clay-server 4.0.1-beta.1 → 4.1.0-beta.2

package/lib/project-worker-proposal.js

@@ -3,10 +3,21 @@ var yoke = require("./yoke");
 var buildShape = require("./session-spawn-mcp-server").buildShape;
 var driverEligibility = require("./session-driver-eligibility");
 var driverOrchestration = require("./session-driver-orchestration");
-var MAX_SUMMARY_CHARS = 600;
-var MAX_PLAN_CHARS = 6000;
-var MAX_TASK_CHARS = 30000;
-var MAX_RATIONALE_CHARS = 1000;
+var proposalControl = require("./worker-proposal-control");
+var runtimeCatalog = require("./worker-runtime-catalog");
+var MAX_SUMMARY_CHARS = 600, MAX_PLAN_CHARS = 6000, MAX_TASK_CHARS = 30000, MAX_RATIONALE_CHARS = 1000;
+var EVALUATION_OUTCOMES = ["succeeded", "partial", "failed", "abandoned"];
+function normalizeEvaluation(raw) {
+  if (raw == null) return null;
+  var input = typeof raw === "string" ? { outcome: raw } : raw;
+  if (!input || typeof input !== "object") return { error: "evaluation must be an outcome string or object" };
+  var outcome = typeof input.outcome === "string" ? input.outcome.trim().toLowerCase() : "";
+  if (EVALUATION_OUTCOMES.indexOf(outcome) === -1) {
+    return { error: "evaluation outcome must be one of: " + EVALUATION_OUTCOMES.join(", ") };
+  }
+  var note = typeof input.note === "string" ? input.note.replace(/\s+/g, " ").trim().slice(0, 400) : "";
+  return { value: { outcome: outcome, note: note } };
+}
 function modelValue(entry) {
   if (typeof entry === "string") return entry;
   return entry && (entry.value || entry.id) || "";
@@ -15,16 +26,14 @@ function modelLabel(entry) {
   if (typeof entry === "string") return entry;
   return entry && (entry.displayName || entry.name || entry.value || entry.id) || "";
 }
-function toolResult(value) {
-  return Promise.resolve({ content: [{ type: "text", text: JSON.stringify(value) }] });
-}
+function toolResult(value) { return Promise.resolve({ content: [{ type: "text", text: JSON.stringify(value) }] }); }
 function attachWorkerProposal(ctx) {
   var sm = ctx.sm;
   var store = ctx.splitStore;
+  var catalogErrors = {};
   function isLiveSession(session) {
     return !!session && sm.sessions.get(session.localId) === session;
   }
-
   function canOffer(session) { return !ctx.isMate && isLiveSession(session) && driverEligibility.isEligibleDriverSession(session, sm); }
   function isEligible(session) {
     return canOffer(session) && !store.groupForMember(session.localId);
@@ -45,7 +54,6 @@ function attachWorkerProposal(ctx) {
     }
     return result;
   }
-
   function proposalOptions() {
     var installed = (sm.installedVendors || []).slice();
     var capabilities = {};
@@ -59,9 +67,10 @@ function attachWorkerProposal(ctx) {
       installedVendors: installed,
       modelsByVendor: safeModelsByVendor(installed),
       capabilitiesByVendor: capabilities,
+      unavailableReasons: Object.assign({}, catalogErrors),
+      availableVendors: Array.isArray(sm.availableVendors) ? sm.availableVendors.slice() : null,
     };
   }
-
   async function ensureModelCatalogs() {
     var installed = sm.installedVendors || [];
     sm.modelsByVendor = sm.modelsByVendor || {};
@@ -70,11 +79,10 @@ function attachWorkerProposal(ctx) {
       if (sm.modelsByVendor[vendor] && sm.modelsByVendor[vendor].length > 0) continue;
       var adapter = ctx.adapters && ctx.adapters[vendor];
       if (!adapter || typeof adapter.supportedModels !== "function") continue;
-      try { sm.modelsByVendor[vendor] = await adapter.supportedModels(); }
-      catch (err) { console.warn("[worker-proposal] Could not load " + vendor + " models:", err.message || err); }
+      try { sm.modelsByVendor[vendor] = await adapter.supportedModels(); delete catalogErrors[vendor]; }
+      catch (err) { catalogErrors[vendor] = err.message || String(err); console.warn("[worker-proposal] Could not load " + vendor + " models:", catalogErrors[vendor]); }
     }
   }
-
   function modelIsAvailable(options, vendor, model) {
     if (!model) return true;
     var models = options.modelsByVendor[vendor] || [];
@@ -83,7 +91,6 @@ function attachWorkerProposal(ctx) {
     }
     return false;
   }
-
   function effortIsAvailable(options, vendor, model, effort) {
     var capabilities = options.capabilitiesByVendor[vendor] || {};
     if (capabilities.effort === false) return !effort;
@@ -97,7 +104,6 @@ function attachWorkerProposal(ctx) {
     }
     return true;
   }
-
   function chooseRecommendation(args, session, options) {
     var installed = options.installedVendors;
     var vendor = args.recommendedVendor;
@@ -125,12 +131,10 @@ function attachWorkerProposal(ctx) {
     var effort = yoke.clampEffort(vendor, args.recommendedEffort || "medium") || "";
     return { vendor: vendor, model: model, effort: effort };
   }
-
   function skipPermissionsEnabled(session) {
     return !!(session && (session.permissionMode === "bypassPermissions" ||
       session.dangerouslySkipPermissions || ctx.dangerouslySkipPermissions));
   }
-
   function recommendationCanAutoAccept(args, recommendation, options) {
     var requestedVendor = typeof args.recommendedVendor === "string" ? args.recommendedVendor.trim() : "";
     var requestedModel = typeof args.recommendedModel === "string" ? args.recommendedModel.trim() : "";
@@ -143,32 +147,12 @@ function attachWorkerProposal(ctx) {
     return requestedEffort === recommendation.effort &&
       effortIsAvailable(options, requestedVendor, requestedModel, requestedEffort);
   }
-
   function autoAcceptanceWs(session) {
     return {
       _clayActiveSession: session.localId,
       _clayUser: session.ownerId ? { id: session.ownerId } : null,
     };
   }
-
-  function findProposal(session, proposalId) {
-    var history = (session && session.history) || [];
-    for (var i = history.length - 1; i >= 0; i--) {
-      if (history[i] && history[i].type === "worker_proposal" && history[i].proposalId === proposalId) return history[i];
-    }
-    return null;
-  }
-
-  function hasPendingProposal(session) {
-    var history = (session && session.history) || [];
-    for (var i = history.length - 1; i >= 0; i--) {
-      var item = history[i];
-      if (!item || item.type !== "worker_proposal") continue;
-      return item.status === "pending" || item.status === "starting" || item.status === "running";
-    }
-    return false;
-  }
-
   function updateProposal(session, proposal, patch) {
     Object.assign(proposal, patch, { updatedAt: Date.now() });
     sm.saveSessionFile(session);
@@ -177,10 +161,13 @@ function attachWorkerProposal(ctx) {
       proposalId: proposal.proposalId,
     }, patch));
   }
-
   async function propose(args, session) {
     if (!isEligible(session)) return toolResult({ error: "Split Worker proposals are only available in an eligible unpaired Driver session." });
-    if (hasPendingProposal(session)) return toolResult({ error: "A Split Worker suggestion is already awaiting a decision." });
+    var superseded = proposalControl.pendingProposal(session);
+    var supersedeId = typeof args.supersedeProposalId === "string" ? args.supersedeProposalId.trim() : "";
+    if (superseded && superseded.proposalId !== supersedeId) return toolResult({ error: "A Split Worker suggestion is already awaiting a decision. Inspect it or supply its exact id to supersede it." });
+    if (!superseded && supersedeId) return toolResult({ error: "The Split Worker suggestion to supersede is no longer pending." });
+    if (superseded && superseded.status !== "pending") return toolResult({ error: "The Split Worker suggestion is already starting and cannot be superseded." });
     var summary = typeof args.summary === "string" ? args.summary.trim() : "";
     var plan = typeof args.plan === "string" ? args.plan.trim() : "";
     var task = typeof args.message === "string" ? args.message.trim() : "";
@@ -193,6 +180,8 @@ function attachWorkerProposal(ctx) {
     if (!isEligible(session)) {
       return toolResult({ error: "The Driver session changed while Split Worker runtimes were loading." });
     }
+    var currentPending = proposalControl.pendingProposal(session);
+    if (currentPending !== superseded) return toolResult({ error: "The pending Split Worker suggestion changed while runtimes were loading." });
     var options = proposalOptions();
     if (options.installedVendors.length === 0) return toolResult({ error: "No coding agent is installed for a Split Worker session." });
     var recommendation = chooseRecommendation(args, session, options);
@@ -203,12 +192,14 @@ function attachWorkerProposal(ctx) {
       plan: plan.slice(0, MAX_PLAN_CHARS),
       message: task,
       status: "pending",
+      createdAt: Date.now(),
       recommendedVendor: recommendation.vendor,
       recommendedModel: recommendation.model,
       recommendedEffort: recommendation.effort,
       recommendationRationale: rationale.slice(0, MAX_RATIONALE_CHARS),
       options: options,
     };
+    if (superseded) updateProposal(session, superseded, { status: "superseded", supersededBy: proposal.proposalId });
     sm.sendAndRecord(session, proposal);
     if (skipPermissionsEnabled(session) && recommendationCanAutoAccept(args, recommendation, options)) {
       var accepted = await acceptProposal(session, proposal, {
@@ -230,7 +221,6 @@ function attachWorkerProposal(ctx) {
       instruction: "The Split Worker suggestion is visible in the chat. End this turn now and wait for the user's decision.",
     });
   }
-
   async function proposeReplacement(args, session) {
     var group = session && store.groupForMember(session.localId);
     if (ctx.isMate || !isLiveSession(session) || !driverEligibility.isEligibleDriverSession(session, sm) || !group ||
@@ -239,12 +229,18 @@ function attachWorkerProposal(ctx) {
     }
     var sourceGroupId = group.id;
     var sourceWorkerId = group.pair.workerId;
-    if (hasPendingProposal(session)) return toolResult({ error: "A Split Worker proposal is already awaiting a decision." });
+    var superseded = proposalControl.pendingProposal(session);
+    var supersedeId = typeof args.supersedeProposalId === "string" ? args.supersedeProposalId.trim() : "";
+    if (superseded && superseded.proposalId !== supersedeId) return toolResult({ error: "A Split Worker proposal is already awaiting a decision. Inspect it or supply its exact id to supersede it." });
+    if (!superseded && supersedeId) return toolResult({ error: "The Split Worker proposal to supersede is no longer pending." });
+    if (superseded && superseded.status !== "pending") return toolResult({ error: "The Split Worker proposal is already starting and cannot be superseded." });
     var task = typeof args.message === "string" ? args.message.trim() : "";
     var rationale = typeof args.recommendationRationale === "string" ? args.recommendationRationale.trim() : "";
     if (!task) return toolResult({ error: "message is required so an accepted replacement delegates exactly once." });
     if (!rationale) return toolResult({ error: "recommendationRationale is required for the replacement audit trail." });
     if (task.length > MAX_TASK_CHARS) return toolResult({ error: "The Split Worker task is too long." });
+    var normalizedEvaluation = normalizeEvaluation(args.evaluation);
+    if (normalizedEvaluation && normalizedEvaluation.error) return toolResult({ error: normalizedEvaluation.error });
     await ensureModelCatalogs();
     var liveGroup = store.groupForMember(session.localId);
     if (!isLiveSession(session) || !driverEligibility.isEligibleDriverSession(session, sm) ||
@@ -252,6 +248,8 @@ function attachWorkerProposal(ctx) {
         liveGroup.pair.driverId !== session.localId || liveGroup.pair.workerId !== sourceWorkerId) {
       return toolResult({ error: "The Driver/Split Worker pair changed while replacement runtimes were loading." });
     }
+    var currentPending = proposalControl.pendingProposal(session);
+    if (currentPending !== superseded) return toolResult({ error: "The pending Split Worker proposal changed while runtimes were loading." });
     var options = proposalOptions();
     if (options.installedVendors.length === 0) return toolResult({ error: "No coding agent is installed for a Split Worker session." });
     var recommendationArgs = {
@@ -268,6 +266,7 @@ function attachWorkerProposal(ctx) {
       plan: "1. Preserve the current Worker's session and history\n2. Create the selected replacement runtime\n3. Delegate the next task exactly once",
       message: task,
       status: "pending",
+      createdAt: Date.now(),
       recommendedVendor: recommendation.vendor,
       recommendedModel: recommendation.model,
       recommendedEffort: recommendation.effort,
@@ -276,8 +275,10 @@ function attachWorkerProposal(ctx) {
       sourceGroupId: sourceGroupId,
       sourceWorkerId: sourceWorkerId,
       interrupt: args.interrupt === true,
-      evaluation: args.evaluation || null,
+      evaluation: normalizedEvaluation ? normalizedEvaluation.value : null,
+      transactionId: "replace_" + crypto.randomUUID(),
     };
+    if (superseded) updateProposal(session, superseded, { status: "superseded", supersededBy: proposal.proposalId });
     sm.sendAndRecord(session, proposal);
     if (skipPermissionsEnabled(session) && recommendationCanAutoAccept(recommendationArgs, recommendation, options)) {
       var accepted = await acceptProposal(session, proposal, {
@@ -299,7 +300,6 @@ function attachWorkerProposal(ctx) {
       instruction: "The replacement configuration is visible in the chat. End this turn now and wait for the user's decision.",
     });
   }
-
   function resumeDriver(session, text) {
     var sdk = ctx.getSdk();
     if (!sdk) return Promise.reject(new Error("SDK bridge is not ready"));
@@ -335,7 +335,7 @@ function attachWorkerProposal(ctx) {
     if (result.status === "complete") {
       followup = "[Split Worker execution completed]\nReview and verify the Split Worker's result. The Split Worker session remains available: if the implementation needs corrections or additional edits, send a follow-up with send_to_partner instead of taking over the Split Worker-owned files yourself. If that Split Worker is no longer available, keep the work in the visible Split Worker flow and use send_to_partner again after the stale pair is removed; never substitute a background Sub-agent.\n\n" + (result.response || "The Split Worker completed without a text summary.");
     } else if (result.status === "interrupted") {
-      followup = "[Split Worker execution interrupted]\nThe user interrupted the Split Worker mid-turn. Its work is PARTIAL and unverified — do not treat it as finished. Review what was done and decide next steps with the user.";
+      followup = "[Split Worker execution interrupted]\nThe Split Worker stopped mid-turn. Its work is PARTIAL and unverified — do not treat it as finished. Check partner_status before deciding next steps; this result alone does not identify who interrupted it. If the human stopped it, do not retry until a new human Driver message. Otherwise continue within the user's authorized task.";
     } else if (result.status === "running") {
       followup = "[Split Worker execution is still running]\nUse read_partner to inspect progress before completing the task.";
     } else {
@@ -398,6 +398,7 @@ function attachWorkerProposal(ctx) {
           workerModel: model,
           workerEffort: effort,
           evaluation: proposal.evaluation || undefined,
+          transactionId: proposal.transactionId,
         }, session);
         liveGroup = store.groupForMember(session.localId);
         updateProposal(session, proposal, { status: "running", groupId: liveGroup.id, workerId: replaced.workerSessionId });
@@ -426,6 +427,7 @@ function attachWorkerProposal(ctx) {
             restoredGroup.pair.workerId === proposal.sourceWorkerId) {
           proposal.sourceGroupId = restoredGroup.id;
         }
+        proposal.transactionId = "replace_" + crypto.randomUUID();
       }
       updateProposal(session, proposal, {
         status: "pending",
@@ -440,7 +442,7 @@ function attachWorkerProposal(ctx) {
 
   async function respondToProposal(ws, msg) {
     var session = sessionForResponse(ws);
-    var proposal = findProposal(session, msg.proposalId);
+    var proposal = proposalControl.findProposal(session, msg.proposalId);
     if (!proposal) throw new Error("Split Worker suggestion not found");
     if (proposal.status !== "pending") throw new Error("Split Worker suggestion has already been resolved");
     if (!msg.accepted) {
@@ -464,8 +466,9 @@ function attachWorkerProposal(ctx) {
 
   function getToolDefs(session, options) {
     var persistent = !!(options && options.persistent);
+    var controlsOnly = !!(options && options.controlsOnly);
     if (!isEligible(session) && !(persistent && canOffer(session))) return [];
-    return [{
+    var proposalTools = controlsOnly ? [] : [{
       name: "propose_worker",
       description: "Propose a visible Split Worker for implementation-heavy execution. This non-mutating tool only shows the user a card where they choose vendor, model, and effort. It never creates a session or delegates work until the user accepts.",
       inputSchema: buildShape({
@@ -476,25 +479,33 @@ function attachWorkerProposal(ctx) {
         recommendedModel: { type: "string", description: "Optional exact Split Worker model id. Omit when uncertain." },
         recommendedEffort: { type: "string", description: "Optional reasoning effort: minimal, low, medium, high, xhigh, or max." },
         recommendationRationale: { type: "string", description: "Concise Driver-authored explanation of why the recommended vendor, model, and effort fit this exact task." },
+        supersedeProposalId: { type: "string", description: "Exact pending proposal id to resolve as superseded when posting this replacement suggestion." },
       }, ["summary", "plan", "message", "recommendationRationale"]),
       handler: function (args) { return propose(args || {}, session); },
     }];
+    return proposalTools.concat(proposalControl.getToolDefs({
+      inspect: function () { return toolResult(isLiveSession(session) ? proposalControl.projection(proposalControl.pendingProposal(session)) : { status: "rejected", reason: "The Driver session is no longer live." }); },
+      cancel: function (args) {
+        if (!isLiveSession(session)) return toolResult({ status: "rejected", proposalId: args.proposalId || null, reason: "The Driver session is no longer live." });
+        var proposal = proposalControl.findProposal(session, args.proposalId);
+        if (!proposal || proposal.status !== "pending") return toolResult({ status: "rejected", proposalId: args.proposalId || null, reason: "The exact proposal is not pending." });
+        updateProposal(session, proposal, { status: "cancelled" });
+        return toolResult({ status: "cancelled", proposalId: proposal.proposalId });
+      },
+      catalog: function () { return ensureModelCatalogs().then(function () {
+        return toolResult(runtimeCatalog.build(proposalOptions(), skipPermissionsEnabled(session), function (vendor, model, effort) {
+          return ctx.preflightWorkerForDriver ? ctx.preflightWorkerForDriver(session, { workerVendor: vendor, workerModel: model, workerEffort: effort || "" }) : null;
+        }));
+      }); },
+    }));
   }
 
   function getSystemPrompt(session) {
     if (!isEligible(session) || !driverOrchestration.isHighTierDriverSession(session, sm)) return "";
     return "For implementation-heavy work, use propose_worker before substantial execution. Work is implementation-heavy when it spans multiple modules, crosses client/server/data boundaries, requires a migration, or contains independent investigation and execution. Do not skip delegation merely because you can implement it yourself; preserve the Driver for decomposition, runtime selection, judgment, review, and integration. The user's explicit request to work directly takes precedence, and work that must remain sequential in this session stays here. Recommend an exact available vendor, model, and effort, and give a concise recommendationRationale explaining why all three fit the task. Clay always records and shows the runtime configuration card. In full-access mode Clay may auto-accept that exact validated recommendation; otherwise it waits for the user's explicit choice. After posting, end the turn. If accepted, Clay creates the exact Driver/Split Worker pair and delegates the proposed task once. If declined, continue in this Driver session. Do not call send_to_partner while unpaired.";
   }
-
-  return {
-    getToolDefs: getToolDefs,
-    getSystemPrompt: getSystemPrompt,
-    proposeReplacement: proposeReplacement,
-    handleMessage: handleMessage,
-    respondToProposal: respondToProposal,
-  };
+  return { getToolDefs: getToolDefs, getSystemPrompt: getSystemPrompt, proposeReplacement: proposeReplacement,
+    handleMessage: handleMessage, respondToProposal: respondToProposal,
+    proposalStatus: function (session) { return proposalControl.projection(proposalControl.pendingProposal(session)); } };
 }
-
-module.exports = {
-  attachWorkerProposal: attachWorkerProposal,
-};
+module.exports = { attachWorkerProposal: attachWorkerProposal };

package/lib/project.js

@@ -390,14 +390,31 @@ function createProjectContext(opts) {
   }
 
   function send(obj) {
-    var data = JSON.stringify(obj);
     for (var ws of clients) {
-      if (ws.readyState === 1) ws.send(data);
+      if (ws.readyState !== 1) continue;
+      var payload = obj;
+      if (obj && obj.type === "info") {
+        var infoUserId = ws._clayUser ? ws._clayUser.id : null;
+        var visibleProjects = getProjectList(infoUserId);
+        payload = Object.assign({}, obj, { projects: visibleProjects, projectCount: visibleProjects.length });
+      } else if (obj && obj.type === "loop_registry_updated") {
+        var userId = ws._clayUser ? ws._clayUser.id : null;
+        payload = Object.assign({}, obj, { records: getHubSchedules(userId) });
+      }
+      ws.send(JSON.stringify(payload));
     }
   }
 
   function sendTo(ws, obj) {
-    if (ws.readyState === 1) ws.send(JSON.stringify(obj));
+    if (ws.readyState !== 1) return;
+    var payload = obj;
+    if (obj && (obj.type === "loop_registry_updated" || obj.type === "hub_schedules")) {
+      var userId = ws._clayUser ? ws._clayUser.id : null;
+      payload = Object.assign({}, obj);
+      if (obj.type === "loop_registry_updated") payload.records = getHubSchedules(userId);
+      else payload.schedules = getHubSchedules(userId);
+    }
+    ws.send(JSON.stringify(payload));
   }
 
   function sendToAdmins(obj) {
@@ -2256,7 +2273,7 @@ function createProjectContext(opts) {
     var _mateId = path.basename(cwd);
     var _mateCtx = matesModule.buildMateCtx(projectOwnerId);
     // Collect non-mate projects for project registry injection
-    var _projectList = (getProjectList() || []).filter(function (p) { return !p.isMate; });
+    var _projectList = (getProjectList(projectOwnerId) || []).filter(function (p) { return !p.isMate; });
     var _enforceOpts = { ctx: _mateCtx, mateId: _mateId, projects: _projectList };
     // Enforce all system sections atomically on startup (single read/write)
     var _selfWrite = false; // suppress watcher when we wrote the file ourselves

package/lib/public/css/icon-strip.css

@@ -593,6 +593,37 @@
   line-height: 1;
 }
 .project-access-close:hover { color: var(--text); }
+.project-access-scope {
+  display: flex;
+  gap: 10px;
+  margin: 12px 14px 4px;
+  padding: 10px;
+  color: var(--text);
+  background: rgba(var(--overlay-rgb), 0.045);
+  border: 1px solid var(--border);
+  border-radius: 9px;
+}
+.project-access-scope-icon {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 28px;
+  height: 28px;
+  flex: 0 0 28px;
+  color: var(--accent, #6366f1);
+  background: var(--accent-8, rgba(99, 102, 241, 0.08));
+  border-radius: 7px;
+}
+.project-access-scope-icon .lucide { width: 15px; height: 15px; }
+.project-access-scope strong,
+.project-access-scope small { display: block; }
+.project-access-scope strong { font-size: 12px; font-weight: 600; }
+.project-access-scope small {
+  margin-top: 2px;
+  color: var(--text-secondary);
+  font-size: 10px;
+  line-height: 1.35;
+}
 .project-access-section {
   padding: 10px 14px;
 }
@@ -653,6 +684,15 @@
   cursor: pointer;
 }
 .project-access-user-item:hover { color: var(--text); }
+.project-access-user-item small {
+  margin-left: auto;
+  color: var(--text-tertiary);
+  font-size: 9px;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+.project-access-user-item.is-inherited { color: var(--text-secondary); cursor: default; }
+.project-access-user-item.is-inherited input { cursor: default; }
 .project-access-empty {
   font-size: 12px;
   color: var(--text-tertiary);

package/lib/public/modules/app-messages.js

@@ -89,6 +89,10 @@ var inputEl = document.getElementById("input");
 var connectOverlay = document.getElementById("connect-overlay");
 
 export function processMessage(msg) {
+    if (msg.type === "access_revoked") {
+      window.location.assign("/");
+      return;
+    }
     // Preserve original timestamp from history replay
     store.set({ currentMsgTs: msg._ts || null });
     var isMateDm = store.get('dmMode') && store.get('dmTargetUser') && store.get('dmTargetUser').isMate;
@@ -723,6 +727,11 @@ export function processMessage(msg) {
         syncPaneTitles();
         break;
 
+      case "partner_task_completed":
+        // The result is resumed into the Driver transcript; this correlated
+        // event is available to clients that track task state separately.
+        break;
+
       case "session_presence":
         updateSessionPresence(msg.presence || {});
         break;

package/lib/public/modules/project-access.js

@@ -0,0 +1,141 @@
+import { escapeHtml } from './utils.js';
+import { iconHtml, refreshIcons } from './icons.js';
+
+var projectAccessPopover = null;
+
+function closeAccessOnOutside(e) {
+  if (projectAccessPopover && !projectAccessPopover.contains(e.target)) closeProjectAccessPopover();
+}
+
+function closeAccessOnEscape(e) {
+  if (e.key === "Escape") closeProjectAccessPopover();
+}
+
+export function closeProjectAccessPopover() {
+  if (!projectAccessPopover) return;
+  projectAccessPopover.remove();
+  projectAccessPopover = null;
+  document.removeEventListener("click", closeAccessOnOutside);
+  document.removeEventListener("keydown", closeAccessOnEscape);
+}
+
+function positionPopover(popover, anchorEl) {
+  var rect = anchorEl.getBoundingClientRect();
+  popover.style.position = "fixed";
+  popover.style.left = (rect.right + 8) + "px";
+  popover.style.top = rect.top + "px";
+  popover.style.zIndex = "9999";
+  var popRect = popover.getBoundingClientRect();
+  if (popRect.right > window.innerWidth - 8) popover.style.left = (rect.left - popRect.width - 8) + "px";
+  if (popRect.bottom > window.innerHeight - 8) popover.style.top = (window.innerHeight - popRect.height - 8) + "px";
+}
+
+function selectedExactUsers(popover) {
+  var selected = [];
+  popover.querySelectorAll('.project-access-user-item input[type="checkbox"]:checked').forEach(function (checkbox) {
+    if (!checkbox.disabled || checkbox.dataset.explicit === "true") selected.push(checkbox.dataset.uid);
+  });
+  return selected;
+}
+
+function renderAccessPopover(popover, slug, access, allUsers) {
+  var visibility = access.visibility || "public";
+  var isWorktree = access.isWorktree === true;
+  var allowedUsers = isWorktree ? (access.worktreeAllowedUsers || []) : (access.allowedUsers || []);
+  var inheritedUsers = isWorktree ? (access.parentAllowedUsers || []) : [];
+  var ownerId = access.ownerId;
+  var selectableUsers = allUsers.filter(function (user) { return user.id !== ownerId; });
+  var html = '';
+  html += '<div class="project-access-header">';
+  html += '<span class="project-access-title">' + (isWorktree ? 'Worktree Access' : 'Project Access') + '</span>';
+  html += '<button class="project-access-close" aria-label="Close access settings">&times;</button>';
+  html += '</div>';
+
+  if (isWorktree) {
+    var scopeTitle = visibility === "public" ? "Public parent project" : "This worktree only";
+    var scopeText = visibility === "public"
+      ? "Every authenticated user can access this worktree. Exact grants are retained if the parent becomes private."
+      : "Entire-project access is inherited automatically.";
+    html += '<div class="project-access-scope">';
+    html += '<span class="project-access-scope-icon">' + iconHtml(visibility === "public" ? "globe" : "git-branch") + '</span>';
+    html += '<span><strong>' + scopeTitle + '</strong><small>' + scopeText + '</small></span>';
+    html += '</div>';
+  } else {
+    html += '<div class="project-access-section">';
+    html += '<label class="project-access-label">Visibility</label>';
+    html += '<div class="project-access-vis-row">';
+    html += '<button class="project-access-vis-btn' + (visibility === "private" ? ' active' : '') + '" data-vis="private">' + iconHtml("lock") + ' Private</button>';
+    html += '<button class="project-access-vis-btn' + (visibility === "public" ? ' active' : '') + '" data-vis="public">' + iconHtml("globe") + ' Public</button>';
+    html += '</div></div>';
+  }
+
+  html += '<div class="project-access-section project-access-users-section"' + (!isWorktree && visibility !== "private" ? ' style="display:none"' : '') + '>';
+  html += '<label class="project-access-label">' + (isWorktree ? 'People with exact access' : 'Allowed Users') + '</label>';
+  html += '<div class="project-access-user-list">';
+  for (var i = 0; i < selectableUsers.length; i++) {
+    var user = selectableUsers[i];
+    var explicit = allowedUsers.indexOf(user.id) !== -1;
+    var inherited = inheritedUsers.indexOf(user.id) !== -1;
+    html += '<label class="project-access-user-item' + (inherited ? ' is-inherited' : '') + '">';
+    html += '<input type="checkbox" data-uid="' + user.id + '" data-explicit="' + (explicit ? 'true' : 'false') + '"' + (explicit || inherited ? ' checked' : '') + (inherited ? ' disabled' : '') + '>';
+    html += '<span>' + escapeHtml(user.displayName || user.username || user.id) + '</span>';
+    if (inherited) html += '<small>Entire project</small>';
+    html += '</label>';
+  }
+  if (selectableUsers.length === 0) html += '<div class="project-access-empty">No other users</div>';
+  html += '</div></div>';
+  popover.innerHTML = html;
+  refreshIcons();
+
+  popover.querySelector(".project-access-close").addEventListener("click", closeProjectAccessPopover);
+  popover.querySelectorAll(".project-access-vis-btn").forEach(function (button) {
+    button.addEventListener("click", function () {
+      var visibilityValue = button.dataset.vis;
+      popover.querySelectorAll(".project-access-vis-btn").forEach(function (item) { item.classList.remove("active"); });
+      button.classList.add("active");
+      var usersSection = popover.querySelector(".project-access-users-section");
+      if (usersSection) usersSection.style.display = visibilityValue === "private" ? "" : "none";
+      fetch("/api/admin/projects/" + encodeURIComponent(slug) + "/visibility", {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ visibility: visibilityValue }),
+      });
+    });
+  });
+  popover.querySelectorAll('.project-access-user-item input[type="checkbox"]').forEach(function (checkbox) {
+    checkbox.addEventListener("change", function () {
+      fetch("/api/admin/projects/" + encodeURIComponent(slug) + "/users", {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ allowedUsers: selectedExactUsers(popover) }),
+      });
+    });
+  });
+}
+
+export function showProjectAccessPopover(anchorEl, slug) {
+  closeProjectAccessPopover();
+  var popover = document.createElement("div");
+  popover.className = "project-access-popover";
+  popover.innerHTML = '<div class="project-access-loading">Loading...</div>';
+  popover.addEventListener("click", function (e) { e.stopPropagation(); });
+  document.body.appendChild(popover);
+  projectAccessPopover = popover;
+  requestAnimationFrame(function () { positionPopover(popover, anchorEl); });
+  setTimeout(function () {
+    document.addEventListener("click", closeAccessOnOutside);
+    document.addEventListener("keydown", closeAccessOnEscape);
+  }, 0);
+  Promise.all([
+    fetch("/api/admin/projects/" + encodeURIComponent(slug) + "/access").then(function (response) { return response.json(); }),
+    fetch("/api/admin/users").then(function (response) { return response.json(); }),
+  ]).then(function (results) {
+    if (results[0].error || results[1].error) {
+      popover.innerHTML = '<div class="project-access-loading">Failed to load</div>';
+      return;
+    }
+    renderAccessPopover(popover, slug, results[0], results[1].users || []);
+  }).catch(function () {
+    popover.innerHTML = '<div class="project-access-loading">Failed to load</div>';
+  });
+}

package/lib/public/modules/project-grouping.js

@@ -0,0 +1,22 @@
+// Groups visible parent projects with their visible worktrees. A worktree whose
+// parent is not in the authorized projection remains a standalone item.
+
+export function groupProjects(projects) {
+  var source = Array.isArray(projects) ? projects : [];
+  var parentSlugs = {};
+  var parents = [];
+  var wtByParent = {};
+  for (var i = 0; i < source.length; i++) {
+    if (!source[i].isWorktree) parentSlugs[source[i].slug] = true;
+  }
+  for (var j = 0; j < source.length; j++) {
+    var project = source[j];
+    if (project.isWorktree && project.parentSlug && parentSlugs[project.parentSlug]) {
+      if (!wtByParent[project.parentSlug]) wtByParent[project.parentSlug] = [];
+      wtByParent[project.parentSlug].push(project);
+    } else {
+      parents.push(project);
+    }
+  }
+  return { parents: parents, wtByParent: wtByParent };
+}