clay-server 4.0.0-beta.9 → 4.0.0

package/lib/workspace-query-service.js

@@ -1,5 +1,6 @@
 var sessionSearch = require("./session-search");
 var builtinMates = require("./builtin-mates");
+var workspaceQueryAccess = require("./workspace-query-access");
 var crypto = require("crypto");
 
 var MAX_PAGE = 50;
@@ -100,7 +101,13 @@ function attachWorkspaceQueryService(ctx) {
   var getProjects = ctx.getProjects;
   var isMultiUser = ctx.isMultiUser;
   var resolveMate = ctx.resolveMate;
-  var canAccessProject = ctx.canAccessProject;
+  // Ownership and access both come from here, never from getStatus().
+  var projectAccess = workspaceQueryAccess.attachWorkspaceQueryAccess({
+    isMultiUser: isMultiUser,
+    resolveMate: resolveMate,
+    onGetProjectAccess: ctx.onGetProjectAccess,
+    canAccessProject: ctx.canAccessProject,
+  });
 
   function authoritativeMate(source) {
     if (!source || source.isMate !== true || !source.mateId || typeof resolveMate !== "function") return null;
@@ -164,12 +171,6 @@ function attachWorkspaceQueryService(ctx) {
     });
   }
 
-  function ownsProject(principal, status) {
-    if (!status || status.isWorktree) return false;
-    if (isMultiUser()) return !!principal.userId && status.projectOwnerId === principal.userId;
-    return !status.projectOwnerId || (!!principal.singleUserOwnerId && status.projectOwnerId === principal.singleUserOwnerId);
-  }
-
   function ownsSession(principal, session) {
     if (!session || session.hidden) return false;
     if (isMultiUser()) return !!principal.userId && session.ownerId === principal.userId;
@@ -180,12 +181,12 @@ function attachWorkspaceQueryService(ctx) {
     var projects = [];
     getProjects().forEach(function (project, slug) {
       var status = project.getStatus();
-      var projectOwned = ownsProject(principal, status);
-      var projectAccessible = projectOwned;
-      if (!projectAccessible && isMultiUser() && typeof canAccessProject === "function") {
-        projectAccessible = canAccessProject(principal.userId, status) === true;
-      }
-      if (!projectAccessible || (status && status.isWorktree)) return;
+      if (!status || status.isWorktree) return;
+      // Authorized here rather than at bind time, so an already-created tool
+      // handler loses a project the moment its access record changes.
+      var verdict = projectAccess.evaluate(principal, status);
+      if (!verdict.accessible) return;
+      var projectOwned = verdict.owned;
       var manager = project.getSessionManager ? project.getSessionManager() : project.sm;
       if (!manager || !manager.sessions) return;
       var sessions = [];
@@ -305,14 +306,20 @@ function attachWorkspaceQueryService(ctx) {
   function searchHistory(principal, projectSlug, args) {
     var query = cleanText(args && args.query || "", 500);
     if (!query) throw new Error("A search query is required.");
-    var projects;
+    // One authorization snapshot for the whole call. Resolving hits back to
+    // their project through findProject() would re-authorize every project once
+    // per hit, so the visible set is captured once and indexed.
+    var visible;
     if (projectSlug) {
       var project = findProject(principal, projectSlug);
       if (!project) throw new Error("Project not found in the owned workspace.");
-      projects = [sanitizedProject(project)];
+      visible = [project];
     } else {
-      projects = collect(principal).map(sanitizedProject);
+      visible = collect(principal);
     }
+    var bySlug = {};
+    for (var v = 0; v < visible.length; v++) bySlug[visible[v].projectSlug] = visible[v];
+    var projects = visible.map(sanitizedProject);
     var max = Math.min(100, decodeCursor(args && args.cursor) + parseLimit(args && args.limit, 20) + 20);
     var ranked = sessionSearch.searchPalette(projects, query, { maxResults: max });
     var offset = decodeCursor(args && args.cursor);
@@ -321,7 +328,7 @@ function attachWorkspaceQueryService(ctx) {
     var results = [];
     for (var i = 0; i < selected.length; i++) {
       var hit = selected[i];
-      var projectForHit = findProject(principal, hit.projectSlug);
+      var projectForHit = bySlug[hit.projectSlug] || null;
       var session = projectForHit ? findSession(projectForHit, String(hit.sessionId)) : null;
       if (!session) continue;
       results.push({

package/lib/worktree.js

@@ -1,6 +1,6 @@
-var { execFileSync } = require("child_process");
 var fs = require("fs");
 var path = require("path");
+var { runGitSync } = require("./git-cli");
 
 // Parse `git worktree list --porcelain` output into structured objects
 function parseWorktreeOutput(output) {
@@ -28,14 +28,10 @@ function parseWorktreeOutput(output) {
 }
 
 // Check if a given path is itself a worktree (not the main working tree)
-function isWorktree(projectPath) {
+function isWorktree(projectPath, osUserInfo) {
   try {
-    var gitDir = execFileSync("git", ["rev-parse", "--git-dir"], {
-      cwd: projectPath, encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"],
-    }).trim();
-    var commonDir = execFileSync("git", ["rev-parse", "--git-common-dir"], {
-      cwd: projectPath, encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"],
-    }).trim();
+    var gitDir = runGitSync(projectPath, ["rev-parse", "--git-dir"], null, osUserInfo).trim();
+    var commonDir = runGitSync(projectPath, ["rev-parse", "--git-common-dir"], null, osUserInfo).trim();
     var absGit = path.resolve(projectPath, gitDir);
     var absCommon = path.resolve(projectPath, commonDir);
     return absGit !== absCommon;
@@ -49,18 +45,21 @@ function isPathInside(parentPath, candidatePath) {
   return relative !== "" && relative !== ".." && relative.indexOf(".." + path.sep) !== 0 && !path.isAbsolute(relative);
 }
 
+function worktreePath(projectPath, dirName) {
+  if (typeof dirName !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(dirName)) return null;
+  var resolvedParent = path.resolve(projectPath);
+  var resolvedWorktree = path.resolve(resolvedParent, dirName);
+  return isPathInside(resolvedParent, resolvedWorktree) ? resolvedWorktree : null;
+}
+
 // Scan worktrees for a given project path
 // Returns array of { path, branch, bare, detached, external }
 // external = true when Git registered the worktree outside the main project folder
-function scanWorktrees(projectPath) {
+function scanWorktrees(projectPath, osUserInfo) {
   var resolvedParent = path.resolve(projectPath);
+  try { resolvedParent = fs.realpathSync(resolvedParent); } catch (e) {}
   try {
-    var output = execFileSync("git", ["worktree", "list", "--porcelain"], {
-      cwd: resolvedParent,
-      encoding: "utf8",
-      timeout: 5000,
-      stdio: ["pipe", "pipe", "pipe"],
-    });
+    var output = runGitSync(resolvedParent, ["worktree", "list", "--porcelain"], null, osUserInfo);
     var all = parseWorktreeOutput(output);
     // Filter out bare worktrees and the main worktree itself
     var results = [];
@@ -68,10 +67,11 @@ function scanWorktrees(projectPath) {
       var wt = all[i];
       if (wt.bare) continue;
       var resolvedWt = path.resolve(wt.path);
-      if (resolvedWt === resolvedParent) continue;
       // Git retains removed worktrees until `git worktree prune` runs. Do not
       // register those stale paths as Clay projects.
       if (!fs.existsSync(resolvedWt)) continue;
+      try { resolvedWt = fs.realpathSync(resolvedWt); } catch (e) {}
+      if (resolvedWt === resolvedParent) continue;
       wt.external = !isPathInside(resolvedParent, resolvedWt);
       wt.dirName = path.basename(wt.path);
       results.push(wt);
@@ -84,28 +84,19 @@ function scanWorktrees(projectPath) {
 
 // Create a new worktree inside the parent project directory
 // Returns { ok, path, error }
-function createWorktree(projectPath, branchName, dirName, baseBranch) {
+function createWorktree(projectPath, branchName, dirName, baseBranch, osUserInfo) {
   var resolvedParent = path.resolve(projectPath);
-  var wtPath = path.join(resolvedParent, dirName || branchName);
+  var wtPath = worktreePath(resolvedParent, dirName || branchName);
+  if (!wtPath) return { ok: false, error: "Invalid worktree directory name" };
   var base = baseBranch || "main";
   // Try creating with -b (new branch)
   try {
-    execFileSync("git", ["worktree", "add", wtPath, "-b", branchName, base], {
-      cwd: resolvedParent,
-      encoding: "utf8",
-      timeout: 15000,
-      stdio: ["pipe", "pipe", "pipe"],
-    });
+    runGitSync(resolvedParent, ["worktree", "add", wtPath, "-b", branchName, base], { timeout: 15000 }, osUserInfo);
     return { ok: true, path: wtPath };
   } catch (e) {
     // Branch may already exist, try without -b
     try {
-      execFileSync("git", ["worktree", "add", wtPath, branchName], {
-        cwd: resolvedParent,
-        encoding: "utf8",
-        timeout: 15000,
-        stdio: ["pipe", "pipe", "pipe"],
-      });
+      runGitSync(resolvedParent, ["worktree", "add", wtPath, branchName], { timeout: 15000 }, osUserInfo);
       return { ok: true, path: wtPath };
     } catch (e2) {
       return { ok: false, error: e2.message || "Failed to create worktree" };
@@ -115,17 +106,13 @@ function createWorktree(projectPath, branchName, dirName, baseBranch) {
 
 // Remove a worktree
 // Returns { ok, error }
-function removeWorktree(projectPath, worktreeDirName) {
+function removeWorktree(projectPath, worktreeDirName, osUserInfo) {
   var resolvedParent = path.resolve(projectPath);
-  var wtPath = path.join(resolvedParent, worktreeDirName);
+  var wtPath = worktreePath(resolvedParent, worktreeDirName);
+  if (!wtPath) return { ok: false, error: "Invalid worktree directory name" };
   // Try normal remove first
   try {
-    execFileSync("git", ["worktree", "remove", wtPath], {
-      cwd: resolvedParent,
-      encoding: "utf8",
-      timeout: 15000,
-      stdio: ["pipe", "pipe", "pipe"],
-    });
+    runGitSync(resolvedParent, ["worktree", "remove", wtPath], { timeout: 15000 }, osUserInfo);
     return { ok: true };
   } catch (e) {
     var errMsg = (e.stderr || e.message || "").toString();

package/lib/ws-schema.js

@@ -40,10 +40,12 @@ var schema = {
   "split_group_set_pair":     { direction: "c2s", handler: "lib/session-split-groups.js", description: "Assign Driver/Worker roles on a split group (driverId null clears them)" },
   "pair_session_options":     { direction: "c2s", handler: "lib/project-session-pair.js", description: "Request vendors/models for the pair-session dialog (response reuses the same type)" },
   "pair_session_create":      { direction: "c2s", handler: "lib/project-session-pair.js", description: "Create a Driver/Split Worker session pair as a split group" },
-  "worker_proposal_response": { direction: "c2s", handler: "lib/project-worker-proposal.js", description: "Accept or decline a Fable Worker suggestion with the selected runtime" },
+  "worker_proposal_response": { direction: "c2s", handler: "lib/project-worker-proposal.js", description: "Accept or decline an exact Driver Split Worker configuration with the selected runtime" },
   "project_assignment_response": { direction: "c2s", handler: "lib/workspace-assignment-service.js", description: "Approve or cancel an exact-session cross-project assignment proposal" },
   "home_clay_session_resolve": { direction: "c2s", handler: "lib/server-home-chat.js", description: "Resolve an opaque Mate session reference through the exact bound source session" },
   "home_clay_session_target": { direction: "s2c", handler: "lib/public/modules/command-palette.js", description: "Return an owner-validated navigation target for a rendered Mate session reference" },
+  "home_clay_log_resolve":     { direction: "c2s", handler: "lib/server-home-chat.js", description: "Resolve an opaque Project Log reference through the exact bound Clay session" },
+  "home_clay_log_target":      { direction: "s2c", handler: "lib/public/modules/command-palette.js", description: "Return an owner-validated project target for a rendered Log reference" },
 
   "session_list":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Full list of sessions for the sidebar" },
   "session_switched":         { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Confirmation that active session changed" },
@@ -62,8 +64,8 @@ var schema = {
   "split_groups":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Full persistent split-group list for the current user" },
   "split_group_result":       { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Result of a split-group mutation" },
   "pair_session_created":     { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Result of pair_session_create; carries the new group" },
-  "worker_proposal":          { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Inline Fable suggestion to delegate execution to a Worker" },
-  "worker_proposal_update":   { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Worker suggestion lifecycle update" },
+  "worker_proposal":          { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Recorded Split Worker creation/replacement runtime card with Driver rationale" },
+  "worker_proposal_update":   { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Worker card lifecycle and manual/auto decision audit update" },
   "project_assignment_proposal": { direction: "s2c", handler: "lib/public/modules/app-message-router.js", description: "Approval card for a new owner-bound project assignment" },
   "project_assignment_status": { direction: "s2c", handler: "lib/public/modules/app-message-router.js", description: "Durable project assignment lifecycle update" },
   "project_assignment_error": { direction: "s2c", handler: "lib/public/modules/app-message-router.js", description: "Rejected or stale project assignment response" },
@@ -81,7 +83,8 @@ var schema = {
   // -----------------------------------------------------------------------
   // Chat / streaming
   // -----------------------------------------------------------------------
-  "message":                  { direction: "c2s", handler: "lib/project-user-message.js", description: "Send a user chat message" },
+  "message":                  { direction: "c2s", handler: "lib/project-user-message.js", description: "Send an idempotent user chat message; message_ack confirms persistence" },
+  "message_ack":              { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Confirm that an idempotent user chat message was persisted" },
   "user_message":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Echo of the user message in the timeline" },
   "delta":                    { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Incremental text delta from the assistant" },
   "result":                   { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Final assistant result text" },
@@ -247,9 +250,11 @@ var schema = {
   "set_update_channel":       { direction: "c2s", handler: "lib/project-sessions.js", description: "Set the update channel (stable/beta)" },
   "check_update":             { direction: "c2s", handler: "lib/project-sessions.js", description: "Check if an update is available" },
   "update_now":               { direction: "c2s", handler: "lib/project-sessions.js", description: "Start the update process" },
+  "update_snooze":            { direction: "c2s", handler: "lib/project-sessions.js", description: "Snooze the current update notification for an allowlisted duration" },
+  "update_snoozed":           { direction: "s2c", handler: "lib/public/modules/update-snooze.js", description: "Result of an update snooze, fanned out to every device of that user" },
   "update_available":         { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "A new version is available" },
   "up_to_date":               { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Server is already on the latest version" },
-  "update_started":           { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Update download/install has started" },
+  "update_started":           { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Update download/install has started; the version field is included only for admin-grade recipients" },
 
   // -----------------------------------------------------------------------
   // What's New
@@ -396,12 +401,31 @@ var schema = {
   "note_written":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Agent created or updated a sticky note" },
   "note_update":              { direction: "c2s", handler: "lib/project-user-message.js", description: "Update a sticky note" },
   "note_updated":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Sticky note was updated" },
-  "note_delete":              { direction: "c2s", handler: "lib/project-user-message.js", description: "Delete a sticky note" },
-  "note_deleted":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Sticky note was deleted" },
+  "note_close":               { direction: "c2s", handler: "lib/project-user-message.js", description: "Close a sticky note (reversible; never deletes)" },
+  "note_reopen":              { direction: "c2s", handler: "lib/project-user-message.js", description: "Reopen a closed sticky note" },
+  "note_delete":              { direction: "c2s", handler: "lib/project-user-message.js", description: "Retired: older clients still send this; handled as a non-destructive close" },
+  "note_deleted":             { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Retired: never sent. Closing broadcasts note_updated instead" },
   "note_list_request":        { direction: "c2s", handler: "lib/project-user-message.js", description: "Request the full notes list" },
   "note_bring_front":         { direction: "c2s", handler: "lib/project-user-message.js", description: "Bring a note to front (update z-order)" },
   "notes_list":               { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Full list of sticky notes" },
 
+  // -----------------------------------------------------------------------
+  // Project Logs
+  // -----------------------------------------------------------------------
+  "project_logs_list":        { direction: "c2s", handler: "lib/project-logs.js", description: "List or search this project's logs (project scope is bound server-side)" },
+  "project_log_read":         { direction: "c2s", handler: "lib/project-logs.js", description: "Read one project log entry by opaque ref" },
+  "project_log_comment":      { direction: "c2s", handler: "lib/project-logs.js", description: "Append an attributed comment to a project log entry (append-only; author comes from the connection)" },
+  "project_log_delete":       { direction: "c2s", handler: "lib/project-logs.js", description: "Delete a project log entry (project owner only; scope and identity are bound server-side)" },
+  "project_log_create":       { direction: "c2s", handler: "lib/project-logs.js", description: "Retired. Canonical entries are written only by project agent sessions; this is always refused" },
+  "project_log_update":       { direction: "c2s", handler: "lib/project-logs.js", description: "Retired. Canonical revisions are written only by project agent sessions; this is always refused" },
+  "project_logs_state":       { direction: "s2c", handler: "lib/public/modules/project-logs.js", description: "Correlated project log index for a list or search request" },
+  "project_log_entry":        { direction: "s2c", handler: "lib/public/modules/project-logs.js", description: "Correlated full project log entry" },
+  "project_log_commented":    { direction: "s2c", handler: "lib/public/modules/project-logs.js", description: "Correlated project log entry after a comment was appended" },
+  "project_log_comment_reviewed": { direction: "s2c", handler: "lib/public/modules/project-logs.js", description: "A Project Driver resolved a log comment; carries identifiers and action only" },
+  "project_log_deleted":      { direction: "s2c", handler: "lib/public/modules/project-logs.js", description: "Confirm that the project owner deleted a project log entry" },
+  "project_log_updated":      { direction: "s2c", handler: "lib/public/modules/project-logs.js", description: "A project log entry was created, revised, or deleted (bounded ledger metadata only)" },
+  "project_logs_error":       { direction: "s2c", handler: "lib/public/modules/project-logs.js", description: "Correlated project log request failure" },
+
   // -----------------------------------------------------------------------
   // Browser extension
   // -----------------------------------------------------------------------
@@ -471,6 +495,8 @@ var schema = {
   "tool_llm_op":              { direction: "c2s", handler: "lib/server-tools.js", description: "Run a permission-gated vendor-neutral capsule LLM completion" },
   "tool_llm_config_get":      { direction: "c2s", handler: "lib/server-tools.js", description: "Get the concrete configured provider and model used by Capsule LLM calls" },
   "tool_control_response":    { direction: "c2s", handler: "lib/server-tools.js", description: "Resolve a mate tool-control request with browser runtime state or an error" },
+  "tool_server_control":      { direction: "c2s", handler: "lib/server-tools.js", description: "Human snapshot or action against a server-runtime Capsule, through the same Logic a Mate calls" },
+  "tool_frame_url":           { direction: "c2s", handler: "lib/server-tools.js", description: "Mint a one-time separate-origin URL for a Capsule's sandboxed rich Display frame" },
   "tools_state":              { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Full installed tool definitions" },
   "tool_installed":           { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "An installed tool changed" },
   "tool_source_state":        { direction: "s2c", handler: "lib/public/modules/home-capsule-source.js", description: "Correlated authored Capsule source or read error" },
@@ -480,6 +506,10 @@ var schema = {
   "tool_llm_result":          { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Result of a capsule LLM completion" },
   "tool_llm_config_state":    { direction: "s2c", handler: "lib/public/modules/tool-llm-status.js", description: "Concrete provider and model state for Capsule LLM calls" },
   "tool_control_request":     { direction: "s2c", handler: "lib/public/modules/home-tools.js", description: "Ask the connected home client to snapshot or drive a sandboxed tool" },
+  "tool_server_state":        { direction: "s2c", handler: "lib/public/modules/home-tools.js", description: "Correlated server-runtime Capsule state for the human who requested it, or the refusal that blocked it" },
+  "tool_server_event":        { direction: "s2c", handler: "lib/public/modules/home-tools.js", description: "Ordered causal act event {seq, actor, action, previous, next} pushed to the user's Displays whenever server-runtime Capsule Logic changes state" },
+  "tool_frame_url_state":     { direction: "s2c", handler: "lib/public/modules/home-tool-frame.js", description: "Correlated one-time rich Display frame URL, or the refusal that blocked it" },
+  "capsule_game_session":     { direction: "s2c", handler: "lib/public/modules/home-tools.js", description: "A Capsule game session opened or advanced for this user; an explicit game start navigates the home board into it" },
   "tools_error":              { direction: "s2c", handler: "lib/public/modules/app-messages.js", description: "Tool registry, runtime, or storage error" },
 
   // -----------------------------------------------------------------------
@@ -632,6 +662,7 @@ var schema = {
   "home_mate_session_identity": { direction: "s2c", handler: "lib/public/modules/app-message-router.js", description: "Promote an active Home session from its local reference to its durable runtime identity" },
   "home_mate_sessions_state": { direction: "s2c", handler: "lib/public/modules/home-mate-chat.js", description: "Owned visible Mate conversations with sanitized runtime identity, model, status, and timestamps" },
   "home_mate_delta":          { direction: "s2c", handler: "lib/public/modules/home-mate-chat.js", description: "Selected mate's streaming assistant text delta" },
+  "home_mate_segment":        { direction: "s2c", handler: "lib/public/modules/home-mate-chat.js", description: "A tool call ended the mate's current spoken burst; the client seals the streamed bubble and later text starts a fresh one" },
   "home_mate_done":           { direction: "s2c", handler: "lib/public/modules/home-mate-chat.js", description: "Selected mate's turn finished" },
   "home_debate_proposal":     { direction: "s2c", handler: "lib/public/modules/app-message-router.js", description: "Session-bound debate proposal for the active Home transcript" },
   "home_debate_proposal_resolved": { direction: "s2c", handler: "lib/public/modules/app-message-router.js", description: "Server-confirmed result for a Home debate proposal" },

package/lib/yoke/adapters/claude-worker.js

@@ -424,22 +424,32 @@ async function handleQueryStart(msg) {
   function perf(label) { console.log("[PERF] sdk-worker: " + label + " +" + (Date.now() - t0) + "ms (local +" + (Date.now() - localT0) + "ms)"); }
   perf("handleQueryStart entered");
 
+  // Socket messages keep arriving while the SDK import awaits. Accept input
+  // and cancellation synchronously, before yielding to the next IPC message.
+  messageQueue = createMessageQueue();
+  abortController = new AbortController();
+  if (msg.prompt) messageQueue.push(msg.prompt);
+
   var sdk;
   try {
     perf("loading SDK");
     sdk = await getSDK();
     perf("SDK loaded");
   } catch (e) {
+    messageQueue.end();
+    messageQueue = null;
+    abortController = null;
+    sdkModule = null;
     sendToDaemon({ type: "query_error", error: "Failed to load SDK: " + (e.message || e), exitCode: null, stderr: null });
     return;
   }
 
-  messageQueue = createMessageQueue();
-  abortController = new AbortController();
-
-  // Push the initial user message
-  if (msg.prompt) {
-    messageQueue.push(msg.prompt);
+  if (abortController.signal.aborted) {
+    messageQueue.end();
+    messageQueue = null;
+    abortController = null;
+    sendToDaemon({ type: "query_done" });
+    return;
   }
 
   // Build query options (callbacks are local, everything else from daemon)

package/lib/yoke/adapters/claude.js

@@ -260,6 +260,18 @@ function flattenEvent(raw) {
       base.status = raw.status;
       return base;
     }
+    // API retry notices are transient transport state, not conversation
+    // errors. Preserve the structured counters so the host can bound overload
+    // churn without recording one red error row per SDK retry.
+    if (raw.subtype === "api_retry") {
+      base.yokeType = "api_retry";
+      base.attempt = raw.attempt || 0;
+      base.maxRetries = raw.max_retries || 0;
+      base.retryDelayMs = raw.retry_delay_ms || 0;
+      base.error = raw.error || "unknown";
+      base.errorStatus = raw.error_status == null ? null : raw.error_status;
+      return base;
+    }
     if (raw.subtype === "task_started") {
       base.yokeType = "task_started";
       base.parentToolId = raw.tool_use_id;

package/lib/yoke/adapters/codex.js

@@ -28,6 +28,21 @@ var CODEX_REASONING_DEFAULTS = {
   model_reasoning_summary: "detailed",
   model_supports_reasoning_summaries: true,
 };
+var DEFAULT_CODEX_MODEL = "gpt-6-astra";
+var CODEX_NOTE_TOOLS = {
+  list_notes: true,
+  write_note: true,
+  close_note: true,
+  reopen_note: true,
+  remove_note: true,
+};
+
+function canonicalDynamicPermissionToolName(toolName) {
+  if (CODEX_NOTE_TOOLS[toolName]) return "mcp__clay-notes__" + toolName;
+  if (toolName === "send_to_partner" || toolName === "read_partner") return "mcp__clay-sessions__" + toolName;
+  if (toolName === "present_markdown_edit") return "mcp__clay-documents__" + toolName;
+  return toolName;
+}
 
 // --- Event flattening ---
 // Converts app-server JSON-RPC notifications into flat objects with a yokeType field.
@@ -723,7 +738,7 @@ function createEventState(model) {
     done: false,
     aborted: false,
     loopStarted: false,
-    model: model || "gpt-5.6-terra",
+    model: model || DEFAULT_CODEX_MODEL,
     textBlocks: {},
     textLengths: {},
     thinkingBlocks: {},
@@ -912,14 +927,7 @@ function createCodexQueryHandle(appServer, queryOpts) {
           appServer.respond(msg.id, { contentItems: contentItems, success: !(result && result.isError) });
         });
       }
-      var permissionToolName = dynamicParams.tool;
-      if (permissionToolName === "list_notes" || permissionToolName === "write_note" || permissionToolName === "remove_note") {
-        permissionToolName = "mcp__clay-notes__" + permissionToolName;
-      } else if (permissionToolName === "send_to_partner" || permissionToolName === "read_partner") {
-        permissionToolName = "mcp__clay-sessions__" + permissionToolName;
-      } else if (permissionToolName === "present_markdown_edit") {
-        permissionToolName = "mcp__clay-documents__" + permissionToolName;
-      }
+      var permissionToolName = canonicalDynamicPermissionToolName(dynamicParams.tool);
       var permission = canUseTool
         ? Promise.resolve(canUseTool(permissionToolName, dynamicParams.arguments || {}, {
           toolUseID: dynamicParams.callId || String(msg.id),
@@ -1073,7 +1081,7 @@ function createCodexQueryHandle(appServer, queryOpts) {
 
       // Start or resume thread
       var threadParams = {
-        model: queryOpts.model || "gpt-5.6-terra",
+        model: queryOpts.model || DEFAULT_CODEX_MODEL,
         sandbox: queryOpts.sandboxMode || "workspace-write",
         approvalPolicy: queryOpts.approvalPolicy || "on-request",
         cwd: queryOpts.cwd,
@@ -1241,7 +1249,7 @@ function createCodexQueryHandle(appServer, queryOpts) {
     },
 
     setModel: function(model) {
-      state.model = model || "gpt-5.6-terra";
+      state.model = model || DEFAULT_CODEX_MODEL;
       return Promise.resolve();
     },
 
@@ -1330,9 +1338,10 @@ function createCodexAdapter(opts) {
   // slow/failed `initialize` leaves the picker empty and the chip shows the
   // previous vendor's model.
   // Kept in sync with what `model/list` reports for the bundled codex build
-  // (0.152.1). Models the CLI no longer offers are rejected at turn/start, so
+  // (0.153.4). Models the CLI no longer offers are rejected at turn/start, so
   // listing them would only surface a runtime failure in the model picker.
   var CODEX_MODELS = [
+    "gpt-6-astra",
     "gpt-5.6-terra",
     "gpt-5.6-sol",
     "gpt-5.6-luna",
@@ -1430,7 +1439,7 @@ function createCodexAdapter(opts) {
   function buildReadyResponse(skillNames) {
     return {
       models: _cachedModels,
-      defaultModel: "gpt-5.6-terra",
+      defaultModel: DEFAULT_CODEX_MODEL,
       skills: skillNames || [],
       slashCommands: skillNames || [],
       fastModeState: null,
@@ -1767,7 +1776,7 @@ function createCodexAdapter(opts) {
         throw new Error("[yoke/codex] Adapter not initialized. Call init() first.");
       }
 
-      var model = queryOpts.model || "gpt-5.6-terra";
+      var model = queryOpts.model || DEFAULT_CODEX_MODEL;
       var ac = queryOpts.abortController || new AbortController();
       var activeEntry = {
         abort: function() {
@@ -1984,6 +1993,7 @@ function createCodexAdapter(opts) {
 module.exports = {
   createCodexAdapter: createCodexAdapter,
   contractTestKit: {
+    canonicalDynamicPermissionToolName: canonicalDynamicPermissionToolName,
     createEventState: createEventState,
     createQueryHandle: createCodexQueryHandle,
     normalizeEvent: flattenEvent,

package/lib/yoke/vendor-registry.js

@@ -32,7 +32,7 @@ var VENDOR_REGISTRY = {
     binaryName: "codex",
     avatar: "/codex-avatar.png",
     sessionModes: ["gui"],
-    effortLevels: ["minimal", "low", "medium", "high", "xhigh"],
+    effortLevels: ["low", "medium", "high", "xhigh", "max"],
     osUserIsolation: true,
     sessionBoundTools: false,
     usageDashboard: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "4.0.0-beta.9",
+  "version": "4.0.0",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js",
@@ -51,7 +51,7 @@
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.258",
     "@lydell/node-pty": "^1.2.0-beta.3",
-    "@openai/codex": "^0.152.1",
+    "@openai/codex": "^0.153.4",
     "@seald-io/nedb": "^4.1.2",
     "imapflow": "^1.3.1",
     "nodemailer": "^9.0.5",