clay-server 4.2.0 → 4.3.0-beta.10

package/lib/project-worker-creation-proposal.js

@@ -0,0 +1,176 @@
+var crypto = require("crypto");
+var driverEligibility = require("./session-driver-eligibility");
+var multiWorkerFeature = require("./multi-worker-feature");
+var proposalControl = require("./worker-proposal-control");
+var splitRoles = require("./session-split-group-roles");
+
+function generationOf(session) {
+  return session && (session._pairGeneration ||
+    session.sessionProvenance && session.sessionProvenance.generation) || null;
+}
+
+function captureMembership(sm, driver, group) {
+  var roles = splitRoles.resolveLiveRoles(sm, group);
+  if (!roles || roles.driver !== driver || roles.role.kind === "adhoc" || !driver.sessionOriginId) return null;
+  var workers = [];
+  for (var i = 0; i < roles.workers.length; i++) {
+    if (!roles.workers[i].sessionOriginId || !Number.isInteger(generationOf(roles.workers[i]))) return null;
+    workers.push({ id: roles.workers[i].localId, originId: roles.workers[i].sessionOriginId,
+      generation: generationOf(roles.workers[i]) });
+  }
+  return { groupId: group.id, ownerId: driver.ownerId || null, driverId: driver.localId,
+    driverOriginId: driver.sessionOriginId, workerIds: roles.role.workerIds.slice(), workers: workers };
+}
+
+function matchesMembership(sm, driver, group, snapshot) {
+  if (!snapshot || !driver || !group || group.id !== snapshot.groupId || driver.localId !== snapshot.driverId ||
+      (driver.ownerId || null) !== snapshot.ownerId || driver.sessionOriginId !== snapshot.driverOriginId) return false;
+  var current = captureMembership(sm, driver, group);
+  if (!current || current.workerIds.join(",") !== snapshot.workerIds.join(",")) return false;
+  for (var i = 0; i < current.workers.length; i++) {
+    var expected = snapshot.workers[i];
+    if (!expected || current.workers[i].id !== expected.id || current.workers[i].originId !== expected.originId ||
+        current.workers[i].generation !== expected.generation) return false;
+  }
+  return true;
+}
+
+function attachWorkerCreationProposal(ctx) {
+  var sm = ctx.sm;
+  var store = ctx.splitStore;
+
+  function initialSnapshot(session) {
+    if (!ctx.canOffer(session)) return { error: "Split Worker proposals require an eligible Driver session." };
+    var group = store.groupForMember(session.localId);
+    if (!group) return { kind: "initial", driver: session };
+    if (!multiWorkerFeature.isEnabled(ctx.multiWorkerFeature)) {
+      return { error: "This Driver already has a Split Worker." };
+    }
+    var roles = splitRoles.resolveLiveRoles(sm, group);
+    if (!roles || roles.driver !== session || roles.role.kind === "adhoc") {
+      return { error: "The exact Driver/Split Worker membership is not eligible for another Worker." };
+    }
+    if (roles.workers.length >= 2) return { error: "A Driver can have at most two Split Workers." };
+    if (roles.workers.length !== 1) return { error: "The existing Split Worker membership is invalid." };
+    if (!session.sessionOriginId || !roles.workers[0].sessionOriginId || !Number.isInteger(generationOf(roles.workers[0]))) {
+      return { error: "The exact Driver and Split Worker identities are not durable enough to add another Worker." };
+    }
+    return {
+      kind: "add",
+      group: group,
+      groupId: group.id,
+      ownerId: session.ownerId || null,
+      driverId: session.localId,
+      driverOriginId: session.sessionOriginId || null,
+      workerIds: roles.role.workerIds.slice(),
+      workers: roles.workers.map(function (worker) {
+        return { id: worker.localId, originId: worker.sessionOriginId || null, generation: generationOf(worker) };
+      }),
+    };
+  }
+
+  function validateSnapshot(session, snapshot, requireSameObject) {
+    if (!snapshot || snapshot.kind === "initial") {
+      return ctx.isEligible(session) ? { ok: true, group: null } : { ok: false };
+    }
+    if (!multiWorkerFeature.isEnabled(ctx.multiWorkerFeature) || !ctx.canOffer(session) ||
+        (session.ownerId || null) !== snapshot.ownerId || session.localId !== snapshot.driverId ||
+        (session.sessionOriginId || null) !== snapshot.driverOriginId) return { ok: false };
+    var group = store.groupForMember(session.localId);
+    if (!group || group.id !== snapshot.groupId || requireSameObject && group !== snapshot.group) return { ok: false };
+    var roles = splitRoles.resolveLiveRoles(sm, group);
+    if (!roles || roles.role.kind === "adhoc" || roles.driver !== session || roles.role.workerIds.length !== 1 ||
+        roles.role.workerIds.join(",") !== snapshot.workerIds.join(",")) return { ok: false };
+    for (var i = 0; i < snapshot.workers.length; i++) {
+      var expected = snapshot.workers[i];
+      var worker = sm.sessions.get(expected.id);
+      if (!worker || roles.workers.indexOf(worker) === -1 ||
+          (worker.ownerId || null) !== snapshot.ownerId ||
+          (worker.sessionOriginId || null) !== expected.originId || generationOf(worker) !== expected.generation) {
+        return { ok: false };
+      }
+    }
+    return { ok: true, group: group, roles: roles };
+  }
+
+  function snapshotFromProposal(proposal) {
+    if (!proposal || proposal.action !== "add") return { kind: "initial" };
+    return {
+      kind: "add",
+      groupId: proposal.sourceGroupId,
+      ownerId: proposal.sourceOwnerId || null,
+      driverId: proposal.sourceDriverId,
+      driverOriginId: proposal.sourceDriverOriginId || null,
+      workerIds: Array.isArray(proposal.sourceWorkerIds) ? proposal.sourceWorkerIds.slice() : [],
+      workers: Array.isArray(proposal.sourceWorkers) ? proposal.sourceWorkers.slice() : [],
+    };
+  }
+
+  async function propose(args, session) {
+    var snapshot = initialSnapshot(session);
+    if (snapshot.error) return ctx.toolResult({ error: snapshot.error });
+    var superseded = proposalControl.pendingProposal(session);
+    var supersedeId = typeof args.supersedeProposalId === "string" ? args.supersedeProposalId.trim() : "";
+    if (superseded && superseded.proposalId !== supersedeId) return ctx.toolResult({ error: "A Split Worker suggestion is already awaiting a decision. Inspect it or supply its exact id to supersede it." });
+    if (!superseded && supersedeId) return ctx.toolResult({ error: "The Split Worker suggestion to supersede is no longer pending." });
+    if (superseded && superseded.status !== "pending") return ctx.toolResult({ error: "The Split Worker suggestion is already starting and cannot be superseded." });
+    var summary = typeof args.summary === "string" ? args.summary.trim() : "";
+    var plan = typeof args.plan === "string" ? args.plan.trim() : "";
+    var task = typeof args.message === "string" ? args.message.trim() : "";
+    var rationale = typeof args.recommendationRationale === "string" ? args.recommendationRationale.trim() : "";
+    if (!summary || !plan || !task || !rationale) return ctx.toolResult({ error: "summary, plan, message, and recommendationRationale are required." });
+    if (task.length > ctx.maxTaskChars) return ctx.toolResult({ error: "The Split Worker task is too long." });
+    await ctx.ensureModelCatalogs();
+    if (!validateSnapshot(session, snapshot, true).ok) {
+      return ctx.toolResult({ error: "The Driver/Split Worker membership changed while runtimes were loading." });
+    }
+    if (proposalControl.pendingProposal(session) !== superseded) return ctx.toolResult({ error: "The pending Split Worker suggestion changed while runtimes were loading." });
+    var options = ctx.proposalOptions();
+    if (options.installedVendors.length === 0) return ctx.toolResult({ error: "No coding agent is installed for a Split Worker session." });
+    var recommendation = ctx.chooseRecommendation(args, session, options);
+    var proposal = {
+      type: "worker_proposal", proposalId: "worker_" + crypto.randomUUID(),
+      summary: summary.slice(0, ctx.maxSummaryChars), plan: plan.slice(0, ctx.maxPlanChars), message: task,
+      status: "pending", createdAt: Date.now(), recommendedVendor: recommendation.vendor,
+      recommendedModel: recommendation.model, recommendedEffort: recommendation.effort,
+      recommendationRationale: rationale.slice(0, ctx.maxRationaleChars), options: options,
+    };
+    if (snapshot.kind === "add") Object.assign(proposal, {
+      action: "add", sourceGroupId: snapshot.groupId, sourceOwnerId: snapshot.ownerId,
+      sourceDriverId: snapshot.driverId, sourceDriverOriginId: snapshot.driverOriginId,
+      sourceWorkerIds: snapshot.workerIds.slice(), sourceWorkers: snapshot.workers.slice(),
+    });
+    if (superseded) ctx.updateProposal(session, superseded, { status: "superseded", supersededBy: proposal.proposalId });
+    sm.sendAndRecord(session, proposal);
+    if (ctx.skipPermissionsEnabled(session) && ctx.recommendationCanAutoAccept(args, recommendation, options)) {
+      var accepted = await ctx.acceptProposal(session, proposal, {
+        vendor: recommendation.vendor, model: recommendation.model, effort: recommendation.effort,
+      }, ctx.autoAcceptanceWs(session), true);
+      return ctx.toolResult({ status: accepted.ok ? "auto_accepted" : "posted", proposalId: proposal.proposalId,
+        instruction: accepted.ok ? "The recorded Split Worker configuration was auto-accepted. End this turn while the exact Worker runs." :
+          "The automatic decision failed closed. The configuration card remains pending for the user." });
+    }
+    return ctx.toolResult({ status: "posted", proposalId: proposal.proposalId,
+      instruction: "The Split Worker suggestion is visible in the chat. End this turn now and wait for the user's decision." });
+  }
+
+  function canMountProposal(session) {
+    if (!ctx.canOffer(session)) return false;
+    var group = store.groupForMember(session.localId);
+    if (!group) return true;
+    if (!multiWorkerFeature.isEnabled(ctx.multiWorkerFeature)) return false;
+    var roles = splitRoles.resolveLiveRoles(sm, group);
+    return !!roles && roles.role.kind !== "adhoc" && roles.driver === session;
+  }
+
+  return {
+    propose: propose,
+    canMountProposal: canMountProposal,
+    validateAcceptance: function (session, proposal) {
+      return validateSnapshot(session, snapshotFromProposal(proposal), false);
+    },
+  };
+}
+
+module.exports = { attachWorkerCreationProposal: attachWorkerCreationProposal,
+  captureMembership: captureMembership, matchesMembership: matchesMembership };

package/lib/project-worker-permission.js

@@ -43,6 +43,7 @@
 // same user. Anything else is refused and the request stays pending.
 
 var crypto = require("crypto");
+var splitRoles = require("./session-split-group-roles");
 
 // Tools that collect input from the person rather than authorize an action.
 // These are not permission approvals, so they are never routed to a Driver;
@@ -104,20 +105,18 @@ function attachWorkerPermission(ctx) {
     if (sm.sessions.get(session.localId) !== session) return null;
     var group = store.groupForMember(session.localId);
     if (!group || !group.pair) return null;
-    if (group.pair.workerId !== session.localId) return null;
-    var driver = sm.sessions.get(group.pair.driverId);
-    if (!driver) return null;
-    if ((driver.ownerId || null) !== (session.ownerId || null)) return null;
-    if (driver.destroying) return null;
-    return { group: group, driver: driver };
+    var roles = splitRoles.resolveLiveRoles(sm, group);
+    if (!roles || roles.workers.indexOf(session) === -1) return null;
+    return { group: group, driver: roles.driver };
   }
 
   // Is the record's pair still exactly the pair it was created for?
   function pairStillExact(record) {
     var group = store ? store.groupForMember(record.workerId) : null;
     if (!group || group.id !== record.groupId || !group.pair) return false;
-    if (group.pair.driverId !== record.driverId) return false;
-    if (group.pair.workerId !== record.workerId) return false;
+    var roles = splitRoles.resolveLiveRoles(sm, group);
+    if (!roles || roles.driver.localId !== record.driverId) return false;
+    if (roles.workers.indexOf(record.workerRef) === -1 || record.workerRef.localId !== record.workerId) return false;
     var driver = sm.sessions.get(record.driverId);
     var worker = sm.sessions.get(record.workerId);
     if (!driver || !worker || driver.destroying || worker.destroying) return false;

package/lib/project-worker-proposal-runner.js

@@ -0,0 +1,45 @@
+function attachProposalRunner(ctx) {
+  function resumeDriver(session, text) {
+    var sdk = ctx.getSdk();
+    if (!sdk) return Promise.reject(new Error("SDK bridge is not ready"));
+    ctx.sm.sendAndRecord(session, { type: "user_message", text: text, _internal: true });
+    session.sentToolResults = {};
+    if (!session.isProcessing) {
+      session.isProcessing = true;
+      ctx.onProcessingChanged();
+      ctx.sm.sendToSession(session, { type: "status", status: "processing" });
+    }
+    if (sdk.pushMessage(session, text)) return Promise.resolve();
+    return Promise.resolve(sdk.startQuery(session, text, undefined, ctx.getLinuxUserForSession(session)));
+  }
+
+  function parseResult(result) {
+    if (!result || result.isError || !result.content || !result.content[0]) {
+      return { status: "error", error: "Split Worker execution failed." };
+    }
+    try { return JSON.parse(result.content[0].text); }
+    catch (error) { return { status: "error", error: result.content[0].text || "Split Worker execution failed." }; }
+  }
+
+  async function runWorker(session, proposal) {
+    var result = parseResult(await ctx.sendToPartner({ message: proposal.message, wait: true,
+      timeoutSeconds: 900, workerId: proposal.workerId }, session));
+    ctx.updateProposal(session, proposal, { status: result.status === "complete" ? "completed" : result.status || "error",
+      resultPreview: result.response ? result.response.slice(0, 1200) : "", error: result.error || null });
+    var followup;
+    if (result.status === "complete") {
+      followup = "[Split Worker execution completed]\nReview and verify the Split Worker's result. The Split Worker session remains available: if the implementation needs corrections or additional edits, send a follow-up with send_to_partner instead of taking over the Split Worker-owned files yourself. If that Split Worker is no longer available, keep the work in the visible Split Worker flow and use send_to_partner again after the stale pair is removed; never substitute a background Sub-agent.\n\n" + (result.response || "The Split Worker completed without a text summary.");
+    } else if (result.status === "interrupted") {
+      followup = "[Split Worker execution interrupted]\nThe Split Worker stopped mid-turn. Its work is PARTIAL and unverified — do not treat it as finished. Check partner_status before deciding next steps; this result alone does not identify who interrupted it. If the human stopped it, do not retry until a new human Driver message. Otherwise continue within the user's authorized task.";
+    } else if (result.status === "running") {
+      followup = "[Split Worker execution is still running]\nUse read_partner to inspect progress before completing the task.";
+    } else {
+      followup = "[Split Worker execution failed]\nThe existing Split Worker may still be reusable. Inspect partner_status and send a narrower follow-up with send_to_partner when the Worker and pair still exist; do not replace it merely because its task or transport failed. Retry replacement only when the replacement transaction reports that no new Worker was created and the failure is explicitly safe to retry.\n\n" + (result.error || result.response || "Unknown Split Worker error.");
+    }
+    await resumeDriver(session, followup);
+  }
+
+  return { resumeDriver: resumeDriver, runWorker: runWorker };
+}
+
+module.exports = { attachProposalRunner: attachProposalRunner };

package/lib/project-worker-proposal.js

@@ -3,8 +3,12 @@ var yoke = require("./yoke");
 var buildShape = require("./session-spawn-mcp-server").buildShape;
 var driverEligibility = require("./session-driver-eligibility");
 var driverOrchestration = require("./session-driver-orchestration");
+var pairTarget = require("./session-pair-target");
+var splitRoles = require("./session-split-group-roles");
 var proposalControl = require("./worker-proposal-control");
 var runtimeCatalog = require("./worker-runtime-catalog");
+var proposalRunner = require("./project-worker-proposal-runner");
+var creationProposalModule = require("./project-worker-creation-proposal");
 var MAX_SUMMARY_CHARS = 600, MAX_PLAN_CHARS = 6000, MAX_TASK_CHARS = 30000, MAX_RATIONALE_CHARS = 1000;
 var EVALUATION_OUTCOMES = ["succeeded", "partial", "failed", "abandoned"];
 function normalizeEvaluation(raw) {
@@ -161,66 +165,18 @@ function attachWorkerProposal(ctx) {
       proposalId: proposal.proposalId,
     }, patch));
   }
-  async function propose(args, session) {
-    if (!isEligible(session)) return toolResult({ error: "Split Worker proposals are only available in an eligible unpaired Driver session." });
-    var superseded = proposalControl.pendingProposal(session);
-    var supersedeId = typeof args.supersedeProposalId === "string" ? args.supersedeProposalId.trim() : "";
-    if (superseded && superseded.proposalId !== supersedeId) return toolResult({ error: "A Split Worker suggestion is already awaiting a decision. Inspect it or supply its exact id to supersede it." });
-    if (!superseded && supersedeId) return toolResult({ error: "The Split Worker suggestion to supersede is no longer pending." });
-    if (superseded && superseded.status !== "pending") return toolResult({ error: "The Split Worker suggestion is already starting and cannot be superseded." });
-    var summary = typeof args.summary === "string" ? args.summary.trim() : "";
-    var plan = typeof args.plan === "string" ? args.plan.trim() : "";
-    var task = typeof args.message === "string" ? args.message.trim() : "";
-    var rationale = typeof args.recommendationRationale === "string" ? args.recommendationRationale.trim() : "";
-    if (!summary || !plan || !task || !rationale) {
-      return toolResult({ error: "summary, plan, message, and recommendationRationale are required." });
-    }
-    if (task.length > MAX_TASK_CHARS) return toolResult({ error: "The Split Worker task is too long." });
-    await ensureModelCatalogs();
-    if (!isEligible(session)) {
-      return toolResult({ error: "The Driver session changed while Split Worker runtimes were loading." });
-    }
-    var currentPending = proposalControl.pendingProposal(session);
-    if (currentPending !== superseded) return toolResult({ error: "The pending Split Worker suggestion changed while runtimes were loading." });
-    var options = proposalOptions();
-    if (options.installedVendors.length === 0) return toolResult({ error: "No coding agent is installed for a Split Worker session." });
-    var recommendation = chooseRecommendation(args, session, options);
-    var proposal = {
-      type: "worker_proposal",
-      proposalId: "worker_" + crypto.randomUUID(),
-      summary: summary.slice(0, MAX_SUMMARY_CHARS),
-      plan: plan.slice(0, MAX_PLAN_CHARS),
-      message: task,
-      status: "pending",
-      createdAt: Date.now(),
-      recommendedVendor: recommendation.vendor,
-      recommendedModel: recommendation.model,
-      recommendedEffort: recommendation.effort,
-      recommendationRationale: rationale.slice(0, MAX_RATIONALE_CHARS),
-      options: options,
-    };
-    if (superseded) updateProposal(session, superseded, { status: "superseded", supersededBy: proposal.proposalId });
-    sm.sendAndRecord(session, proposal);
-    if (skipPermissionsEnabled(session) && recommendationCanAutoAccept(args, recommendation, options)) {
-      var accepted = await acceptProposal(session, proposal, {
-        vendor: recommendation.vendor,
-        model: recommendation.model,
-        effort: recommendation.effort,
-      }, autoAcceptanceWs(session), true);
-      return toolResult({
-        status: accepted.ok ? "auto_accepted" : "posted",
-        proposalId: proposal.proposalId,
-        instruction: accepted.ok
-          ? "The recorded Split Worker configuration was auto-accepted under the Driver session's full-access mode. End this turn now while the exact paired Worker runs."
-          : "The automatic decision failed closed. The configuration card remains pending for the user; end this turn and wait for their decision.",
-      });
-    }
-    return toolResult({
-      status: "posted",
-      proposalId: proposal.proposalId,
-      instruction: "The Split Worker suggestion is visible in the chat. End this turn now and wait for the user's decision.",
-    });
-  }
+  var runner = proposalRunner.attachProposalRunner(Object.assign({}, ctx, { updateProposal: updateProposal }));
+  var resumeDriver = runner.resumeDriver;
+  var runWorker = runner.runWorker;
+  var creationProposal = creationProposalModule.attachWorkerCreationProposal({
+    sm: sm, splitStore: store, multiWorkerFeature: ctx.multiWorkerFeature,
+    canOffer: canOffer, isEligible: isEligible, ensureModelCatalogs: ensureModelCatalogs,
+    proposalOptions: proposalOptions, chooseRecommendation: chooseRecommendation,
+    skipPermissionsEnabled: skipPermissionsEnabled, recommendationCanAutoAccept: recommendationCanAutoAccept,
+    autoAcceptanceWs: autoAcceptanceWs, acceptProposal: acceptProposal, updateProposal: updateProposal,
+    toolResult: toolResult, maxSummaryChars: MAX_SUMMARY_CHARS, maxPlanChars: MAX_PLAN_CHARS,
+    maxTaskChars: MAX_TASK_CHARS, maxRationaleChars: MAX_RATIONALE_CHARS,
+  });
   async function proposeReplacement(args, session) {
     var group = session && store.groupForMember(session.localId);
     if (ctx.isMate || !isLiveSession(session) || !driverEligibility.isEligibleDriverSession(session, sm) || !group ||
@@ -228,7 +184,17 @@ function attachWorkerProposal(ctx) {
       return toolResult({ error: "Split Worker replacement proposals require the exact paired Driver session." });
     }
     var sourceGroupId = group.id;
-    var sourceWorkerId = group.pair.workerId;
+    var addressed;
+    try { addressed = pairTarget.resolveGroupTarget(sm, group, session, args, {
+      mutation: true, multiWorkerFeature: ctx.multiWorkerFeature,
+    }); }
+    catch (e) { return toolResult({ error: e.message || String(e) }); }
+    var sourceWorkerId = addressed.workerId;
+    var sourceWorkerOriginId = addressed.partner.sessionOriginId || null;
+    var sourceGeneration = addressed.partner._pairGeneration ||
+      addressed.partner.sessionProvenance && addressed.partner.sessionProvenance.generation || null;
+    var sourceMembership = creationProposalModule.captureMembership(sm, session, group);
+    if (!sourceMembership) return toolResult({ error: "The exact Driver/Split Worker identities are not durable enough to replace a Worker." });
     var superseded = proposalControl.pendingProposal(session);
     var supersedeId = typeof args.supersedeProposalId === "string" ? args.supersedeProposalId.trim() : "";
     if (superseded && superseded.proposalId !== supersedeId) return toolResult({ error: "A Split Worker proposal is already awaiting a decision. Inspect it or supply its exact id to supersede it." });
@@ -245,9 +211,17 @@ function attachWorkerProposal(ctx) {
     var liveGroup = store.groupForMember(session.localId);
     if (!isLiveSession(session) || !driverEligibility.isEligibleDriverSession(session, sm) ||
         !liveGroup || liveGroup.id !== sourceGroupId || !liveGroup.pair ||
-        liveGroup.pair.driverId !== session.localId || liveGroup.pair.workerId !== sourceWorkerId) {
+        liveGroup.pair.driverId !== session.localId || liveGroup.members.indexOf(sourceWorkerId) === -1 ||
+        sm.sessions.get(sourceWorkerId) !== addressed.partner ||
+        (addressed.partner.sessionOriginId || null) !== sourceWorkerOriginId ||
+        (addressed.partner._pairGeneration || addressed.partner.sessionProvenance && addressed.partner.sessionProvenance.generation || null) !== sourceGeneration ||
+        !creationProposalModule.matchesMembership(sm, session, liveGroup, sourceMembership)) {
       return toolResult({ error: "The Driver/Split Worker pair changed while replacement runtimes were loading." });
     }
+    try { pairTarget.resolveGroupTarget(sm, liveGroup, session, args, {
+      mutation: true, multiWorkerFeature: ctx.multiWorkerFeature,
+    }); }
+    catch (e) { return toolResult({ error: e.message || String(e) }); }
     var currentPending = proposalControl.pendingProposal(session);
     if (currentPending !== superseded) return toolResult({ error: "The pending Split Worker proposal changed while runtimes were loading." });
     var options = proposalOptions();
@@ -274,6 +248,10 @@ function attachWorkerProposal(ctx) {
       options: options,
       sourceGroupId: sourceGroupId,
       sourceWorkerId: sourceWorkerId,
+      sourceWorkerOriginId: sourceWorkerOriginId,
+      sourceGeneration: sourceGeneration,
+      sourceMembership: sourceMembership,
+      workerId: sourceWorkerId,
       interrupt: args.interrupt === true,
       evaluation: normalizedEvaluation ? normalizedEvaluation.value : null,
       transactionId: "replace_" + crypto.randomUUID(),
@@ -300,50 +278,6 @@ function attachWorkerProposal(ctx) {
       instruction: "The replacement configuration is visible in the chat. End this turn now and wait for the user's decision.",
     });
   }
-  function resumeDriver(session, text) {
-    var sdk = ctx.getSdk();
-    if (!sdk) return Promise.reject(new Error("SDK bridge is not ready"));
-    var message = { type: "user_message", text: text, _internal: true };
-    sm.sendAndRecord(session, message);
-    session.sentToolResults = {};
-    if (!session.isProcessing) {
-      session.isProcessing = true;
-      ctx.onProcessingChanged();
-      sm.sendToSession(session, { type: "status", status: "processing" });
-    }
-    if (sdk.pushMessage(session, text)) return Promise.resolve();
-    return Promise.resolve(sdk.startQuery(session, text, undefined, ctx.getLinuxUserForSession(session)));
-  }
-
-  function parsePartnerResult(result) {
-    if (!result || result.isError || !result.content || !result.content[0]) {
-      return { status: "error", error: "Split Worker execution failed." };
-    }
-    try { return JSON.parse(result.content[0].text); }
-    catch (e) { return { status: "error", error: result.content[0].text || "Split Worker execution failed." }; }
-  }
-
-  async function runWorker(session, proposal) {
-    var result = parsePartnerResult(await ctx.sendToPartner({ message: proposal.message, wait: true, timeoutSeconds: 900 }, session));
-    var status = result.status === "complete" ? "completed" : result.status;
-    updateProposal(session, proposal, {
-      status: status || "error",
-      resultPreview: result.response ? result.response.slice(0, 1200) : "",
-      error: result.error || null,
-    });
-    var followup;
-    if (result.status === "complete") {
-      followup = "[Split Worker execution completed]\nReview and verify the Split Worker's result. The Split Worker session remains available: if the implementation needs corrections or additional edits, send a follow-up with send_to_partner instead of taking over the Split Worker-owned files yourself. If that Split Worker is no longer available, keep the work in the visible Split Worker flow and use send_to_partner again after the stale pair is removed; never substitute a background Sub-agent.\n\n" + (result.response || "The Split Worker completed without a text summary.");
-    } else if (result.status === "interrupted") {
-      followup = "[Split Worker execution interrupted]\nThe Split Worker stopped mid-turn. Its work is PARTIAL and unverified — do not treat it as finished. Check partner_status before deciding next steps; this result alone does not identify who interrupted it. If the human stopped it, do not retry until a new human Driver message. Otherwise continue within the user's authorized task.";
-    } else if (result.status === "running") {
-      followup = "[Split Worker execution is still running]\nUse read_partner to inspect progress before completing the task.";
-    } else {
-      followup = "[Split Worker execution failed]\nInspect the failure and delegate a narrower follow-up to the Split Worker when implementation work remains.\n\n" + (result.error || result.response || "Unknown Split Worker error.");
-    }
-    await resumeDriver(session, followup);
-  }
-
   function sessionForResponse(ws) {
     var session = sm.sessions.get(ws._clayActiveSession);
     if (!session) throw new Error("active Driver session not found");
@@ -356,19 +290,28 @@ function attachWorkerProposal(ctx) {
 
   async function acceptProposal(session, proposal, msg, ws, trustedAutoAcceptance) {
     if (!isLiveSession(session)) throw new Error("The Driver session is no longer live");
-    if (proposal.action !== "replace" && !isEligible(session)) {
+    if (!proposal.action && !isEligible(session)) {
       throw new Error("The Driver is no longer eligible to create this Split Worker");
     }
     var approvedGroup = null;
-    if (proposal.action === "replace") {
+    if (proposal.action === "add") {
+      var addition = creationProposal.validateAcceptance(session, proposal);
+      if (!addition.ok) throw new Error("The Driver/Split Worker membership changed before the addition was approved");
+      approvedGroup = addition.group;
+    } else if (proposal.action === "replace") {
       approvedGroup = store.groupForMember(session.localId);
+      var approvedRoles = splitRoles.normalizePair(approvedGroup && approvedGroup.pair, approvedGroup && approvedGroup.members);
+      var approvedWorker = sm.sessions.get(proposal.sourceWorkerId);
       if (!driverEligibility.isEligibleDriverSession(session, sm) || !approvedGroup ||
-          approvedGroup.id !== proposal.sourceGroupId || !approvedGroup.pair ||
-          approvedGroup.pair.driverId !== session.localId || approvedGroup.pair.workerId !== proposal.sourceWorkerId) {
+          approvedGroup.id !== proposal.sourceGroupId || !approvedRoles.ok || approvedRoles.kind === "adhoc" ||
+          approvedRoles.driverId !== session.localId || approvedRoles.workerIds.indexOf(proposal.sourceWorkerId) === -1 ||
+          !approvedWorker || (approvedWorker.sessionOriginId || null) !== (proposal.sourceWorkerOriginId || null) ||
+          (approvedWorker._pairGeneration || approvedWorker.sessionProvenance && approvedWorker.sessionProvenance.generation || null) !== proposal.sourceGeneration ||
+          !creationProposalModule.matchesMembership(sm, session, approvedGroup, proposal.sourceMembership)) {
         throw new Error("The Driver/Split Worker pair changed before the replacement was approved");
       }
     }
-    var options = proposalOptions();
+    var options = proposal.options || proposalOptions();
     var vendor = msg.vendor || proposal.recommendedVendor;
     var model = msg.model || "";
     if (options.installedVendors.indexOf(vendor) === -1) throw new Error("Selected Split Worker vendor is not installed");
@@ -390,6 +333,19 @@ function attachWorkerProposal(ctx) {
     };
     updateProposal(session, proposal, startingPatch);
     try {
+      if (proposal.action === "add") {
+        var added = ctx.addWorkerForDriver(session, {
+          workerVendor: vendor, workerModel: model, workerEffort: effort,
+          expectedGroup: approvedGroup, expectedWorkerIds: proposal.sourceWorkerIds,
+        });
+        ctx.recordGenerationStart(session, added.worker);
+        updateProposal(session, proposal, { status: "running", groupId: added.group.id, workerId: added.worker.localId });
+        runWorker(session, proposal).catch(function (err) {
+          updateProposal(session, proposal, { status: "error", error: err.message || String(err) });
+          resumeDriver(session, "[Split Worker execution failed]\n" + (err.message || String(err))).catch(function () {});
+        });
+        return { ok: true, status: "running", group: added.group, addition: added };
+      }
       if (proposal.action === "replace") {
         var liveGroup = approvedGroup;
         var replaced = await ctx.replacePartner({
@@ -399,6 +355,7 @@ function attachWorkerProposal(ctx) {
           workerEffort: effort,
           evaluation: proposal.evaluation || undefined,
           transactionId: proposal.transactionId,
+          workerId: proposal.workerId,
         }, session);
         liveGroup = store.groupForMember(session.localId);
         updateProposal(session, proposal, { status: "running", groupId: liveGroup.id, workerId: replaced.workerSessionId });
@@ -423,9 +380,11 @@ function attachWorkerProposal(ctx) {
     } catch (err) {
       if (proposal.action === "replace") {
         var restoredGroup = store.groupForMember(session.localId);
-        if (restoredGroup && restoredGroup.pair && restoredGroup.pair.driverId === session.localId &&
-            restoredGroup.pair.workerId === proposal.sourceWorkerId) {
+        var restoredRoles = splitRoles.normalizePair(restoredGroup && restoredGroup.pair, restoredGroup && restoredGroup.members);
+        if (restoredGroup && restoredRoles.ok && restoredRoles.kind !== "adhoc" &&
+            restoredRoles.driverId === session.localId && restoredRoles.workerIds.indexOf(proposal.sourceWorkerId) !== -1) {
           proposal.sourceGroupId = restoredGroup.id;
+          proposal.sourceMembership = creationProposalModule.captureMembership(sm, session, restoredGroup);
         }
         proposal.transactionId = "replace_" + crypto.randomUUID();
       }
@@ -449,6 +408,8 @@ function attachWorkerProposal(ctx) {
       updateProposal(session, proposal, { status: "declined" });
       var declinedText = proposal.action === "replace"
         ? "[Split Worker replacement declined]\nContinue with the existing Split Worker and the current task."
+        : proposal.action === "add"
+          ? "[Additional Split Worker declined]\nContinue with the existing Split Worker and current plan."
         : "[Split Worker proposal declined]\nContinue this task in the current Driver session using the plan you already prepared.";
       await resumeDriver(session, declinedText);
       return { ok: true, status: "declined" };
@@ -468,7 +429,7 @@ function attachWorkerProposal(ctx) {
     var persistent = !!(options && options.persistent);
     var controlsOnly = !!(options && options.controlsOnly);
     if (!isEligible(session) && !(persistent && canOffer(session))) return [];
-    var proposalTools = controlsOnly ? [] : [{
+    var proposalTools = controlsOnly && !creationProposal.canMountProposal(session) ? [] : [{
       name: "propose_worker",
       description: "Propose a visible Split Worker for implementation-heavy execution. This non-mutating tool only shows the user a card where they choose vendor, model, and effort. It never creates a session or delegates work until the user accepts.",
       inputSchema: buildShape({
@@ -481,7 +442,7 @@ function attachWorkerProposal(ctx) {
         recommendationRationale: { type: "string", description: "Concise Driver-authored explanation of why the recommended vendor, model, and effort fit this exact task." },
         supersedeProposalId: { type: "string", description: "Exact pending proposal id to resolve as superseded when posting this replacement suggestion." },
       }, ["summary", "plan", "message", "recommendationRationale"]),
-      handler: function (args) { return propose(args || {}, session); },
+      handler: function (args) { return creationProposal.propose(args || {}, session); },
     }];
     return proposalTools.concat(proposalControl.getToolDefs({
       inspect: function () { return toolResult(isLiveSession(session) ? proposalControl.projection(proposalControl.pendingProposal(session)) : { status: "rejected", reason: "The Driver session is no longer live." }); },
@@ -501,6 +462,9 @@ function attachWorkerProposal(ctx) {
   }
 
   function getSystemPrompt(session) {
+    if (creationProposal.canMountProposal(session) && !isEligible(session)) {
+      return "This Driver may configure one additional Split Worker through propose_worker. With two Workers, pass workerId to every targeted partner, queue, interrupt, replacement, close, permission, and status operation. Give each Worker independent file ownership and bounded work. Do not assign simultaneous overlapping file edits unless the work is explicitly separated, such as by distinct paths or worktrees.";
+    }
     if (!isEligible(session) || !driverOrchestration.isHighTierDriverSession(session, sm)) return "";
     return "For implementation-heavy work, use propose_worker before substantial execution. Work is implementation-heavy when it spans multiple modules, crosses client/server/data boundaries, requires a migration, or contains independent investigation and execution. Do not skip delegation merely because you can implement it yourself; preserve the Driver for decomposition, runtime selection, judgment, review, and integration. The user's explicit request to work directly takes precedence, and work that must remain sequential in this session stays here. Recommend an exact available vendor, model, and effort, and give a concise recommendationRationale explaining why all three fit the task. Clay always records and shows the runtime configuration card. In full-access mode Clay may auto-accept that exact validated recommendation; otherwise it waits for the user's explicit choice. After posting, end the turn. If accepted, Clay creates the exact Driver/Split Worker pair and delegates the proposed task once. If declined, continue in this Driver session. Do not call send_to_partner while unpaired.";
   }