clay-server 4.0.0-beta.2 → 4.0.0-beta.21

package/lib/sdk-bridge.js

@@ -12,6 +12,7 @@ var { createMessageQueue } = require("./sdk-message-queue");
 var { attachMessageProcessor } = require("./sdk-message-processor");
 var homeDebateToolPolicy = require("./home-debate-tool-policy");
 var yoke = require("./yoke");
+var sessionTitlePolicy = require("./session-title-policy");
 
 // Extract serializable tool descriptors from MCP server instances.
 // Used for IPC to worker processes (McpSdkServerConfigWithInstance is not serializable).
@@ -128,6 +129,9 @@ function createSDKBridge(opts) {
   var clayTls = opts.clayTls || false;
   var clayAuthToken = opts.clayAuthToken || null;
   var getSessionToolDefs = opts.getSessionToolDefs || function () { return []; };
+  // Split Worker permission routing. A getter because the pair module is
+  // constructed before this bridge exists.
+  var getWorkerPermissionRouter = opts.getWorkerPermissionRouter || function () { return null; };
   var onProcessingChanged = opts.onProcessingChanged || function () {};
   var _cachedFreshAuthState = null;
   var _cachedFreshAuthAt = 0;
@@ -601,27 +605,77 @@ function createSDKBridge(opts) {
       return { behavior: "allow", updatedInput: input };
     }
 
-    // Auto-approve split-pair partner tools. The pair itself is
-    // user-constructed (the user created the split and its roles and
-    // watches both panes live), the target is structurally confined to the
-    // split partner, and a prompt on every delegation hop defeats the
-    // driver/worker workflow. spawn_sessions is NOT here: it creates new
-    // sessions and keeps its prompt.
-    var pairPartnerTools = { send_to_partner: true, read_partner: true, propose_worker: true };
-    if (toolName.indexOf("mcp__clay-sessions__") === 0) {
-      var sessionsToolName = toolName.substring(toolName.lastIndexOf("__") + 2);
-      if (pairPartnerTools[sessionsToolName]) {
+    // Auto-approve the non-mutating configuration proposal and the visible
+    // Driver/Split Worker pair tools, including the Driver's answer to a Worker
+    // permission request. Creation and replacement still require a separate
+    // human decision in the proposal card; skip-permissions is never treated as
+    // that product choice. Every handler is confined to the caller's exact
+    // session/pair and re-checks eligibility, ownership and live identity.
+    //
+    // spawn_sessions is deliberately absent: it creates arbitrary sessions.
+    //
+    // Only the two name forms the bridge can genuinely emit are accepted:
+    //
+    //   mcp__clay-sessions__<tool>  every MCP-mounted vendor. The server
+    //                              segment is matched exactly, so a tool of
+    //                              the same name on another MCP server is
+    //                              never auto-approved.
+    //   <tool>                      a Codex dynamic tool. Codex canonicalizes
+    //                              send_to_partner and read_partner to the MCP
+    //                              form itself, so only the remaining names
+    //                              can legitimately arrive bare.
+    var PAIR_MCP_PREFIX = "mcp__clay-sessions__";
+    var pairMcpTools = {
+      propose_worker: true,
+      send_to_partner: true,
+      read_partner: true,
+      partner_status: true,
+      replace_partner: true,
+      interrupt_partner: true,
+      close_partner: true,
+      record_partner_evaluation: true,
+      respond_to_worker_permission: true,
+    };
+    var pairDynamicTools = {
+      propose_worker: true,
+      partner_status: true,
+      replace_partner: true,
+      interrupt_partner: true,
+      close_partner: true,
+      record_partner_evaluation: true,
+      respond_to_worker_permission: true,
+    };
+    if (toolName.indexOf("mcp__") === 0) {
+      if (toolName.indexOf(PAIR_MCP_PREFIX) === 0
+          && pairMcpTools[toolName.slice(PAIR_MCP_PREFIX.length)]) {
         return { behavior: "allow", updatedInput: input };
       }
+    } else if (pairDynamicTools[toolName]) {
+      return { behavior: "allow", updatedInput: input };
+    }
+
+    // Sticky-note operations are immediately visible and reversible on the
+    // shared board. The exact session-bound handlers still enforce ownership,
+    // lifecycle rules, and input validation, so a provider prompt adds no
+    // authority. Keep this confined to the exact Clay Notes namespace.
+    var NOTES_MCP_PREFIX = "mcp__clay-notes__";
+    var notesTools = {
+      list_notes: true,
+      write_note: true,
+      close_note: true,
+      reopen_note: true,
+      remove_note: true,
+    };
+    if (toolName.indexOf(NOTES_MCP_PREFIX) === 0
+        && notesTools[toolName.slice(NOTES_MCP_PREFIX.length)]) {
+      return { behavior: "allow", updatedInput: input };
     }
 
-    // Sticky-note reads and writes are immediately visible on the shared
-    // board. Deletion stays outside the whitelist and therefore prompts;
-    // its session ownership is enforced again inside the server handler.
-    var notesToolName = toolName.substring(toolName.lastIndexOf("__") + 2);
-    var isClayNotesTool = toolName.indexOf("mcp__clay-notes__") === 0
-      || toolName.indexOf("clay-notes__") !== -1;
-    if (isClayNotesTool && (notesToolName === "list_notes" || notesToolName === "write_note")) {
+    // Project Logs are exact-session, project-bound tools whose authority is
+    // enforced again by the server binding. Canonical changes are append-only
+    // revisions, and the surface exposes no destructive delete operation, so
+    // a second provider permission prompt adds no additional safety.
+    if (toolName.indexOf("mcp__clay-logs__") === 0) {
       return { behavior: "allow", updatedInput: input };
     }
 
@@ -720,6 +774,19 @@ function createSDKBridge(opts) {
     // Full-auto mode: auto-approve everything except AskUserQuestion
     // (which still needs to go through the user interaction flow).
     var clayPermissionMode = session.permissionMode || sm.currentPermissionMode;
+    // A configured Split Worker is Driver-operated, so it runs under its
+    // Driver's permission mode, re-resolved from the live pair on every single
+    // decision. Nothing is copied at creation and the Worker's own persisted
+    // setting is never written, so toggling skip permissions on the Driver
+    // applies to the Worker's next call in either direction, mid-turn included.
+    var _wpMode = getWorkerPermissionRouter();
+    if (_wpMode && typeof _wpMode.inheritedPermissionMode === "function") {
+      var inherited = _wpMode.inheritedPermissionMode(session);
+      if (inherited) clayPermissionMode = inherited;
+    }
+    // AskUserQuestion is genuine user input, not an authorization, so it is
+    // excluded here exactly as it always was: a Driver in skip mode still
+    // cannot silently answer a question addressed to the person.
     if (clayPermissionMode === "bypassPermissions" && toolName !== "AskUserQuestion") {
       return Promise.resolve({ behavior: "allow", updatedInput: input });
     }
@@ -747,6 +814,22 @@ function createSDKBridge(opts) {
       return Promise.resolve({ behavior: "allow", updatedInput: input });
     }
 
+    // A visible Split Worker's remaining prompts belong to its paired Driver,
+    // not to the Worker pane. This sits below every auto-decision above, so
+    // skip permissions, the whitelist, allowedTools and the loop/debate
+    // policies all still resolve first and never wait on a Driver.
+    var _wp = getWorkerPermissionRouter();
+    if (_wp) {
+      var routed = _wp.routeIfWorker(session, {
+        toolName: toolName,
+        input: input,
+        toolUseId: opts.toolUseID,
+        decisionReason: opts.decisionReason || "",
+        signal: opts.signal,
+      });
+      if (routed) return routed;
+    }
+
     // Regular tool permission request: send to client and wait
     return new Promise(function(resolve) {
       var requestId = crypto.randomUUID();
@@ -1540,25 +1623,33 @@ function createSDKBridge(opts) {
     if (selectedUserInputMode === "fallback") {
       sessionToolDefs = sessionToolDefs.concat(yoke.userInput.fallbackToolDefs(sessionUserInputHandler));
     }
+    function findSessionToolDef(toolName) {
+      // Codex restores a thread's original dynamic-tool catalog on resume, but
+      // pair state can change after this query starts. Resolve live session
+      // handlers first so the dispatcher cannot lag behind that catalog. Keep
+      // the query snapshot as a fallback for query-bound tools such as the
+      // structured-input fallback, whose handler exists only for this turn.
+      var liveToolDefs = getSessionToolDefs(session) || [];
+      for (var liveIndex = 0; liveIndex < liveToolDefs.length; liveIndex++) {
+        if (liveToolDefs[liveIndex].name === toolName) return liveToolDefs[liveIndex];
+      }
+      for (var snapshotIndex = 0; snapshotIndex < sessionToolDefs.length; snapshotIndex++) {
+        if (sessionToolDefs[snapshotIndex].name === toolName) return sessionToolDefs[snapshotIndex];
+      }
+      return null;
+    }
 
-    // Derive an explicit session title for fresh queries so the SDK records
-    // it at session creation and skips its own auto-generation. This also
-    // lets us short-circuit autoGenerateTitle below for the common case.
+    // Give fresh queries an immediate provisional label. The visible user
+    // message in history wins over `text`, which may contain an internal
+    // provider wrapper rather than what the person typed.
     // Only applied to NEW sessions (no cliSessionId yet) — when resuming,
     // the SDK ignores Options.title in favor of the persisted title.
     var initialTitle = null;
+    var initialTitleProvisional = false;
     if (!session.cliSessionId && !session.titleManuallySet && !session.titleAutoGenerated) {
-      if (session.title) {
-        // Loop / scheduled / mate-seeded sessions arrive with a title already set.
-        initialTitle = session.title;
-      } else if (typeof text === "string") {
-        // Derive a quick first-line snippet from the user's first message.
-        // Skip if too short to be meaningful — fall back to autoGenerateTitle.
-        var firstLine = text.replace(/\s+/g, " ").trim();
-        if (firstLine.length >= 10) {
-          initialTitle = firstLine.length > 60 ? firstLine.substring(0, 60) : firstLine;
-        }
-      }
+      var initialTitleChoice = sessionTitlePolicy.selectInitialTitle(session, text);
+      initialTitle = initialTitleChoice.title;
+      initialTitleProvisional = initialTitleChoice.provisional;
     }
 
     var queryOpts = {
@@ -1587,10 +1678,9 @@ function createSDKBridge(opts) {
       toolServerDescriptors: extractMcpDescriptors(mergedMcpServers) || undefined,
       dynamicTools: sessionToolDefs,
       callDynamicTool: function (toolName, args) {
-        for (var dti = 0; dti < sessionToolDefs.length; dti++) {
-          if (sessionToolDefs[dti].name === toolName && typeof sessionToolDefs[dti].handler === "function") {
-            return sessionToolDefs[dti].handler(args || {});
-          }
+        var toolDef = findSessionToolDef(toolName);
+        if (toolDef && typeof toolDef.handler === "function") {
+          return toolDef.handler(args || {});
         }
         return Promise.reject(new Error("Session tool not found: " + toolName));
       },
@@ -1598,12 +1688,8 @@ function createSDKBridge(opts) {
       abortController: linuxUser ? undefined : session.abortController,
       canUseTool: function(toolName, input, toolOpts) {
         var permissionName = toolName;
-        for (var pti = 0; pti < sessionToolDefs.length; pti++) {
-          if (sessionToolDefs[pti].name === toolName && sessionToolDefs[pti].permissionName) {
-            permissionName = sessionToolDefs[pti].permissionName;
-            break;
-          }
-        }
+        var permissionToolDef = findSessionToolDef(toolName);
+        if (permissionToolDef && permissionToolDef.permissionName) permissionName = permissionToolDef.permissionName;
         return handleCanUseTool(session, permissionName, input, toolOpts);
       },
       onUserInputRequest: function(request, respond) {
@@ -1653,16 +1739,16 @@ function createSDKBridge(opts) {
     try {
       handle = await sessionAdapter.createQuery(queryOpts);
       console.log("[sdk-bridge] createQuery returned handle, vendor=" + sessionAdapter.vendor);
-      // SDK accepted the explicit title — adopt it locally so the session
-      // list reflects it immediately and autoGenerateTitle skips this
-      // session (titleAutoGenerated gates re-trigger).
+      // SDK accepted the explicit title. Provisional labels remain eligible
+      // for semantic generation after the first Home exchange (or the normal
+      // project threshold); seeded titles remain fixed.
       if (initialTitle && !session.title) {
         session.title = initialTitle;
-        session.titleAutoGenerated = true;
+        session.titleAutoGenerated = !initialTitleProvisional;
         sm.saveSessionFile(session);
         sm.broadcastSessionList();
       } else if (initialTitle && session.title === initialTitle) {
-        session.titleAutoGenerated = true;
+        session.titleAutoGenerated = !initialTitleProvisional;
         sm.saveSessionFile(session);
       }
     } catch (e) {

package/lib/sdk-message-processor.js

@@ -1,5 +1,9 @@
 var usersModule = require("./users");
 var yoke = require("./yoke");
+var backgroundTaskTiming = require("./background-task-timing");
+var sessionTitlePolicy = require("./session-title-policy");
+
+var OVERLOAD_RETRY_LIMIT = 3;
 
 function attachMessageProcessor(ctx) {
   var sm = ctx.sm;
@@ -22,8 +26,6 @@ function attachMessageProcessor(ctx) {
   var saveImageFile = ctx.saveImageFile;
   var getSessionLinuxUser = ctx.getSessionLinuxUser || function () { return null; };
 
-  var AUTO_TITLE_TURN_THRESHOLD = 2;
-
   function getMateIdForNotification() {
     if (!isMate) return null;
     if (typeof slug === "string" && slug.indexOf("mate-") === 0) {
@@ -60,6 +62,8 @@ function attachMessageProcessor(ctx) {
     if (session._lastAuthEmit && (now - session._lastAuthEmit) < 5000) return;
     session._lastAuthEmit = now;
 
+    var vendor = session.vendor || "claude";
+
     var authUser = session.ownerId ? usersModule.findUserById(session.ownerId) : null;
     var authLinuxUser = authUser && authUser.linuxUser ? authUser.linuxUser : null;
     var canAutoLogin = !usersModule.isMultiUser()
@@ -69,10 +73,13 @@ function attachMessageProcessor(ctx) {
     var authTitle = ((vendorInfo && vendorInfo.displayName) || "Claude Code") + " is not logged in.";
     var loginCommand = (vendorInfo && vendorInfo.loginCommand) || "claude login";
     var _nmLogin = getNotificationsModule();
-    sendAndRecord(session, {
+    // Authentication recovery is transient UI state, not transcript content.
+    // Recording it makes history replay look like a fresh auth failure and
+    // re-opens the login terminal after a successful sign-in.
+    sendToSession(session, {
       type: "auth_required",
       text: authTitle,
-      vendor: session.vendor || "claude",
+      vendor: vendor,
       loginCommand: loginCommand,
       linuxUser: authLinuxUser,
       canAutoLogin: canAutoLogin,
@@ -84,7 +91,7 @@ function attachMessageProcessor(ctx) {
         slug: slug,
         sessionId: session.localId,
         ownerId: session.ownerId || null,
-        vendor: session.vendor || "claude",
+        vendor: vendor,
         loginCommand: loginCommand,
         linuxUser: authLinuxUser,
         canAutoLogin: canAutoLogin,
@@ -192,7 +199,9 @@ function attachMessageProcessor(ctx) {
 
     // Cache slash_commands and model from CLI init message
     if (parsed.yokeType === "init") {
-      var previousBackgroundTaskCount = (session.activeBackgroundTasks || []).length;
+      // Ambient housekeeping never drove the sidebar badge, so a reset that
+      // only clears ambient watchers must not rebroadcast the session list.
+      var previousBackgroundTaskCount = backgroundTaskTiming.countUserTasks(session.activeBackgroundTasks);
       session.activeBackgroundTasks = [];
       sendToSession(session, { type: "active_background_tasks", tasks: [] });
       if (previousBackgroundTaskCount !== 0) sm.broadcastSessionList();
@@ -480,6 +489,8 @@ function attachMessageProcessor(ctx) {
       }
 
     } else if (parsed.yokeType === "result") {
+      var overloadAbortRequested = !!session._overloadAbortRequested;
+      session._overloadAbortRequested = false;
       session.blocks = {};
       session.sentToolResults = {};
       session.pendingPermissions = {};
@@ -525,7 +536,9 @@ function attachMessageProcessor(ctx) {
         session._awaitingTurnResult = false;
         session._queuedTurnCount = 0;
         onProcessingChanged();
-        sendAndRecord(session, { type: "error", text: "Claude error: " + execError });
+        if (!overloadAbortRequested) {
+          sendAndRecord(session, { type: "error", text: "Claude error: " + execError });
+        }
         sendAndRecord(session, { type: "done", code: 1 });
         sm.broadcastSessionList();
         return;
@@ -617,7 +630,7 @@ function attachMessageProcessor(ctx) {
       sm.broadcastSessionList();
 
       // Auto-generate title after N turns (skip if loop or already auto-generated)
-      if (session.turnCount === AUTO_TITLE_TURN_THRESHOLD
+      if (session.turnCount === sessionTitlePolicy.generationTurn(isMate)
           && !session.titleAutoGenerated
           && !session.titleManuallySet
           && !session.loop
@@ -686,11 +699,20 @@ function attachMessageProcessor(ctx) {
       }
 
     } else if (parsed.yokeType === "background_tasks_changed") {
-      var previousBackgroundTaskCount = (session.activeBackgroundTasks || []).length;
-      var activeBackgroundTasks = Array.isArray(parsed.tasks) ? parsed.tasks : [];
+      var previousBackgroundTasks = session.activeBackgroundTasks || [];
+      // Count user work only: an ambient watcher starting or stopping must not
+      // rebroadcast the session list and flicker every client's sidebar badge.
+      var previousBackgroundTaskCount = backgroundTaskTiming.countUserTasks(previousBackgroundTasks);
+      // Vendors re-send the whole list on every change, so carry each task's
+      // first-seen time forward; otherwise the composer's elapsed timer would
+      // restart whenever any other task starts or finishes.
+      var activeBackgroundTasks = backgroundTaskTiming.mergeStartTimes(
+        previousBackgroundTasks,
+        Array.isArray(parsed.tasks) ? parsed.tasks : []
+      );
       session.activeBackgroundTasks = activeBackgroundTasks;
       sendToSession(session, { type: "active_background_tasks", tasks: activeBackgroundTasks });
-      if (previousBackgroundTaskCount !== activeBackgroundTasks.length) {
+      if (previousBackgroundTaskCount !== backgroundTaskTiming.countUserTasks(activeBackgroundTasks)) {
         sm.broadcastSessionList();
       }
 
@@ -803,9 +825,33 @@ function attachMessageProcessor(ctx) {
       }
 
     } else if (parsed.yokeType === "api_retry") {
-      // Transient retry notification, show in UI but don't persist in history
-      var retryText = parsed.message || parsed.error || "Retrying API request...";
-      sendToSession(session, { type: "system_info", text: retryText });
+      // The Claude SDK may otherwise paint one persistent red error for every
+      // retry and remain busy for many minutes. Show one transient status, and
+      // stop a repeatedly overloaded turn after a small bounded number of
+      // attempts so the user regains control and can retry or change models.
+      var apiRetryAttempt = parsed.attempt || 1;
+      if (parsed.error === "overloaded") {
+        if (apiRetryAttempt === 1) {
+          session._overloadAbortRequested = false;
+          sendToSession(session, {
+            type: "system_info",
+            text: "The model is overloaded. Retrying briefly...",
+          });
+        }
+        if (apiRetryAttempt >= OVERLOAD_RETRY_LIMIT && !session._overloadAbortRequested) {
+          session._overloadAbortRequested = true;
+          sendAndRecord(session, {
+            type: "error",
+            text: "The model remained overloaded after " + apiRetryAttempt +
+              " attempts, so this turn was stopped. Try again or choose another model.",
+          });
+          if (session.abortController && typeof session.abortController.abort === "function") {
+            try { session.abortController.abort(); } catch (e) {}
+          }
+        }
+      } else if (apiRetryAttempt === 1) {
+        sendToSession(session, { type: "system_info", text: "The model request failed temporarily. Retrying..." });
+      }
 
     } else if (parsed.yokeType === "commands_changed") {
       // Mid-session command list change: rebuild the union with skills (same as

package/lib/server-experimental-settings.js

@@ -0,0 +1,49 @@
+function attachExperimentalSettings(ctx) {
+  var users = ctx.users;
+  var getMultiUserFromReq = ctx.getMultiUserFromReq;
+  var opts = ctx.opts;
+
+  function handleRequest(req, res, fullUrl) {
+    if (req.method !== "PUT" || fullUrl !== "/api/user/capsules-enabled") return false;
+    var isMultiUser = users.isMultiUser();
+    var mu = getMultiUserFromReq(req);
+    if (isMultiUser && !mu) {
+      res.writeHead(401, { "Content-Type": "application/json" });
+      res.end('{"error":"unauthorized"}');
+      return true;
+    }
+    var body = "";
+    req.on("data", function (chunk) { body += chunk; });
+    req.on("end", function () {
+      try {
+        var data = JSON.parse(body);
+        var result;
+        var userId = "default";
+        if (isMultiUser) {
+          userId = mu.id;
+          result = users.setCapsulesEnabled(userId, data.enabled === true);
+        } else if (typeof opts.onSetCapsulesEnabled === "function") {
+          result = opts.onSetCapsulesEnabled(data.enabled === true);
+        } else {
+          result = { ok: true, capsulesEnabled: false };
+        }
+        if (result.error) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: result.error }));
+          return;
+        }
+        if (typeof ctx.onCapsulesPreferenceChanged === "function") ctx.onCapsulesPreferenceChanged(userId);
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: true, capsulesEnabled: result.capsulesEnabled === true }));
+      } catch (e) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end('{"error":"Invalid request"}');
+      }
+    });
+    return true;
+  }
+
+  return { handleRequest: handleRequest };
+}
+
+module.exports = { attachExperimentalSettings: attachExperimentalSettings };

package/lib/server-global-ws.js

@@ -7,6 +7,7 @@
 // Bound to the slug-less `/ws` endpoint by lib/server.js. Only handles the
 // small set of messages needed to bootstrap into a project context:
 //   - ping            -> pong keep-alive
+//   - Home and Mate    -> the same user-scoped handlers as project sockets
 //   - browse_dir      -> directory picker for the add-project modal
 //   - add_project     -> register an existing directory
 //   - create_project  -> make a new empty project
@@ -37,6 +38,8 @@ function attachGlobalWs(opts) {
   var onAddProject = opts.onAddProject;
   var onCreateProject = opts.onCreateProject;
   var onCloneProject = opts.onCloneProject;
+  var onHomePreferenceMessage = opts.onHomePreferenceMessage;
+  var onAppMessage = opts.onAppMessage;
 
   function handleMessage(ws, msg) {
     if (!msg || typeof msg !== "object") return;
@@ -46,6 +49,14 @@ function attachGlobalWs(opts) {
       return;
     }
 
+    // A user does not need an ordinary project before Home becomes useful.
+    // Route Mate discovery, Home chat/debates, and tools through the same
+    // handlers used by project sockets. This also lets mate_list repair an
+    // existing account whose built-ins were missing from its final storage.
+    if (typeof onAppMessage === "function" && onAppMessage(ws, msg)) return;
+
+    if (typeof onHomePreferenceMessage === "function" && onHomePreferenceMessage(ws, msg)) return;
+
     // --- Directory picker for the add-project modal ---
     if (msg.type === "browse_dir") {
       var rawPath = (msg.path || "").replace(/^~/, config.REAL_HOME);

package/lib/server-home-chat-events.js

@@ -134,9 +134,24 @@ function historyToHomeChat(history, debateSetupMode, mateCreationMode) {
       applyDebateHistoryEvent(messages, event);
       continue;
     }
+    if (event.type === "capsule_turn") {
+      // A Capsule engagement delivery. The transcript shows a short system
+      // note; the full delivery prompt is model-facing, not conversation.
+      flushAssistant();
+      messages.push({
+        role: "capsule_turn",
+        text: (event.toolName || event.toolId || "Capsule") + (event.kind === "start" ? ": a new game started." : ": your Mate is taking its turn."),
+      });
+      continue;
+    }
     if (event.type === "user_message" && event.text && event.askUserAnswer !== true && !interviewMode) {
       flushAssistant();
       messages.push({ role: "user", text: event.text });
+    } else if (!interviewMode && (event.type === "tool_start" || event.type === "tool_executing" || event.type === "tool_result")) {
+      // A tool call ends the current spoken burst. Without this flush the
+      // text on both sides of the call concatenates into one run-on bubble,
+      // which is exactly how a Capsule game transcript turns into a wall.
+      flushAssistant();
     } else if (event.type === "delta" && typeof event.text === "string" && !interviewMode) {
       pending += event.text;
     } else if (event.type === "result" || event.type === "done") {
@@ -185,13 +200,17 @@ function historyToHomeChat(history, debateSetupMode, mateCreationMode) {
   return messages;
 }
 
+// The authoritative text for the bubble being finalized: only the deltas
+// since the last conversational boundary. Tool calls and Capsule turn
+// deliveries are boundaries too, or a session that is never driven by typed
+// user messages (a Capsule game) would collapse into one run-on bubble.
 function latestAssistantText(history) {
   var text = "";
   for (var i = (history || []).length - 1; i >= 0; i--) {
     var event = history[i];
     if (!event) continue;
     if (event.type === "delta" && typeof event.text === "string") text = event.text + text;
-    if (event.type === "user_message" || event.type === "debate_proposal" || event.type === "debate_proposal_resolved" || event.type === "project_assignment_proposal" || event.type === "project_assignment_status" || (event.type === "tool_executing" && event.name === "AskUserQuestion")) break;
+    if (event.type === "user_message" || event.type === "capsule_turn" || event.type === "tool_start" || event.type === "tool_executing" || event.type === "tool_result" || event.type === "debate_proposal" || event.type === "debate_proposal_resolved" || event.type === "project_assignment_proposal" || event.type === "project_assignment_status") break;
   }
   return text;
 }
@@ -209,6 +228,9 @@ function searchToolLabel(name, input) {
   if (name === "list_project_sessions") return "Reviewing project conversations";
   if (name === "list_projects") return "Reviewing your projects";
   if (name === "search_project_history") return query ? "Searching a project for \u201c" + query + "\u201d" : "Searching a project";
+  if (name === "search_project_logs") return query ? "Searching project logs for \u201c" + query + "\u201d" : "Searching project logs";
+  if (name === "list_project_logs") return "Reviewing project logs";
+  if (name === "read_project_log" || name === "read_project_log_revision" || name === "project_log_history") return "Reading a project log";
   return "Using " + (cleanActivityText(name, 64) || "a workspace tool");
 }
 
@@ -281,6 +303,14 @@ function transformEvent(event, mateId, session, requestId, stableSessionId) {
   if (session && session.mateCreationMode === true && event.type === "tool_executing" && event.name === "AskUserQuestion" && event.id && event.input) return Object.assign({ type: "home_mate_creation_question", toolId: event.id, questions: homeDebateQuestions(event.input) }, metadata);
   if (session && session.mateCreationMode === true && event.type === "ask_user_answered" && event.toolId) return Object.assign({ type: "home_mate_creation_question_resolved", toolId: event.toolId, status: "answered", answers: event.answers || null }, metadata);
   if (session && session.mateCreationMode === true && event.type === "home_mate_creation_question_expired" && event.toolId) return Object.assign({ type: "home_mate_creation_question_resolved", toolId: event.toolId, status: "expired", error: event.error || "This question expired. Ask Clay to repeat it." }, metadata);
+  if ((event.type === "tool_start" || event.type === "tool_executing") && event.name !== "AskUserQuestion") {
+    // A tool call ends the current spoken burst: the client seals the bubble
+    // it has streamed so far, and later text starts a fresh one. Without this
+    // a session driven by tool play (a Capsule game) streams into one
+    // ever-growing run-on bubble. Last so every special surface above (search
+    // activity, debates, interviews, AskUserQuestion) keeps precedence.
+    return Object.assign({ type: "home_mate_segment" }, metadata);
+  }
   return null;
 }