clay-server 4.0.1-beta.1 → 4.1.0-beta.2

package/lib/server.js

@@ -202,6 +202,23 @@ function createServer(opts) {
   var isRequestAuthed = auth.isRequestAuthed;
   var parseCookies = auth.parseCookies;
 
+  function canUserAccessSlug(userId, slug) {
+    if (!userId || !slug) return false;
+    var project = projects && projects.get(slug);
+    var status = project && project.getStatus ? project.getStatus() : null;
+    if (status && status.isMate === true) {
+      return users.canAccessProject(userId, {
+        visibility: "private",
+        ownerId: status.projectOwnerId || null,
+        allowedUsers: [],
+      }) === true;
+    }
+    if (!onGetProjectAccess) return false;
+    var access = onGetProjectAccess(slug);
+    if (!access || access.error) return false;
+    return users.canAccessProject(userId, access) === true;
+  }
+
   var realVersion = require("../package.json").version;
   var currentVersion = debug ? "0.0.9" : realVersion;
 
@@ -339,6 +356,13 @@ function createServer(opts) {
       if (!access || access.error) return false;
       return users.canAccessProject(userId, access) === true;
     },
+    hasFullProjectAccess: function (userId, status) {
+      if (!status || !status.slug || !onGetProjectAccess) return false;
+      var access = onGetProjectAccess(status.slug);
+      if (!access || access.error) return false;
+      var governing = access.isWorktree && access.parentAccess ? access.parentAccess : access;
+      return users.canAccessProject(userId, governing) === true;
+    },
     resolveMate: function (userId, mateId) {
       return mates.getMate(mates.buildMateCtx(users.isMultiUser() ? userId : null), mateId);
     },
@@ -403,6 +427,7 @@ function createServer(opts) {
     projects: projects,
     getMultiUserFromReq: getMultiUserFromReq,
     onGetProjectAccess: onGetProjectAccess,
+    canUserAccessSlug: canUserAccessSlug,
   });
 
   // --- Push module (global) ---
@@ -662,7 +687,11 @@ function createServer(opts) {
       if (isRequestAuthed(req)) {
         var mem = process.memoryUsage();
         var activeSessions = 0;
-        projects.forEach(function (ctx) {
+        var healthProjects = 0;
+        var healthUser = users.isMultiUser() ? getMultiUserFromReq(req) : null;
+        projects.forEach(function (ctx, slug) {
+          if (users.isMultiUser() && (!healthUser || !canUserAccessSlug(healthUser.id, slug))) return;
+          healthProjects++;
           if (ctx && ctx.clients) {
             activeSessions += ctx.clients.size || 0;
           }
@@ -671,7 +700,7 @@ function createServer(opts) {
         health.version = pkg.version;
         health.node = process.version;
         health.sessions = activeSessions;
-        health.projects = projects.size;
+        health.projects = healthProjects;
         health.memory = {
           rss: mem.rss,
           heapUsed: mem.heapUsed,
@@ -850,7 +879,9 @@ function createServer(opts) {
         return;
       }
       var projectList = [];
+      var infoUser = users.isMultiUser() ? getMultiUserFromReq(req) : null;
       projects.forEach(function (ctx, slug) {
+        if (users.isMultiUser() && (!infoUser || !canUserAccessSlug(infoUser.id, slug))) return;
         projectList.push({ slug: slug, project: ctx.project });
       });
       res.writeHead(200, { "Content-Type": "application/json" });
@@ -912,15 +943,12 @@ function createServer(opts) {
     res.setHeader("Set-Cookie", "clay_last_project=" + slug + "; Path=/; SameSite=Strict; Max-Age=31536000" + (tlsOptions ? "; Secure" : ""));
 
     // Multi-user: check project access for HTTP requests
-    if (users.isMultiUser() && onGetProjectAccess) {
+    if (users.isMultiUser()) {
       var httpUser = getMultiUserFromReq(req);
-      if (httpUser) {
-        var httpAccess = onGetProjectAccess(slug);
-        if (httpAccess && !httpAccess.error && !users.canAccessProject(httpUser.id, httpAccess)) {
-          res.writeHead(302, { "Location": "/" });
-          res.end();
-          return;
-        }
+      if (!httpUser || !canUserAccessSlug(httpUser.id, slug)) {
+        res.writeHead(302, { "Location": "/" });
+        res.end();
+        return;
       }
     }
 
@@ -1029,6 +1057,9 @@ function createServer(opts) {
     onAppMessage: function (ws, msg) {
       return handleDmMessage(ws, msg);
     },
+    onConnection: function (ws) {
+      sendProjectsUpdatedToClient(ws);
+    },
   });
 
   server.on("upgrade", function (req, socket, head) {
@@ -1106,19 +1137,19 @@ function createServer(opts) {
     if (users.isMultiUser()) {
       wsUser = getMultiUserFromReq(req);
       // Check project access for multi-user mode
-      if (wsUser && onGetProjectAccess) {
-        // For worktree projects, inherit access from parent
-        var accessSlug = (wsSlug.indexOf("--") !== -1) ? wsSlug.split("--")[0] : wsSlug;
-        var projectAccess = onGetProjectAccess(accessSlug);
+      if (wsUser) {
+        var projectAccess = onGetProjectAccess ? onGetProjectAccess(wsSlug) : null;
         if (debug) console.log("[server] WS access check:", wsSlug, "user:", wsUser.id, "role:", wsUser.role, "visibility:", projectAccess && projectAccess.visibility, "ownerId:", projectAccess && projectAccess.ownerId, "allowed:", projectAccess && projectAccess.allowedUsers);
-        if (projectAccess && !projectAccess.error) {
-          if (!users.canAccessProject(wsUser.id, projectAccess)) {
-            if (debug) console.log("[server] WS rejected: access denied for", wsUser.id, "on", wsSlug);
-            socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
-            socket.destroy();
-            return;
-          }
+        if (!canUserAccessSlug(wsUser.id, wsSlug)) {
+          if (debug) console.log("[server] WS rejected: access denied for", wsUser.id, "on", wsSlug);
+          socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
+          socket.destroy();
+          return;
         }
+      } else {
+        socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
+        socket.destroy();
+        return;
       }
     }
 
@@ -1200,13 +1231,9 @@ function createServer(opts) {
           var filtered = allProjectsList;
           if (users.isMultiUser() && onGetProjectAccess) {
             var wsUser = ws._clayUser;
-            if (wsUser) {
-              filtered = allProjectsList.filter(function (p) {
-                var access = onGetProjectAccess(p.slug);
-                if (!access || access.error) return true;
-                return users.canAccessProject(wsUser.id, access);
-              });
-            }
+            filtered = wsUser ? allProjectsList.filter(function (p) {
+              return canUserAccessSlug(wsUser.id, p.slug);
+            }) : [];
           }
           // Attach per-project unread counts for this client
           var unreadMap = getCrossProjectUnread(ws);
@@ -1306,20 +1333,12 @@ function createServer(opts) {
       authToken: pinHash || null,
       getProjectCount: function () { return projects.size; },
       getProjectList: function (userId) {
-        var list = [];
-        projects.forEach(function (ctx, s) {
-          var status = ctx.getStatus();
-          if (userId && users.isMultiUser() && onGetProjectAccess) {
-            var access = onGetProjectAccess(s);
-            if (access && !access.error && !users.canAccessProject(userId, access)) return;
-          }
-          list.push(status);
-        });
-        return list;
+        return getVisibleProjects(userId);
       },
-      getHubSchedules: function () {
+      getHubSchedules: function (userId) {
         var allSchedules = [];
         projects.forEach(function (ctx, s) {
+          if (users.isMultiUser() && (!userId || !canUserAccessSlug(userId, s))) return;
           var status = ctx.getStatus();
           var recs = ctx.getSchedules();
           for (var i = 0; i < recs.length; i++) {
@@ -1379,6 +1398,7 @@ function createServer(opts) {
         if (!ctx) return 0;
         return ctx.getSchedules().length;
       },
+      canAccessProjectSlug: canUserAccessSlug,
       onPresenceChange: broadcastPresenceChange,
       onProcessingChanged: broadcastProcessingChange,
       onSessionDone: function () { onSessionDone(slug); },
@@ -1592,27 +1612,81 @@ function createServer(opts) {
   function getServerUsers() {
     var seen = {};
     var list = [];
-    projects.forEach(function (ctx) {
-      ctx.forEachClient(function (ws) {
-        if (!ws._clayUser) return;
-        var u = ws._clayUser;
-        if (seen[u.id]) return;
-        seen[u.id] = true;
-        var p = u.profile || {};
-        list.push({
-          id: u.id,
-          displayName: p.name || u.displayName || u.username,
-          username: u.username,
-          avatarStyle: p.avatarStyle || "imprint",
-          avatarSeed: p.avatarSeed || u.username,
-          avatarColor: p.avatarColor || "#5857fc",
-          avatarCustom: p.avatarCustom || "",
-        });
+    forEachAppClient(function (ws) {
+      if (!ws._clayUser) return;
+      var u = ws._clayUser;
+      if (seen[u.id]) return;
+      seen[u.id] = true;
+      var p = u.profile || {};
+      list.push({
+        id: u.id,
+        displayName: p.name || u.displayName || u.username,
+        username: u.username,
+        avatarStyle: p.avatarStyle || "imprint",
+        avatarSeed: p.avatarSeed || u.username,
+        avatarColor: p.avatarColor || "#5857fc",
+        avatarCustom: p.avatarCustom || "",
       });
     });
     return list;
   }
 
+  function forEachAppClient(visitor) {
+    if (globalWs && typeof globalWs.forEachClient === "function") {
+      globalWs.forEachClient(visitor);
+    }
+    projects.forEach(function (ctx) {
+      ctx.forEachClient(visitor);
+    });
+  }
+
+  function getVisibleProjects(userId) {
+    var visible = [];
+    projects.forEach(function (ctx, slug) {
+      if (users.isMultiUser() && (!userId || !canUserAccessSlug(userId, slug))) return;
+      visible.push(ctx.getStatus());
+    });
+    return visible;
+  }
+
+  function sendProjectsUpdatedToClient(ws, serverUsers, allUsers) {
+    if (!ws || ws.readyState !== 1) return;
+    var userId = ws._clayUser ? ws._clayUser.id : null;
+    var visibleProjects = getVisibleProjects(userId);
+    var message = {
+      type: "projects_updated",
+      projects: visibleProjects,
+      projectCount: visibleProjects.length,
+      removedProjects: getRemovedProjects(userId),
+    };
+    if (users.isMultiUser()) {
+      message.serverUsers = serverUsers || getServerUsers();
+      message.allUsers = allUsers || users.getAllUsers().map(function (user) {
+        var profile = user.profile || {};
+        return {
+          id: user.id,
+          displayName: profile.name || user.displayName || user.username,
+          username: user.username,
+          role: user.role,
+          avatarStyle: profile.avatarStyle || "imprint",
+          avatarSeed: profile.avatarSeed || user.username,
+          avatarColor: profile.avatarColor || "#5857fc",
+          avatarCustom: profile.avatarCustom || "",
+        };
+      });
+      message.dmFavorites = userId ? users.getDmFavorites(userId) : [];
+      message.dmConversations = [];
+      if (userId) {
+        var hidden = users.getDmHidden(userId);
+        var dmList = dm.getDmList(userId);
+        for (var i = 0; i < dmList.length; i++) {
+          if (hidden.indexOf(dmList[i].otherUserId) === -1) message.dmConversations.push(dmList[i].otherUserId);
+        }
+      }
+    }
+    ws.send(JSON.stringify(message));
+  }
+
   // Debounced broadcast of projects_updated when presence changes
   // Sends per-user filtered project lists + server-wide user list
   var presenceTimer = null;
@@ -1621,12 +1695,7 @@ function createServer(opts) {
     presenceTimer = setTimeout(function () {
       presenceTimer = null;
       if (!users.isMultiUser()) {
-        broadcastAll({
-          type: "projects_updated",
-          projects: getProjects(),
-          projectCount: projects.size,
-          removedProjects: getRemovedProjects(),
-        });
+        forEachAppClient(function (ws) { sendProjectsUpdatedToClient(ws); });
         return;
       }
       var serverUsers = getServerUsers();
@@ -1643,61 +1712,73 @@ function createServer(opts) {
           avatarCustom: p.avatarCustom || "",
         };
       });
-      // Build per-user filtered lists, send individually
+      // Build per-user filtered lists, send individually to both project and
+      // slug-less Home sockets. A Home fallback must replace, never retain,
+      // the project cache from its previous authenticated project socket.
       var sentUsers = {};
-      projects.forEach(function (ctx) {
-        ctx.forEachClient(function (ws) {
-          var userId = ws._clayUser ? ws._clayUser.id : null;
-          var key = userId || "__anon__";
-          if (sentUsers[key]) {
-            // Already computed for this user, just send the cached msg
-            ws.send(sentUsers[key]);
-            return;
-          }
-          var filteredProjects = [];
-          projects.forEach(function (pCtx, s) {
-            var status = pCtx.getStatus();
-            if (userId && onGetProjectAccess) {
-              var access = onGetProjectAccess(s);
-              if (access && !access.error && !users.canAccessProject(userId, access)) return;
-            }
-            filteredProjects.push(status);
-          });
-          // Per-user DM data
-          var userDmFavorites = userId ? users.getDmFavorites(userId) : [];
-          var userDmHidden = userId ? users.getDmHidden(userId) : [];
-          var userDmConversations = [];
-          if (userId) {
-            var dmList = dm.getDmList(userId);
-            for (var di = 0; di < dmList.length; di++) {
-              if (userDmHidden.indexOf(dmList[di].otherUserId) === -1) {
-                userDmConversations.push(dmList[di].otherUserId);
-              }
+      forEachAppClient(function (ws) {
+        var userId = ws._clayUser ? ws._clayUser.id : null;
+        var key = userId || "__anon__";
+        if (sentUsers[key]) {
+          // Already computed for this user, just send the cached msg
+          if (ws.readyState === 1) ws.send(sentUsers[key]);
+          return;
+        }
+        var filteredProjects = getVisibleProjects(userId);
+        // Per-user DM data
+        var userDmFavorites = userId ? users.getDmFavorites(userId) : [];
+        var userDmHidden = userId ? users.getDmHidden(userId) : [];
+        var userDmConversations = [];
+        if (userId) {
+          var dmList = dm.getDmList(userId);
+          for (var di = 0; di < dmList.length; di++) {
+            if (userDmHidden.indexOf(dmList[di].otherUserId) === -1) {
+              userDmConversations.push(dmList[di].otherUserId);
             }
           }
-          var msgStr = JSON.stringify({
-            type: "projects_updated",
-            projects: filteredProjects,
-            projectCount: projects.size,
-            serverUsers: serverUsers,
-            allUsers: allUsers,
-            dmFavorites: userDmFavorites,
-            dmConversations: userDmConversations,
-            removedProjects: getRemovedProjects(userId),
-          });
-          sentUsers[key] = msgStr;
-          ws.send(msgStr);
+        }
+        var msgStr = JSON.stringify({
+          type: "projects_updated",
+          projects: filteredProjects,
+          projectCount: filteredProjects.length,
+          serverUsers: serverUsers,
+          allUsers: allUsers,
+          dmFavorites: userDmFavorites,
+          dmConversations: userDmConversations,
+          removedProjects: getRemovedProjects(userId),
         });
+        sentUsers[key] = msgStr;
+        if (ws.readyState === 1) ws.send(msgStr);
       });
     }, 300);
   }
 
   function broadcastAll(msg) {
+    if (msg && msg.type === "projects_updated") {
+      broadcastPresenceChange();
+      return;
+    }
     projects.forEach(function (ctx) {
       ctx.send(msg);
     });
   }
 
+  function refreshProjectAccess() {
+    if (!users.isMultiUser()) return;
+    projects.forEach(function (ctx, slug) {
+      if (!ctx || typeof ctx.forEachClient !== "function") return;
+      ctx.forEachClient(function (ws) {
+        var userId = ws._clayUser && ws._clayUser.id;
+        if (userId && canUserAccessSlug(userId, slug)) return;
+        try {
+          if (ws.readyState === 1) ws.send(JSON.stringify({ type: "access_revoked", slug: slug }));
+          ws.close(1008, "Project access revoked");
+        } catch (e) {}
+      });
+    });
+    broadcastPresenceChange();
+  }
+
   // Send a message to every live ws belonging to a specific user across all projects.
   // Used by user-targeted notifications (e.g. user-to-user @mentions).
   function sendToUser(userId, msg) {
@@ -1813,6 +1894,7 @@ function createServer(opts) {
     setRecovery: auth.setRecovery,
     clearRecovery: auth.clearRecovery,
     broadcastAll: broadcastAll,
+    refreshProjectAccess: refreshProjectAccess,
     forEachProject: forEachProject,
     destroyProject: removeProject,
     destroyAll: destroyAll,

package/lib/session-pair-factory.js

@@ -42,6 +42,9 @@ function attachPairFactory(ctx) {
   function validateVendor(vendor) {
     var installed = sm.installedVendors || [];
     if (!vendor || installed.indexOf(vendor) === -1) throw new Error("vendor is not installed: " + (vendor || "unknown"));
+    if (Array.isArray(sm.availableVendors) && sm.availableVendors.indexOf(vendor) === -1) {
+      throw new Error("vendor runtime is temporarily unavailable: " + vendor);
+    }
     return vendor;
   }
 

package/lib/session-pair-history.js

@@ -0,0 +1,40 @@
+var MAX_RESPONSE_CHARS = 30000;
+
+function responseText(history, fromIndex) {
+  var text = "";
+  for (var i = Math.max(0, fromIndex || 0); i < history.length; i++) {
+    if (history[i] && history[i].type === "delta" && history[i].text) text += history[i].text;
+  }
+  return text.length > MAX_RESPONSE_CHARS ? text.slice(-MAX_RESPONSE_CHARS) : text;
+}
+
+function errorSince(history, fromIndex) {
+  for (var i = history.length - 1; i >= Math.max(0, fromIndex || 0); i--) {
+    if (history[i] && history[i].type === "error") return history[i].text || "partner turn failed";
+  }
+  return null;
+}
+
+function recentTurns(session, count) {
+  var history = session.history || [];
+  var starts = [];
+  for (var i = 0; i < history.length; i++) if (history[i] && history[i].type === "user_message") starts.push(i);
+  var from = starts.length > 0 ? starts[Math.max(0, starts.length - count)] : 0;
+  var turns = [];
+  var current = null;
+  for (var j = from; j < history.length; j++) {
+    var item = history[j];
+    if (!item) continue;
+    if (item.type === "user_message") {
+      current = { user: item.text || "", delegated: !!item.delegated, response: "" };
+      turns.push(current);
+    } else if (item.type === "delta" && item.text) {
+      if (!current) { current = { user: "", delegated: false, response: "" }; turns.push(current); }
+      current.response += item.text;
+      if (current.response.length > MAX_RESPONSE_CHARS) current.response = current.response.slice(-MAX_RESPONSE_CHARS);
+    }
+  }
+  return turns;
+}
+
+module.exports = { errorSince: errorSince, recentTurns: recentTurns, responseText: responseText };

package/lib/session-pair-mcp-server.js

@@ -1,6 +1,12 @@
 // Partner-control tools for sessions that belong to a split group.
 
 var buildShape = require("./session-spawn-mcp-server").buildShape;
+var z;
+try { z = require("zod"); } catch (e) { z = null; }
+var evaluationSchema = z ? z.union([
+  z.string(),
+  z.object({ outcome: z.string(), note: z.string().optional() }),
+]) : null;
 
 // `options.lifecycle` adds the autonomous management tools. They are omitted
 // for a plain side-by-side split, which has no Driver role to exercise them.
@@ -15,6 +21,7 @@ function getToolDefs(handlers, options) {
         wait: { type: "boolean", description: "Wait for the partner's turn to finish. Defaults to true." },
         timeoutSeconds: { type: "number", description: "Maximum wait in seconds, from 1 to 900. Defaults to 300." },
         operationId: { type: "string", description: "Optional stable id for this delegation. Reusing it within the same human turn returns the original operation instead of sending twice." },
+        taskId: { type: "string", description: "Optional stable task id for generation and completion correlation." },
       }, ["message"]),
       handler: function (args) { return handlers.send(args || {}); },
     },
@@ -29,7 +36,7 @@ function getToolDefs(handlers, options) {
     {
       name: "interrupt_partner",
       description: "Interrupt the Split Worker's current task. Use this when the task is going in the wrong direction, needs to be reprioritized, or must stop before the next instruction. The Split Worker returns any partial result to you for review.",
-      inputSchema: buildShape({}),
+      inputSchema: buildShape({ reason: { type: "string", description: "Why the Driver is interrupting this task." } }),
       handler: function (args) { return handlers.interrupt(args || {}); },
     },
     {
@@ -41,6 +48,15 @@ function getToolDefs(handlers, options) {
   ];
   if (!lifecycle) return defs;
   return defs.concat([
+    {
+      name: "message_partner",
+      description: "Queue a non-interrupting message on the active Split Worker's runtime input without creating a delegated follow-up. Returns queued or rejected with an exact request id; queued does not claim model execution.",
+      inputSchema: buildShape({
+        message: { type: "string", description: "Bounded correction or context for the current active Worker turn." },
+        requestId: { type: "string", description: "Optional stable request id. Reuse it to deduplicate a retried delivery within this human turn." },
+      }, ["message"]),
+      handler: function (args) { return handlers.message(args || {}); },
+    },
     {
       name: "partner_status",
       description: "Bounded capacity and continuity report for your Split Worker, for deciding reuse against replacement: context tokens used and the ratio of its window, current task and activity, vendor/model/effort, history size and idle time, whether it is safe to replace right now, and your own recorded results for earlier Worker generations. Returns no transcript. Prefer this over reading turns when you only need to decide.",
@@ -58,10 +74,11 @@ function getToolDefs(handlers, options) {
         workerEffort: { type: "string", description: "Optional reasoning effort for the new Worker." },
         recommendationRationale: { type: "string", description: "Concise Driver-authored explanation of why the recommended replacement vendor, model, and effort fit the next task." },
         evaluation: {
-          type: "object",
+          schema: evaluationSchema,
           description: "Optional bounded assessment of the Worker being replaced, recorded against that exact generation.",
         },
         operationId: { type: "string", description: "Optional stable id for this replacement. Reusing it within the same human turn returns the original operation instead of replacing twice." },
+        supersedeProposalId: { type: "string", description: "Exact pending replacement proposal id to supersede with this new configuration." },
       }, ["message", "recommendationRationale"]),
       handler: function (args) { return handlers.replace(args || {}); },
     },

package/lib/session-pair-operation.js

@@ -0,0 +1,11 @@
+function fingerprint(args, fields) {
+  var source = args || {};
+  var value = {};
+  for (var i = 0; i < fields.length; i++) {
+    var name = fields[i];
+    value[name] = Object.prototype.hasOwnProperty.call(source, name) ? source[name] : null;
+  }
+  return JSON.stringify(value);
+}
+
+module.exports = { fingerprint: fingerprint };

package/lib/session-pair-prompts.js

@@ -3,6 +3,19 @@
 // Pure data, extracted from project-session-pair.js so that module stays under
 // the size limit and so the guidance can be reviewed as prose.
 
+var WORKER_RUNTIME_SELECTION = [
+  "Use a high-low model mix: keep decomposition, judgment, and review with the Driver, and prefer a lighter",
+  "Worker model capable of the bounded execution task. Do not mirror the Driver's model or default to the",
+  "strongest available model merely because it is available. Explicitly fill the vendor, model, and thinking",
+  "effort recommendation fields for both creation and replacement; never leave model selection to card defaults.",
+  "Select model capability and thinking effort separately. Start with the lowest effort adequate for the task,",
+  "not high effort by habit. Choose from the installed, offered catalog; do not invent model availability or prices.",
+  "Explain why the lighter choice can handle the task. Escalate only for a concrete requirement beyond its",
+  "capabilities or observed failures, and state that reason. Use recorded Worker outcomes when available,",
+  "and reconsider a lighter model for the next bounded task after an escalation. Honor the user's explicit",
+  "runtime choice; this is a recommendation policy, not a restriction on which model the user may select.",
+].join(" ").replace(/ {2,}/g, " ");
+
 var DRIVER_DELEGATION = [
   "Your management objective: protect your own context, keep the Split Worker compact, and put execution where",
   "it runs best. Delegate implementation-heavy work rather than doing it here. Treat work spanning multiple modules,",
@@ -13,9 +26,10 @@ var DRIVER_DELEGATION = [
 ].join(" ").replace(/ {2,}/g, " ");
 
 var DRIVER_CORE = [
+  WORKER_RUNTIME_SELECTION,
   "You are the Driver of a visible Driver/Split Worker pair, and you manage that Split Worker yourself.",
-  "The tools send_to_partner, read_partner, partner_status, replace_partner, interrupt_partner, close_partner,",
-  "and record_partner_evaluation are provided directly to you.",
+  "The pair tools distinguish a live message, a queued follow-up, an interrupt-and-replace task, resumption,",
+  "and replacement of the Worker runtime. Inspect exact task and proposal ids before changing queued work.",
   "",
   "Reuse the existing Split Worker",
   "only when its accumulated context genuinely helps the next task; when it is context-bloated, stale, or",
@@ -34,6 +48,8 @@ var DRIVER_CORE = [
   "interrupt true, which stops it first only after acceptance. A human Stop",
   "is authoritative: do not retry, send more work, or replace the Worker in the same turn. Clay blocks those",
   "actions until the human sends a new Driver message. Use close_partner when they ask to close the pane.",
+  "A Worker outcome envelope is Worker-reported evidence, not Driver verification. Preserve partial results and",
+  "correlate completions to their task and generation; never attach a late old-generation result to a new Worker.",
   "",
   "Recommend a Worker vendor, model, and effort from what is actually installed and offered, and include a concise",
   "rationale explaining why all three fit the task. The card remains visible as an audit trail even when full access",
@@ -56,7 +72,12 @@ var DRIVER_CORE = [
 
 var DRIVER = DRIVER_CORE + " " + DRIVER_DELEGATION;
 
+function worker(taskId) {
+  return "You are the configured Split Worker. For task " + (taskId || "unknown") + ", call report_partner_outcome before finishing when the tool is available. Report only what you observed: changed files, verification commands/results, unverified work, running processes, and next action. Never claim Driver verification.";
+}
+
 var UNPAIRED = [
+  WORKER_RUNTIME_SELECTION,
   "Infer the user's intended target from conversational and UI context. References to a user-visible paired or",
   "split pane, its session, its activity or status, or a collaborator the user wants opened resolve to Clay's",
   "Split Worker and its partner tools. Internal Sub-agents are a distinct execution mechanism, not a lexical",
@@ -76,4 +97,5 @@ module.exports = {
   DRIVER_CORE: DRIVER_CORE,
   DRIVER_DELEGATION: DRIVER_DELEGATION,
   UNPAIRED: UNPAIRED,
+  worker: worker,
 };

package/lib/session-pair-turn-control.js

@@ -111,14 +111,19 @@ function attachPairTurnControl(ctx) {
     return clean;
   }
 
-  function runOperation(driver, kind, rawId, fn) {
+  function runOperation(driver, kind, rawId, fn, fingerprint) {
     var id = operationId(rawId);
     if (!id) return Promise.resolve().then(fn);
     var state = stateFor(driver);
     var key = kind + ":" + id;
-    if (state.operations[key]) return state.operations[key];
+    if (state.operations[key]) {
+      if (fingerprint !== undefined && state.operations[key].fingerprint !== fingerprint) {
+        return Promise.reject(new Error("operation id was already used with different input"));
+      }
+      return state.operations[key].promise;
+    }
     var promise = Promise.resolve().then(fn);
-    state.operations[key] = promise;
+    state.operations[key] = { fingerprint: fingerprint, promise: promise };
     return promise;
   }
 

package/lib/session-provenance.js

@@ -69,6 +69,7 @@ function restore(meta, session) {
     createdVia: stored.createdVia === "split-worker" ? "split-worker" : null,
     createdAt: typeof stored.createdAt === "number" && isFinite(stored.createdAt) ? stored.createdAt : null,
   };
+  session._pairGeneration = session.sessionProvenance.generation;
   return storedOriginId !== session.sessionOriginId || JSON.stringify(stored) !== JSON.stringify(session.sessionProvenance);
 }
 

package/lib/session-spawn-mcp-server.js

@@ -12,7 +12,8 @@ function buildShape(props, required) {
     var key = keys[i];
     var prop = props[key];
     var field;
-    if (prop.type === "number") field = z.number();
+    if (prop.schema) field = prop.schema;
+    else if (prop.type === "number") field = z.number();
     else if (prop.type === "boolean") field = z.boolean();
     else if (prop.enum) field = z.enum(prop.enum);
     else field = z.string();