clay-server 4.0.0-beta.2 → 4.0.0-beta.21

package/lib/workspace-query-service.js

@@ -1,5 +1,6 @@
 var sessionSearch = require("./session-search");
 var builtinMates = require("./builtin-mates");
+var workspaceQueryAccess = require("./workspace-query-access");
 var crypto = require("crypto");
 
 var MAX_PAGE = 50;
@@ -100,7 +101,13 @@ function attachWorkspaceQueryService(ctx) {
   var getProjects = ctx.getProjects;
   var isMultiUser = ctx.isMultiUser;
   var resolveMate = ctx.resolveMate;
-  var canAccessProject = ctx.canAccessProject;
+  // Ownership and access both come from here, never from getStatus().
+  var projectAccess = workspaceQueryAccess.attachWorkspaceQueryAccess({
+    isMultiUser: isMultiUser,
+    resolveMate: resolveMate,
+    onGetProjectAccess: ctx.onGetProjectAccess,
+    canAccessProject: ctx.canAccessProject,
+  });
 
   function authoritativeMate(source) {
     if (!source || source.isMate !== true || !source.mateId || typeof resolveMate !== "function") return null;
@@ -164,12 +171,6 @@ function attachWorkspaceQueryService(ctx) {
     });
   }
 
-  function ownsProject(principal, status) {
-    if (!status || status.isWorktree) return false;
-    if (isMultiUser()) return !!principal.userId && status.projectOwnerId === principal.userId;
-    return !status.projectOwnerId || (!!principal.singleUserOwnerId && status.projectOwnerId === principal.singleUserOwnerId);
-  }
-
   function ownsSession(principal, session) {
     if (!session || session.hidden) return false;
     if (isMultiUser()) return !!principal.userId && session.ownerId === principal.userId;
@@ -180,12 +181,12 @@ function attachWorkspaceQueryService(ctx) {
     var projects = [];
     getProjects().forEach(function (project, slug) {
       var status = project.getStatus();
-      var projectOwned = ownsProject(principal, status);
-      var projectAccessible = projectOwned;
-      if (!projectAccessible && isMultiUser() && typeof canAccessProject === "function") {
-        projectAccessible = canAccessProject(principal.userId, status) === true;
-      }
-      if (!projectAccessible || (status && status.isWorktree)) return;
+      if (!status || status.isWorktree) return;
+      // Authorized here rather than at bind time, so an already-created tool
+      // handler loses a project the moment its access record changes.
+      var verdict = projectAccess.evaluate(principal, status);
+      if (!verdict.accessible) return;
+      var projectOwned = verdict.owned;
       var manager = project.getSessionManager ? project.getSessionManager() : project.sm;
       if (!manager || !manager.sessions) return;
       var sessions = [];
@@ -305,14 +306,20 @@ function attachWorkspaceQueryService(ctx) {
   function searchHistory(principal, projectSlug, args) {
     var query = cleanText(args && args.query || "", 500);
     if (!query) throw new Error("A search query is required.");
-    var projects;
+    // One authorization snapshot for the whole call. Resolving hits back to
+    // their project through findProject() would re-authorize every project once
+    // per hit, so the visible set is captured once and indexed.
+    var visible;
     if (projectSlug) {
       var project = findProject(principal, projectSlug);
       if (!project) throw new Error("Project not found in the owned workspace.");
-      projects = [sanitizedProject(project)];
+      visible = [project];
     } else {
-      projects = collect(principal).map(sanitizedProject);
+      visible = collect(principal);
     }
+    var bySlug = {};
+    for (var v = 0; v < visible.length; v++) bySlug[visible[v].projectSlug] = visible[v];
+    var projects = visible.map(sanitizedProject);
     var max = Math.min(100, decodeCursor(args && args.cursor) + parseLimit(args && args.limit, 20) + 20);
     var ranked = sessionSearch.searchPalette(projects, query, { maxResults: max });
     var offset = decodeCursor(args && args.cursor);
@@ -321,7 +328,7 @@ function attachWorkspaceQueryService(ctx) {
     var results = [];
     for (var i = 0; i < selected.length; i++) {
       var hit = selected[i];
-      var projectForHit = findProject(principal, hit.projectSlug);
+      var projectForHit = bySlug[hit.projectSlug] || null;
       var session = projectForHit ? findSession(projectForHit, String(hit.sessionId)) : null;
       if (!session) continue;
       results.push({

package/lib/worktree.js

@@ -1,6 +1,6 @@
-var { execFileSync } = require("child_process");
 var fs = require("fs");
 var path = require("path");
+var { runGitSync } = require("./git-cli");
 
 // Parse `git worktree list --porcelain` output into structured objects
 function parseWorktreeOutput(output) {
@@ -28,14 +28,10 @@ function parseWorktreeOutput(output) {
 }
 
 // Check if a given path is itself a worktree (not the main working tree)
-function isWorktree(projectPath) {
+function isWorktree(projectPath, osUserInfo) {
   try {
-    var gitDir = execFileSync("git", ["rev-parse", "--git-dir"], {
-      cwd: projectPath, encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"],
-    }).trim();
-    var commonDir = execFileSync("git", ["rev-parse", "--git-common-dir"], {
-      cwd: projectPath, encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"],
-    }).trim();
+    var gitDir = runGitSync(projectPath, ["rev-parse", "--git-dir"], null, osUserInfo).trim();
+    var commonDir = runGitSync(projectPath, ["rev-parse", "--git-common-dir"], null, osUserInfo).trim();
     var absGit = path.resolve(projectPath, gitDir);
     var absCommon = path.resolve(projectPath, commonDir);
     return absGit !== absCommon;
@@ -49,18 +45,21 @@ function isPathInside(parentPath, candidatePath) {
   return relative !== "" && relative !== ".." && relative.indexOf(".." + path.sep) !== 0 && !path.isAbsolute(relative);
 }
 
+function worktreePath(projectPath, dirName) {
+  if (typeof dirName !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(dirName)) return null;
+  var resolvedParent = path.resolve(projectPath);
+  var resolvedWorktree = path.resolve(resolvedParent, dirName);
+  return isPathInside(resolvedParent, resolvedWorktree) ? resolvedWorktree : null;
+}
+
 // Scan worktrees for a given project path
 // Returns array of { path, branch, bare, detached, external }
 // external = true when Git registered the worktree outside the main project folder
-function scanWorktrees(projectPath) {
+function scanWorktrees(projectPath, osUserInfo) {
   var resolvedParent = path.resolve(projectPath);
+  try { resolvedParent = fs.realpathSync(resolvedParent); } catch (e) {}
   try {
-    var output = execFileSync("git", ["worktree", "list", "--porcelain"], {
-      cwd: resolvedParent,
-      encoding: "utf8",
-      timeout: 5000,
-      stdio: ["pipe", "pipe", "pipe"],
-    });
+    var output = runGitSync(resolvedParent, ["worktree", "list", "--porcelain"], null, osUserInfo);
     var all = parseWorktreeOutput(output);
     // Filter out bare worktrees and the main worktree itself
     var results = [];
@@ -68,10 +67,11 @@ function scanWorktrees(projectPath) {
       var wt = all[i];
       if (wt.bare) continue;
       var resolvedWt = path.resolve(wt.path);
-      if (resolvedWt === resolvedParent) continue;
       // Git retains removed worktrees until `git worktree prune` runs. Do not
       // register those stale paths as Clay projects.
       if (!fs.existsSync(resolvedWt)) continue;
+      try { resolvedWt = fs.realpathSync(resolvedWt); } catch (e) {}
+      if (resolvedWt === resolvedParent) continue;
       wt.external = !isPathInside(resolvedParent, resolvedWt);
       wt.dirName = path.basename(wt.path);
       results.push(wt);
@@ -84,28 +84,19 @@ function scanWorktrees(projectPath) {
 
 // Create a new worktree inside the parent project directory
 // Returns { ok, path, error }
-function createWorktree(projectPath, branchName, dirName, baseBranch) {
+function createWorktree(projectPath, branchName, dirName, baseBranch, osUserInfo) {
   var resolvedParent = path.resolve(projectPath);
-  var wtPath = path.join(resolvedParent, dirName || branchName);
+  var wtPath = worktreePath(resolvedParent, dirName || branchName);
+  if (!wtPath) return { ok: false, error: "Invalid worktree directory name" };
   var base = baseBranch || "main";
   // Try creating with -b (new branch)
   try {
-    execFileSync("git", ["worktree", "add", wtPath, "-b", branchName, base], {
-      cwd: resolvedParent,
-      encoding: "utf8",
-      timeout: 15000,
-      stdio: ["pipe", "pipe", "pipe"],
-    });
+    runGitSync(resolvedParent, ["worktree", "add", wtPath, "-b", branchName, base], { timeout: 15000 }, osUserInfo);
     return { ok: true, path: wtPath };
   } catch (e) {
     // Branch may already exist, try without -b
     try {
-      execFileSync("git", ["worktree", "add", wtPath, branchName], {
-        cwd: resolvedParent,
-        encoding: "utf8",
-        timeout: 15000,
-        stdio: ["pipe", "pipe", "pipe"],
-      });
+      runGitSync(resolvedParent, ["worktree", "add", wtPath, branchName], { timeout: 15000 }, osUserInfo);
       return { ok: true, path: wtPath };
     } catch (e2) {
       return { ok: false, error: e2.message || "Failed to create worktree" };
@@ -115,17 +106,13 @@ function createWorktree(projectPath, branchName, dirName, baseBranch) {
 
 // Remove a worktree
 // Returns { ok, error }
-function removeWorktree(projectPath, worktreeDirName) {
+function removeWorktree(projectPath, worktreeDirName, osUserInfo) {
   var resolvedParent = path.resolve(projectPath);
-  var wtPath = path.join(resolvedParent, worktreeDirName);
+  var wtPath = worktreePath(resolvedParent, worktreeDirName);
+  if (!wtPath) return { ok: false, error: "Invalid worktree directory name" };
   // Try normal remove first
   try {
-    execFileSync("git", ["worktree", "remove", wtPath], {
-      cwd: resolvedParent,
-      encoding: "utf8",
-      timeout: 15000,
-      stdio: ["pipe", "pipe", "pipe"],
-    });
+    runGitSync(resolvedParent, ["worktree", "remove", wtPath], { timeout: 15000 }, osUserInfo);
     return { ok: true };
   } catch (e) {
     var errMsg = (e.stderr || e.message || "").toString();

package/lib/ws-schema.js

@@ -40,10 +40,12 @@ var schema = {
   "split_group_set_pair":     { direction: "c2s", handler: "lib/session-split-groups.js", description: "Assign Driver/Worker roles on a split group (driverId null clears them)" },
   "pair_session_options":     { direction: "c2s", handler: "lib/project-session-pair.js", description: "Request vendors/models for the pair-session dialog (response reuses the same type)" },
   "pair_session_create":      { direction: "c2s", handler: "lib/project-session-pair.js", description: "Create a Driver/Split Worker session pair as a split group" },
-  "worker_proposal_response": { direction: "c2s", handler: "lib/project-worker-proposal.js", description: "Accept or decline a Fable Worker suggestion with the selected runtime" },
+  "worker_proposal_response": { direction: "c2s", handler: "lib/project-worker-proposal.js", description: "Accept or decline an exact Driver Split Worker configuration with the selected runtime" },
   "project_assignment_response": { direction: "c2s", handler: "lib/workspace-assignment-service.js", description: "Approve or cancel an exact-session cross-project assignment proposal" },
   "home_clay_session_resolve": { direction: "c2s", handler: "lib/server-home-chat.js", description: "Resolve an opaque Mate session reference through the exact bound source session" },
   "home_clay_session_target": { direction: "s2c", handler: "lib/public/modules/command-palette.js", description: "Return an owner-validated navigation target for a rendered Mate session reference" },
+  "home_clay_log_resolve":     { direction: "c2s", handler: "lib/server-home-chat.js", description: "Resolve an opaque Project Log reference through the exact bound Clay session" },
+  "home_clay_log_target":      { direction: "s2c", handler: "lib/public/modules/command-palette.js", description: "Return an owner-validated project target for a rendered Log reference" },
 
   "session_list":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Full list of sessions for the sidebar" },
   "session_switched":         { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Confirmation that active session changed" },
@@ -62,8 +64,8 @@ var schema = {
   "split_groups":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Full persistent split-group list for the current user" },
   "split_group_result":       { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Result of a split-group mutation" },
   "pair_session_created":     { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Result of pair_session_create; carries the new group" },
-  "worker_proposal":          { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Inline Fable suggestion to delegate execution to a Worker" },
-  "worker_proposal_update":   { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Worker suggestion lifecycle update" },
+  "worker_proposal":          { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Recorded Split Worker creation/replacement runtime card with Driver rationale" },
+  "worker_proposal_update":   { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Worker card lifecycle and manual/auto decision audit update" },
   "project_assignment_proposal": { direction: "s2c", handler: "lib/public/modules/app-message-router.js", description: "Approval card for a new owner-bound project assignment" },
   "project_assignment_status": { direction: "s2c", handler: "lib/public/modules/app-message-router.js", description: "Durable project assignment lifecycle update" },
   "project_assignment_error": { direction: "s2c", handler: "lib/public/modules/app-message-router.js", description: "Rejected or stale project assignment response" },
@@ -81,7 +83,8 @@ var schema = {
   // -----------------------------------------------------------------------
   // Chat / streaming
   // -----------------------------------------------------------------------
-  "message":                  { direction: "c2s", handler: "lib/project-user-message.js", description: "Send a user chat message" },
+  "message":                  { direction: "c2s", handler: "lib/project-user-message.js", description: "Send an idempotent user chat message; message_ack confirms persistence" },
+  "message_ack":              { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Confirm that an idempotent user chat message was persisted" },
   "user_message":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Echo of the user message in the timeline" },
   "delta":                    { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Incremental text delta from the assistant" },
   "result":                   { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Final assistant result text" },
@@ -247,9 +250,11 @@ var schema = {
   "set_update_channel":       { direction: "c2s", handler: "lib/project-sessions.js", description: "Set the update channel (stable/beta)" },
   "check_update":             { direction: "c2s", handler: "lib/project-sessions.js", description: "Check if an update is available" },
   "update_now":               { direction: "c2s", handler: "lib/project-sessions.js", description: "Start the update process" },
+  "update_snooze":            { direction: "c2s", handler: "lib/project-sessions.js", description: "Snooze the current update notification for an allowlisted duration" },
+  "update_snoozed":           { direction: "s2c", handler: "lib/public/modules/update-snooze.js", description: "Result of an update snooze, fanned out to every device of that user" },
   "update_available":         { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "A new version is available" },
   "up_to_date":               { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Server is already on the latest version" },
-  "update_started":           { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Update download/install has started" },
+  "update_started":           { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Update download/install has started; the version field is included only for admin-grade recipients" },
 
   // -----------------------------------------------------------------------
   // What's New
@@ -396,12 +401,31 @@ var schema = {
   "note_written":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Agent created or updated a sticky note" },
   "note_update":              { direction: "c2s", handler: "lib/project-user-message.js", description: "Update a sticky note" },
   "note_updated":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Sticky note was updated" },
-  "note_delete":              { direction: "c2s", handler: "lib/project-user-message.js", description: "Delete a sticky note" },
-  "note_deleted":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Sticky note was deleted" },
+  "note_close":               { direction: "c2s", handler: "lib/project-user-message.js", description: "Close a sticky note (reversible; never deletes)" },
+  "note_reopen":              { direction: "c2s", handler: "lib/project-user-message.js", description: "Reopen a closed sticky note" },
+  "note_delete":              { direction: "c2s", handler: "lib/project-user-message.js", description: "Retired: older clients still send this; handled as a non-destructive close" },
+  "note_deleted":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Retired: never sent. Closing broadcasts note_updated instead" },
   "note_list_request":        { direction: "c2s", handler: "lib/project-user-message.js", description: "Request the full notes list" },
   "note_bring_front":         { direction: "c2s", handler: "lib/project-user-message.js", description: "Bring a note to front (update z-order)" },
   "notes_list":               { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Full list of sticky notes" },
 
+  // -----------------------------------------------------------------------
+  // Project Logs
+  // -----------------------------------------------------------------------
+  "project_logs_list":        { direction: "c2s", handler: "lib/project-logs.js", description: "List or search this project's logs (project scope is bound server-side)" },
+  "project_log_read":         { direction: "c2s", handler: "lib/project-logs.js", description: "Read one project log entry by opaque ref" },
+  "project_log_comment":      { direction: "c2s", handler: "lib/project-logs.js", description: "Append an attributed comment to a project log entry (append-only; author comes from the connection)" },
+  "project_log_delete":       { direction: "c2s", handler: "lib/project-logs.js", description: "Delete a project log entry (project owner only; scope and identity are bound server-side)" },
+  "project_log_create":       { direction: "c2s", handler: "lib/project-logs.js", description: "Retired. Canonical entries are written only by project agent sessions; this is always refused" },
+  "project_log_update":       { direction: "c2s", handler: "lib/project-logs.js", description: "Retired. Canonical revisions are written only by project agent sessions; this is always refused" },
+  "project_logs_state":       { direction: "s2c", handler: "lib/public/modules/project-logs.js", description: "Correlated project log index for a list or search request" },
+  "project_log_entry":        { direction: "s2c", handler: "lib/public/modules/project-logs.js", description: "Correlated full project log entry" },
+  "project_log_commented":    { direction: "s2c", handler: "lib/public/modules/project-logs.js", description: "Correlated project log entry after a comment was appended" },
+  "project_log_comment_reviewed": { direction: "s2c", handler: "lib/public/modules/project-logs.js", description: "A Project Driver resolved a log comment; carries identifiers and action only" },
+  "project_log_deleted":      { direction: "s2c", handler: "lib/public/modules/project-logs.js", description: "Confirm that the project owner deleted a project log entry" },
+  "project_log_updated":      { direction: "s2c", handler: "lib/public/modules/project-logs.js", description: "A project log entry was created, revised, or deleted (bounded ledger metadata only)" },
+  "project_logs_error":       { direction: "s2c", handler: "lib/public/modules/project-logs.js", description: "Correlated project log request failure" },
+
   // -----------------------------------------------------------------------
   // Browser extension
   // -----------------------------------------------------------------------
@@ -471,6 +495,8 @@ var schema = {
   "tool_llm_op":              { direction: "c2s", handler: "lib/server-tools.js", description: "Run a permission-gated vendor-neutral capsule LLM completion" },
   "tool_llm_config_get":      { direction: "c2s", handler: "lib/server-tools.js", description: "Get the concrete configured provider and model used by Capsule LLM calls" },
   "tool_control_response":    { direction: "c2s", handler: "lib/server-tools.js", description: "Resolve a mate tool-control request with browser runtime state or an error" },
+  "tool_server_control":      { direction: "c2s", handler: "lib/server-tools.js", description: "Human snapshot or action against a server-runtime Capsule, through the same Logic a Mate calls" },
+  "tool_frame_url":           { direction: "c2s", handler: "lib/server-tools.js", description: "Mint a one-time separate-origin URL for a Capsule's sandboxed rich Display frame" },
   "tools_state":              { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Full installed tool definitions" },
   "tool_installed":           { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "An installed tool changed" },
   "tool_source_state":        { direction: "s2c", handler: "lib/public/modules/home-capsule-source.js", description: "Correlated authored Capsule source or read error" },
@@ -480,6 +506,10 @@ var schema = {
   "tool_llm_result":          { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Result of a capsule LLM completion" },
   "tool_llm_config_state":    { direction: "s2c", handler: "lib/public/modules/tool-llm-status.js", description: "Concrete provider and model state for Capsule LLM calls" },
   "tool_control_request":     { direction: "s2c", handler: "lib/public/modules/home-tools.js", description: "Ask the connected home client to snapshot or drive a sandboxed tool" },
+  "tool_server_state":        { direction: "s2c", handler: "lib/public/modules/home-tools.js", description: "Correlated server-runtime Capsule state for the human who requested it, or the refusal that blocked it" },
+  "tool_server_event":        { direction: "s2c", handler: "lib/public/modules/home-tools.js", description: "Ordered causal act event {seq, actor, action, previous, next} pushed to the user's Displays whenever server-runtime Capsule Logic changes state" },
+  "tool_frame_url_state":     { direction: "s2c", handler: "lib/public/modules/home-tool-frame.js", description: "Correlated one-time rich Display frame URL, or the refusal that blocked it" },
+  "capsule_game_session":     { direction: "s2c", handler: "lib/public/modules/home-tools.js", description: "A Capsule game session opened or advanced for this user; an explicit game start navigates the home board into it" },
   "tools_error":              { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Tool registry, runtime, or storage error" },
 
   // -----------------------------------------------------------------------
@@ -632,6 +662,7 @@ var schema = {
   "home_mate_session_identity": { direction: "s2c", handler: "lib/public/modules/app-message-router.js", description: "Promote an active Home session from its local reference to its durable runtime identity" },
   "home_mate_sessions_state": { direction: "s2c", handler: "lib/public/modules/home-mate-chat.js", description: "Owned visible Mate conversations with sanitized runtime identity, model, status, and timestamps" },
   "home_mate_delta":          { direction: "s2c", handler: "lib/public/modules/home-mate-chat.js", description: "Selected mate's streaming assistant text delta" },
+  "home_mate_segment":        { direction: "s2c", handler: "lib/public/modules/home-mate-chat.js", description: "A tool call ended the mate's current spoken burst; the client seals the streamed bubble and later text starts a fresh one" },
   "home_mate_done":           { direction: "s2c", handler: "lib/public/modules/home-mate-chat.js", description: "Selected mate's turn finished" },
   "home_debate_proposal":     { direction: "s2c", handler: "lib/public/modules/app-message-router.js", description: "Session-bound debate proposal for the active Home transcript" },
   "home_debate_proposal_resolved": { direction: "s2c", handler: "lib/public/modules/app-message-router.js", description: "Server-confirmed result for a Home debate proposal" },

package/lib/yoke/adapters/claude-worker.js

@@ -424,22 +424,32 @@ async function handleQueryStart(msg) {
   function perf(label) { console.log("[PERF] sdk-worker: " + label + " +" + (Date.now() - t0) + "ms (local +" + (Date.now() - localT0) + "ms)"); }
   perf("handleQueryStart entered");
 
+  // Socket messages keep arriving while the SDK import awaits. Accept input
+  // and cancellation synchronously, before yielding to the next IPC message.
+  messageQueue = createMessageQueue();
+  abortController = new AbortController();
+  if (msg.prompt) messageQueue.push(msg.prompt);
+
   var sdk;
   try {
     perf("loading SDK");
     sdk = await getSDK();
     perf("SDK loaded");
   } catch (e) {
+    messageQueue.end();
+    messageQueue = null;
+    abortController = null;
+    sdkModule = null;
     sendToDaemon({ type: "query_error", error: "Failed to load SDK: " + (e.message || e), exitCode: null, stderr: null });
     return;
   }
 
-  messageQueue = createMessageQueue();
-  abortController = new AbortController();
-
-  // Push the initial user message
-  if (msg.prompt) {
-    messageQueue.push(msg.prompt);
+  if (abortController.signal.aborted) {
+    messageQueue.end();
+    messageQueue = null;
+    abortController = null;
+    sendToDaemon({ type: "query_done" });
+    return;
   }
 
   // Build query options (callbacks are local, everything else from daemon)

package/lib/yoke/adapters/claude.js

@@ -20,6 +20,49 @@ var claudeUserInput = require("../claude-user-input");
 // emitted. Keep in sync with the client's generic user-dialog renderer.
 var SUPPORTED_DIALOG_KINDS = ["refusal_fallback_prompt"];
 
+// Clay renders a per-task Stop control in the composer's background-tasks bar
+// (public/modules/background-tasks-ui.js), wired through project-sessions.js
+// `stop_task` -> adapter.stopTask -> rawQuery.stopTask (worker path: the
+// stop_task message in claude-worker.js). Declaring that affordance makes an
+// interrupt spare running background tasks so Stop only aborts the current
+// turn. The CLI fails CLOSED on absence: without this, every interrupt would
+// also kill background tasks, since a consumer with no per-task control could
+// not otherwise stop a runaway one.
+//
+// Declared identically on the in-process and OS-user worker paths. The CLI
+// takes first-attached-client-wins on multi-client sessions, so the two paths
+// must not disagree, or which one connected first would decide whether Stop
+// kills background work.
+var PER_TASK_STOP_AFFORDANCE = true;
+
+// --- System prompt recording (SDK `snapshot`) ---
+// Records the conversation's system prompt once and replays it verbatim on
+// every later request and resume, which keeps the prompt-cache prefix and
+// extended-thinking context stable across CLI upgrades and flag changes.
+//
+// OFF for Clay's persistent sessions, deliberately. getSessionSystemPrompt
+// (project.js) recomposes the append from live state every time the query is
+// rebuilt - sticky notes, pair/Driver role, and the Mate Capsule catalog - and
+// three call sites exist purely to force that re-render mid-conversation
+// (project-capsule-catalog.js refreshSessions, project.js pair regrouping,
+// sdk-bridge refreshEnvironmentRuntime). Because Clay resumes those
+// conversations, a recorded prompt would pin the first render and silently
+// swallow every later update until compaction.
+//
+// Callers whose prompt is fixed for the life of the conversation opt in with
+// queryOpts.systemPromptSnapshot. A bare string prompt cannot be recorded, so
+// it is promoted to the custom form the SDK requires.
+function applySystemPromptSnapshot(systemPrompt, enabled) {
+  if (!enabled || !systemPrompt) return systemPrompt;
+  if (typeof systemPrompt === "string" || Array.isArray(systemPrompt)) {
+    return { type: "custom", prompt: systemPrompt, snapshot: true };
+  }
+  if (typeof systemPrompt === "object") {
+    return Object.assign({}, systemPrompt, { snapshot: true });
+  }
+  return systemPrompt;
+}
+
 function getSharedSkillPlugins(homeDir, existingPlugins) {
   var plugins = Array.isArray(existingPlugins) ? existingPlugins.slice() : [];
   var bridgePath = skillDiscovery.ensureClaudeCodexPlugin(homeDir ? { homeDir: homeDir } : null);
@@ -45,10 +88,16 @@ function buildWorkerQueryOptions(queryOpts, claudeOpts, workerCwd) {
   if (claudeOpts.permissionMode) queryOptions.permissionMode = claudeOpts.permissionMode;
   if (claudeOpts.allowDangerouslySkipPermissions) queryOptions.allowDangerouslySkipPermissions = true;
   if (claudeOpts.settings) queryOptions.settings = claudeOpts.settings;
-  if (queryOpts.appendSystemPrompt) queryOptions.systemPrompt = { type: "preset", preset: "claude_code", append: queryOpts.appendSystemPrompt };
+  if (queryOpts.appendSystemPrompt) {
+    queryOptions.systemPrompt = applySystemPromptSnapshot(
+      { type: "preset", preset: "claude_code", append: queryOpts.appendSystemPrompt },
+      queryOpts.systemPromptSnapshot
+    );
+  }
   queryOptions.plugins = queryOpts.skipSkills ? (claudeOpts.plugins || []) : getSharedSkillPlugins(claudeOpts.originalHome, claudeOpts.plugins);
   if (queryOpts.toolServerDescriptors) queryOptions.mcpServerDescriptors = queryOpts.toolServerDescriptors;
   if (queryOpts.onUserDialog) queryOptions.supportedDialogKinds = SUPPORTED_DIALOG_KINDS;
+  queryOptions.perTaskStopAffordance = PER_TASK_STOP_AFFORDANCE;
   if (queryOpts.model) queryOptions.model = queryOpts.model;
   if (queryOpts.effort) queryOptions.effort = queryOpts.effort;
   if (queryOpts.resumeSessionId) queryOptions.resume = queryOpts.resumeSessionId;
@@ -211,6 +260,18 @@ function flattenEvent(raw) {
       base.status = raw.status;
       return base;
     }
+    // API retry notices are transient transport state, not conversation
+    // errors. Preserve the structured counters so the host can bound overload
+    // churn without recording one red error row per SDK retry.
+    if (raw.subtype === "api_retry") {
+      base.yokeType = "api_retry";
+      base.attempt = raw.attempt || 0;
+      base.maxRetries = raw.max_retries || 0;
+      base.retryDelayMs = raw.retry_delay_ms || 0;
+      base.error = raw.error || "unknown";
+      base.errorStatus = raw.error_status == null ? null : raw.error_status;
+      return base;
+    }
     if (raw.subtype === "task_started") {
       base.yokeType = "task_started";
       base.parentToolId = raw.tool_use_id;
@@ -400,11 +461,21 @@ function normalizeBackgroundTasks(tasks) {
     var nativeType = task && task.task_type;
     var taskType = nativeType === "local_bash" ? "shell"
       : nativeType === "local_agent" ? "agent" : "other";
-    return {
+    var normalized = {
       task_id: task && task.task_id,
       task_type: taskType,
       description: (task && task.description) || "",
+      // Housekeeping the CLI does not surface as user work (skip_transcript
+      // tasks, auto-started live-update watchers). Clay keeps these out of its
+      // activity indicators and lists them as a subdued secondary group.
+      // Normalized to a boolean so consumers never have to test for absence.
+      ambient: !!(task && task.ambient),
     };
+    // The SDK does not report a start time today. Forward one if a future
+    // version adds it; otherwise the session stamps first-seen time.
+    var startedAt = task && (task.started_at || task.startedAt || task.created_at);
+    if (startedAt) normalized.started_at = startedAt;
+    return normalized;
   });
 }
 
@@ -1449,12 +1520,17 @@ function createClaudeAdapter(opts) {
       if (_claudeBinaryPath) sdkOptions.pathToClaudeCodeExecutable = _claudeBinaryPath;
 
       // YOKE standard options -> SDK options
-      if (queryOpts.systemPrompt) sdkOptions.systemPrompt = queryOpts.systemPrompt;
+      if (queryOpts.systemPrompt) {
+        sdkOptions.systemPrompt = applySystemPromptSnapshot(queryOpts.systemPrompt, queryOpts.systemPromptSnapshot);
+      }
       // Additive variant: keep the full Claude Code system prompt and append.
       // A plain-string systemPrompt REPLACES the whole prompt, so pair
       // presets and other add-ons must come through here instead.
       if (!queryOpts.systemPrompt && queryOpts.appendSystemPrompt) {
-        sdkOptions.systemPrompt = { type: "preset", preset: "claude_code", append: queryOpts.appendSystemPrompt };
+        sdkOptions.systemPrompt = applySystemPromptSnapshot(
+          { type: "preset", preset: "claude_code", append: queryOpts.appendSystemPrompt },
+          queryOpts.systemPromptSnapshot
+        );
       }
       if (queryOpts.model) sdkOptions.model = queryOpts.model;
       if (queryOpts.effort) sdkOptions.effort = queryOpts.effort;
@@ -1470,6 +1546,7 @@ function createClaudeAdapter(opts) {
         sdkOptions.onUserDialog = queryOpts.onUserDialog;
         sdkOptions.supportedDialogKinds = SUPPORTED_DIALOG_KINDS;
       }
+      sdkOptions.perTaskStopAffordance = PER_TASK_STOP_AFFORDANCE;
       if (queryOpts.resumeSessionId) sdkOptions.resume = queryOpts.resumeSessionId;
       if (queryOpts.persistSession === false) sdkOptions.persistSession = false;