse(JSON.stringify(row.config)), signature: row.signature, revision: scan.revision };
-  }
-  return { scan: scan, selected: selected, candidate: function (owner, subject, args) {
-    selected(owner, subject, args);
-    return publicScans.get(owner).candidates.find(function (row) { return row.id === args.candidateId; });
-  }, destroy: function () { scans.clear(); publicScans.clear(); } };
-}
-module.exports = { createDiscovery: createDiscovery };
+module.exports = require("./yoke/mcp-source-discovery");

package/lib/mcp-source-plugins.js

@@ -1,68 +1 @@
-var path = require('path');
-function discover(ctx) {
-  var load = ctx.load, source = ctx.source, list = ctx.list, roots = ctx.roots;
-  function optional(file) { try { return load(file); } catch (error) { return {}; } }
-  var enabled = {};
-  var settingsFiles = [path.join(roots.claude, 'settings.json'), path.join(ctx.cwd, '.claude/settings.json'), path.join(ctx.cwd, '.claude/settings.local.json')];
-  settingsFiles.forEach(function (file) { Object.assign(enabled, optional(file).enabledPlugins || {}); });
-  var installed = optional(path.join(roots.claude, 'plugins/installed_plugins.json'));
-  Object.keys(installed.plugins || {}).slice(0, 100).forEach(function (name) {
-    var entries = (installed.plugins[name] || []).filter(function (entry) { return entry.installPath && (!entry.projectPath || path.resolve(entry.projectPath) === path.resolve(ctx.cwd)); });
-    var scoped = entries.filter(function (entry) { return entry.scope === 'local' || entry.scope === 'project'; });
-    if (scoped.length) entries = scoped;
-    var local = entries.filter(function (entry) { return entry.scope === 'local'; }); if (local.length) entries = local;
-    // The registry is authoritative only when it selects one installation.
-    entries.forEach(function (entry) {
-      var extra = { pluginName: name, pluginVersion: entry.version || null, sourceEnabled: enabled[name] === true ? true : enabled[name] === false ? false : null,
-        blocked: entries.length > 1 ? 'Claude registry selects multiple installations. Resolve the active plugin installation before importing.' : typeof enabled[name] !== 'boolean' ? 'Claude plugin enablement is unknown. Enable or disable it explicitly in vendor settings and scan again.' : null };
-      var root = entry.installPath;
-      source('claude', path.join(root, '.mcp.json'), 'plugin', root, extra);
-      var manifest = optional(path.join(root, '.claude-plugin/plugin.json'));
-      var definitions = Array.isArray(manifest.mcpServers) ? manifest.mcpServers : [manifest.mcpServers];
-      definitions.forEach(function (definition) {
-        if (typeof definition === 'string' && definition.endsWith('.json') && !definition.includes('://')) source('claude', path.resolve(root, definition), 'plugin', root, extra);
-        else if (definition && typeof definition === 'object') source('claude', path.join(root, '.claude-plugin/plugin.json'), 'plugin-inline', root, extra);
-        else if (definition) ctx.diagnostics.push({ vendor: 'claude', scope: 'plugin', message: 'Remote plugin bundles are not downloaded. Install and resolve the local plugin before scanning.' });
-      });
-    });
-  });
-  var codex = {};
-  [path.join(roots.codex, 'config.toml'), path.join(ctx.cwd, '.codex/config.toml')].forEach(function (file) {
-    var plugins = optional(file).plugins || {};
-    Object.keys(plugins).forEach(function (name) {
-      var previous = codex[name] || {}, next = plugins[name] || {};
-      codex[name] = Object.assign({}, previous, next, { mcp_servers: Object.assign({}, previous.mcp_servers || {}, next.mcp_servers || {}) });
-    });
-  });
-  var cache = path.join(roots.codex, 'plugins/cache');
-  list(cache).slice(0, 50).forEach(function (market) {
-    if (!market.isDir) return;
-    list(path.join(cache, market.name)).slice(0, 50).forEach(function (plugin) {
-      if (!plugin.isDir) return;
-      var name = plugin.name + '@' + market.name, configured = codex[name] || {};
-      var versions = list(path.join(cache, market.name, plugin.name)).filter(function (entry) { return entry.isDir; });
-      // Codex core-plugin-common/installed.rs selects local first, otherwise the greatest installed version.
-      versions = versions.filter(function (entry) { return /^[A-Za-z0-9._+-]+$/.test(entry.name); }).sort(function (left, right) {
-        var semver = require('semver');
-        return semver.valid(left.name) && semver.valid(right.name) ? semver.compareBuild(left.name, right.name) : left.name < right.name ? -1 : left.name > right.name ? 1 : 0;
-      });
-      var active = versions.find(function (entry) { return entry.name === 'local'; }) || versions[versions.length - 1];
-      versions = active ? [active] : [];
-      versions.slice(0, 50).forEach(function (version) {
-        var root = path.join(cache, market.name, plugin.name, version.name);
-        var extra = { pluginName: name, pluginVersion: version.name, overrides: configured.mcp_servers,
-          sourceEnabled: Object.prototype.hasOwnProperty.call(codex, name) ? configured.enabled !== false : false,
-          blocked: configured.enabled !== undefined && typeof configured.enabled !== 'boolean' ? 'Invalid Codex plugin enabled state. Review its vendor configuration before importing.' : null };
-        var portable = optional(path.join(root, 'plugin.json'));
-        var manifest = portable.extensions && portable.extensions['com.openai'] || optional(path.join(root, '.codex-plugin/plugin.json'));
-        if (portable.name) source('codex', path.join(root, 'mcp.json'), 'plugin', root, extra);
-        else {
-          source('codex', path.join(root, '.mcp.json'), 'plugin', root, extra);
-          source('codex', path.join(root, 'mcp.json'), 'plugin', root, extra);
-        }
-        if (typeof manifest.mcpServers === 'string' && !manifest.mcpServers.includes('://')) source('codex', path.resolve(root, manifest.mcpServers), 'plugin', root, extra);
-      });
-    });
-  });
-}
-module.exports = { discover: discover };
+module.exports = require("./yoke/mcp-source-plugins");

package/lib/mcp-source-restrictions.js

@@ -1,47 +1 @@
-var path = require('path');
-var SECURITY = /permission|policy|security|sandbox|registry|disabledMcp|restrict|approval|allowed|denied|managedMcp|strictPlugin|includeTools|excludeTools/i;
-function inspect(ctx) {
-  var blocked = {}, files = [];
-  function add(vendor, file, exclusive) { files.push({ vendor: vendor, file: file, exclusive: exclusive }); }
-  var claudeManaged = process.platform === 'darwin' ? '/Library/Application Support/ClaudeCode' : process.platform === 'win32' ? path.join(process.env.ProgramFiles || 'C:\\Program Files', 'ClaudeCode') : '/etc/claude-code';
-  ['managed-mcp.json', 'managed-settings.json'].forEach(function (file) { add('claude', path.join(claudeManaged, file), true); });
-  add('claude', path.join(claudeManaged, 'managed-settings.d'), true);
-  if (process.platform === 'darwin') {
-    add('claude', '/Library/Managed Preferences/com.anthropic.claudecode.plist', true);
-    if (ctx.username) add('claude', path.join('/Library/Managed Preferences', ctx.username, 'com.anthropic.claudecode.plist'), true);
-  }
-  [path.join(ctx.roots.claude, 'settings.json'), path.join(ctx.cwd, '.claude/settings.json'), path.join(ctx.cwd, '.claude/settings.local.json')].forEach(function (file) { add('claude', file); });
-  [path.join(ctx.roots.codex, 'requirements.toml'), '/etc/codex/requirements.toml', '/etc/codex/managed_config.toml', path.join(ctx.roots.codex, 'managed_config.toml')].forEach(function (file) { add('codex', file, true); });
-  var openCodeManaged = process.platform === 'darwin' ? '/Library/Application Support/opencode' : process.platform === 'win32' ? path.join(process.env.ProgramData || 'C:\\ProgramData', 'opencode') : '/etc/opencode';
-  ['opencode.json', 'opencode.jsonc'].forEach(function (file) { add('opencode', path.join(openCodeManaged, file), true); });
-  if (process.platform === 'darwin') {
-    add('opencode', '/Library/Managed Preferences/ai.opencode.managed.plist', true);
-    if (ctx.username) add('opencode', path.join('/Library/Managed Preferences', ctx.username, 'ai.opencode.managed.plist'), true);
-  }
-  ['settings.json', 'permissions-config.json'].forEach(function (file) { add('copilot', path.join(ctx.roots.copilot, file)); });
-  ['settings.json', 'settings.local.json'].forEach(function (file) { add('copilot', path.join(ctx.cwd, '.github/copilot', file)); });
-  var copilotManaged = process.platform === 'darwin' ? '/Library/Application Support/GitHubCopilot/managed-settings.json' : process.platform === 'win32' ? path.join(process.env.ProgramFiles || 'C:\\Program Files', 'GitHubCopilot/managed-settings.json') : '/etc/github-copilot/managed-settings.json';
-  add('copilot', copilotManaged, true);
-  if (process.platform === 'darwin') {
-    add('copilot', '/Library/Managed Preferences/com.github.copilot.plist', true);
-    if (ctx.username) add('copilot', path.join('/Library/Managed Preferences', ctx.username, 'com.github.copilot.plist'), true);
-  }
-  add('kimi', path.join(ctx.roots.kimi, 'config.toml'));
-  var qwenSystem = process.platform === 'darwin' ? '/Library/Application Support/QwenCode' : process.platform === 'win32' ? 'C:\\ProgramData\\qwen-code' : '/etc/qwen-code';
-  add('qwen', ctx.policyPaths.qwenSettings || path.join(qwenSystem, 'settings.json'), true);
-  add('qwen', ctx.policyPaths.qwenDefaults || path.join(qwenSystem, 'system-defaults.json'), true);
-  add('grok', '/etc/grok/requirements.toml', true);
-  add('grok', '/etc/grok/managed_config.toml', true);
-  add('grok', path.join(ctx.roots.grok, 'requirements.toml'), true);
-  add('grok', path.join(ctx.roots.grok, 'managed_config.toml'), true);
-  files.forEach(function (entry) {
-    try {
-      var value = ctx.load(entry.file);
-      if (entry.exclusive || path.basename(entry.file) === 'permissions-config.json' && Object.keys(value).length || Object.keys(value).some(function (key) { return SECURITY.test(key); })) blocked[entry.vendor] = 'Local vendor security or managed policy is present. Clay cannot resolve its effective restrictions. Review that policy and configure an explicitly authorized Clay connection; vendor import is blocked.';
-    } catch (error) {
-      if (error.code !== 'ENOENT' && !/ENOENT|no such file/i.test(error.message)) blocked[entry.vendor] = 'Could not resolve a local vendor policy source. Check permissions and format before importing.';
-    }
-  });
-  return blocked;
-}
-module.exports = { inspect: inspect, securityKey: function (key) { return SECURITY.test(key); } };
+module.exports = require("./yoke/mcp-source-restrictions");

package/lib/mcp-tool-policy.js

@@ -1,29 +1,4 @@
-// Restrictive policies are intersected; an empty allowlist means no tools.
-var ALLOW = ['enabled_tools', 'enabledTools', 'includeTools'];
-var DENY = ['disabled_tools', 'disabledTools', 'excludeTools'];
-function list(value, key) {
-  if (!Array.isArray(value) || value.some(function (item) { return typeof item !== 'string' || !item || item.indexOf('\0') >= 0; })) throw new Error('Invalid tool policy: ' + key + '. Review the vendor configuration before importing.');
-  return Array.from(new Set(value));
-}
-function normalize(vendor, value) {
-  var allow = null, deny = [], keys = ALLOW.slice();
-  if (vendor === 'copilot') keys.push('tools');
-  keys.forEach(function (key) {
-    if (!Object.prototype.hasOwnProperty.call(value, key)) return;
-    var next = list(value[key], key);
-    if (vendor === 'copilot' && key === 'tools' && next.indexOf('*') >= 0) next = null;
-    if (next !== null) allow = allow === null ? next : allow.filter(function (name) { return next.indexOf(name) >= 0; });
-  });
-  DENY.forEach(function (key) { if (Object.prototype.hasOwnProperty.call(value, key)) deny = deny.concat(list(value[key], key)); });
-  var unsupported = Object.keys(value).filter(function (key) {
-    if (ALLOW.concat(DENY, vendor === 'copilot' ? ['tools'] : [], ['autoApprove', 'trust', 'oauth', 'oauthScopes']).indexOf(key) >= 0) return false;
-    return /tool|permission|policy|security|authProvider|allowed|denied|restrict|approval/i.test(key) && ['tool_timeout_sec'].indexOf(key) < 0;
-  });
-  if (unsupported.length) throw new Error('Unsupported restriction or security configuration: ' + unsupported.join(', ') + '. Configure and review a direct Clay connection instead.');
-  if (value.autoApprove !== undefined && (!Array.isArray(value.autoApprove) || value.autoApprove.some(function (item) { return typeof item !== 'string'; }))) throw new Error('Invalid autoApprove policy.');
-  if (value.trust !== undefined && typeof value.trust !== 'boolean') throw new Error('Invalid trust policy.');
-  return { enabledTools: allow, disabledTools: Array.from(new Set(deny)) };
-}
+var normalize = require("./yoke/mcp-tool-policy-normalize").normalize;
 function matches(pattern, name) {
   return new RegExp('^' + pattern.split('').map(function (letter) { return letter === '*' ? '.*' : letter === '?' ? '.' : letter.replace(/[\\^$+.[\]{}()|]/g, '\\$&'); }).join('') + '$').test(name);
 }

package/lib/os-user-diagnostics.js

@@ -17,12 +17,10 @@ function commandAvailable(command, execFile) {
 
 function credentialPaths(home) {
   if (!home) return [];
-  return [
-    home + "/.claude",
-    home + "/.codex",
+  return require("./yoke/maintenance").credentialPaths(home).concat([
     home + "/.config/gh",
     home + "/.config/gcloud",
-  ];
+  ]);
 }
 
 function accessStatus(checks) {

package/lib/os-users.js

@@ -475,72 +475,11 @@ function getLinuxUserUid(username) {
  * hardcoded ~/.local/bin/claude path.
  * Returns true if claude resolves, false otherwise.
  */
-function claudeAvailableForUser(linuxName) {
-  if (!isSafeLinuxUsername(linuxName)) return false;
-  try {
-    var out = execFileSync("su", ["-", linuxName, "-c", "command -v claude"], {
-      encoding: "utf8",
-      timeout: 10000,
-      stdio: "pipe",
-    }).trim();
-    return out.length > 0;
-  } catch (e) {
-    return false;
-  }
-}
-
-/**
- * Install Claude CLI for a Linux user account.
- * Downloads and runs the install script, then ensures PATH is configured.
- * Non-fatal: logs errors but does not throw.
- * Skips entirely when claude is already resolvable for the user, or when
- * CLAY_SKIP_CLAUDE_INSTALL is set (bring-your-own-claude).
- */
-function installClaudeCli(linuxName) {
-  if (process.env.CLAY_SKIP_CLAUDE_INSTALL) {
-    console.log("[os-users] CLAY_SKIP_CLAUDE_INSTALL set, skipping Claude CLI install for " + linuxName);
-    return;
-  }
-  if (claudeAvailableForUser(linuxName)) {
-    console.log("[os-users] Claude CLI already available for " + linuxName + ", skipping install");
-    return;
-  }
-  try {
-    if (!isSafeLinuxUsername(linuxName)) throw new Error("Invalid Linux username");
-    // Download and run the Claude CLI install script as the target user
-    execFileSync("su", ["-", linuxName, "-c", "curl -fsSL https://claude.ai/install.sh | bash"], {
-      encoding: "utf8",
-      timeout: 60000,
-      stdio: "pipe",
-    });
-    console.log("[os-users] Claude CLI installed for " + linuxName);
-  } catch (e) {
-    var msg = (e.stderr || e.message || "").trim();
-    console.error("[os-users] Failed to install Claude CLI for " + linuxName + ": " + msg);
-    return;
-  }
-
-  // Append PATH export to the user's shell config if not already present
-  try {
-    var userInfo = resolveOsUserInfo(linuxName);
-    var home = userInfo.home || ("/home/" + linuxName);
-    var rcPath = fs.existsSync(path.join(home, ".zshrc")) ? path.join(home, ".zshrc") : path.join(home, ".bashrc");
-    var exportLine = 'export PATH="$HOME/.local/bin:$PATH"';
-    var existing = "";
-    try { existing = fs.readFileSync(rcPath, "utf8"); } catch (e2) {}
-    if (existing.indexOf(exportLine) === -1) {
-      var prefix = existing && !/\n$/.test(existing) ? "\n" : "";
-      fs.appendFileSync(rcPath, prefix + exportLine + "\n", "utf8");
-      try { fs.chownSync(rcPath, userInfo.uid, userInfo.gid); } catch (e3) {}
-      console.log("[os-users] PATH export appended to " + rcPath + " for " + linuxName);
-    } else {
-      console.log("[os-users] PATH already configured in " + rcPath + " for " + linuxName);
-    }
-  } catch (e) {
-    var rcMsg = (e.stderr || e.message || "").trim();
-    console.error("[os-users] Failed to configure PATH for " + linuxName + ": " + rcMsg);
-  }
+function defaultRuntimeProvisioning() {
+  return require("./yoke/provisioning").forProvider("claude", { isSafeLinuxUsername: isSafeLinuxUsername, resolveOsUserInfo: resolveOsUserInfo });
 }
+function claudeAvailableForUser(user) { return defaultRuntimeProvisioning().available(user); }
+function installClaudeCli(user) { return defaultRuntimeProvisioning().install(user); }
 
 /**
  * Provision a Linux user account for a Clay user.

package/lib/project-connection.js

@@ -3,7 +3,7 @@ var path = require("path");
 var usersModule = require("./users");
 var userPresence = require("./user-presence");
 var emailAccounts = require("./email-accounts");
-var { getCodexConfig } = require("./codex-defaults");
+var providerSettings = require("./yoke/settings");
 var yoke = require("./yoke");
 var permissionModes = require("./session-permission-mode");
 var sessionProvenance = require("./session-provenance");
@@ -217,7 +217,7 @@ function attachConnection(ctx) {
       sm.saveSessionFile(restoredActive);
     }
     var initialModels = (sm.modelsByVendor && sm.modelsByVendor[initialVendor]) || sm.availableModels || [];
-    sendTo(ws, { type: "info", cwd: cwd, slug: slug, project: title || project, version: currentVersion, debug: !!debug, dangerouslySkipPermissions: dangerouslySkipPermissions, osUsers: osUsers, lanHost: lanHost, projectCount: _filteredProjects.length, projects: _filteredProjects, projectOwnerId: projectOwnerId, ownerLocked: ownerLocked, vendors: yoke.VENDOR_REGISTRY, isMate: isMate, mateId: isMate ? mateId : null, mateDisplayName: isMate ? (mateDisplayName || title || project || "Mate") : "" });
+    sendTo(ws, { type: "info", cwd: cwd, slug: slug, project: title || project, version: currentVersion, debug: !!debug, dangerouslySkipPermissions: dangerouslySkipPermissions, osUsers: osUsers, lanHost: lanHost, projectCount: _filteredProjects.length, projects: _filteredProjects, projectOwnerId: projectOwnerId, ownerLocked: ownerLocked, vendors: require("./yoke/vendor-registry").publicInfo(), isMate: isMate, mateId: isMate ? mateId : null, mateDisplayName: isMate ? (mateDisplayName || title || project || "Mate") : "" });
     if (typeof sendCursorSharingState === "function") sendCursorSharingState(ws);
     // Update notifications are pushed on a scheduled interval (see
     // scheduleUpdateBroadcast). We no longer push on connect to avoid
@@ -234,7 +234,7 @@ function attachConnection(ctx) {
     var initialPermissionState = permissionModes.clientState(restoredActive, sm.currentPermissionMode, sm.defaultVendor);
     sendTo(ws, { type: "config_state", model: initialModelInfo.model, vendor: initialVendor, sessionId: restoredActive ? restoredActive.localId : null, mode: initialPermissionState.requestedPermissionMode, effectivePermissionMode: initialPermissionState.effectivePermissionMode, permissionCapabilities: initialPermissionState.permissionCapabilities, mcpPermissionModeOverrides: initialPermissionState.mcpPermissionModeOverrides, effort: initialEffort || "medium", betas: sm.currentBetas || [], thinking: sm.currentThinking || "adaptive", thinkingBudget: sm.currentThinkingBudget || 10000 });
     sendTo(ws, { type: "last_vendor", vendor: sm.lastVendor || "" });
-    sendTo(ws, Object.assign({ type: "codex_config" }, getCodexConfig(sm)));
+    providerSettings.messages(sm).forEach(function(message) { sendTo(ws, message); });
     sendTo(ws, { type: "term_list", terminals: tm.list() });
     // Any login flow already running in this project, so a reconnecting client
     // re-attaches to the existing login terminal instead of starting another.
@@ -301,12 +301,13 @@ function attachConnection(ctx) {
       }
       sendTo(ws, { type: "history_meta", total: total, from: fromIndex });
       for (var i = fromIndex; i < total; i++) {
-        sendTo(ws, Object.assign({}, hydrateImageRefs(active.history[i]), { _historyIndex: i }));
+        sendTo(ws, Object.assign({}, hydrateImageRefs(require("./yoke/usage").clientEvent(active.history[i], active.vendor || "claude")), { _historyIndex: i }));
       }
-      var _lastUsage = null, _lastModelUsage = null, _lastCost = null, _lastStreamInputTokens = null;
+      var _lastContext = null, _lastUsage = null, _lastModelUsage = null, _lastCost = null, _lastStreamInputTokens = null;
       for (var _ri = total - 1; _ri >= 0; _ri--) {
         if (active.history[_ri].type === "result") {
-          var _r = active.history[_ri];
+          var _r = require("./yoke/usage").clientEvent(active.history[_ri], active.vendor || "claude");
+          _lastContext = _r.context;
           _lastUsage = _r.usage || null;
           _lastModelUsage = _r.modelUsage || null;
           _lastCost = _r.cost != null ? _r.cost : null;
@@ -314,7 +315,7 @@ function attachConnection(ctx) {
           break;
         }
       }
-      sendTo(ws, { type: "history_done", lastUsage: _lastUsage, lastModelUsage: _lastModelUsage, lastCost: _lastCost, lastStreamInputTokens: _lastStreamInputTokens, contextUsage: active.lastContextUsage || null });
+      sendTo(ws, { type: "history_done", lastUsage: _lastUsage, lastModelUsage: _lastModelUsage, lastCost: _lastCost, lastStreamInputTokens: _lastStreamInputTokens, context: _lastContext, contextUsage: require("./yoke/usage").context(active.lastContextUsage, active.vendor || "claude") });
       if (scheduledMessages) scheduledMessages.sendState(active, ws);
       if (pairResultRecovery) pairResultRecovery.sendState(active, ws);
 

package/lib/project-http.js

@@ -419,9 +419,9 @@ function attachHTTP(ctx) {
         var uninstallUserInfo = getOsUserInfoForReq(req);
         var baseDir = scope === "global" ? (uninstallUserInfo ? uninstallUserInfo.home : require("./config").REAL_HOME) : cwd;
         if (osUsers && !uninstallUserInfo) throw new Error("A mapped OS user is required to uninstall skills");
-        var skillDir = claySkillStorage.isClaySkill(skill) ? path.join(claySkillStorage.privateRoot(baseDir), skill) : path.join(baseDir, ".claude", "skills", skill);
+        var skillDir = claySkillStorage.isClaySkill(skill) ? path.join(claySkillStorage.privateRoot(baseDir), skill) : path.join(require("./yoke/source-locations").legacySkillRoot(baseDir), skill);
         // Safety: keep removal inside the selected skill storage root.
-        var expectedParent = claySkillStorage.isClaySkill(skill) ? claySkillStorage.privateRoot(baseDir) : path.join(baseDir, ".claude", "skills");
+        var expectedParent = claySkillStorage.isClaySkill(skill) ? claySkillStorage.privateRoot(baseDir) : require("./yoke/source-locations").legacySkillRoot(baseDir);
         var resolved = path.resolve(skillDir);
         if (!resolved.startsWith(expectedParent + path.sep)) {
           res.writeHead(403, { "Content-Type": "application/json" });
@@ -528,8 +528,8 @@ function attachHTTP(ctx) {
           var sui = getOsUserInfoForReq(req);
           return sui ? sui.home : require("./config").REAL_HOME;
         })();
-        var globalSkillsDir = path.join(skillUserHome, ".claude", "skills");
-        var projectSkillsDir = path.join(cwd, ".claude", "skills");
+        var globalSkillsDir = require("./yoke/source-locations").legacySkillRoot(skillUserHome);
+        var projectSkillsDir = require("./yoke/source-locations").legacySkillRoot(cwd);
         var results = [];
         var pending = skills.length;
 

package/lib/project-mcp.js

@@ -26,7 +26,7 @@ function attachMcp(ctx) {
   }
   function isSession(subject) { return !!subject && ctx.canUseSession(subject); }
   function sourceIdentity(subject) { return isSession(subject) ? ctx.ownerIdentity(ctx.isMultiUser() ? String(subject.ownerId) : 'default') : ctx.identity(subject); }
-  var discovery = require('./mcp-source-discovery').createDiscovery({ cwd: ctx.cwd || process.cwd(), home: ctx.discoveryHome,
+  var discovery = require('./yoke/mcp-source-discovery').createDiscovery({ cwd: ctx.cwd || process.cwd(), home: ctx.discoveryHome,
     identity: sourceIdentity, runtimeEnv: function (owner, subject) { return isSession(subject) ? ctx.runtimeEnvForSession(subject) : ctx.runtimeEnv ? ctx.runtimeEnv(owner, subject) : {}; }, authorize: function (owner, subject) {
       var permitted = isSession(subject) ? (ctx.isMultiUser() ? String(subject.ownerId) : 'default') === owner && ctx.canDiscoverSession(subject) : ownerFor(subject) === owner && ctx.canDiscover && ctx.canDiscover(subject);
       if (!permitted) throw new Error('Vendor discovery requires your authorized OS user mapping or a sole account installation.');
@@ -152,7 +152,7 @@ function attachMcp(ctx) {
     });
   }
   function getMcpServers(session, allowManagement) {
-    if (!session || !ctx.canUseSession(session) || (ctx.sessionVendor ? ctx.sessionVendor(session) : session.vendor) === 'antigravity') return {};
+    if (!session || !ctx.canUseSession(session) || !require('./yoke/session-tool-transport').capability(ctx.sessionVendor ? ctx.sessionVendor(session) : session.vendor || 'claude').supported) return {};
     var owner = ctx.isMultiUser() ? String(session.ownerId) : 'default';
     function authorize() {
       authorizeOwner(owner);

package/lib/project-pair-result-delivery.js

@@ -125,8 +125,8 @@ function attachPairResultDelivery(ctx) {
         if (!currentAttempt(caller, partner, token, attemptId)) return;
         // A known, cancellable provider admission wait has not sent input.
         // Keep the correlated completion eligible until admission or Stop.
-        if (caller._queryStarting && Number(caller._codexRecoveryWaiting) > 0
-            && caller._codexRecoveryWaiting === caller._sdkQueryGeneration) {
+        if (caller._queryStarting && Number(caller._providerRecoveryWaiting) > 0
+            && caller._providerRecoveryWaiting === caller._sdkQueryGeneration) {
           token._deliveryTimer = { attemptId: attemptId, timer: setTimeout(acceptanceTimeout, timeoutMs) };
           return;
         }