clay-server 4.1.0-beta.7 → 4.1.0-beta.9

package/bin/cli.js

@@ -1268,7 +1268,7 @@ function setup(callback) {
   console.clear();
   printLogo();
   log("");
-  log(sym.pointer + "  " + a.bold + "Clay" + a.reset + a.dim + "  ·  Unofficial, open-source project" + a.reset);
+  log(sym.pointer + "  " + a.bold + "Clay Studio" + a.reset + a.dim + "  ·  Official open-source distribution" + a.reset);
   log(sym.bar);
   log(sym.bar + "  " + a.yellow + sym.warn + " Disclaimer" + a.reset);
   log(sym.bar);

package/lib/project-pending-message-queue.js

@@ -37,6 +37,7 @@ function createPendingMessageQueue(opts) {
     for (var i = 0; i < parsed.items.length; i++) {
       var item = parsed.items[i];
       if (!item || typeof item.id !== "string" || typeof item.sessionKey !== "string" || typeof item.projectSlug !== "string" || typeof item.actorId !== "string" || !item.message || ["pending", "claimed", "consumed", "cancelled", "failed"].indexOf(item.state) < 0) return false;
+      if (item.schedule !== undefined && (!item.schedule || typeof item.schedule !== "object" || typeof item.schedule.jobId !== "string" || typeof item.schedule.revision !== "string" || typeof item.schedule.ready !== "boolean" || !Number.isFinite(Number(item.schedule.notBefore)))) return false;
     }
     return true;
   }
@@ -113,30 +114,42 @@ function createPendingMessageQueue(opts) {
     for (var i = 0; i < data.items.length; i++) if (sameTarget(data.items[i], session) && (data.items[i].state === "pending" || data.items[i].state === "claimed")) return true;
     return false;
   }
-  function admit(session, message, actor) {
+  function admitInternal(session, message, actor, trustedSchedule) {
     if (loadError) return result(false, loadError, session, actor);
     if (!session || !canMutate(session, actor, null)) return result(false, "Not authorized", session, actor);
     var validationError = validateMessage(message);
     if (validationError) return result(false, validationError, session, actor);
+    var clientId = message.clientMessageId ? String(message.clientMessageId) : null;
+    var duplicate = inspect(session, actor, clientId);
+    if (duplicate) {
+      var duplicateResult = result(duplicate.state !== "cancelled" && duplicate.state !== "failed", duplicate.state === "cancelled" ? "Message was cancelled" : duplicate.state === "failed" ? "Message delivery failed" : null, session, actor);
+      duplicateResult.item = duplicate;
+      return duplicateResult;
+    }
     var activeCount = 0;
     for (var activeIndex = 0; activeIndex < data.items.length; activeIndex++) {
       if (sameTarget(data.items[activeIndex], session) && (data.items[activeIndex].state === "pending" || data.items[activeIndex].state === "claimed")) activeCount++;
     }
     if (activeCount >= MAX_ACTIVE_ITEMS) return result(false, "Pending message queue is full", session, actor);
-    var clientId = message.clientMessageId ? String(message.clientMessageId) : null;
-    var duplicate = inspect(session, actor, clientId);
-    if (duplicate) return result(duplicate.state !== "cancelled" && duplicate.state !== "failed", duplicate.state === "cancelled" ? "Message was cancelled" : duplicate.state === "failed" ? "Message delivery failed" : null, session, actor);
     var before = copy(data);
     var storedMessage = copy(message);
+    delete storedMessage.schedule;
     if (Object.prototype.hasOwnProperty.call(storedMessage, "images")) storedMessage.images = sanitizeImages(storedMessage.images);
     var item = { id: "pm_" + data.nextId++, sessionKey: key(session), sessionLocalId: session.localId, projectSlug: opts.slug, actorId: actorId(actor), actorName: actor && (actor.displayName || actor.username || actor.name) ? String(actor.displayName || actor.username || actor.name).slice(0, 120) : null, clientMessageId: clientId, message: storedMessage, createdAt: Date.now(), state: "pending" };
+    if (trustedSchedule) item.schedule = copy(trustedSchedule);
     delete item.message._pendingConsumed;
+    delete item.message._scheduledJobId;
+    delete item.message._scheduledRevision;
+    delete item.message._scheduledNotBefore;
     data.items.push(item);
     data.revision++;
     try { persist(); } catch (e) { restore(before); return result(false, "Queue storage failed", session, actor); }
     broadcast(session, { type: "pending_message_queued", sessionId: session.localId, projectSlug: opts.slug, paused: isPaused(session), item: copy(item), revision: data.revision });
-    return result(true, null, session, actor);
+    var admitted = result(true, null, session, actor);
+    admitted.item = copy(item);
+    return admitted;
   }
+  function admit(session, message, actor) { return admitInternal(session, message, actor, null); }
   function mutate(session, actor, id, expectedRevision, expectedSessionId, operation, allowedStates) {
     if (loadError) return result(false, loadError, session, actor);
     if (!session || session.localId !== expectedSessionId || !authorize(session, actor)) return result(false, "Session changed", session, actor);
@@ -151,6 +164,7 @@ function createPendingMessageQueue(opts) {
     try { persist(); } catch (e) { restore(before); return result(false, "Queue storage failed", session, actor); }
     if (data.items[index].state === "cancelled" && session._pendingMessageClaimId === data.items[index].id) delete session._pendingMessageClaimId;
     broadcast(session, { type: "pending_message_state", sessionId: session.localId, projectSlug: opts.slug, paused: isPaused(session), revision: data.revision, items: visible(session, actor) });
+    if (data.items[index].state === "cancelled" && typeof opts.onItemCancelled === "function") opts.onItemCancelled(copy(data.items[index]));
     return result(true, null, session, actor);
   }
   function edit(session, actor, id, revision, expectedSessionId, message) {
@@ -166,8 +180,9 @@ function createPendingMessageQueue(opts) {
       var validationError = validateMessage(proposed);
       if (validationError) return result(false, validationError, session, actor);
     }
+    if (current && (!session || session.localId !== expectedSessionId || !authorize(session, actor) || revision !== data.revision || current.state !== "pending" || !canMutate(session, actor, current))) return result(false, "Pending message not found", session, actor);
     return mutate(session, actor, id, revision, expectedSessionId, function (items, index) {
-      var nextMessage = Object.assign({}, items[index].message, { text: text });
+      var nextMessage = Object.assign({}, items[index].message, proposed || { text: text });
       if (message && Object.prototype.hasOwnProperty.call(message, "images")) nextMessage.images = sanitizeImages(message.images);
       items[index].message = nextMessage;
     });
@@ -229,6 +244,7 @@ function createPendingMessageQueue(opts) {
     try { persist(); } catch (e) { restore(before); return false; }
     if (session._pendingMessageClaimId === id) delete session._pendingMessageClaimId;
     broadcast(session, { type: ok === "release" ? "pending_message_state" : "pending_message_consumed", sessionId: session.localId, projectSlug: opts.slug, paused: isPaused(session), id: id, state: data.items[index].state, items: ok === "release" ? visible(session, { id: data.items[index].actorId }) : undefined, revision: data.revision });
+    if (ok === true && typeof opts.onItemConsumed === "function") opts.onItemConsumed(copy(data.items[index]));
     return true;
   }
   function consumeOne(session, dispatch) {
@@ -237,6 +253,7 @@ function createPendingMessageQueue(opts) {
     for (var i = 0; i < data.items.length; i++) {
       var item = data.items[i];
       if (!sameTarget(item, session) || item.state !== "pending") continue;
+      if (item.schedule && !item.schedule.ready) continue;
       if (!canMutate(session, { id: item.actorId }, item)) continue;
       var before = copy(data);
       item.state = "claimed";
@@ -258,7 +275,54 @@ function createPendingMessageQueue(opts) {
     for (var i = 0; i < data.items.length; i++) if (data.items[i].id === id && sameTarget(data.items[i], session) && data.items[i].state === "claimed") return true;
     return false;
   }
-  return { admit: admit, edit: edit, cancel: cancel, reorder: reorder, pause: pause, resume: resume, consumeOne: consumeOne, hydrate: hydrate, inspect: inspect, hasActive: hasActive, isClaimed: isClaimed, isPaused: isPaused, list: visible, getRevision: function () { return data.revision; }, getLoadError: function () { return loadError; }, filePath: filePath };
+  function upsertScheduled(session, message, actor, trustedSchedule) {
+    message = copy(message);
+    var schedule = trustedSchedule || message.schedule;
+    delete message.schedule;
+    if (!schedule || typeof schedule.jobId !== "string" || typeof schedule.revision !== "string" || typeof schedule.ready !== "boolean" || !Number.isFinite(Number(schedule.notBefore))) return result(false, "Invalid scheduled queue metadata", session, actor);
+    var validationError = validateMessage(message);
+    if (validationError) return result(false, validationError, session, actor);
+    if (Object.prototype.hasOwnProperty.call(message, "images")) message.images = sanitizeImages(message.images);
+    delete message._pendingConsumed;
+    delete message._scheduledJobId;
+    delete message._scheduledRevision;
+    delete message._scheduledNotBefore;
+    for (var i = 0; i < data.items.length; i++) {
+      if (sameTarget(data.items[i], session) && data.items[i].schedule && data.items[i].schedule.jobId === schedule.jobId && data.items[i].state !== "pending") return result(false, "Scheduled queue item is terminal", session, actor);
+      if (sameTarget(data.items[i], session) && data.items[i].schedule && data.items[i].schedule.jobId === schedule.jobId && data.items[i].state === "pending") {
+        if (!authorize(session, actor) || !canMutate(session, actor, data.items[i])) return result(false, "Not authorized", session, actor);
+        var before = copy(data);
+        data.items[i].message = copy(message);
+        data.items[i].schedule = copy(schedule);
+        data.revision++;
+        try { persist(); } catch (error) { restore(before); return result(false, "Queue storage failed", session, actor); }
+        broadcast(session, { type: "pending_message_state", sessionId: session.localId, projectSlug: opts.slug, paused: isPaused(session), revision: data.revision, items: visible(session, actor) });
+        return { ok: true, item: copy(data.items[i]), revision: data.revision };
+      }
+    }
+    return admitInternal(session, message, actor, schedule);
+  }
+  function cancelScheduled(session, jobId, actor) {
+    for (var i = 0; i < data.items.length; i++) {
+      if (sameTarget(data.items[i], session) && data.items[i].schedule && data.items[i].schedule.jobId === jobId && (data.items[i].state === "pending" || data.items[i].state === "claimed")) return cancel(session, actor, data.items[i].id, data.revision, session.localId);
+    }
+    return false;
+  }
+  function releaseScheduled(session, jobId, revision) {
+    for (var i = 0; i < data.items.length; i++) {
+      var item = data.items[i];
+      if (!sameTarget(item, session) || !item.schedule || item.schedule.jobId !== jobId || item.schedule.revision !== revision) continue;
+      if (item.state !== "pending" || item.schedule.ready) return item.state === "pending" ? copy(item) : null;
+      var before = copy(data);
+      item.schedule.ready = true;
+      data.revision++;
+      try { persist(); } catch (error) { restore(before); return null; }
+      broadcast(session, { type: "pending_message_state", sessionId: session.localId, projectSlug: opts.slug, paused: isPaused(session), revision: data.revision, items: visible(session, { id: item.actorId }) });
+      return copy(item);
+    }
+    return null;
+  }
+  return { admit: admit, upsertScheduled: upsertScheduled, releaseScheduled: releaseScheduled, cancelScheduled: cancelScheduled, edit: edit, cancel: cancel, reorder: reorder, pause: pause, resume: resume, consumeOne: consumeOne, hydrate: hydrate, inspect: inspect, hasActive: hasActive, isClaimed: isClaimed, isPaused: isPaused, list: visible, getRevision: function () { return data.revision; }, getLoadError: function () { return loadError; }, filePath: filePath };
 }
 
 module.exports = { createPendingMessageQueue: createPendingMessageQueue };

package/lib/project-scheduled-messages.js

@@ -2,19 +2,19 @@ var crypto = require("crypto");
 var sessionProvenance = require("./session-provenance");
 
 var LOCAL_OWNER = "local-user";
-
+var REQUEST_ID_RE = /^[A-Za-z0-9._:-]{1,128}$/;
 function attachProjectScheduledMessages(ctx) {
   var scheduler = ctx.scheduler;
   var slug = ctx.slug;
   var sm = ctx.sm;
-  var sdk = ctx.sdk;
   var users = ctx.usersModule;
+  var pendingMessageQueue = ctx.pendingMessageQueue;
+  var consumePendingMessage = ctx.consumePendingMessage;
   var type = "project-chat-message:" + slug;
   var makeRevision = ctx.makeRevision || function () { return crypto.randomUUID(); };
   var now = ctx.now || Date.now;
   var unregister = null;
   var stopped = false;
-
   function findSession(cliSessionId) {
     var found = null;
     sm.sessions.forEach(function (session) {
@@ -22,7 +22,6 @@ function attachProjectScheduledMessages(ctx) {
     });
     return found;
   }
-
   function latestJob(session) {
     if (!scheduler || !session || !session.cliSessionId) return null;
     var jobs = scheduler.listJobs();
@@ -31,7 +30,6 @@ function attachProjectScheduledMessages(ctx) {
     }
     return null;
   }
-
   function pendingJob(session) {
     if (!scheduler || !session || !session.cliSessionId) return null;
     if (session.scheduledMessage && session.scheduledMessage.jobId) {
@@ -45,21 +43,43 @@ function attachProjectScheduledMessages(ctx) {
     }
     return null;
   }
-
-  function projection(job) {
+  function projection(job, queueItem) {
     if (!job || job.state !== "queued") return null;
     return {
       jobId: job.id,
       revision: job.payload.revision,
-      text: job.payload.text,
+      text: queueItem && queueItem.message ? queueItem.message.text : "",
       resetsAt: job.runAt,
       scheduledAt: job.payload.scheduledAt,
     };
   }
-
+  function queueActor(actorId) {
+    return users.isMultiUser() ? users.findUserById(actorId) : { id: "default" };
+  }
+  function queueItemForJob(session, job, actorId) {
+    if (!pendingMessageQueue || !session || !job) return null;
+    var actor = queueActor(actorId || (job.payload && job.payload.actorId));
+    var items = pendingMessageQueue.list(session, actor);
+    for (var i = 0; i < items.length; i++) {
+      if (items[i].schedule && items[i].schedule.jobId === job.id && items[i].schedule.revision === job.payload.revision) return items[i];
+    }
+    return null;
+  }
+  function validateQueueControl(session, job, actorId, correlation, requireQueueRevision) {
+    if (!pendingMessageQueue) return null;
+    if (requireQueueRevision && (!correlation || correlation.queueRevision == null || Number(correlation.queueRevision) !== pendingMessageQueue.getRevision())) {
+      throw new Error("The scheduled-message queue is stale.");
+    }
+    var actor = queueActor(actorId || (job.payload && job.payload.actorId));
+    var item = queueItemForJob(session, job, actorId);
+    if (!item || item.actorId !== actor.id || ["cancelled", "consumed", "failed"].indexOf(item.state) >= 0) {
+      throw new Error("The scheduled queue item is no longer available.");
+    }
+    return item;
+  }
   function sendState(session, targetWs, sendFn) {
     var job = pendingJob(session);
-    session.scheduledMessage = projection(job);
+    session.scheduledMessage = projection(job, queueItemForJob(session, job, job && job.payload && job.payload.actorId));
     var latest = latestJob(session);
     var interrupted = !job && latest && latest.state === "interrupted" ? {
       jobId: latest.id,
@@ -72,20 +92,17 @@ function attachProjectScheduledMessages(ctx) {
     else ctx.sendToSession(session.localId, message);
     return message;
   }
-
   function visibleError(session, targetWs, text) {
     var message = { type: "error", text: text };
     if (targetWs) ctx.sendTo(targetWs, message);
     else if (session) ctx.sendToSession(session.localId, message);
   }
-
   function ownerFor(session) {
     if (!users.isMultiUser()) return LOCAL_OWNER;
     if (!session.ownerId) throw new Error("Scheduled messages require a session owner.");
     if (!users.findUserById(session.ownerId)) throw new Error("The session owner no longer exists.");
     return session.ownerId;
   }
-
   function authorize(session, actorId) {
     if (!session || session.destroying) throw new Error("The session is no longer available.");
     if (sm.sessions.get(session.localId) !== session) throw new Error("The session is no longer live.");
@@ -106,7 +123,6 @@ function attachProjectScheduledMessages(ctx) {
     }
     return ownerId;
   }
-
   function buildSpec(session, text, resetsAt, actorId, revision) {
     var timestamp = now();
     var runAt = resetsAt <= timestamp ? timestamp + 5000 : resetsAt + 60000;
@@ -119,6 +135,8 @@ function attachProjectScheduledMessages(ctx) {
       target: { kind: "project-session", id: session.cliSessionId },
       payload: {
         text: text,
+        hasAttachments: false,
+        queueAdmissionRequired: true,
         cliSessionId: session.cliSessionId,
         actorId: actorId || LOCAL_OWNER,
         sessionOwnerId: ownerId,
@@ -129,27 +147,117 @@ function attachProjectScheduledMessages(ctx) {
       runAt: runAt,
     };
   }
+  function requestJobs(session, actorId, requestId) {
+    if (!scheduler || !session || !requestId) return [];
+    var jobs = scheduler.listJobs();
+    return jobs.filter(function (job) {
+      return job.type === type && job.projectId === slug && job.target && job.target.id === session.cliSessionId &&
+        job.payload && job.payload.admissionRequestId === requestId && job.payload.actorId === actorId;
+    });
+  }
+  function requestIdempotencyKey(session, actorId, requestId) {
+    var base = "project-message:" + slug + ":" + session.cliSessionId + ":actor:" + actorId + ":request:" + requestId;
+    var jobs = requestJobs(session, actorId, requestId);
+    var retryCount = 0;
+    for (var i = 0; i < jobs.length; i++) if (jobs[i].state === "cancelled" && jobs[i].cancelledReason === "queue_admission_failed") retryCount++;
+    var key = crypto.createHash("sha256").update(base).digest("hex");
+    return "project-message-request:" + key + (retryCount ? ":retry-" + retryCount : "");
+  }
+  function sendAdmissionResult(targetWs, session, actorId, requestId, job, error, transportAccountId) {
+    if (!targetWs || !requestId) return;
+    ctx.sendTo(targetWs, {
+      type: "schedule_message_result",
+      requestId: requestId,
+      projectSlug: slug,
+      sessionId: session ? session.localId : null,
+      accountId: transportAccountId || actorId || "default",
+      ok: !error,
+      error: error || null,
+      scheduledMessage: job ? projection(job, queueItemForJob(session, job, actorId)) : null,
+    });
+  }
 
-  function schedule(session, text, resetsAt, actorUser, targetWs) {
+  function schedule(session, text, resetsAt, actorUser, targetWs, attachments, requestId, transportAccountId) {
+    var actorId = users.isMultiUser() ? (actorUser && actorUser.id) : LOCAL_OWNER;
     if (!scheduler || stopped) {
+      sendAdmissionResult(targetWs, session, actorId, requestId, null, "Scheduled messages are temporarily unavailable.", transportAccountId);
       visibleError(session, targetWs, "Scheduled messages are temporarily unavailable.");
       return null;
     }
-    if (typeof text !== "string" || !text.trim() || !isFinite(Number(resetsAt))) {
+    var images = attachments && Array.isArray(attachments.images) ? attachments.images : [];
+    var pastes = attachments && Array.isArray(attachments.pastes) ? attachments.pastes : [];
+    if (attachments && Object.prototype.hasOwnProperty.call(attachments, "images") && !Array.isArray(attachments.images)) {
+      sendAdmissionResult(targetWs, session, actorId, requestId, null, "Invalid image attachments.", transportAccountId);
+      return null;
+    }
+    if (attachments && Object.prototype.hasOwnProperty.call(attachments, "pastes") && !Array.isArray(attachments.pastes)) {
+      sendAdmissionResult(targetWs, session, actorId, requestId, null, "Invalid paste attachments.", transportAccountId);
+      return null;
+    }
+    if (requestId && (typeof requestId !== "string" || !REQUEST_ID_RE.test(requestId))) {
+      sendAdmissionResult(targetWs, session, actorId, requestId, null, "Invalid schedule request identifier.", transportAccountId);
+      return null;
+    }
+    if (typeof text !== "string" || (!text.trim() && !images.length && !pastes.length) || !isFinite(Number(resetsAt))) {
+      sendAdmissionResult(targetWs, session, actorId, requestId, null, "A valid scheduled message and reset time are required.", transportAccountId);
       visibleError(session, targetWs, "A valid scheduled message and reset time are required.");
       return null;
     }
     try {
-      var actorId = users.isMultiUser() ? (actorUser && actorUser.id) : LOCAL_OWNER;
+      // Authorization is deliberately performed before looking up a durable
+      // request association, so replay cannot disclose another account's job.
+      authorize(session, actorId);
+      var priorJobs = requestJobs(session, actorId, requestId);
+      var prior = priorJobs.length ? priorJobs[priorJobs.length - 1] : null;
+      if (prior && (prior.state !== "cancelled" || prior.cancelledReason !== "queue_admission_failed")) {
+        if (prior.state === "queued") {
+          var priorItem = queueItemForJob(session, prior, actorId);
+          if (!priorItem) throw new Error("Scheduled queue item is missing; refusing to replay request.");
+          if (["cancelled", "consumed", "failed"].indexOf(priorItem.state) >= 0) throw new Error("Scheduled queue item is no longer available; refusing to replay request.");
+        }
+        sendAdmissionResult(targetWs, session, actorId, requestId, prior, null, transportAccountId);
+        return prior;
+      }
       var revision = makeRevision();
       var spec = buildSpec(session, text, Number(resetsAt), actorId, revision);
+      if (requestId) {
+        spec.idempotencyKey = requestIdempotencyKey(session, actorId, requestId);
+        spec.payload.admissionRequestId = requestId;
+        spec.payload.admissionAccountId = actorId;
+      }
+      spec.payload.hasAttachments = images.length > 0 || pastes.length > 0;
       var current = pendingJob(session);
+      if (current && requestId && (!current.payload || current.payload.admissionRequestId !== requestId)) {
+        throw new Error("Another scheduled message is already pending.");
+      }
+      if (current && pendingMessageQueue) validateQueueControl(session, current, actorId, null, false);
       var job = current ? scheduler.replaceQueued(current.id, spec) : scheduler.enqueue(spec);
-      session.scheduledMessage = projection(job);
+      if (pendingMessageQueue && job) {
+        var queuedScheduled = pendingMessageQueue.upsertScheduled(session, {
+          type: "message",
+          text: text,
+          images: images,
+          pastes: pastes,
+          clientMessageId: requestId ? "scheduled-request-" + requestId : "scheduled-" + job.id,
+          schedule: { jobId: job.id, revision: job.payload.revision, notBefore: job.runAt, ready: false },
+        }, queueActor(actorId));
+        if (!queuedScheduled.ok) {
+          if (current) {
+            try { scheduler.replaceQueued(current.id, current); }
+            catch (rollbackError) { throw new Error((queuedScheduled.error || "Unable to queue scheduled message") + "; scheduler rollback failed: " + rollbackError.message); }
+          } else {
+            scheduler.cancel(job.id, "queue_admission_failed");
+          }
+          throw new Error(queuedScheduled.error || "Unable to queue scheduled message");
+        }
+      }
+      session.scheduledMessage = projection(job, queueItemForJob(session, job, job && job.payload && job.payload.actorId));
+      sendAdmissionResult(targetWs, session, actorId, requestId, job, null, transportAccountId);
       sm.sendAndRecord(session, Object.assign({ type: "scheduled_message_queued" }, session.scheduledMessage));
       return job;
     } catch (error) {
       if (session) session.rateLimitAutoContinuePending = false;
+      sendAdmissionResult(targetWs, session, actorId, requestId, null, error.message, transportAccountId);
       visibleError(session, targetWs, "Could not schedule the message: " + error.message);
       return null;
     }
@@ -157,7 +265,7 @@ function attachProjectScheduledMessages(ctx) {
 
   function requireCorrelation(job, correlation, targetWs) {
     if (!targetWs) return;
-    if (!correlation || correlation.jobId !== job.id || correlation.revision !== job.payload.revision) {
+    if (!correlation || correlation.jobId !== job.id || correlation.revision !== job.payload.revision || correlation.queueRevision == null || !pendingMessageQueue || Number(correlation.queueRevision) !== pendingMessageQueue.getRevision()) {
       throw new Error("The scheduled-message control is stale.");
     }
   }
@@ -165,13 +273,18 @@ function attachProjectScheduledMessages(ctx) {
   function cancel(session, actorUser, targetWs, reason, correlation) {
     try {
       authorize(session, users.isMultiUser() ? (actorUser && actorUser.id) : LOCAL_OWNER);
-      var job = pendingJob(session);
+      var job = pendingJob(session) || latestJob(session);
       if (!job) return false;
       requireCorrelation(job, correlation, targetWs);
-      scheduler.cancel(job.id, reason || "cancelled_by_user");
+      if (pendingMessageQueue) validateQueueControl(session, job, actorUser && actorUser.id, correlation, !!targetWs);
+      if (pendingMessageQueue) {
+        var queueCancelled = pendingMessageQueue.cancelScheduled(session, job.id, queueActor(actorUser && actorUser.id));
+        if (!queueCancelled || queueCancelled.ok !== true) throw new Error((queueCancelled && queueCancelled.error) || "The scheduled queue item could not be cancelled.");
+      }
+      if (job.state === "queued" && !pendingMessageQueue) scheduler.cancel(job.id, reason || "cancelled_by_user");
       session.scheduledMessage = null;
       session.rateLimitAutoContinuePending = false;
-      sm.sendAndRecord(session, { type: "scheduled_message_cancelled", jobId: job.id, revision: job.payload.revision });
+      if (!pendingMessageQueue) sm.sendAndRecord(session, { type: "scheduled_message_cancelled", jobId: job.id, revision: job.payload.revision });
       return true;
     } catch (error) {
       visibleError(session, targetWs, "Could not cancel the scheduled message: " + error.message);
@@ -185,11 +298,27 @@ function attachProjectScheduledMessages(ctx) {
       var job = pendingJob(session);
       if (!job) return false;
       requireCorrelation(job, correlation, targetWs);
+      var existing = validateQueueControl(session, job, actorUser && actorUser.id, correlation, !!targetWs);
       var updated = scheduler.replaceQueued(job.id, {
         runAt: now(),
         idempotencyKey: job.idempotencyKey + ":now",
       });
-      session.scheduledMessage = projection(updated);
+      if (pendingMessageQueue) {
+        var queued = pendingMessageQueue.upsertScheduled(session, {
+          type: "message",
+          text: existing ? existing.message.text : updated.payload.text,
+          images: existing ? existing.message.images : undefined,
+          pastes: existing ? existing.message.pastes : undefined,
+          clientMessageId: existing ? existing.clientMessageId : "scheduled-" + updated.id,
+          schedule: { jobId: updated.id, revision: updated.payload.revision, notBefore: updated.runAt, ready: false },
+        }, queueActor(actorUser && actorUser.id));
+        if (!queued.ok) {
+          try { scheduler.replaceQueued(job.id, job); }
+          catch (rollbackError) { throw new Error((queued.error || "The scheduled queue item could not be updated.") + "; scheduler rollback failed: " + rollbackError.message); }
+          throw new Error(queued.error || "The scheduled queue item could not be updated.");
+        }
+      }
+      session.scheduledMessage = projection(updated, existing);
       scheduler.tick();
       return true;
     } catch (error) {
@@ -237,43 +366,94 @@ function attachProjectScheduledMessages(ctx) {
       var linuxUser = ctx.ensureProjectAccessForSession(session);
       if (ctx.osUsers && !linuxUser) throw new Error("The session owner OS identity is unavailable.");
       execution.recordMetadata({ projectSlug: slug, cliSessionId: session.cliSessionId, revision: job.payload.revision });
-      execution.recordReceipt({ state: "dispatching", projectSlug: slug, cliSessionId: session.cliSessionId, revision: job.payload.revision, recordedAt: now() });
-
-      var userMessage = {
-        type: "user_message",
-        text: job.payload.text,
-        _ts: now(),
-        scheduledJobId: job.id,
-        scheduledRevision: job.payload.revision,
-      };
-      session.history.push(userMessage);
-      sm.appendToSessionFile(session, userMessage);
-      ctx.sendToSession(session.localId, userMessage);
-      processingOwner = {};
-      session._scheduledMessageProcessing = processingOwner;
-      session.isProcessing = true;
-      ctx.onProcessingChanged();
-      ctx.sendToSession(session.localId, { type: "status", status: "processing" });
-      var queryPromise = sdk.startQuery(session, job.payload.text, null, linuxUser);
-      processingOwner.queryGeneration = session._queryGeneration;
-      processingOwner.queryInstance = session.queryInstance;
-      if (session.scheduledMessage && session.scheduledMessage.jobId === job.id) {
-        session.scheduledMessage = null;
-        session.rateLimitAutoContinuePending = false;
+      if (!pendingMessageQueue) throw new Error("Scheduled message queue is unavailable.");
+      var existing = queueItemForJob(session, job, job.payload.actorId);
+      if (existing && ["cancelled", "consumed", "failed"].indexOf(existing.state) >= 0) {
+        return { released: false, queueItemId: existing.id, cliSessionId: session.cliSessionId, revision: job.payload.revision };
       }
-      sm.sendAndRecord(session, { type: "scheduled_message_sent", jobId: job.id, revision: job.payload.revision });
-      sm.broadcastSessionList();
-      await Promise.resolve(queryPromise);
-      if (session._scheduledMessageProcessing === processingOwner) delete session._scheduledMessageProcessing;
-      return { dispatched: true, cliSessionId: session.cliSessionId, revision: job.payload.revision };
+      if (!existing && ["interrupted", "completed"].indexOf(job.state) >= 0) {
+        return { released: false, queueItemId: null, cliSessionId: session.cliSessionId, revision: job.payload.revision };
+      }
+      var ensured = existing;
+      if (!ensured && job.payload.queueAdmissionRequired === true) throw new Error("Scheduled queue item is missing; refusing to recreate message payload.");
+      if (!ensured) ensured = pendingMessageQueue.upsertScheduled(session, {
+        type: "message", text: job.payload.text, clientMessageId: "scheduled-" + job.id,
+        schedule: { jobId: job.id, revision: job.payload.revision, notBefore: job.runAt, ready: false },
+      }, queueActor(job.payload.actorId));
+      if (!ensured || ensured.ok === false) throw new Error(ensured.error || "Scheduled queue handoff could not be prepared.");
+      var released = pendingMessageQueue.releaseScheduled(session, job.id, job.payload.revision);
+      if (!released) throw new Error("Scheduled message queue handoff could not be released.");
+      if (typeof consumePendingMessage === "function") setImmediate(function () { consumePendingMessage(session); });
+      return { released: true, queueItemId: released.id, cliSessionId: session.cliSessionId, revision: job.payload.revision };
     } catch (error) {
       failJob(session, job, error, processingOwner);
       throw error;
     }
   }
 
+  function onQueueConsumed(item) {
+    if (!item || !item.schedule || !scheduler) return false;
+    var job = scheduler.getJob(item.schedule.jobId);
+    var session = job && job.target ? findSession(job.target.id) : null;
+    if (!session) return false;
+    if (session.scheduledMessage && session.scheduledMessage.jobId === item.schedule.jobId) {
+      session.scheduledMessage = null;
+      session.rateLimitAutoContinuePending = false;
+    }
+    sm.sendAndRecord(session, { type: "scheduled_message_sent", jobId: job.id, revision: item.schedule.revision });
+    sm.broadcastSessionList();
+    return true;
+  }
+
+  function onQueueCancelled(item) {
+    if (!item || !item.schedule || !scheduler) return false;
+    var job = scheduler.getJob(item.schedule.jobId);
+    if (job && job.state === "queued") {
+      try { scheduler.cancel(job.id, "cancelled_by_user"); } catch (error) {}
+    }
+    var session = job && job.target ? findSession(job.target.id) : null;
+    if (session && session.scheduledMessage && session.scheduledMessage.jobId === item.schedule.jobId) {
+      session.scheduledMessage = null;
+      session.rateLimitAutoContinuePending = false;
+      sm.sendAndRecord(session, { type: "scheduled_message_cancelled", jobId: item.schedule.jobId, revision: item.schedule.revision });
+    }
+    return true;
+  }
+
+  function authorizePending(item, session) {
+    if (!item || !item.schedule || !scheduler || !session) return true;
+    var job = scheduler.getJob(item.schedule.jobId);
+    var expectedActorId = users.isMultiUser() ? job && job.payload && job.payload.actorId : "default";
+    if (!job || ["running", "completed", "interrupted"].indexOf(job.state) < 0 || !job.target || job.target.id !== session.cliSessionId ||
+        !job.payload || job.projectId !== slug || job.payload.revision !== item.schedule.revision || item.actorId !== expectedActorId ||
+        job.ownerId !== job.payload.sessionOwnerId) return false;
+    try { return authorize(session, job.payload.actorId) === job.ownerId; } catch (error) { return false; }
+  }
+
   function rehydrate() {
-    sm.sessions.forEach(function (session) { session.scheduledMessage = projection(pendingJob(session)); });
+    sm.sessions.forEach(function (session) {
+      var pending = pendingJob(session);
+      session.scheduledMessage = projection(pending, queueItemForJob(session, pending, pending && pending.payload && pending.payload.actorId));
+      if (!pendingMessageQueue) return;
+      var jobs = scheduler.listJobs();
+      for (var i = 0; i < jobs.length; i++) {
+        if (jobs[i].type !== type || jobs[i].projectId !== slug || !jobs[i].target || jobs[i].target.id !== session.cliSessionId) continue;
+        var actor = users.isMultiUser() ? users.findUserById(jobs[i].payload.actorId) : { id: "default" };
+        if (jobs[i].state === "queued" && !queueItemForJob(session, jobs[i], jobs[i].payload.actorId)) {
+          if (jobs[i].payload.queueAdmissionRequired !== true) pendingMessageQueue.upsertScheduled(session, {
+            type: "message", text: jobs[i].payload.text, clientMessageId: "scheduled-" + jobs[i].id,
+            schedule: { jobId: jobs[i].id, revision: jobs[i].payload.revision, notBefore: jobs[i].runAt, ready: false },
+          }, actor);
+        }
+        else if (["interrupted", "completed"].indexOf(jobs[i].state) >= 0) {
+          var existing = queueItemForJob(session, jobs[i], jobs[i].payload.actorId);
+          if (existing && existing.state === "pending" && jobs[i].runAt <= now() && authorizePending(existing, session)) {
+            var released = pendingMessageQueue.releaseScheduled(session, jobs[i].id, jobs[i].payload.revision);
+            if (released && typeof consumePendingMessage === "function") setImmediate(function () { consumePendingMessage(session); });
+          }
+        }
+      }
+    });
   }
 
   function deleted(localId, session) {
@@ -310,6 +490,9 @@ function attachProjectScheduledMessages(ctx) {
     notify: notify,
     shutdown: shutdown,
     handlerType: type,
+    authorizePending: authorizePending,
+    onQueueConsumed: onQueueConsumed,
+    onQueueCancelled: onQueueCancelled,
   };
 }
 

package/lib/project-user-message.js

@@ -303,22 +303,42 @@ function attachUserMessage(ctx) {
     // --- Schedule message for after rate limit resets ---
     if (msg.type === "schedule_message") {
       var schedSession = getSessionForWs(ws);
-      if (!schedSession || !msg.text || !msg.resetsAt) return true;
-      scheduleMessage(schedSession, msg.text, msg.resetsAt, ws._clayUser || null, ws);
+      var transportAccountId = (ws && ws._clayUser && ws._clayUser.id) ? String(ws._clayUser.id) : "default";
+      if (!schedSession || msg.projectSlug !== slug || String(msg.sessionId) !== String(schedSession && schedSession.localId) ||
+          (msg.accountId || "default") !== transportAccountId) {
+        if (msg.requestId) sendTo(ws, { type: "schedule_message_result", requestId: msg.requestId,
+          projectSlug: msg.projectSlug || slug, sessionId: msg.sessionId == null ? null : msg.sessionId,
+          accountId: transportAccountId, ok: false, error: "The scheduling session or account is stale.", scheduledMessage: null });
+        return true;
+      }
+      scheduleMessage(schedSession, msg.text || "", msg.resetsAt, ws._clayUser || null, ws,
+        { images: msg.images, pastes: msg.pastes }, msg.requestId || null, transportAccountId);
       return true;
     }
 
     if (msg.type === "cancel_scheduled_message") {
       var cancelSession = getSessionForWs(ws);
       if (!cancelSession) return true;
-      cancelScheduledMessage(cancelSession, ws._clayUser || null, ws, { jobId: msg.jobId, revision: msg.revision });
+      if (msg.projectSlug && msg.projectSlug !== slug) return true;
+      if (msg.sessionId != null && String(msg.sessionId) !== String(cancelSession.localId)) return true;
+      cancelScheduledMessage(cancelSession, ws._clayUser || null, ws, { jobId: msg.jobId, revision: msg.revision, queueRevision: msg.queueRevision, requestId: msg.requestId });
       return true;
     }
 
     if (msg.type === "send_scheduled_now") {
       var nowSession = getSessionForWs(ws);
-      if (!nowSession || !nowSession.scheduledMessage) return true;
-      sendScheduledMessageNow(nowSession, ws._clayUser || null, ws, { jobId: msg.jobId, revision: msg.revision });
+      var requestedContext = { projectSlug: slug, sessionId: nowSession ? nowSession.localId : msg.sessionId, revision: pendingMessageQueue ? pendingMessageQueue.getRevision() : 0, items: [], paused: false };
+      var controlResult;
+      if (!nowSession) controlResult = Object.assign({}, requestedContext, { ok: false, error: "The session is no longer available." });
+      else if (msg.projectSlug && msg.projectSlug !== slug) controlResult = Object.assign({}, requestedContext, { ok: false, error: "Project changed" });
+      else if (msg.sessionId != null && String(msg.sessionId) !== String(nowSession.localId)) controlResult = Object.assign({}, requestedContext, { ok: false, error: "Session changed" });
+      else if (!nowSession.scheduledMessage) controlResult = Object.assign({}, requestedContext, { ok: false, error: "The scheduled message is no longer available." });
+      else {
+        var sentNow = sendScheduledMessageNow(nowSession, ws._clayUser || null, ws, { jobId: msg.jobId, revision: msg.revision, queueRevision: msg.queueRevision, requestId: msg.requestId });
+        controlResult = pendingMessageQueue ? pendingMessageQueue.hydrate(nowSession, ws._clayUser || null) : { ok: sentNow === true, projectSlug: slug, sessionId: nowSession.localId, revision: 0, items: [], paused: false };
+        if (sentNow !== true) controlResult = Object.assign({}, controlResult, { ok: false, error: "Could not send the scheduled message." });
+      }
+      if (msg.requestId) sendTo(ws, { type: "pending_message_result", requestId: msg.requestId, result: controlResult });
       return true;
     }