clay-server 5.2.0-beta.5 → 5.2.0-beta.7

package/lib/mcp-source-restrictions.js

@@ -1,47 +1 @@
-var path = require('path');
-var SECURITY = /permission|policy|security|sandbox|registry|disabledMcp|restrict|approval|allowed|denied|managedMcp|strictPlugin|includeTools|excludeTools/i;
-function inspect(ctx) {
-  var blocked = {}, files = [];
-  function add(vendor, file, exclusive) { files.push({ vendor: vendor, file: file, exclusive: exclusive }); }
-  var claudeManaged = process.platform === 'darwin' ? '/Library/Application Support/ClaudeCode' : process.platform === 'win32' ? path.join(process.env.ProgramFiles || 'C:\\Program Files', 'ClaudeCode') : '/etc/claude-code';
-  ['managed-mcp.json', 'managed-settings.json'].forEach(function (file) { add('claude', path.join(claudeManaged, file), true); });
-  add('claude', path.join(claudeManaged, 'managed-settings.d'), true);
-  if (process.platform === 'darwin') {
-    add('claude', '/Library/Managed Preferences/com.anthropic.claudecode.plist', true);
-    if (ctx.username) add('claude', path.join('/Library/Managed Preferences', ctx.username, 'com.anthropic.claudecode.plist'), true);
-  }
-  [path.join(ctx.roots.claude, 'settings.json'), path.join(ctx.cwd, '.claude/settings.json'), path.join(ctx.cwd, '.claude/settings.local.json')].forEach(function (file) { add('claude', file); });
-  [path.join(ctx.roots.codex, 'requirements.toml'), '/etc/codex/requirements.toml', '/etc/codex/managed_config.toml', path.join(ctx.roots.codex, 'managed_config.toml')].forEach(function (file) { add('codex', file, true); });
-  var openCodeManaged = process.platform === 'darwin' ? '/Library/Application Support/opencode' : process.platform === 'win32' ? path.join(process.env.ProgramData || 'C:\\ProgramData', 'opencode') : '/etc/opencode';
-  ['opencode.json', 'opencode.jsonc'].forEach(function (file) { add('opencode', path.join(openCodeManaged, file), true); });
-  if (process.platform === 'darwin') {
-    add('opencode', '/Library/Managed Preferences/ai.opencode.managed.plist', true);
-    if (ctx.username) add('opencode', path.join('/Library/Managed Preferences', ctx.username, 'ai.opencode.managed.plist'), true);
-  }
-  ['settings.json', 'permissions-config.json'].forEach(function (file) { add('copilot', path.join(ctx.roots.copilot, file)); });
-  ['settings.json', 'settings.local.json'].forEach(function (file) { add('copilot', path.join(ctx.cwd, '.github/copilot', file)); });
-  var copilotManaged = process.platform === 'darwin' ? '/Library/Application Support/GitHubCopilot/managed-settings.json' : process.platform === 'win32' ? path.join(process.env.ProgramFiles || 'C:\\Program Files', 'GitHubCopilot/managed-settings.json') : '/etc/github-copilot/managed-settings.json';
-  add('copilot', copilotManaged, true);
-  if (process.platform === 'darwin') {
-    add('copilot', '/Library/Managed Preferences/com.github.copilot.plist', true);
-    if (ctx.username) add('copilot', path.join('/Library/Managed Preferences', ctx.username, 'com.github.copilot.plist'), true);
-  }
-  add('kimi', path.join(ctx.roots.kimi, 'config.toml'));
-  var qwenSystem = process.platform === 'darwin' ? '/Library/Application Support/QwenCode' : process.platform === 'win32' ? 'C:\\ProgramData\\qwen-code' : '/etc/qwen-code';
-  add('qwen', ctx.policyPaths.qwenSettings || path.join(qwenSystem, 'settings.json'), true);
-  add('qwen', ctx.policyPaths.qwenDefaults || path.join(qwenSystem, 'system-defaults.json'), true);
-  add('grok', '/etc/grok/requirements.toml', true);
-  add('grok', '/etc/grok/managed_config.toml', true);
-  add('grok', path.join(ctx.roots.grok, 'requirements.toml'), true);
-  add('grok', path.join(ctx.roots.grok, 'managed_config.toml'), true);
-  files.forEach(function (entry) {
-    try {
-      var value = ctx.load(entry.file);
-      if (entry.exclusive || path.basename(entry.file) === 'permissions-config.json' && Object.keys(value).length || Object.keys(value).some(function (key) { return SECURITY.test(key); })) blocked[entry.vendor] = 'Local vendor security or managed policy is present. Clay cannot resolve its effective restrictions. Review that policy and configure an explicitly authorized Clay connection; vendor import is blocked.';
-    } catch (error) {
-      if (error.code !== 'ENOENT' && !/ENOENT|no such file/i.test(error.message)) blocked[entry.vendor] = 'Could not resolve a local vendor policy source. Check permissions and format before importing.';
-    }
-  });
-  return blocked;
-}
-module.exports = { inspect: inspect, securityKey: function (key) { return SECURITY.test(key); } };
+module.exports = require("./yoke/mcp-source-restrictions");

package/lib/mcp-tool-policy.js

@@ -1,29 +1,4 @@
-// Restrictive policies are intersected; an empty allowlist means no tools.
-var ALLOW = ['enabled_tools', 'enabledTools', 'includeTools'];
-var DENY = ['disabled_tools', 'disabledTools', 'excludeTools'];
-function list(value, key) {
-  if (!Array.isArray(value) || value.some(function (item) { return typeof item !== 'string' || !item || item.indexOf('\0') >= 0; })) throw new Error('Invalid tool policy: ' + key + '. Review the vendor configuration before importing.');
-  return Array.from(new Set(value));
-}
-function normalize(vendor, value) {
-  var allow = null, deny = [], keys = ALLOW.slice();
-  if (vendor === 'copilot') keys.push('tools');
-  keys.forEach(function (key) {
-    if (!Object.prototype.hasOwnProperty.call(value, key)) return;
-    var next = list(value[key], key);
-    if (vendor === 'copilot' && key === 'tools' && next.indexOf('*') >= 0) next = null;
-    if (next !== null) allow = allow === null ? next : allow.filter(function (name) { return next.indexOf(name) >= 0; });
-  });
-  DENY.forEach(function (key) { if (Object.prototype.hasOwnProperty.call(value, key)) deny = deny.concat(list(value[key], key)); });
-  var unsupported = Object.keys(value).filter(function (key) {
-    if (ALLOW.concat(DENY, vendor === 'copilot' ? ['tools'] : [], ['autoApprove', 'trust', 'oauth', 'oauthScopes']).indexOf(key) >= 0) return false;
-    return /tool|permission|policy|security|authProvider|allowed|denied|restrict|approval/i.test(key) && ['tool_timeout_sec'].indexOf(key) < 0;
-  });
-  if (unsupported.length) throw new Error('Unsupported restriction or security configuration: ' + unsupported.join(', ') + '. Configure and review a direct Clay connection instead.');
-  if (value.autoApprove !== undefined && (!Array.isArray(value.autoApprove) || value.autoApprove.some(function (item) { return typeof item !== 'string'; }))) throw new Error('Invalid autoApprove policy.');
-  if (value.trust !== undefined && typeof value.trust !== 'boolean') throw new Error('Invalid trust policy.');
-  return { enabledTools: allow, disabledTools: Array.from(new Set(deny)) };
-}
+var normalize = require("./yoke/mcp-tool-policy-normalize").normalize;
 function matches(pattern, name) {
   return new RegExp('^' + pattern.split('').map(function (letter) { return letter === '*' ? '.*' : letter === '?' ? '.' : letter.replace(/[\\^$+.[\]{}()|]/g, '\\$&'); }).join('') + '$').test(name);
 }

package/lib/os-user-diagnostics.js

@@ -17,12 +17,10 @@ function commandAvailable(command, execFile) {
 
 function credentialPaths(home) {
   if (!home) return [];
-  return [
-    home + "/.claude",
-    home + "/.codex",
+  return require("./yoke/maintenance").credentialPaths(home).concat([
     home + "/.config/gh",
     home + "/.config/gcloud",
-  ];
+  ]);
 }
 
 function accessStatus(checks) {

package/lib/os-users.js

@@ -475,72 +475,11 @@ function getLinuxUserUid(username) {
  * hardcoded ~/.local/bin/claude path.
  * Returns true if claude resolves, false otherwise.
  */
-function claudeAvailableForUser(linuxName) {
-  if (!isSafeLinuxUsername(linuxName)) return false;
-  try {
-    var out = execFileSync("su", ["-", linuxName, "-c", "command -v claude"], {
-      encoding: "utf8",
-      timeout: 10000,
-      stdio: "pipe",
-    }).trim();
-    return out.length > 0;
-  } catch (e) {
-    return false;
-  }
-}
-
-/**
- * Install Claude CLI for a Linux user account.
- * Downloads and runs the install script, then ensures PATH is configured.
- * Non-fatal: logs errors but does not throw.
- * Skips entirely when claude is already resolvable for the user, or when
- * CLAY_SKIP_CLAUDE_INSTALL is set (bring-your-own-claude).
- */
-function installClaudeCli(linuxName) {
-  if (process.env.CLAY_SKIP_CLAUDE_INSTALL) {
-    console.log("[os-users] CLAY_SKIP_CLAUDE_INSTALL set, skipping Claude CLI install for " + linuxName);
-    return;
-  }
-  if (claudeAvailableForUser(linuxName)) {
-    console.log("[os-users] Claude CLI already available for " + linuxName + ", skipping install");
-    return;
-  }
-  try {
-    if (!isSafeLinuxUsername(linuxName)) throw new Error("Invalid Linux username");
-    // Download and run the Claude CLI install script as the target user
-    execFileSync("su", ["-", linuxName, "-c", "curl -fsSL https://claude.ai/install.sh | bash"], {
-      encoding: "utf8",
-      timeout: 60000,
-      stdio: "pipe",
-    });
-    console.log("[os-users] Claude CLI installed for " + linuxName);
-  } catch (e) {
-    var msg = (e.stderr || e.message || "").trim();
-    console.error("[os-users] Failed to install Claude CLI for " + linuxName + ": " + msg);
-    return;
-  }
-
-  // Append PATH export to the user's shell config if not already present
-  try {
-    var userInfo = resolveOsUserInfo(linuxName);
-    var home = userInfo.home || ("/home/" + linuxName);
-    var rcPath = fs.existsSync(path.join(home, ".zshrc")) ? path.join(home, ".zshrc") : path.join(home, ".bashrc");
-    var exportLine = 'export PATH="$HOME/.local/bin:$PATH"';
-    var existing = "";
-    try { existing = fs.readFileSync(rcPath, "utf8"); } catch (e2) {}
-    if (existing.indexOf(exportLine) === -1) {
-      var prefix = existing && !/\n$/.test(existing) ? "\n" : "";
-      fs.appendFileSync(rcPath, prefix + exportLine + "\n", "utf8");
-      try { fs.chownSync(rcPath, userInfo.uid, userInfo.gid); } catch (e3) {}
-      console.log("[os-users] PATH export appended to " + rcPath + " for " + linuxName);
-    } else {
-      console.log("[os-users] PATH already configured in " + rcPath + " for " + linuxName);
-    }
-  } catch (e) {
-    var rcMsg = (e.stderr || e.message || "").trim();
-    console.error("[os-users] Failed to configure PATH for " + linuxName + ": " + rcMsg);
-  }
+function defaultRuntimeProvisioning() {
+  return require("./yoke/provisioning").forProvider("claude", { isSafeLinuxUsername: isSafeLinuxUsername, resolveOsUserInfo: resolveOsUserInfo });
 }
+function claudeAvailableForUser(user) { return defaultRuntimeProvisioning().available(user); }
+function installClaudeCli(user) { return defaultRuntimeProvisioning().install(user); }
 
 /**
  * Provision a Linux user account for a Clay user.

package/lib/project-connection.js

@@ -3,7 +3,7 @@ var path = require("path");
 var usersModule = require("./users");
 var userPresence = require("./user-presence");
 var emailAccounts = require("./email-accounts");
-var { getCodexConfig } = require("./codex-defaults");
+var providerSettings = require("./yoke/settings");
 var yoke = require("./yoke");
 var permissionModes = require("./session-permission-mode");
 var sessionProvenance = require("./session-provenance");
@@ -143,6 +143,9 @@ function attachConnection(ctx) {
   var _warmedUp = false;
 
   function findRestoredActiveSession(ws, wsUser, allSessions) {
+    if (ws._clayContextual && ws._clayPaneSession) {
+      return { active: allSessions.find(function (session) { return session.localId === ws._clayPaneSession; }) || null, storedPresence: null };
+    }
     var active = null;
     var presenceKey = wsUser ? wsUser.id : "_default";
     var storedPresence = userPresence.getPresence(slug, presenceKey);
@@ -202,7 +205,7 @@ function attachConnection(ctx) {
     } else if (!usersModule.isMultiUser()) {
       allSessions = allSessions.filter(function (s) { return !s.ownerId; });
     }
-    var restoredState = ws._clayPane
+    var restoredState = ws._clayPane && !ws._clayContextual
       ? { active: null, storedPresence: null }
       : findRestoredActiveSession(ws, wsUser, allSessions);
     var restoredActive = restoredState.active;
@@ -217,7 +220,7 @@ function attachConnection(ctx) {
       sm.saveSessionFile(restoredActive);
     }
     var initialModels = (sm.modelsByVendor && sm.modelsByVendor[initialVendor]) || sm.availableModels || [];
-    sendTo(ws, { type: "info", cwd: cwd, slug: slug, project: title || project, version: currentVersion, debug: !!debug, dangerouslySkipPermissions: dangerouslySkipPermissions, osUsers: osUsers, lanHost: lanHost, projectCount: _filteredProjects.length, projects: _filteredProjects, projectOwnerId: projectOwnerId, ownerLocked: ownerLocked, vendors: yoke.VENDOR_REGISTRY, isMate: isMate, mateId: isMate ? mateId : null, mateDisplayName: isMate ? (mateDisplayName || title || project || "Mate") : "" });
+    sendTo(ws, { type: "info", controlRuntimeId: require("./clay-control-target-projection").runtime(sm), cwd: cwd, slug: slug, project: title || project, version: currentVersion, debug: !!debug, dangerouslySkipPermissions: dangerouslySkipPermissions, osUsers: osUsers, lanHost: lanHost, projectCount: _filteredProjects.length, projects: _filteredProjects, projectOwnerId: projectOwnerId, ownerLocked: ownerLocked, vendors: require("./yoke/vendor-registry").publicInfo(), isMate: isMate, mateId: isMate ? mateId : null, mateDisplayName: isMate ? (mateDisplayName || title || project || "Mate") : "" });
     if (typeof sendCursorSharingState === "function") sendCursorSharingState(ws);
     // Update notifications are pushed on a scheduled interval (see
     // scheduleUpdateBroadcast). We no longer push on connect to avoid
@@ -234,8 +237,8 @@ function attachConnection(ctx) {
     var initialPermissionState = permissionModes.clientState(restoredActive, sm.currentPermissionMode, sm.defaultVendor);
     sendTo(ws, { type: "config_state", model: initialModelInfo.model, vendor: initialVendor, sessionId: restoredActive ? restoredActive.localId : null, mode: initialPermissionState.requestedPermissionMode, effectivePermissionMode: initialPermissionState.effectivePermissionMode, permissionCapabilities: initialPermissionState.permissionCapabilities, mcpPermissionModeOverrides: initialPermissionState.mcpPermissionModeOverrides, effort: initialEffort || "medium", betas: sm.currentBetas || [], thinking: sm.currentThinking || "adaptive", thinkingBudget: sm.currentThinkingBudget || 10000 });
     sendTo(ws, { type: "last_vendor", vendor: sm.lastVendor || "" });
-    sendTo(ws, Object.assign({ type: "codex_config" }, getCodexConfig(sm)));
-    sendTo(ws, { type: "term_list", terminals: tm.list() });
+    providerSettings.messages(sm).forEach(function(message) { sendTo(ws, message); });
+    sendTo(ws, { type: "term_list", terminals: tm.list(true) });
     // Any login flow already running in this project, so a reconnecting client
     // re-attaches to the existing login terminal instead of starting another.
     if (_vendorLogin) _vendorLogin.sendStateTo(ws);
@@ -267,7 +270,7 @@ function attachConnection(ctx) {
     var presenceKey = wsUser ? wsUser.id : "_default";
     var storedPresence = restoredState.storedPresence;
     var autoCreated = false;
-    if (!active && !ws._clayPane) {
+    if (!active && (!ws._clayPane || (ws._clayContextual && !ws._clayPaneSession))) {
       var autoOpts = {};
       if (wsUser && usersModule.isMultiUser()) autoOpts.ownerId = wsUser.id;
       active = sm.createSession(autoOpts, ws);
@@ -301,12 +304,13 @@ function attachConnection(ctx) {
       }
       sendTo(ws, { type: "history_meta", total: total, from: fromIndex });
       for (var i = fromIndex; i < total; i++) {
-        sendTo(ws, Object.assign({}, hydrateImageRefs(active.history[i]), { _historyIndex: i }));
+        sendTo(ws, Object.assign({}, hydrateImageRefs(require("./yoke/usage").clientEvent(active.history[i], active.vendor || "claude")), { _historyIndex: i }));
       }
-      var _lastUsage = null, _lastModelUsage = null, _lastCost = null, _lastStreamInputTokens = null;
+      var _lastContext = null, _lastUsage = null, _lastModelUsage = null, _lastCost = null, _lastStreamInputTokens = null;
       for (var _ri = total - 1; _ri >= 0; _ri--) {
         if (active.history[_ri].type === "result") {
-          var _r = active.history[_ri];
+          var _r = require("./yoke/usage").clientEvent(active.history[_ri], active.vendor || "claude");
+          _lastContext = _r.context;
           _lastUsage = _r.usage || null;
           _lastModelUsage = _r.modelUsage || null;
           _lastCost = _r.cost != null ? _r.cost : null;
@@ -314,7 +318,7 @@ function attachConnection(ctx) {
           break;
         }
       }
-      sendTo(ws, { type: "history_done", lastUsage: _lastUsage, lastModelUsage: _lastModelUsage, lastCost: _lastCost, lastStreamInputTokens: _lastStreamInputTokens, contextUsage: active.lastContextUsage || null });
+      sendTo(ws, { type: "history_done", controlHistoryRevision: require("./clay-control-target-projection").digest(active.history || []), sessionId: active.localId, sessionOriginId: active.sessionOriginId || null, lastUsage: _lastUsage, lastModelUsage: _lastModelUsage, lastCost: _lastCost, lastStreamInputTokens: _lastStreamInputTokens, context: _lastContext, contextUsage: require("./yoke/usage").context(active.lastContextUsage, active.vendor || "claude") });
       if (scheduledMessages) scheduledMessages.sendState(active, ws);
       if (pairResultRecovery) pairResultRecovery.sendState(active, ws);
 

package/lib/project-control-git-view.js

@@ -0,0 +1,12 @@
+var fs = require('fs'), path = require('path');
+var projection = require('./clay-control-target-projection');
+function project(service, principal, status, manager) {
+  var before = service.rootIdentity(principal, 'git');
+  var directory = fs.realpathSync(status.gitDir), stat = fs.statSync(directory), indexPath = path.join(directory, 'index');
+  var index = fs.existsSync(indexPath) ? require('crypto').createHash('sha256').update(fs.readFileSync(indexPath)).digest('hex') : null;
+  var view = { runtimeId: projection.runtime(manager), repository: projection.digest([directory, [stat.dev, stat.ino, stat.mode, stat.uid, stat.gid]]),
+    files: status.files.slice(0, 200).map(function (file) { return { path: file.path, revision: projection.digest([status.oid, index, file]) }; }) };
+  if (service.rootIdentity(principal, 'git') !== before) throw new Error('Workspace identity changed during projection.');
+  return view;
+}
+module.exports = { project: project };

package/lib/project-filesystem.js

@@ -116,7 +116,11 @@ function attachFilesystem(ctx) {
     // --- fs_read ---
     if (msg.type === "fs_read") {
       var metadata = { type: 'fs_read_result', path: msg.path, requestId: msg.requestId, projectSlug: msg.projectSlug, sessionId: msg.sessionId, accountId: msg.accountId };
-      try { sendTo(ws, Object.assign(metadata, operations.read(fileScope, msg.path))); }
+      try {
+        var readResult = operations.read(fileScope, msg.path);
+        try { var fileSnapshot = operations.snapshot(fileScope, msg.path); if (fileSnapshot.hash === require('crypto').createHash('sha256').update(readResult.content).digest('hex')) readResult.controlRevision = require('./clay-control-target-projection').digest(fileSnapshot); } catch (ignored) {}
+        sendTo(ws, Object.assign(metadata, readResult));
+      }
       catch (e) { sendTo(ws, Object.assign(metadata, { error: fileError(e).message, errorCode: fileError(e).code })); }
       return true;
     }

package/lib/project-http.js

@@ -419,9 +419,9 @@ function attachHTTP(ctx) {
         var uninstallUserInfo = getOsUserInfoForReq(req);
         var baseDir = scope === "global" ? (uninstallUserInfo ? uninstallUserInfo.home : require("./config").REAL_HOME) : cwd;
         if (osUsers && !uninstallUserInfo) throw new Error("A mapped OS user is required to uninstall skills");
-        var skillDir = claySkillStorage.isClaySkill(skill) ? path.join(claySkillStorage.privateRoot(baseDir), skill) : path.join(baseDir, ".claude", "skills", skill);
+        var skillDir = claySkillStorage.isClaySkill(skill) ? path.join(claySkillStorage.privateRoot(baseDir), skill) : path.join(require("./yoke/source-locations").legacySkillRoot(baseDir), skill);
         // Safety: keep removal inside the selected skill storage root.
-        var expectedParent = claySkillStorage.isClaySkill(skill) ? claySkillStorage.privateRoot(baseDir) : path.join(baseDir, ".claude", "skills");
+        var expectedParent = claySkillStorage.isClaySkill(skill) ? claySkillStorage.privateRoot(baseDir) : require("./yoke/source-locations").legacySkillRoot(baseDir);
         var resolved = path.resolve(skillDir);
         if (!resolved.startsWith(expectedParent + path.sep)) {
           res.writeHead(403, { "Content-Type": "application/json" });
@@ -528,8 +528,8 @@ function attachHTTP(ctx) {
           var sui = getOsUserInfoForReq(req);
           return sui ? sui.home : require("./config").REAL_HOME;
         })();
-        var globalSkillsDir = path.join(skillUserHome, ".claude", "skills");
-        var projectSkillsDir = path.join(cwd, ".claude", "skills");
+        var globalSkillsDir = require("./yoke/source-locations").legacySkillRoot(skillUserHome);
+        var projectSkillsDir = require("./yoke/source-locations").legacySkillRoot(cwd);
         var results = [];
         var pending = skills.length;
 
@@ -663,6 +663,9 @@ function attachHTTP(ctx) {
       var gitUserInfo = getOsUserInfoForReq(req);
       try {
         var gitStatus = gitCli.getStatus(cwd, gitUserInfo);
+        if (ctx.workspaceOperations) {
+          try { gitStatus.controlView = require('./project-control-git-view').project(ctx.workspaceOperations, { userId: req._clayUser && req._clayUser.id || null, singleUserOwnerId: ctx.getProjectOwnerId && ctx.getProjectOwnerId() || null }, gitStatus, sm); } catch (ignored) {}
+        }
         if (gitAttribution) {
           var visibleGitSessions = sm.sessions;
           if (usersModule.isMultiUser() && req._clayUser) {

package/lib/project-mcp.js

@@ -26,7 +26,7 @@ function attachMcp(ctx) {
   }
   function isSession(subject) { return !!subject && ctx.canUseSession(subject); }
   function sourceIdentity(subject) { return isSession(subject) ? ctx.ownerIdentity(ctx.isMultiUser() ? String(subject.ownerId) : 'default') : ctx.identity(subject); }
-  var discovery = require('./mcp-source-discovery').createDiscovery({ cwd: ctx.cwd || process.cwd(), home: ctx.discoveryHome,
+  var discovery = require('./yoke/mcp-source-discovery').createDiscovery({ cwd: ctx.cwd || process.cwd(), home: ctx.discoveryHome,
     identity: sourceIdentity, runtimeEnv: function (owner, subject) { return isSession(subject) ? ctx.runtimeEnvForSession(subject) : ctx.runtimeEnv ? ctx.runtimeEnv(owner, subject) : {}; }, authorize: function (owner, subject) {
       var permitted = isSession(subject) ? (ctx.isMultiUser() ? String(subject.ownerId) : 'default') === owner && ctx.canDiscoverSession(subject) : ownerFor(subject) === owner && ctx.canDiscover && ctx.canDiscover(subject);
       if (!permitted) throw new Error('Vendor discovery requires your authorized OS user mapping or a sole account installation.');
@@ -152,7 +152,7 @@ function attachMcp(ctx) {
     });
   }
   function getMcpServers(session, allowManagement) {
-    if (!session || !ctx.canUseSession(session) || (ctx.sessionVendor ? ctx.sessionVendor(session) : session.vendor) === 'antigravity') return {};
+    if (!session || !ctx.canUseSession(session) || !require('./yoke/session-tool-transport').capability(ctx.sessionVendor ? ctx.sessionVendor(session) : session.vendor || 'claude').supported) return {};
     var owner = ctx.isMultiUser() ? String(session.ownerId) : 'default';
     function authorize() {
       authorizeOwner(owner);

package/lib/project-notifications.js

@@ -154,8 +154,9 @@ function attachNotifications(ctx) {
     return notifications.length;
   }
 
+  function controlProjection(item) { var value = Object.assign({}, item); delete value.controlRevision; return Object.assign(value, { controlRevision: require('./clay-control-target-projection').digest(value) }); }
   function visible(ws) {
-    return notifications.filter(function (notification) { return !ctx.canView || ctx.canView(ws, notification); });
+    return notifications.filter(function (notification) { return !ctx.canView || ctx.canView(ws, notification); }).map(controlProjection);
   }
 
   function publish(payload) {
@@ -164,7 +165,7 @@ function attachNotifications(ctx) {
       if (ws.readyState !== 1) return;
       if (payload.notification && !ctx.canView(ws, payload.notification)) return;
       var list = visible(ws);
-      ws.send(JSON.stringify(Object.assign({}, payload, { unreadCount: list.length })));
+      ws.send(JSON.stringify(Object.assign({}, payload, { notification: payload.notification ? controlProjection(payload.notification) : undefined, unreadCount: list.length })));
     });
   }
 
@@ -197,7 +198,7 @@ function attachNotifications(ctx) {
     saveNotifications();
     var payload = {
       type: "notification_created",
-      notification: notif,
+      notification: controlProjection(notif),
       unreadCount: getUnreadCount(),
     };
     // Project/session previews are projected for each authenticated viewer.
@@ -235,7 +236,7 @@ function attachNotifications(ctx) {
     if (items.some(function (item) { return !canReadOwned(principal, item); })) throw new Error('Owned notification access changed.');
   }
   function listOwned(principal) {
-    return notifications.filter(function (item) { return canReadOwned(principal, item); }).slice(0, 100).map(function (item) { return JSON.parse(JSON.stringify(item)); });
+    return notifications.filter(function (item) { return canReadOwned(principal, item); }).slice(0, 100).map(function (item) { return JSON.parse(JSON.stringify(controlProjection(item))); });
   }
   function inspectOwned(principal, ids) {
     var owned = listOwned(principal);

package/lib/project-pair-result-delivery.js

@@ -125,8 +125,8 @@ function attachPairResultDelivery(ctx) {
         if (!currentAttempt(caller, partner, token, attemptId)) return;
         // A known, cancellable provider admission wait has not sent input.
         // Keep the correlated completion eligible until admission or Stop.
-        if (caller._queryStarting && Number(caller._codexRecoveryWaiting) > 0
-            && caller._codexRecoveryWaiting === caller._sdkQueryGeneration) {
+        if (caller._queryStarting && Number(caller._providerRecoveryWaiting) > 0
+            && caller._providerRecoveryWaiting === caller._sdkQueryGeneration) {
           token._deliveryTimer = { attemptId: attemptId, timer: setTimeout(acceptanceTimeout, timeoutMs) };
           return;
         }

package/lib/project-pair-usage.js

@@ -16,16 +16,14 @@ function contextStatus(session) {
   var used = null;
   var window = null;
   var source = "unavailable";
+  var measurement = "unavailable";
   if (snapshot && typeof snapshot === "object") {
-    if (session.vendor === "claude") {
-      used = firstNumber(snapshot.totalTokens);
-      window = firstNumber(snapshot.maxTokens);
-      if (used !== null || window !== null) source = "claude_sdk_context_usage";
-    } else {
-      used = firstNumber(snapshot.input_tokens);
-      window = firstNumber(snapshot.contextWindow);
-      if (used !== null || window !== null) source = "adapter_context_usage";
-    }
+    var current = require("./yoke/usage").context(snapshot, session.vendor || "claude").context;
+    measurement = current.measurement;
+    used = firstNumber(current.usedTokens);
+    window = firstNumber(current.windowTokens);
+    if (used !== null || window !== null) source = current.source;
+
   }
   var history = session.history || [];
   var cumulativeInput = 0;
@@ -46,9 +44,9 @@ function contextStatus(session) {
       if (typeof item._ts === "number") lastCompactionAt = item._ts;
     }
     if (item.type !== "result") continue;
-    var usage = item.usage || {};
-    var input = firstNumber(usage.input_tokens, usage.inputTokens);
-    var output = firstNumber(usage.output_tokens, usage.outputTokens);
+    var usage = require("./yoke/usage").accounting(item.usage) || {};
+    var input = firstNumber(usage.inputTokens);
+    var output = firstNumber(usage.outputTokens);
     if (input !== null) { cumulativeInput += input; observedInput = true; }
     if (output !== null) { cumulativeOutput += output; observedOutput = true; }
     results++;
@@ -59,13 +57,14 @@ function contextStatus(session) {
   if (used !== null && window !== null && used > window) {
     used = null;
     source = "unavailable";
+    measurement = "unavailable";
   }
   // Older result records contain lastStreamInputTokens, but that field was
   // populated from adapter snapshots that could be cumulative or inflated by
   // cache accounting. It is not safe evidence of current context occupancy.
   var ratio = used !== null && window !== null && window > 0 ? Math.min(1, Math.round((used / window) * 1000) / 1000) : null;
   return {
-    current: { source: source, usedTokens: used, windowTokens: window, usedRatio: ratio,
+    current: { source: source, measurement: measurement, usedTokens: used, windowTokens: window, usedRatio: ratio,
       scope: used === null && window === null ? "unknown" : (used !== null && window !== null ? "current_context" : "partial_current_context") },
     cumulative: { inputTokens: observedInput ? cumulativeInput : null, outputTokens: observedOutput ? cumulativeOutput : null, tasksObserved: results, scope: "loaded_session_history", complete: false },
     lastTask: lastTask,

package/lib/project-pending-message-queue.js

@@ -249,7 +249,8 @@ function createPendingMessageQueue(opts) {
     return true;
   }
   function consumeOne(session, dispatch) {
-    if (loadError || !session || session._pendingMessageClaimId || isPaused(session) || session._pendingMessageDrainPaused || session.taskStopRequested || session._queryStarting || session._awaitingTurnResult || session.isProcessing) return null;
+    var foreground = require('./sdk-foreground-admission');
+    if (loadError || !session || session._pendingMessageClaimId || isPaused(session) || session._pendingMessageDrainPaused || session.taskStopRequested || session._queryStarting || (session._awaitingTurnResult || session.isProcessing) && !foreground.available(session)) return null;
     if (session.rateLimitResetsAt && session.rateLimitResetsAt > Date.now()) return null;
     for (var i = 0; i < data.items.length; i++) {
       var item = data.items[i];
@@ -262,6 +263,7 @@ function createPendingMessageQueue(opts) {
       data.revision++;
       try { persist(); } catch (e) { restore(before); return null; }
       session._pendingMessageClaimId = item.id;
+      foreground.take(session);
       broadcast(session, { type: "pending_message_claimed", sessionId: session.localId, projectSlug: opts.slug, paused: isPaused(session), id: item.id, revision: data.revision });
       var completed = false;
       function complete(ok, error) { if (completed) return false; completed = true; return finishClaim(session, item.id, ok, error); }

package/lib/project-product-control.js

@@ -18,9 +18,11 @@ function attachProjectProductControl(ctx) {
     if (session.ownerId && session.ownerId !== principal.singleUserOwnerId) throw new Error("Live target ownership denied.");
     return null;
   }
-  function review(session, question, revalidate) {
+  function review(session, question, revalidate, presentation) {
     var owner = session.ownerId || null;
     return userInput.dispatchUserInput(function (request, respond) {
+      // Presentation comes only from the bound product service, after normalization.
+      if (presentation) request.questions[0].review = presentation;
       request.authorizeResponse = function (ws) {
         try {
           revalidate();

package/lib/project-scheduled-messages.js

@@ -234,7 +234,7 @@ function attachProjectScheduledMessages(ctx) {
           images: images,
           pastes: pastes,
           clientMessageId: requestId ? "scheduled-request-" + requestId : "scheduled-" + job.id,
-          schedule: { jobId: job.id, revision: job.payload.revision, notBefore: job.runAt, ready: false },
+          schedule: { jobId: job.id, revision: job.payload.revision, notBefore: job.runAt, ready: false, logicalScheduleId: job.payload.logicalScheduleId || null, logicalRevision: job.payload.logicalRevision || null },
         }, queueActor(actorId));
         if (!queuedScheduled.ok) {
           if (current) {
@@ -304,7 +304,7 @@ function attachProjectScheduledMessages(ctx) {
           images: existing ? existing.message.images : undefined,
           pastes: existing ? existing.message.pastes : undefined,
           clientMessageId: existing ? existing.clientMessageId : "scheduled-" + updated.id,
-          schedule: { jobId: updated.id, revision: updated.payload.revision, notBefore: updated.runAt, ready: false },
+          schedule: { jobId: updated.id, revision: updated.payload.revision, notBefore: updated.runAt, ready: false, logicalScheduleId: updated.payload.logicalScheduleId || null, logicalRevision: updated.payload.logicalRevision || null },
         }, queueActor(actorUser && actorUser.id));
         if (!queued.ok) {
           try { scheduler.replaceQueued(job.id, job); }
@@ -375,7 +375,7 @@ function attachProjectScheduledMessages(ctx) {
       if (!ensured && job.payload.queueAdmissionRequired === true) throw new Error("Scheduled queue item is missing; refusing to recreate message payload.");
       if (!ensured) ensured = pendingMessageQueue.upsertScheduled(session, {
         type: "message", text: job.payload.text, clientMessageId: "scheduled-" + job.id,
-        schedule: { jobId: job.id, revision: job.payload.revision, notBefore: job.runAt, ready: false },
+        schedule: { jobId: job.id, revision: job.payload.revision, notBefore: job.runAt, ready: false, logicalScheduleId: job.payload.logicalScheduleId || null, logicalRevision: job.payload.logicalRevision || null },
       }, queueActor(job.payload.actorId));
       if (!ensured || ensured.ok === false) throw new Error(ensured.error || "Scheduled queue handoff could not be prepared.");
       var released = pendingMessageQueue.releaseScheduled(session, job.id, job.payload.revision);
@@ -438,7 +438,7 @@ function attachProjectScheduledMessages(ctx) {
         if (jobs[i].state === "queued" && !queueItemForJob(session, jobs[i], jobs[i].payload.actorId)) {
           if (jobs[i].payload.queueAdmissionRequired !== true || (jobs[i].payload.mateScheduleId && ctx.mateLifecycle && ctx.mateLifecycle().current(session, jobs[i]))) pendingMessageQueue.upsertScheduled(session, {
             type: "message", text: jobs[i].payload.text, clientMessageId: "scheduled-" + jobs[i].id,
-            schedule: { jobId: jobs[i].id, revision: jobs[i].payload.revision, notBefore: jobs[i].runAt, ready: false },
+            schedule: { jobId: jobs[i].id, revision: jobs[i].payload.revision, notBefore: jobs[i].runAt, ready: false, logicalScheduleId: jobs[i].payload.logicalScheduleId || null, logicalRevision: jobs[i].payload.logicalRevision || null },
           }, actor);
         }
         else if (["interrupted", "completed"].indexOf(jobs[i].state) >= 0) {

package/lib/project-scheduled-task-control.js

@@ -31,7 +31,7 @@ function attachScheduledTaskControl(ctx) {
     var begun = ctx.beginManual(session, requestId);
     if (!begun.ok) throw new Error(begun.error);
     var prior = session.scheduledTaskDraft;
-    var draft = Object.assign({}, prior, checked.value, { canonicalScheduling: true });
+    var draft = Object.assign({}, prior, checked.value, { canonicalScheduling: true, version: Number(prior.version || 0) + 1 });
     session.scheduledTaskDraft = draft;
     if (ctx.sm.saveSessionFile(session) !== true) { session.scheduledTaskDraft = prior; throw new Error('The canonical schedule proposal could not be saved.'); }
     if (drafts.size >= 100) drafts.delete(drafts.keys().next().value);

package/lib/project-session-document.js

@@ -63,23 +63,34 @@ function attachSessionDocument(ctx) {
 
   function canUse(caller) { return !!caller && (!ctx.canUseSession || ctx.canUseSession(caller)); }
 
+  function activity(caller, action) {
+    if (ctx.studioPresentation) return ctx.studioPresentation.begin(caller, action);
+    try { var display = ctx.getPresentation && ctx.getPresentation(caller); return display && display.track('studio', action); } catch (error) { return null; }
+  }
   function present(args, caller) {
     if (!canUse(caller)) return toolError("Documents require a live authorized session.");
     if (!caller) return toolError("present_markdown_edit requires a session-bound tool server");
     var target = resolveMarkdownPath(args.path);
     if (!target) return toolError("path must be a .md or .mdx file inside the project");
+    var observer;
     try {
+      observer = activity(caller, 'document');
       var snapshot = readSnapshot(target, caller);
       var relativePath = path.relative(cwd, target).split(path.sep).join("/");
-      sendToSession(caller.localId, {
+      var message = {
         type: "markdown_edit_present",
         path: relativePath,
         content: snapshot.content,
         exists: snapshot.exists,
-        size: snapshot.size,
-      });
+        size: snapshot.size, sessionId: caller.localId,
+      };
+      var delivered;
+      if (observer && observer.present) delivered = observer.present(message, "document", relativePath, require("./clay-control-target-projection").digest(snapshot), function () { if (!canUse(caller) || require("./clay-control-target-projection").digest(readSnapshot(target, caller)) !== require("./clay-control-target-projection").digest(snapshot)) throw new Error("Document revision changed."); }, function (value, onSent) { return sendToSession(caller.localId, value, onSent); });
+      else delivered = sendToSession(caller.localId, message);
+      if (observer && !observer.present) observer.finish(delivered > 0 ? { status: 'delivered' } : { outcome: 'uncertain' });
       return toolResult({ ready: true, path: relativePath });
     } catch (e) {
+      if (observer) { if (observer.unknown) observer.unknown(); else observer.finish({ outcome: 'uncertain' }); }
       return toolError(e.message || String(e));
     }
   }
@@ -95,11 +106,15 @@ function attachSessionDocument(ctx) {
     } catch (e) {
       return toolError(e.message || String(e));
     }
+    var observer = activity(caller, 'sketch');
     return wireframeRenderer.renderPlantUml(source).then(function () {
-      if (!canUse(caller)) return toolError("Document access changed.");
-      sendToSession(caller.localId, { type: "wireframe_present", source: source, id: args.id, title: String(args.title || "clay-sketch").slice(0, 100), sessionId: caller.localId });
+      if (!canUse(caller)) { if (observer) { if (observer.fail) observer.fail(); else observer.cancel(); } return toolError("Document access changed."); }
+      var message = { type: "wireframe_present", source: source, id: args.id, title: String(args.title || "clay-sketch").slice(0, 100), sessionId: caller.localId };
+      var delivered = observer && observer.present ? observer.present(message, "sketch", args.id, require("./clay-control-target-projection").digest(source), function () { if (!canUse(caller)) throw new Error("Sketch source changed."); }, function (value, onSent) { return sendToSession(caller.localId, value, onSent); }) : sendToSession(caller.localId, message);
+      if (observer && !observer.present) observer.finish(delivered > 0 ? { status: 'delivered' } : { outcome: 'uncertain' });
       return toolResult({ ready: true, id: args.id, saved: false });
     }).catch(function (e) {
+      if (observer) { if (observer.unknown) observer.unknown(); else observer.finish({ outcome: 'uncertain' }); }
       return toolError(e && e.message ? e.message : String(e));
     });
   }

package/lib/project-session-history-actions.js

@@ -105,7 +105,10 @@ function attachSessionHistoryActions(ctx) {
         if (session.messageUUIDs[fi].uuid === uuid) { targetIdx = fi; break; }
       }
       var forkHistory = [];
-      if (targetIdx >= 0) {
+      if (result.localHistoryEndIndex !== undefined) {
+        if (!Number.isInteger(result.localHistoryEndIndex) || result.localHistoryEndIndex < 0 || result.localHistoryEndIndex > session.history.length) throw new Error("The provider fork exists but its local history boundary is unavailable; inspect before retrying");
+        forkHistory = session.history.slice(0, result.localHistoryEndIndex);
+      } else if (targetIdx >= 0) {
         var trimTo = session.messageUUIDs[targetIdx].historyIndex;
         forkHistory = session.history.slice(0, trimTo);
       } else {
@@ -133,8 +136,7 @@ function attachSessionHistoryActions(ctx) {
       return forked;
     } else {
       // Read history from CLI session files
-      var cliSess = require("./cli-sessions");
-      var history = await cliSess.readCliSessionHistory(resolveSessionHome(session), cwd, result.sessionId);
+      var history = await require("./yoke/session-history").read(session.vendor || "claude", resolveSessionHome(session), cwd, result.sessionId);
       revalidate();
       var options = {
         history: history,

package/lib/project-session-pair.js

@@ -350,7 +350,7 @@ function attachSessionPair(ctx) {
     if (boundRoles && boundRoles.workers.indexOf(boundSession) !== -1) return taskControl.workerToolDefs(boundSession);
     var adHocSplit = !!(group && !group.pair);
     if (!driverEligibility.isEligibleDriverSession(boundSession, sm)) return [];
-    var persistentCatalog = boundSession.vendor === "codex" && (!group || !!group.pair);
+    var persistentCatalog = require("./yoke/session-tool-transport").contract(boundSession.vendor || "claude").catalogLifetime === "conversation" && (!group || !!group.pair);
     if (!group && !persistentCatalog) {
       return workerProposal.getToolDefs(boundSession)
         .concat(workerPermission.getToolDefs(boundSession, { dormantDriver: true }));