clay-server 4.0.0-beta.9 → 4.0.0

package/lib/server-tools.js

@@ -2,14 +2,29 @@ var toolsRegistry = require("./tools-registry");
 var toolStorage = require("./tool-storage");
 var crypto = require("crypto");
 var toolLlm = require("./tool-llm");
+var capsuleFloor = require("./capsule-display-floor");
+var capsuleServerRuntimes = require("./capsule-server-runtimes");
+var capsuleFrameServer = require("./capsule-frame-server");
+var capsuleMateTurn = require("./capsule-mate-turn");
 
 function attachTools(deps) {
   var users = deps.users;
   var projects = deps.projects;
-  var serverLogic = Object.create(null);
+  var serverRuntimes = deps.serverRuntimes || capsuleServerRuntimes;
+  var frameServer = deps.frameServer || capsuleFrameServer.createCapsuleFrameServer({ tlsOptions: deps.tlsOptions || null });
+  var mateTurn = deps.mateTurn || capsuleMateTurn.attachCapsuleMateTurn({
+    users: users,
+    findMateProject: deps.findMateProject || null,
+    broadcastToUser: function (targetUserId, payload) { broadcastToUser(targetUserId, payload); },
+  });
   var controlTimeoutMs = deps.controlTimeoutMs || 15000;
   var llmControlTimeoutMs = deps.llmControlTimeoutMs || 90000;
   var pendingControl = Object.create(null);
+  var isCapsulesEnabled = deps.isCapsulesEnabled || function () { return true; };
+
+  function requireCapsulesEnabled(userId) {
+    if (!isCapsulesEnabled(userId)) throw new Error("Capsules are disabled in User Settings.");
+  }
 
   function contextFor(userId) {
     var multiUser = users.isMultiUser();
@@ -68,6 +83,7 @@ function attachTools(deps) {
   }
 
   function installedManifests(userId) {
+    if (!isCapsulesEnabled(userId)) return [];
     var ctx = contextFor(userId);
     return toolsRegistry.listTools(ctx).filter(function (manifest) { return !manifest.error; });
   }
@@ -137,20 +153,52 @@ function attachTools(deps) {
     });
   }
 
+  // One act pipeline for server-runtime Capsules. The human's button click and
+  // the Mate's clay_tool_act call both arrive here, so the same Logic enforces
+  // the same rules for both and neither gets a private path. The seat is set
+  // from the server-resolved actor, never from caller-supplied text.
+  //
+  // The caller gets state and nothing else: a Mate never sees Display. Every
+  // successful act additionally pushes its causal {seq, actor, action,
+  // previous, next} event to the user's own connected clients, so a watching
+  // Display re-renders on any Logic change no matter who caused it.
+  async function controlServerCapsule(userId, installed, actor, callerId, kind, payload) {
+    var runtime = serverRuntimes.createRuntime(installed.manifest.id, contextFor(userId));
+    if (!runtime) throw new Error("No trusted server runtime is registered for this capsule.");
+    var context = { userId: userId, actor: actor, callerId: callerId };
+    if (kind === "snapshot") return runtime.snapshot(context);
+    if (kind === "act") {
+      var result = await runtime.act(context, payload.actionId, payload.args || {});
+      if (result && result.event) {
+        broadcastToUser(userId, { type: "tool_server_event", toolId: installed.manifest.id, event: result.event });
+        // The game round-trips: a Mate act names the opponent seat, and a
+        // human act that hands the turn over wakes that Mate to play it.
+        if (actor === "mate" && callerId) mateTurn.rememberOpponent(userId, installed.manifest.id, callerId);
+        mateTurn.maybeNudge(userId, installed.manifest, actor, result.event);
+        return result.state;
+      }
+      return result;
+    }
+    if (kind === "set" && runtime.set) return runtime.set(context, payload.controlId, payload.value);
+    throw new Error("The server-runtime capsule does not support '" + kind + "'.");
+  }
+
   function controlForMate(userId, mateId, toolId, kind, payload) {
+    requireCapsulesEnabled(userId);
     payload = payload || {};
     var ctx = contextFor(userId);
     toolsRegistry.listTools(ctx);
     var installed = toolsRegistry.getTool(ctx, toolId);
     if (!installed) return Promise.reject(new Error("Tool is not installed."));
+    // Skills are gated by Display: the Mate loses a Capsule at the same moment
+    // the human loses the declarative floor it is operated through.
+    if (!capsuleFloor.hasUsableFloor(installed.manifest, installed.uiTree)) {
+      return Promise.reject(new Error("This Capsule has no usable human Display, so it is unavailable to Mates."));
+    }
     if (installed.manifest.runtime === "server") {
-      var adapter = serverLogic[toolId];
-      if (!adapter) return Promise.reject(new Error("No trusted server runtime is registered for this capsule."));
-      var context = { userId: userId, callerId: mateId };
-      if (kind === "snapshot") return Promise.resolve(adapter.snapshot(context));
-      if (kind === "act") return Promise.resolve(adapter.act(context, payload.actionId, payload.args || {}));
-      if (kind === "set" && adapter.set) return Promise.resolve(adapter.set(context, payload.controlId, payload.value));
-      return Promise.reject(new Error("The server-runtime capsule does not support '" + kind + "'."));
+      return Promise.resolve().then(function () {
+        return controlServerCapsule(userId, installed, "mate", mateId, kind, payload);
+      });
     }
     var permissions = installed.manifest.permissions || [];
     var timeoutMs = kind === "act" && permissions.indexOf("llm") !== -1 ? llmControlTimeoutMs : controlTimeoutMs;
@@ -211,6 +259,7 @@ function attachTools(deps) {
   }
 
   function installForMate(userId, input) {
+    requireCapsulesEnabled(userId);
     var installed = toolsRegistry.installTool(contextFor(userId), input);
     refreshMateCatalogs(userId);
     broadcastToUser(userId, { type: "tool_installed", tool: installed });
@@ -218,6 +267,7 @@ function attachTools(deps) {
   }
 
   function sourceForMate(userId, toolId) {
+    requireCapsulesEnabled(userId);
     var ctx = contextFor(userId);
     var installed = toolsRegistry.getTool(ctx, toolId);
     if (!installed) throw new Error("Tool not found.");
@@ -229,6 +279,7 @@ function attachTools(deps) {
   }
 
   function updateForMate(userId, toolId, input) {
+    requireCapsulesEnabled(userId);
     var ctx = contextFor(userId);
     var installed = toolsRegistry.getTool(ctx, toolId);
     if (!installed) throw new Error("Tool not found.");
@@ -243,6 +294,7 @@ function attachTools(deps) {
   }
 
   function setMateAccess(userId, toolId, allowed, requestId) {
+    requireCapsulesEnabled(userId);
     var ctx = contextFor(userId);
     var tool = toolsRegistry.getTool(ctx, toolId);
     if (!tool) throw new Error("Tool not found.");
@@ -255,6 +307,7 @@ function attachTools(deps) {
   }
 
   function removeForMate(userId, toolId) {
+    requireCapsulesEnabled(userId);
     var removed = toolsRegistry.removeTool(contextFor(userId), toolId);
     if (!removed) throw new Error("Tool not found.");
     refreshMateCatalogs(userId);
@@ -262,8 +315,19 @@ function attachTools(deps) {
     return { removed: true, toolId: toolId };
   }
 
+  // The human half of the shared server-Capsule pipeline. Same Logic, same
+  // rules, no AI in the path.
+  function controlForUser(userId, toolId, kind, payload) {
+    requireCapsulesEnabled(userId);
+    var ctx = contextFor(userId);
+    var installed = toolsRegistry.getTool(ctx, toolId);
+    if (!installed) throw new Error("Tool is not installed.");
+    if (installed.manifest.runtime !== "server") throw new Error("This Capsule does not run on the server.");
+    return controlServerCapsule(userId, installed, "human", "user", kind, payload || {});
+  }
+
   function handleMessage(ws, msg) {
-    var messageTypes = ["tools_list", "tool_get", "tool_install", "tool_remove", "tool_storage_op", "tool_llm_op", "tool_llm_config_get", "tool_control_response", "tool_source_get", "tool_mate_access_set"];
+    var messageTypes = ["tools_list", "tool_get", "tool_install", "tool_remove", "tool_storage_op", "tool_llm_op", "tool_llm_config_get", "tool_control_response", "tool_source_get", "tool_mate_access_set", "tool_server_control", "tool_frame_url"];
     if (!msg || messageTypes.indexOf(msg.type) === -1) return false;
     var userId;
     if (users.isMultiUser()) {
@@ -279,6 +343,12 @@ function attachTools(deps) {
       return true;
     }
 
+    if (!isCapsulesEnabled(userId)) {
+      if (msg.type === "tools_list") send(ws, { type: "tools_state", tools: [] });
+      else sendError(ws, msg, new Error("Capsules are disabled in User Settings."));
+      return true;
+    }
+
     if (msg.type === "tools_list") {
       run(ws, msg, function () {
         send(ws, { type: "tools_state", tools: fullToolList(ctx) });
@@ -312,6 +382,52 @@ function attachTools(deps) {
       });
       return true;
     }
+    if (msg.type === "tool_frame_url") {
+      // The rich element renders on a separate anonymous origin, so the frame
+      // URL is minted here, on the authenticated socket, as a short-lived
+      // one-time token bound to this user's tools root. The rich element is
+      // additive only: it exists solely when the floor already validated at
+      // registration, and losing it never costs the human the floor.
+      Promise.resolve().then(function () {
+        var ctx = contextFor(userId);
+        var installed = toolsRegistry.getTool(ctx, msg.toolId);
+        if (!installed) throw new Error("Tool is not installed.");
+        if (!installed.hasRichDisplay) throw new Error("This Capsule ships no rich Display element.");
+        return frameServer.issueFrameUrl(ctx, msg.toolId);
+      }).then(function (frame) {
+        send(ws, { type: "tool_frame_url_state", toolId: msg.toolId, requestId: msg.requestId || null, ok: true, frame: frame });
+      }).catch(function (error) {
+        send(ws, {
+          type: "tool_frame_url_state",
+          toolId: msg.toolId,
+          requestId: msg.requestId || null,
+          ok: false,
+          error: error && error.message ? error.message : "The rich Display is unavailable.",
+        });
+      });
+      return true;
+    }
+    if (msg.type === "tool_server_control") {
+      Promise.resolve().then(function () {
+        return controlForUser(userId, msg.toolId, msg.kind, {
+          actionId: msg.actionId,
+          args: msg.args || {},
+          controlId: msg.controlId,
+          value: msg.value,
+        });
+      }).then(function (state) {
+        send(ws, { type: "tool_server_state", toolId: msg.toolId, requestId: msg.requestId || null, ok: true, state: state });
+      }).catch(function (error) {
+        send(ws, {
+          type: "tool_server_state",
+          toolId: msg.toolId,
+          requestId: msg.requestId || null,
+          ok: false,
+          error: error && error.message ? error.message : "The Capsule action failed.",
+        });
+      });
+      return true;
+    }
     if (msg.type === "tool_install") {
       run(ws, msg, function () {
         installForMate(userId, {
@@ -366,11 +482,13 @@ function attachTools(deps) {
     handleMessage: handleMessage,
     installedManifests: installedManifests,
     controlForMate: controlForMate,
+    controlForUser: controlForUser,
     installForMate: installForMate,
     sourceForMate: sourceForMate,
     updateForMate: updateForMate,
     setMateAccess: setMateAccess,
     removeForMate: removeForMate,
+    refreshMateCatalogs: refreshMateCatalogs,
   };
 }
 

package/lib/server.js

@@ -23,6 +23,8 @@ var serverPalette = require("./server-palette");
 var workspaceQueryModule = require("./workspace-query-service");
 var { attachWorkspaceQueryService } = workspaceQueryModule;
 var { attachWorkspaceAssignmentService } = require("./workspace-assignment-service");
+var { attachProjectLogsService } = require("./project-logs-service");
+var { attachMateKnowledgeService } = require("./mate-knowledge-service");
 var serverEmail = require("./server-email");
 var serverGlobalWs = require("./server-global-ws");
 var { parseWsRequestUrl } = require("./ws-request");
@@ -122,6 +124,14 @@ function stripPrefix(urlPath, slug) {
   return rest || "/";
 }
 
+function injectRootProjectSlug(html, slug) {
+  var bodyPattern = /<body\b([^>]*)>/i;
+  if (!bodyPattern.test(html)) throw new Error("App shell body is missing");
+  return html.replace(bodyPattern, function (_match, attributes) {
+    return '<body' + attributes + ' data-home-project-slug="' + slug + '">';
+  });
+}
+
 /**
  * Create a multi-project server.
  * opts: { tlsOptions, caPath, pinHash, port, debug, dangerouslySkipPermissions }
@@ -306,18 +316,50 @@ function createServer(opts) {
   var workspaceQueryService = attachWorkspaceQueryService({
     getProjects: function () { return projects; },
     isMultiUser: function () { return users.isMultiUser(); },
-    canAccessProject: function (userId, status) {
-      return users.canAccessProject(userId, {
-        ownerId: status && status.projectOwnerId || null,
-        visibility: status && status.visibility || "public",
-        allowedUsers: status && status.allowedUsers || [],
-      });
+    // Project access is resolved from the authoritative project record, not
+    // from getStatus(), which carries no visibility or allowedUsers fields and
+    // would otherwise default every project to public.
+    onGetProjectAccess: onGetProjectAccess,
+    canAccessProject: function (userId, access) {
+      return users.canAccessProject(userId, access) === true;
     },
     resolveMate: function (userId, mateId) {
       return mates.getMate(mates.buildMateCtx(users.isMultiUser() ? userId : null), mateId);
     },
     assignmentService: assignmentService,
   });
+  // Project access is resolved from the authoritative project record, not from
+  // getStatus(), which carries no visibility or allowedUsers fields.
+  var projectLogsService = attachProjectLogsService({
+    getProjects: function () { return projects; },
+    isMultiUser: function () { return users.isMultiUser(); },
+    canAccessProject: function (userId, status) {
+      if (!status || !status.slug || !onGetProjectAccess) return false;
+      var access = onGetProjectAccess(status.slug);
+      if (!access || access.error) return false;
+      return users.canAccessProject(userId, access) === true;
+    },
+    resolveMate: function (userId, mateId) {
+      return mates.getMate(mates.buildMateCtx(users.isMultiUser() ? userId : null), mateId);
+    },
+    findUserById: function (userId) { return users.findUserById(userId); },
+  });
+  // Mate Knowledge reads the synchronized Knowledge records. The Mate list is
+  // derived from the owning user alone, so a binding can never span users.
+  var mateKnowledgeService = attachMateKnowledgeService({
+    getProjects: function () { return projects; },
+    isMultiUser: function () { return users.isMultiUser(); },
+    resolveMate: function (userId, mateId) {
+      return mates.getMate(mates.buildMateCtx(users.isMultiUser() ? userId : null), mateId);
+    },
+    listMates: function (userId) {
+      var mateCtx = mates.buildMateCtx(users.isMultiUser() ? userId : null);
+      var all = mates.getAllMates(mateCtx) || [];
+      return all.map(function (mate) {
+        return { id: mate.id, name: mate.name || null, createdBy: mate.createdBy || null, dir: mates.getMateDir(mateCtx, mate.id) };
+      });
+    },
+  });
 
   // --- Admin module ---
   var admin = serverAdmin.attachAdmin({
@@ -351,6 +393,9 @@ function createServer(opts) {
     projects: projects,
     opts: opts,
     CONFIG_DIR: CONFIG_DIR,
+    onCapsulesPreferenceChanged: function (userId) {
+      if (toolsHandler) toolsHandler.refreshMateCatalogs(userId);
+    },
   });
 
   var palette = serverPalette.attachPalette({
@@ -388,16 +433,38 @@ function createServer(opts) {
     securityHeaders["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains";
   }
 
-  function setSecurityHeaders(res) {
+  // Capsule rich-Display frames are served by a second listener on the same
+  // hostname but a different port, so frame-src cannot stay at the default
+  // 'self'. The allowance is computed from the request's own hostname with
+  // any port, never a wildcard host, and only for the scheme the app itself
+  // speaks. If the host header is unusable the CSP stays at 'self' and the
+  // frame silently falls back to the floor Display.
+  function frameSrcFor(req) {
+    var host = req && req.headers && typeof req.headers.host === "string" ? req.headers.host : "";
+    if (!host) return "'self'";
+    var scheme = tlsOptions ? "https" : "http";
+    var hostname;
+    try {
+      hostname = new URL(scheme + "://" + host).hostname;
+    } catch (error) {
+      return "'self'";
+    }
+    if (!hostname) return "'self'";
+    if (hostname.indexOf(":") !== -1) hostname = "[" + hostname + "]";
+    return "'self' " + scheme + "://" + hostname + ":*";
+  }
+
+  function setSecurityHeaders(res, req) {
     var keys = Object.keys(securityHeaders);
     for (var i = 0; i < keys.length; i++) {
       res.setHeader(keys[i], securityHeaders[keys[i]]);
     }
+    res.setHeader("Content-Security-Policy", securityHeaders["Content-Security-Policy"] + " frame-src " + frameSrcFor(req) + ";");
   }
 
   // --- HTTP handler ---
   var appHandler = function (req, res) {
-    setSecurityHeaders(res);
+    setSecurityHeaders(res, req);
     var fullUrl = req.url.split("?")[0];
 
     // --- Auth routes (delegated to server-auth) ---
@@ -682,7 +749,8 @@ function createServer(opts) {
     // --- Skills routes (delegated to server-skills) ---
     if (skills.handleRequest(req, res, fullUrl)) return;
 
-    // Root path — render home while keeping the last accessible project connected.
+    // Root path — render the default project workspace while keeping Home
+    // available as an explicit client-side surface.
     if (fullUrl === "/" && req.method === "GET") {
       if (!isRequestAuthed(req)) {
         res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
@@ -692,11 +760,16 @@ function createServer(opts) {
       if (projects.size > 0) {
         var targetSlug = null;
         var reqUser = users.isMultiUser() ? getMultiUserFromReq(req) : null;
+        function isOrdinaryProject(slug) {
+          var candidate = slug ? projects.get(slug) : null;
+          var status = candidate && candidate.getStatus ? candidate.getStatus() : null;
+          return !!candidate && (!status || status.isMate !== true);
+        }
         var homePreference = typeof users.getHomeSurfacePreference === "function"
           ? users.getHomeSurfacePreference(reqUser ? reqUser.id : "default")
           : null;
         var preferredContextSlug = homePreference && homePreference.projectSlug;
-        if (preferredContextSlug && projects.has(preferredContextSlug)) {
+        if (isOrdinaryProject(preferredContextSlug)) {
           if (reqUser && onGetProjectAccess) {
             var preferredAccess = onGetProjectAccess(preferredContextSlug);
             if (preferredAccess && !preferredAccess.error && users.canAccessProject(reqUser.id, preferredAccess)) {
@@ -708,7 +781,7 @@ function createServer(opts) {
         }
         // Check for last-visited project cookie
         var lastProject = parseCookies(req)["clay_last_project"];
-        if (!targetSlug && lastProject && projects.has(lastProject)) {
+        if (!targetSlug && isOrdinaryProject(lastProject)) {
           if (reqUser && onGetProjectAccess) {
             var lpAccess = onGetProjectAccess(lastProject);
             if (lpAccess && !lpAccess.error && users.canAccessProject(reqUser.id, lpAccess)) {
@@ -722,6 +795,7 @@ function createServer(opts) {
         if (!targetSlug) {
           projects.forEach(function (ctx, s) {
             if (targetSlug) return;
+            if (!isOrdinaryProject(s)) return;
             if (reqUser && onGetProjectAccess) {
               var access = onGetProjectAccess(s);
               if (access && !access.error && users.canAccessProject(reqUser.id, access)) {
@@ -735,7 +809,7 @@ function createServer(opts) {
         if (targetSlug) {
           try {
             var homeHtml = fs.readFileSync(path.join(publicDir, "index.html"), "utf8");
-            homeHtml = homeHtml.replace("<body>", '<body data-home-project-slug="' + targetSlug + '">');
+            homeHtml = injectRootProjectSlug(homeHtml, targetSlug);
             res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-cache" });
             res.end(homeHtml);
           } catch (e) {
@@ -937,17 +1011,24 @@ function createServer(opts) {
 
   // --- WebSocket ---
   var wss = new WebSocketServer({ noServer: true });
+  var homePreferencesHandler = null;
 
   // Slug-less /ws handler: lets a user with no projects yet load the regular
   // app shell and create/add/clone their first one. Only knows about the
-  // small set of bootstrap messages (browse_dir, add_project, create_project,
-  // clone_project, ping).
+  // small set of bootstrap messages, including the Home preferences required
+  // to dismiss the workspace restoration screen.
   var globalWs = serverGlobalWs.attachGlobalWs({
     osUsers: osUsers,
     usersModule: users,
     onAddProject: onAddProject,
     onCreateProject: onCreateProject,
     onCloneProject: onCloneProject,
+    onHomePreferenceMessage: function (ws, msg) {
+      return homePreferencesHandler ? homePreferencesHandler.handleMessage(ws, msg) : false;
+    },
+    onAppMessage: function (ws, msg) {
+      return handleDmMessage(ws, msg);
+    },
   });
 
   server.on("upgrade", function (req, socket, head) {
@@ -1182,6 +1263,7 @@ function createServer(opts) {
       title: title || null,
       icon: icon || null,
       projectOwnerId: projectOwnerId || null,
+      projectKnowledgeId: extra.projectKnowledgeId || (worktreeMeta && worktreeMeta.projectKnowledgeId) || null,
       worktreeMeta: worktreeMeta || null,
       isMate: extra.isMate || false,
       mateId: extra.mateId || (extra.isMate ? path.basename(cwd) : null),
@@ -1192,6 +1274,21 @@ function createServer(opts) {
         return mateHandler.createReadyMateFromInterview(ws, userId, definition);
       },
       workspaceQueryService: workspaceQueryService,
+      projectLogsService: projectLogsService,
+      mateKnowledgeService: mateKnowledgeService,
+      canAccessProjectSlug: function (userId, targetSlug) {
+        var target = projects.get(targetSlug);
+        if (!target) return false;
+        var status = target.getStatus();
+        var access;
+        if (status.isMate) {
+          access = { visibility: "private", ownerId: status.projectOwnerId, allowedUsers: [] };
+        } else {
+          if (!onGetProjectAccess) return false;
+          access = onGetProjectAccess(status.parentSlug || targetSlug);
+        }
+        return !!(access && !access.error && users.canAccessProject(userId, access));
+      },
       getProjectAccess: function () {
         return onGetProjectAccess ? onGetProjectAccess(slug) : { visibility: "public", ownerId: projectOwnerId || null };
       },
@@ -1361,6 +1458,10 @@ function createServer(opts) {
     return true;
   }
 
+  function setProjectLogContextState(slug, status) {
+    return projectLogsService.setContextState(slug, status);
+  }
+
   // --- DM message handler (delegated to server-dm + server-mates inline) ---
   var dmHandler = serverDm.attachDm({
     users: users,
@@ -1381,9 +1482,10 @@ function createServer(opts) {
     projects: projects,
     addProject: addProject,
     workspaceQueryService: workspaceQueryService,
+    projectLogsService: projectLogsService,
   });
 
-  var homePreferencesHandler = serverHomePreferences.attachHomePreferences({
+  homePreferencesHandler = serverHomePreferences.attachHomePreferences({
     users: users,
     projects: projects,
   });
@@ -1392,6 +1494,17 @@ function createServer(opts) {
   var toolsHandler = serverTools.attachTools({
     users: users,
     projects: projects,
+    // The rich-Display frame listener must speak the same scheme as the app,
+    // or the sandboxed frame would be blocked as mixed content under TLS.
+    tlsOptions: tlsOptions,
+    // Lets a Capsule turn handed to the mate seat wake the opponent Mate's
+    // project, registering it first if it has never been opened.
+    findMateProject: homeChatHandler.findMateProject,
+    isCapsulesEnabled: function (userId) {
+      if (users.isMultiUser()) return users.getCapsulesEnabled(userId);
+      var daemonConfig = onGetDaemonConfig ? onGetDaemonConfig() : {};
+      return daemonConfig.capsulesEnabled === true;
+    },
   });
 
   // --- Mate handler ---
@@ -1402,13 +1515,14 @@ function createServer(opts) {
   }
 
   function handleDmMessage(ws, msg, routedProjectSlug) {
-    if (assignmentService.handleMessage(ws, msg, routedProjectSlug)) return;
-    if (dmHandler.handleMessage(ws, msg)) return;
-    if (mateHandler && mateHandler.handleMessage(ws, msg)) return;
-    if (emailHandler.handleMessage(ws, msg)) return;
-    if (homeChatHandler.handleMessage(ws, msg)) return;
-    if (homePreferencesHandler.handleMessage(ws, msg)) return;
-    if (toolsHandler.handleMessage(ws, msg)) return;
+    if (assignmentService.handleMessage(ws, msg, routedProjectSlug)) return true;
+    if (dmHandler.handleMessage(ws, msg)) return true;
+    if (mateHandler && mateHandler.handleMessage(ws, msg)) return true;
+    if (emailHandler.handleMessage(ws, msg)) return true;
+    if (homeChatHandler.handleMessage(ws, msg)) return true;
+    if (homePreferencesHandler.handleMessage(ws, msg)) return true;
+    if (toolsHandler.handleMessage(ws, msg)) return true;
+    return false;
   }
 
   function removeProject(slug) {
@@ -1702,6 +1816,7 @@ function createServer(opts) {
     forEachProject: forEachProject,
     destroyProject: removeProject,
     destroyAll: destroyAll,
+    setProjectLogContextState: setProjectLogContextState,
   };
 }
 

package/lib/session-driver-eligibility.js

@@ -0,0 +1,38 @@
+// Driver capability for a visible Driver/Split Worker pair.
+//
+// Model and vendor choice belongs to the user. A session does not need to
+// clear a model-tier threshold to coordinate a Split Worker; runtime catalog
+// validation belongs to session-pair-factory.js and applies equally to every
+// requested role. The only session-level exclusion here is structural: an
+// embedded terminal has no project chat surface on which to host the Driver
+// controls or the paired pane.
+
+var sessionProvenance = require("./session-provenance");
+
+function evaluateDriverSession(session) {
+  if (!session) {
+    return { ok: false, error: "No session was bound to this request." };
+  }
+  if (session.mode === "tui") {
+    return {
+      ok: false,
+      error: "An embedded terminal session cannot take the Driver role.",
+    };
+  }
+  if (sessionProvenance.isWorker(session)) {
+    return {
+      ok: false,
+      error: "A Split Worker session cannot take the Driver role.",
+    };
+  }
+  return { ok: true, error: null };
+}
+
+function isEligibleDriverSession(session) {
+  return evaluateDriverSession(session).ok;
+}
+
+module.exports = {
+  evaluateDriverSession: evaluateDriverSession,
+  isEligibleDriverSession: isEligibleDriverSession,
+};

package/lib/session-driver-orchestration.js

@@ -0,0 +1,31 @@
+// Model-tier policy for proactive Split Worker orchestration.
+//
+// Structural Driver eligibility remains model-agnostic. This policy only
+// decides whether a model should be prompted to judge when delegation helps.
+
+var HIGH_TIER_PATTERNS = {
+  claude: [/(?:^|-)fable(?:-|$)/i, /(?:^|-)opus(?:-|$)/i],
+  codex: [/^gpt-6(?:-|$)/i, /^gpt-[0-9]+(?:\.[0-9]+)?-sol(?:-|$)/i],
+};
+
+function resolvedModel(session, sm) {
+  if (!session) return "";
+  var vendor = session.vendor || "claude";
+  var defaults = sm && sm.defaultModelByVendor || {};
+  return session.model || defaults[vendor] || "";
+}
+
+function isHighTierDriverSession(session, sm) {
+  if (!session) return false;
+  var patterns = HIGH_TIER_PATTERNS[session.vendor || "claude"] || [];
+  var model = resolvedModel(session, sm);
+  for (var i = 0; i < patterns.length; i++) {
+    if (patterns[i].test(model)) return true;
+  }
+  return false;
+}
+
+module.exports = {
+  isHighTierDriverSession: isHighTierDriverSession,
+  resolvedModel: resolvedModel,
+};

package/lib/session-hygiene.js

@@ -2,6 +2,8 @@
 // "New session" request and which abandoned blanks are safe to sweep.
 // Pure decision logic only -- deletion/switching stays in sessions.js.
 
+var sessionProvenance = require("./session-provenance");
+
 var BLANK_SESSION_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 var CLAUDE_INTERRUPTED_TEXT = "[Request interrupted by user]";
 
@@ -19,6 +21,7 @@ function isBlankSession(s) {
     && !s.bookmarked
     && !s.spawn
     && !s.loop
+    && !sessionProvenance.isWorker(s)
     && (s.mode || "gui") !== "tui"
     && s.terminalId == null;
 }