clay-server 4.0.0-beta.17 → 4.0.0-beta.19

package/lib/daemon-projects.js

@@ -29,9 +29,9 @@ function isWorktreeSlug(slug) {
  * @param {string} parentIcon - icon of parent project
  * @param {string} parentOwnerId - owner user ID
  */
-function scanAndRegisterWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerId, projectKnowledgeId) {
-  if (isWorktree(parentPath)) return;
-  var worktrees = scanWorktrees(parentPath);
+function scanAndRegisterWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerId, projectKnowledgeId, osUserInfo) {
+  if (isWorktree(parentPath, osUserInfo)) return;
+  var worktrees = scanWorktrees(parentPath, osUserInfo);
   if (worktrees.length === 0) return;
   if (!worktreeRegistry[parentSlug]) worktreeRegistry[parentSlug] = [];
   for (var i = 0; i < worktrees.length; i++) {
@@ -42,14 +42,14 @@ function scanAndRegisterWorktrees(relay, parentPath, parentSlug, parentIcon, par
       if (worktreeRegistry[parentSlug][j] === wtSlug) { alreadyRegistered = true; break; }
     }
     if (alreadyRegistered) continue;
-    var context = logContext.resolveWorktreeContext(wt.path, projectKnowledgeId, { branch: wt.branch || wt.dirName });
+    var context = logContext.resolveWorktreeContext(wt.path, projectKnowledgeId, { branch: wt.branch || wt.dirName }, osUserInfo);
     var wtMeta = Object.assign({ parentSlug: parentSlug, external: wt.external, projectKnowledgeId: projectKnowledgeId }, context);
     relay.addProject(wt.path, wtSlug, wt.branch || wt.dirName, parentIcon, parentOwnerId, wtMeta);
     worktreeRegistry[parentSlug].push(wtSlug);
     console.log("[daemon] Registered worktree:", wtSlug, "->", wt.path, wt.external ? "(external)" : "(inside project folder)");
   }
   daemonSync.register(getWorktreeSyncKey(parentSlug), function () {
-    rescanWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerId, null, projectKnowledgeId);
+    rescanWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerId, null, projectKnowledgeId, osUserInfo);
   });
 }
 
@@ -62,11 +62,11 @@ function scanAndRegisterWorktrees(relay, parentPath, parentSlug, parentIcon, par
  * @param {string} parentOwnerId - owner user ID
  * @param {object} [config] - daemon config (optional, for broadcasting project count)
  */
-function rescanWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerId, config, projectKnowledgeId) {
+function rescanWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerId, config, projectKnowledgeId, osUserInfo) {
   if (worktreeScanning[parentSlug]) return;
   worktreeScanning[parentSlug] = true;
   try {
-    var discovered = scanWorktrees(parentPath);
+    var discovered = scanWorktrees(parentPath, osUserInfo);
     var changed = false;
     var existingSlugs = worktreeRegistry[parentSlug] || [];
     var discoveredNames = {};
@@ -81,7 +81,7 @@ function rescanWorktrees(relay, parentPath, parentSlug, parentIcon, parentOwnerI
         if (existingSlugs[ei] === wtSlug) { found = true; break; }
       }
       if (!found) {
-        var context = logContext.resolveWorktreeContext(wt.path, projectKnowledgeId, { branch: wt.branch || wt.dirName });
+        var context = logContext.resolveWorktreeContext(wt.path, projectKnowledgeId, { branch: wt.branch || wt.dirName }, osUserInfo);
         var wtMeta = Object.assign({ parentSlug: parentSlug, external: wt.external, projectKnowledgeId: projectKnowledgeId }, context);
         relay.addProject(wt.path, wtSlug, wt.branch || wt.dirName, parentIcon, parentOwnerId, wtMeta);
         if (!worktreeRegistry[parentSlug]) worktreeRegistry[parentSlug] = [];

package/lib/daemon.js

@@ -173,6 +173,25 @@ function projectRuntimeOptions(project) {
   return { projectKnowledgeId: project.projectKnowledgeId };
 }
 
+function worktreeOsUserInfo(project, requestUser) {
+  if (!config.osUsers) return null;
+  var owner = project && project.ownerId ? usersModule.findUserById(project.ownerId) : null;
+  var executionUser = owner && owner.linuxUser ? owner : requestUser;
+  if (!executionUser || !executionUser.linuxUser) {
+    throw new Error("The project owner does not have a provisioned Linux account");
+  }
+  return osUsersMod.resolveOsUserInfo(executionUser.linuxUser);
+}
+
+function registerProjectWorktrees(project, requestUser) {
+  try {
+    var osUserInfo = worktreeOsUserInfo(project, requestUser);
+    scanAndRegisterWorktrees(relay, project.path, project.slug, project.icon, project.ownerId, project.projectKnowledgeId, osUserInfo);
+  } catch (e) {
+    console.error("[daemon] Failed to scan worktrees for " + project.slug + ": " + e.message);
+  }
+}
+
 var relay = createServer({
   tlsOptions: tlsOptions,
   caPath: caRoot,
@@ -219,7 +238,7 @@ var relay = createServer({
       }
     }
     // Discover and register worktrees for the new project
-    scanAndRegisterWorktrees(relay, absPath, slug, null, wsUser && wsUser.id && wsUser.role !== "admin" ? wsUser.id : null, projectEntry.projectKnowledgeId);
+    registerProjectWorktrees(projectEntry, wsUser);
     // Broadcast updated project list to all clients
     relay.broadcastAll({
       type: "projects_updated",
@@ -404,8 +423,15 @@ var relay = createServer({
       }
       if (parentProject) {
         var wtPath = path.join(parentProject.path, wtDirName);
-        var contextStatus = projectLogContext.isMerged(parentProject.path, wtPath) ? "merged" : "archived";
-        var rmResult = removeWorktree(parentProject.path, wtDirName);
+        var removeUser = userId ? usersModule.findUserById(userId) : null;
+        var removeOsUserInfo;
+        try {
+          removeOsUserInfo = worktreeOsUserInfo(parentProject, removeUser);
+        } catch (e) {
+          return { ok: false, error: e.message };
+        }
+        var contextStatus = projectLogContext.isMerged(parentProject.path, wtPath, removeOsUserInfo) ? "merged" : "archived";
+        var rmResult = removeWorktree(parentProject.path, wtDirName, removeOsUserInfo);
         if (!rmResult.ok) {
           console.log("[daemon] Failed to remove worktree:", slug, rmResult.error);
           return { ok: false, error: rmResult.error };
@@ -1003,23 +1029,29 @@ var relay = createServer({
     if (!config.osUsers || !linuxUser) return;
     deactivateLinuxUser(linuxUser);
   },
-  onCreateWorktree: function (parentSlug, branchName, dirName, baseBranch) {
+  onCreateWorktree: function (parentSlug, branchName, dirName, baseBranch, requestUser) {
     // Find the parent project
     var parent = null;
     for (var j = 0; j < config.projects.length; j++) {
       if (config.projects[j].slug === parentSlug) { parent = config.projects[j]; break; }
     }
     if (!parent) return { ok: false, error: "Parent project not found" };
-    if (isWorktree(parent.path)) return { ok: false, error: "Cannot create worktrees from a worktree project" };
-    var baseCommit = projectLogContext.commit(parent.path, baseBranch || "HEAD");
-    var result = createWorktree(parent.path, branchName, dirName, baseBranch);
+    var osUserInfo;
+    try {
+      osUserInfo = worktreeOsUserInfo(parent, requestUser);
+    } catch (e) {
+      return { ok: false, error: e.message };
+    }
+    if (isWorktree(parent.path, osUserInfo)) return { ok: false, error: "Cannot create worktrees from a worktree project" };
+    var baseCommit = projectLogContext.commit(parent.path, baseBranch || "HEAD", osUserInfo);
+    var result = createWorktree(parent.path, branchName, dirName, baseBranch, osUserInfo);
     if (!result.ok) return result;
     // Register the new worktree as ephemeral project
     var wtSlug = parentSlug + "--" + dirName;
     var context = projectLogContext.resolveWorktreeContext(result.path, parent.projectKnowledgeId, {
       branch: branchName,
       baseCommit: baseCommit,
-    });
+    }, osUserInfo);
     var wtMeta = Object.assign({ parentSlug: parentSlug, external: false, projectKnowledgeId: parent.projectKnowledgeId }, context);
     relay.addProject(result.path, wtSlug, branchName, parent.icon, parent.ownerId, wtMeta);
     registerWorktreeSlug(parentSlug, wtSlug);
@@ -1114,7 +1146,7 @@ var ipc = createIPCServer(socketPath(), function (msg) {
       try { syncClayrc(config.projects); } catch (e) {}
       console.log("[daemon] Added project:", slug, "→", absPath);
       // Discover and register worktrees for the new project
-      scanAndRegisterWorktrees(relay, absPath, slug, null, null, projectEntry.projectKnowledgeId);
+      registerProjectWorktrees(projectEntry, null);
       relay.broadcastAll({
         type: "projects_updated",
         projects: relay.getProjects(),
@@ -1345,7 +1377,7 @@ for (var i = 0; i < projects.length; i++) {
     console.log("[daemon] Adding project:", p.slug, "→", p.path);
     relay.addProject(p.path, p.slug, p.title, p.icon, p.ownerId, null, projectRuntimeOptions(p));
     // Discover and register worktrees for this project
-    scanAndRegisterWorktrees(relay, p.path, p.slug, p.icon, p.ownerId, p.projectKnowledgeId);
+    registerProjectWorktrees(p, null);
   } else {
     console.log("[daemon] Skipping missing project:", p.path);
   }

package/lib/git-cli.js

@@ -458,6 +458,7 @@ module.exports = {
   parsePorcelainV2: parsePorcelainV2,
   parseWorktrees: parseWorktrees,
   readWorkingTreeFile: readWorkingTreeFile,
+  runGitSync: runGitSync,
   runAction: runAction,
   shortRemoteLabel: shortRemoteLabel,
 };

package/lib/os-users.js

@@ -161,7 +161,9 @@ function fsAsUser(op, args, osUserInfo) {
       "var fs = require('fs');",
       "var f = " + JSON.stringify(args.file) + ";",
       "var content = " + JSON.stringify(args.content || "") + ";",
-      "fs.writeFileSync(f, content, 'utf8');",
+      "var flag = " + JSON.stringify(args.flag === "wx" ? "wx" : "w") + ";",
+      "var mode = " + JSON.stringify(typeof args.mode === "number" ? args.mode : 0o666) + ";",
+      "fs.writeFileSync(f, content, { encoding: 'utf8', flag: flag, mode: mode });",
       "process.stdout.write(JSON.stringify({ ok: true }));",
     ].join(" ");
   } else if (op === "mkdir") {

package/lib/project-log-context.js

@@ -9,7 +9,8 @@
 var crypto = require("crypto");
 var fs = require("fs");
 var path = require("path");
-var execFileSync = require("child_process").execFileSync;
+var { runGitSync } = require("./git-cli");
+var { fsAsUser } = require("./os-users");
 var logsRoot = require("./project-logs-root");
 var utils = require("./utils");
 
@@ -47,23 +48,18 @@ function createProjectKnowledgeId() {
   return newId("pk");
 }
 
-function git(cwd, args) {
-  return execFileSync("git", args, {
-    cwd: cwd,
-    encoding: "utf8",
-    timeout: 5000,
-    stdio: ["pipe", "pipe", "pipe"],
-  }).trim();
+function git(cwd, args, osUserInfo) {
+  return runGitSync(cwd, args, null, osUserInfo).trim();
 }
 
-function commit(cwd, ref) {
-  try { return git(cwd, ["rev-parse", ref || "HEAD"]); }
+function commit(cwd, ref, osUserInfo) {
+  try { return git(cwd, ["rev-parse", ref || "HEAD"], osUserInfo); }
   catch (e) { return null; }
 }
 
-function markerPath(cwd) {
+function markerPath(cwd, osUserInfo) {
   try {
-    var gitDir = git(cwd, ["rev-parse", "--git-dir"]);
+    var gitDir = git(cwd, ["rev-parse", "--git-dir"], osUserInfo);
     return path.join(path.resolve(cwd, gitDir), "clay-change-set.json");
   } catch (e) {
     return null;
@@ -86,9 +82,18 @@ function deterministicFallback(knowledgeId, cwd) {
   return "cs_" + digest.substring(0, 22);
 }
 
-function resolveWorktreeContext(cwd, knowledgeId, details) {
+function writeMarker(filePath, marker, osUserInfo) {
+  var content = JSON.stringify(marker, null, 2) + "\n";
+  if (osUserInfo) {
+    fsAsUser("write", { file: filePath, content: content, flag: "wx", mode: 0o600 }, osUserInfo);
+    return;
+  }
+  fs.writeFileSync(filePath, content, { flag: "wx", mode: 0o600 });
+}
+
+function resolveWorktreeContext(cwd, knowledgeId, details, osUserInfo) {
   var input = details || {};
-  var filePath = markerPath(cwd);
+  var filePath = markerPath(cwd, osUserInfo);
   var marker = readMarker(filePath, knowledgeId);
   if (!marker) {
     marker = {
@@ -99,7 +104,7 @@ function resolveWorktreeContext(cwd, knowledgeId, details) {
     };
     if (filePath) {
       try {
-        fs.writeFileSync(filePath, JSON.stringify(marker, null, 2) + "\n", { flag: "wx", mode: 0o600 });
+        writeMarker(filePath, marker, osUserInfo);
       } catch (e) {
         marker = readMarker(filePath, knowledgeId) || marker;
       }
@@ -113,20 +118,16 @@ function resolveWorktreeContext(cwd, knowledgeId, details) {
     changeSetId: marker.changeSetId,
     branch: input.branch || null,
     baseCommit: marker.baseCommit || input.baseCommit || null,
-    headCommit: commit(cwd, "HEAD"),
+    headCommit: commit(cwd, "HEAD", osUserInfo),
     status: "active",
   };
 }
 
-function isMerged(parentCwd, worktreeCwd) {
-  var head = commit(worktreeCwd, "HEAD");
+function isMerged(parentCwd, worktreeCwd, osUserInfo) {
+  var head = commit(worktreeCwd, "HEAD", osUserInfo);
   if (!head) return false;
   try {
-    execFileSync("git", ["merge-base", "--is-ancestor", head, "HEAD"], {
-      cwd: parentCwd,
-      timeout: 5000,
-      stdio: ["pipe", "pipe", "pipe"],
-    });
+    runGitSync(parentCwd, ["merge-base", "--is-ancestor", head, "HEAD"], null, osUserInfo);
     return true;
   } catch (e) {
     return false;

package/lib/project-logs-mcp-server.js

@@ -22,6 +22,11 @@ var LOGS_CONTRACT =
   "Do not paste raw conversation transcripts, log command-by-command narration, trivial confirmations, or speculation. Repository history may show the code change but usually does not preserve the user's intent, constraints, verification, or unfinished state, so it is not a substitute for the work log. " +
   "Every write is attributed and permanently revision-tracked, so keep entries concise, concrete, and true while retaining enough context for a clean Driver handoff.";
 
+var CLAY_READ_CONTRACT =
+  "When the user asks Clay about a project's prior work, decisions, defects, status, rationale, or unfinished work, identify the relevant project and search its Project Logs before answering. " +
+  "Use conversation history as additional evidence when useful, but do not substitute it for the ledger's durable project record. Do not search Logs for unrelated general questions. " +
+  "When citing a returned log in user-visible text, write [clayos/<ref> — short label] so Clay Studio renders an owner-validated Log control.";
+
 // User learning moments are a durable project asset, so capturing them is a
 // default rather than an option. This category is about a change in the user's
 // conceptual model, never knowledge the Driver acquired while doing the work.
@@ -236,7 +241,7 @@ function globalTools(bound) {
   return [
     {
       name: "list_project_logs",
-      description: LOGS_CONTRACT + " List logs for one project the current user is authorized to see. Read-only, and available only to authoritative builtin Clay.",
+      description: LOGS_CONTRACT + " " + CLAY_READ_CONTRACT + " List logs for one project the current user is authorized to see. Read-only, and available only to authoritative builtin Clay.",
       inputSchema: buildShape({
         projectSlug: { type: "string", description: "Exact project slug." },
         kind: { type: "string", description: "Optional category filter, matched exactly against this project's vocabulary. The response lists the categories currently in use." },
@@ -250,7 +255,7 @@ function globalTools(bound) {
     },
     {
       name: "search_project_logs",
-      description: LOGS_CONTRACT + " Search logs for one project the current user is authorized to see. Read-only, and available only to authoritative builtin Clay.",
+      description: LOGS_CONTRACT + " " + CLAY_READ_CONTRACT + " Search logs for one project the current user is authorized to see. Read-only, and available only to authoritative builtin Clay.",
       inputSchema: buildShape({
         projectSlug: { type: "string", description: "Exact project slug." },
         query: { type: "string", description: "Search query." },
@@ -264,7 +269,7 @@ function globalTools(bound) {
     },
     {
       name: "read_project_log_revision",
-      description: LOGS_CONTRACT + " Read one entry as of a given revision. Read-only, and available only to authoritative builtin Clay.",
+      description: LOGS_CONTRACT + " " + CLAY_READ_CONTRACT + " Read one entry as of a given revision. Read-only, and available only to authoritative builtin Clay.",
       inputSchema: buildShape({
         projectSlug: { type: "string", description: "Exact project slug." },
         ref: { type: "string", description: REF_DESCRIPTION },
@@ -274,7 +279,7 @@ function globalTools(bound) {
     },
     {
       name: "read_project_log",
-      description: LOGS_CONTRACT + " Read one log entry from an authorized project, including its summary and any comments people have added. Read-only, and available only to authoritative builtin Clay.",
+      description: LOGS_CONTRACT + " " + CLAY_READ_CONTRACT + " Read one log entry from an authorized project, including its summary and any comments people have added. Read-only, and available only to authoritative builtin Clay.",
       inputSchema: buildShape({
         projectSlug: { type: "string", description: "Exact project slug." },
         ref: { type: "string", description: REF_DESCRIPTION },
@@ -312,6 +317,7 @@ function createMcpServer(adapter, bound, includeGlobal) {
 
 module.exports = {
   LOGS_CONTRACT: LOGS_CONTRACT,
+  CLAY_READ_CONTRACT: CLAY_READ_CONTRACT,
   LEARNING_CONTRACT: LEARNING_CONTRACT,
   ATTENTION_CONTRACT: ATTENTION_CONTRACT,
   REVIEW_CONTRACT: REVIEW_CONTRACT,

package/lib/project-logs-service.js

@@ -21,6 +21,7 @@
 
 var builtinMates = require("./builtin-mates");
 var logsStore = require("./project-logs-store");
+var LOG_REF_PATTERN = /^log:[A-Za-z0-9_-]{24}$/;
 
 function readOnly() {
   throw new Error("Project Logs are read-only for builtin Clay.");
@@ -396,6 +397,33 @@ function attachProjectLogsService(ctx) {
       return storeForStatus(statusFor(principal, slug));
     }
 
+    function resolveLogNavigation(args) {
+      var principal = revalidate();
+      var ref = args && args.ref;
+      if (!LOG_REF_PATTERN.test(ref || "")) throw new Error("Invalid log reference.");
+      var projects = getProjects();
+      var seenScopes = new Set();
+      var match = null;
+      if (!projects || typeof projects.forEach !== "function") throw new Error("Project Logs are unavailable.");
+      projects.forEach(function (project, slug) {
+        if (!project || typeof project.getStatus !== "function") return;
+        var status = project.getStatus();
+        if (!authorizedProject(principal, status)) return;
+        var governing = effectiveStatus(status);
+        var scope = governing && (governing.projectKnowledgeId || governing.path);
+        if (!scope || seenScopes.has(scope)) return;
+        seenScopes.add(scope);
+        var entry = null;
+        try { entry = storeForStatus(status).read(ref, false); } catch (e) { return; }
+        if (!entry) return;
+        var targetSlug = status.isWorktree && status.parentSlug && projectFor(status.parentSlug) ? status.parentSlug : slug;
+        if (match && match.projectSlug !== targetSlug) throw new Error("Log reference is ambiguous.");
+        match = { projectSlug: targetSlug, ref: ref };
+      });
+      if (!match) throw new Error("Log entry not found.");
+      return match;
+    }
+
     return {
       isClay: true,
       canWrite: false,
@@ -413,6 +441,7 @@ function attachProjectLogsService(ctx) {
       logHistory: function (args) { return target(args).history(args && args.ref, args || {}); },
       commentLog: readOnly,
       readLogRevision: function (args) { return target(args).readRevision(args && args.ref, args && args.revision); },
+      resolveLogNavigation: resolveLogNavigation,
       listLogFeedback: readOnly,
       reviewLogComment: readOnly,
       revertLog: readOnly,

package/lib/project-logs.js

@@ -366,7 +366,11 @@ function attachProjectLogs(ctx) {
   }
 
   function getSystemPrompt(session) {
-    if (isMate || !service) return "";
+    if (!service) return "";
+    if (isMate) {
+      if (!includeGlobal() || (session && !sessionBinding(session))) return "";
+      return SYSTEM_PROMPT_LABEL + "\n" + logsMcp.CLAY_READ_CONTRACT;
+    }
     if (session && !sessionBinding(session)) return "";
     return SYSTEM_PROMPT_LABEL + "\n" + logsMcp.LOGS_CONTRACT +
       "\n" + logsMcp.LEARNING_CONTRACT +

package/lib/project-sessions.js

@@ -1777,8 +1777,12 @@ function attachSessions(ctx) {
         sendTo(ws, { type: "create_worktree_result", ok: false, error: "Invalid branch name" });
         return true;
       }
+      if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(wtDirName)) {
+        sendTo(ws, { type: "create_worktree_result", ok: false, error: "Invalid worktree directory name" });
+        return true;
+      }
       if (typeof onCreateWorktree === "function") {
-        var wtResult = onCreateWorktree(slug, wtBranch, wtDirName, wtBase);
+        var wtResult = onCreateWorktree(slug, wtBranch, wtDirName, wtBase, ws._clayUser);
         sendTo(ws, { type: "create_worktree_result", ok: wtResult.ok, slug: wtResult.slug, error: wtResult.error });
       } else {
         sendTo(ws, { type: "create_worktree_result", ok: false, error: "Not supported" });

package/lib/project.js

@@ -1319,7 +1319,7 @@ function createProjectContext(opts) {
       if (typeof opts.onDmMessage === "function") opts.onDmMessage(ws, msg);
       return;
     }
-    if (msg.type === "home_clay_ask" || msg.type === "home_clay_session_resolve") {
+    if (msg.type === "home_clay_ask" || msg.type === "home_clay_session_resolve" || msg.type === "home_clay_log_resolve") {
       if (typeof opts.onDmMessage === "function") opts.onDmMessage(ws, msg, slug);
       return;
     }

package/lib/public/css/command-palette.css

@@ -486,7 +486,8 @@ body.mate-dm-active .search-clay-transcript .search-clay-message-user .bubble,
 .search-clay-activity-item small { color: var(--text-dimmer); font-size: 10px; line-height: 1.35; }
 @keyframes searchClaySpin { to { transform: rotate(360deg); } }
 
-.clayos-session-link {
+.clayos-session-link,
+.clayos-log-link {
   display: inline-flex;
   align-items: center;
   gap: 6px;
@@ -503,7 +504,8 @@ body.mate-dm-active .search-clay-transcript .search-clay-message-user .bubble,
   vertical-align: middle;
   cursor: pointer;
 }
-.clayos-session-link::before {
+.clayos-session-link::before,
+.clayos-log-link::before {
   content: "\2197";
   display: grid;
   place-items: center;
@@ -514,13 +516,21 @@ body.mate-dm-active .search-clay-transcript .search-clay-message-user .bubble,
   color: var(--accent);
   font-size: 12px;
 }
-.clayos-session-link > span { font-weight: 620; }
-.clayos-session-link > small { color: var(--text-muted); font-size: 10px; }
-.clayos-session-link:hover { border-color: color-mix(in srgb, var(--accent) 52%, var(--border)); background: color-mix(in srgb, var(--accent) 11%, var(--bg-alt)); }
-.clayos-session-link:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
-.clayos-session-link.is-loading { opacity: 0.62; cursor: progress; }
-.clayos-session-link.is-loading::before { animation: searchClaySpin 1.2s linear infinite; }
-.clayos-session-link.is-error { border-color: color-mix(in srgb, var(--warning) 48%, var(--border)); }
+.clayos-log-link::before { content: "\2261"; }
+.clayos-session-link > span,
+.clayos-log-link > span { font-weight: 620; }
+.clayos-session-link > small,
+.clayos-log-link > small { color: var(--text-muted); font-size: 10px; }
+.clayos-session-link:hover,
+.clayos-log-link:hover { border-color: color-mix(in srgb, var(--accent) 52%, var(--border)); background: color-mix(in srgb, var(--accent) 11%, var(--bg-alt)); }
+.clayos-session-link:focus-visible,
+.clayos-log-link:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+.clayos-session-link.is-loading,
+.clayos-log-link.is-loading { opacity: 0.62; cursor: progress; }
+.clayos-session-link.is-loading::before,
+.clayos-log-link.is-loading::before { animation: searchClaySpin 1.2s linear infinite; }
+.clayos-session-link.is-error,
+.clayos-log-link.is-error { border-color: color-mix(in srgb, var(--warning) 48%, var(--border)); }
 
 .search-clay-pending {
   align-self: flex-start;

package/lib/public/css/sidebar.css

@@ -930,6 +930,17 @@
   position: relative;
 }
 
+.session-driver-header {
+  display: flex;
+  align-items: center;
+}
+
+.session-driver-header > .session-item {
+  min-width: 0;
+  flex: 1;
+  padding-left: 0;
+}
+
 .session-driver-toggle {
   width: 18px;
   height: 24px;

package/lib/public/css/sticky-notes.css

@@ -85,9 +85,13 @@
   min-height: 80px;
   border: 1px solid color-mix(in srgb, var(--note-border) calc(var(--note-opacity, 0.64) * 100%), transparent);
   background: color-mix(in srgb, var(--note-surface) calc(var(--note-opacity, 0.64) * 100%), transparent);
+  -webkit-backdrop-filter: blur(7px) saturate(0.92) contrast(1.02);
+  backdrop-filter: blur(7px) saturate(0.92) contrast(1.02);
   color: var(--note-ink);
   transition: box-shadow 0.15s;
   overflow: hidden;
+  contain: layout style;
+  will-change: transform, backdrop-filter;
 }
 
 .sticky-note:hover {
@@ -798,8 +802,11 @@
 
 @media (prefers-reduced-transparency: reduce) {
   .sticky-note {
+    -webkit-backdrop-filter: none;
+    backdrop-filter: none;
     border-color: var(--note-border);
     background: var(--note-surface);
+    will-change: transform;
   }
 }
 

package/lib/public/index.html

@@ -31,7 +31,7 @@
 (function(){try{var k="clay-theme-vars",v=localStorage.getItem(k),r=document.documentElement;if(v){var o=JSON.parse(v),p;for(p in o)r.style.setProperty(p,o[p]);var vt=localStorage.getItem(k.replace("-vars","-variant"));if(vt==="light"){r.classList.add("light-theme");r.classList.remove("dark-theme")}else{r.classList.add("dark-theme");r.classList.remove("light-theme")}var m=document.querySelector('meta[name="theme-color"]');if(m&&o["--bg"])m.setAttribute("content",o["--bg"])}else{var sl=window.matchMedia&&window.matchMedia("(prefers-color-scheme: light)").matches;if(sl){r.classList.add("light-theme");r.classList.remove("dark-theme")}}}catch(e){}})();
 </script>
 <script>if(window.navigator.standalone||window.matchMedia("(display-mode:standalone)").matches){document.documentElement.classList.add("pwa-standalone")}</script>
-<link rel="stylesheet" href="style.css?v=20260901-clay-chat6">
+<link rel="stylesheet" href="style.css?v=20260908-log-links2">
 <style>
 @media(max-width:768px){
   /* User messages: vertical stack, avatar on top, right-aligned */
@@ -2337,7 +2337,7 @@
 <script src="https://cdn.jsdelivr.net/npm/@xterm/addon-fit@0/lib/addon-fit.min.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/@xterm/addon-web-links@0/lib/addon-web-links.min.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/@xterm/addon-webgl@0/lib/addon-webgl.min.js"></script>
-<script type="module" src="app.js?v=20260902-markdown-boundary1"></script>
+<script type="module" src="app.js?v=20260908-log-links2"></script>
 <div id="pwa-install-modal" class="pwa-modal hidden">
   <div class="pwa-modal-backdrop"></div>
   <div class="pwa-modal-card">

package/lib/public/modules/admin.js

@@ -2,15 +2,15 @@
 import { iconHtml, refreshIcons } from './icons.js';
 import { showToast, copyToClipboard, escapeHtml } from './utils.js';
 
-function showConfirmDialog(message, onConfirm) {
+function showConfirmDialog(message, actionLabel, onConfirm) {
   var modal = document.createElement("div");
   modal.className = "admin-modal-overlay";
-  var html = '<div class="admin-modal">' +
+  var html = '<div class="admin-modal" role="dialog" aria-modal="true" aria-label="Confirm action">' +
     '<div class="admin-modal-body" style="padding:20px 16px 16px">' +
     '<p class="admin-modal-desc" style="margin:0;font-size:14px;color:var(--text)">' + escapeHtml(message) + '</p>' +
     '</div>' +
     '<div class="admin-modal-footer">' +
-    '<button class="admin-modal-save admin-modal-confirm-danger">Revoke</button>' +
+    '<button class="admin-modal-save admin-modal-confirm-danger">' + escapeHtml(actionLabel) + '</button>' +
     '<button class="admin-modal-cancel">Cancel</button>' +
     '</div></div>';
   modal.innerHTML = html;
@@ -198,9 +198,9 @@ function renderUsersTab(body) {
       var userId = this.dataset.userId;
       var user = cachedUsers.find(function (u) { return u.id === userId; });
       var name = user ? (user.displayName || user.username) : "this user";
-      if (confirm("Remove " + name + "? This cannot be undone.")) {
+      showConfirmDialog("Remove " + name + "? This cannot be undone.", "Remove user", function () {
         removeUser(userId, body);
-      }
+      });
     });
   }
 }
@@ -509,7 +509,7 @@ function renderInvitesTab(body) {
     revokeBtns[k].addEventListener("click", function () {
       var code = this.dataset.code;
       var btn = this;
-      showConfirmDialog("Revoke this invite? The link will no longer work.", function () {
+      showConfirmDialog("Revoke this invite? The link will no longer work.", "Revoke", function () {
         btn.disabled = true;
         fetch("/api/admin/invites/" + encodeURIComponent(code), { method: "DELETE" })
           .then(function (r) { return r.json(); })
@@ -751,12 +751,12 @@ function renderSmtpTab(body, cfg) {
   var removeBtn = body.querySelector("#smtp-remove");
   if (removeBtn) {
     removeBtn.addEventListener("click", function () {
-      if (confirm("Remove SMTP configuration? Users will need to use PIN login.")) {
+      showConfirmDialog("Remove SMTP configuration? Users will need to use PIN login.", "Remove SMTP", function () {
         apiPost("/api/admin/smtp", { host: "", user: "", pass: "", from: "" }).then(function () {
           showToast("SMTP configuration removed");
           loadSmtpTab(body);
         });
-      }
+      });
     });
   }
 }

package/lib/public/modules/app-home-hub.js

@@ -2,7 +2,7 @@
 
 import { store } from './store.js';
 import { getWs } from './ws-ref.js';
-import { getCachedProjects } from './app-projects.js';
+import { getCachedProjects, switchProject } from './app-projects.js';
 import { mateAvatarUrl } from './avatar.js';
 import { exitDmMode } from './app-dm.js';
 import { closeHomeDock, initHomeDock, renderDock, requestHomeDockPreference } from './home-dock.js';
@@ -41,7 +41,22 @@ function syncHomePresentation() {
 function syncHomeCloseControl() {
   var close = document.getElementById("home-close-control");
   if (!close) return;
-  close.classList.toggle("hidden", !store.get('currentSlug'));
+  close.classList.toggle("hidden", !getHomeReturnSlug());
+}
+
+function getHomeReturnSlug() {
+  var projects = getCachedProjects() || [];
+  var candidates = [store.get('currentSlug'), store.get('homeSurfaceProjectSlug')];
+  for (var ci = 0; ci < candidates.length; ci++) {
+    if (!candidates[ci]) continue;
+    for (var pi = 0; pi < projects.length; pi++) {
+      if (projects[pi] && !projects[pi].isMate && projects[pi].slug === candidates[ci]) return candidates[ci];
+    }
+  }
+  for (var i = 0; i < projects.length; i++) {
+    if (projects[i] && !projects[i].isMate && projects[i].slug) return projects[i].slug;
+  }
+  return null;
 }
 
 function getVisibleMates() {
@@ -390,13 +405,10 @@ export function hideHomeHub() {
 }
 
 export function minimizeHomeHub() {
-  var slug = store.get('currentSlug');
+  var slug = getHomeReturnSlug();
   if (!slug || !homeHubVisible) return;
   rememberHomePrimarySurface("project");
-  hideHomeHub();
-  var route = "/p/" + slug + "/";
-  if (document.documentElement.classList.contains("pwa-standalone")) history.replaceState(null, "", route);
-  else history.pushState(null, "", route);
+  switchProject(slug);
   var projectInput = document.getElementById("input");
   if (projectInput && !projectInput.disabled) projectInput.focus({ preventScroll: true });
 }