clay-server 4.3.0-beta.1 → 4.3.0-beta.2

package/lib/project-connection.js

@@ -273,7 +273,7 @@ function attachConnection(ctx) {
       }
       var _vendorCaps = (sm.capabilitiesByVendor && sm.capabilitiesByVendor[active.vendor || sm.defaultVendor || "claude"]) || {};
       var activePermissionState = permissionModes.clientState(active, sm.currentPermissionMode, sm.defaultVendor);
-      sendTo(ws, { type: "session_switched", id: active.localId, cliSessionId: active.cliSessionId || null, loop: active.loop || null, vendor: active.vendor || null, model: active.model || null, effort: active.effort || initialEffort || null, hasHistory: (active.history && active.history.length > 0), capabilities: _vendorCaps, mode: active.mode || "gui", terminalId: typeof active.terminalId === "number" ? active.terminalId : null, runtimeMode: active.runtimeMode || null, runtimeTerminalId: typeof active.runtimeTerminalId === "number" ? active.runtimeTerminalId : null, tuiSuspended: !!active.tuiSuspended, permissionMode: activePermissionState.requestedPermissionMode, effectivePermissionMode: activePermissionState.effectivePermissionMode, permissionCapabilities: activePermissionState.permissionCapabilities, mcpPermissionModeOverrides: activePermissionState.mcpPermissionModeOverrides });
+      sendTo(ws, { type: "session_switched", id: active.localId, sessionOriginId: active.sessionOriginId || null, cliSessionId: active.cliSessionId || null, loop: active.loop || null, vendor: active.vendor || null, model: active.model || null, effort: active.effort || initialEffort || null, hasHistory: (active.history && active.history.length > 0), capabilities: _vendorCaps, mode: active.mode || "gui", terminalId: typeof active.terminalId === "number" ? active.terminalId : null, runtimeMode: active.runtimeMode || null, runtimeTerminalId: typeof active.runtimeTerminalId === "number" ? active.runtimeTerminalId : null, tuiSuspended: !!active.tuiSuspended, permissionMode: activePermissionState.requestedPermissionMode, effectivePermissionMode: activePermissionState.effectivePermissionMode, permissionCapabilities: activePermissionState.permissionCapabilities, mcpPermissionModeOverrides: activePermissionState.mcpPermissionModeOverrides });
       if (ctx.autonomousRun) sendTo(ws, { type: "autonomous_run_state", sessionId: active.localId, run: ctx.autonomousRun.project(active.autonomousRun) });
       // Send per-session context sources
       var sessionSources = loadContextSources(slug, active.localId);

package/lib/project-message-delivery.js

@@ -15,6 +15,25 @@ function deliveryKey(ownerId, clientMessageId) {
   return ownerId + ":" + clientMessageId;
 }
 
+function validateContext(ws, session, msg, projectSlug) {
+  if (!msg || !msg.clientMessageId) return { ok: true };
+  if (msg.projectSlug == null && msg.sessionId == null && msg.accountId == null && msg.cliSessionId == null && msg.sessionOriginId == null) return { ok: true };
+  var expectedCliSessionId = session && session.cliSessionId ? String(session.cliSessionId) : null;
+  var actualCliSessionId = msg.cliSessionId ? String(msg.cliSessionId) : null;
+  var expectedSessionId = session && session.localId != null ? String(session.localId) : null;
+  var expectedOriginId = session && session.sessionOriginId ? String(session.sessionOriginId) : null;
+  var actualOriginId = msg.sessionOriginId ? String(msg.sessionOriginId) : null;
+  if (msg.projectSlug !== projectSlug) return { ok: false, reason: "Project changed" };
+  if (msg.accountId !== ownerKey(ws)) return { ok: false, reason: "Account changed" };
+  if (expectedOriginId || actualOriginId) {
+    if (!expectedOriginId || actualOriginId !== expectedOriginId) return { ok: false, reason: "Session identity changed" };
+  } else {
+    if (msg.sessionId == null || String(msg.sessionId) !== expectedSessionId) return { ok: false, reason: "Session changed" };
+    if (actualCliSessionId && expectedCliSessionId && actualCliSessionId !== expectedCliSessionId) return { ok: false, reason: "Session identity changed" };
+  }
+  return { ok: true };
+}
+
 function ensureRecordedMessages(session) {
   if (session._recordedClientMessages) return session._recordedClientMessages;
   var recorded = new Map();
@@ -60,6 +79,7 @@ function createProjectMessageDelivery(sendTo, projectSlug) {
   }
 
   return {
+    validateContext: function (ws, session, msg) { return validateContext(ws, session, msg, projectSlug); },
     inspect: inspect,
     markRecorded: markRecorded,
     acknowledge: acknowledge,

package/lib/project-user-message.js

@@ -399,6 +399,13 @@ function attachUserMessage(ctx) {
       if (pendingInternal && typeof pendingInternal.complete === "function") pendingInternal.complete(outcome, reason);
     }
 
+    var deliveryContext = messageDelivery.validateContext(ws, session, msg);
+    if (!deliveryContext.ok) {
+      sendTo(ws, { type: "error", text: deliveryContext.reason || "Message context changed." });
+      finishPendingEarly(false, deliveryContext.reason || "Message context changed");
+      return true;
+    }
+
     if (session.loopInterviewHandoff && session.loopInterviewHandoff.state === "starting") {
       sendTo(ws, { type: "error", text: "Wait for the approved Loop handoff to finish." });
       finishPendingEarly("release", "Loop handoff is still starting");

package/lib/public/modules/app-connection.js

@@ -22,10 +22,8 @@ import { beginDefaultVendorConnection, requestDefaultVendor } from './default-ve
 import { clearProjectSplitState } from './split-session-boundary.js';
 import { clearPermissionModePending } from './permission-control.js';
 import { clearMcpPermissionModePending } from './mcp-ui.js';
+import { createWebSocketLifecycle } from './websocket-lifecycle.js';
 
-var reconnectTimer = null;
-var reconnectDelay = 1000;
-var connectTimeoutId = null;
 var connectOverlay = null;
 var hasConnectedOnce = false;
 
@@ -46,7 +44,22 @@ var overlayGraceTimer = null;
 var HEARTBEAT_MS = 25000;
 var heartbeatTimer = null;
 var heartbeatDeadlineTimer = null;
+var heartbeatAwaitingSocket = null;
 var disconnectedAt = 0;
+var attemptStartedAt = 0;
+var attemptSocket = null;
+var probeTimer = null;
+var probeSocket = null;
+var probeEpoch = 0;
+var probeStartedAt = 0;
+var lifecycle = createWebSocketLifecycle({
+  handshakeTimeoutMs: 12000,
+  onHandshakeTimeout: function (epoch) {
+    if (lifecycle.current(epoch) && attemptSocket) {
+      forceReplaceSocket("handshake_timeout", 0, epoch);
+    }
+  }
+});
 
 function clearOverlayGrace() {
   if (overlayGraceTimer) {
@@ -64,6 +77,45 @@ function showOverlayNow() {
   connectOverlay.classList.remove("hidden");
 }
 
+function recordConnectionDiagnostic(reason, code, latency) {
+  var safeReasons = { close: true, error: true, handshake_timeout: true, heartbeat_timeout: true, heartbeat_error: true, probe_error: true, probe_timeout: true, auth_timeout: true, "ack-timeout": true, online: true, visible: true };
+  if (!safeReasons[reason]) reason = "unknown";
+  console.warn("[clay] WebSocket diagnostic", {
+    reason: reason,
+    code: typeof code === "number" ? code : 0,
+    retry: lifecycle.getRetryAttempt(),
+    latencyMs: typeof latency === "number" ? Math.max(0, Math.min(latency, 600000)) : null
+  });
+}
+
+function clearProbe() {
+  if (probeTimer) clearTimeout(probeTimer);
+  probeTimer = null;
+  probeSocket = null;
+  probeEpoch = 0;
+  probeStartedAt = 0;
+}
+
+function forceReplaceSocket(reason, code, epoch) {
+  if (!lifecycle.current(epoch)) return;
+  var socket = getWs();
+  var latency = probeStartedAt ? Date.now() - probeStartedAt : null;
+  clearProbe();
+  stopHeartbeat();
+  if (socket) {
+    socket.onopen = null;
+    socket.onmessage = null;
+    socket.onerror = null;
+    socket.onclose = null;
+    try { socket.close(); } catch (e) {}
+  }
+  setWs(null);
+  recordConnectionDiagnostic(reason, code, latency);
+  setStatus("disconnected");
+  lifecycle.invalidate(epoch);
+  scheduleReconnect(reason);
+}
+
 export function stopHeartbeat() {
   if (heartbeatTimer) {
     clearInterval(heartbeatTimer);
@@ -73,6 +125,23 @@ export function stopHeartbeat() {
     clearTimeout(heartbeatDeadlineTimer);
     heartbeatDeadlineTimer = null;
   }
+  heartbeatAwaitingSocket = null;
+}
+
+function suspendSocketForOffline() {
+  clearProbe();
+  stopHeartbeat();
+  var socket = getWs();
+  attemptSocket = null;
+  if (socket) {
+    socket.onopen = null;
+    socket.onmessage = null;
+    socket.onerror = null;
+    socket.onclose = null;
+    try { socket.close(); } catch (e) {}
+  }
+  setWs(null);
+  if (socket || store.get('connected')) setStatus("disconnected");
 }
 
 // Started once per live socket. The socket it was started for is captured, so
@@ -80,28 +149,54 @@ export function stopHeartbeat() {
 // connection. The pong the server sends back keeps a proxy's upstream read
 // timeout from expiring. A missing pong also identifies a half-open socket,
 // which browsers can otherwise leave OPEN while silently losing sends.
-export function startHeartbeat(socket) {
+export function startHeartbeat(socket, attemptEpoch) {
   stopHeartbeat();
   if (!socket) return;
   heartbeatTimer = setInterval(function () {
-    if (!socket || socket.readyState !== 1 || getWs() !== socket) {
+    if (!socket || socket.readyState !== 1 || getWs() !== socket || !lifecycle.current(attemptEpoch)) {
       stopHeartbeat();
       return;
     }
-    try { socket.send(JSON.stringify({ type: "ping" })); } catch (e) {}
+    try { socket.send(JSON.stringify({ type: "ping" })); } catch (e) {
+      forceReplaceSocket("heartbeat_error", 0, attemptEpoch);
+      return;
+    }
+    heartbeatAwaitingSocket = socket;
     if (heartbeatDeadlineTimer) clearTimeout(heartbeatDeadlineTimer);
     heartbeatDeadlineTimer = setTimeout(function () {
       heartbeatDeadlineTimer = null;
-      if (getWs() === socket && socket.readyState === 1) connect();
+      if (getWs() === socket && socket.readyState === 1 && lifecycle.current(attemptEpoch)) {
+        forceReplaceSocket("heartbeat_timeout", 0, attemptEpoch);
+      }
     }, 10000);
   }, HEARTBEAT_MS);
 }
 
 export function initConnection() {
   connectOverlay = document.getElementById("connect-overlay");
+  if (typeof navigator !== "undefined" && navigator.onLine === false) lifecycle.setOffline(true);
   window.addEventListener("clay-message-delivery-timeout", function (event) {
     var socket = event.detail && event.detail.socket;
-    if (!socket || getWs() === socket) connect();
+    recordConnectionDiagnostic("ack-timeout", 0, null);
+    if (!socket || getWs() === socket) probeReconnect("ack-timeout");
+  });
+  window.addEventListener("offline", function () {
+    lifecycle.setOffline(true);
+    suspendSocketForOffline();
+  });
+  window.addEventListener("online", function () {
+    lifecycle.wake(function () {
+      var socket = getWs();
+      if (socket && socket.readyState === 1) startHeartbeat(socket, lifecycle.getEpoch());
+      probeReconnect("online");
+    });
+  });
+  document.addEventListener("visibilitychange", function () {
+    if (!document.hidden) {
+      var socket = getWs();
+      if (socket && socket.readyState === 1) startHeartbeat(socket, lifecycle.getEpoch());
+      probeReconnect("visible");
+    }
   });
 
   // --- Reactive UI sync for connected/processing state ---
@@ -224,6 +319,9 @@ function onConnected() {
 }
 
 export function connect() {
+  if (lifecycle.isOffline()) return;
+  var attemptEpoch = lifecycle.beginAttempt();
+  attemptStartedAt = Date.now();
   var ws = getWs();
   // Tear down the previous socket's heartbeat before a new socket exists, so
   // two sockets can never both be pinging.
@@ -236,37 +334,24 @@ export function connect() {
     ws.onclose = null;
     ws.close();
   }
-  if (connectTimeoutId) { clearTimeout(connectTimeoutId); connectTimeoutId = null; }
-
   var protocol = location.protocol === "https:" ? "wss:" : "ws:";
   var socketPath = store.get('wsPath');
   if (store.get('socketPath') && store.get('socketPath') !== socketPath) clearProjectSplitState();
   store.set({ socketPath: socketPath, activeProjectSlug: null, sessionActivatedProjectSlug: null, sessionListProjectSlug: null, splitGroupsProjectSlug: null });
   var newWs = new WebSocket(protocol + "//" + location.host + socketPath);
   setWs(newWs);
-
-  // If not connected within 3s, force retry
-  connectTimeoutId = setTimeout(function () {
-    if (getWs() !== newWs) return;
-    if (!store.get('connected')) {
-      newWs.onclose = null;
-      newWs.onerror = null;
-      newWs.close();
-      connect();
-    }
-  }, 3000);
+  attemptSocket = newWs;
 
   newWs.onopen = function () {
-    if (getWs() !== newWs) return;
-    if (connectTimeoutId) { clearTimeout(connectTimeoutId); connectTimeoutId = null; }
+    if (getWs() !== newWs || !lifecycle.current(attemptEpoch)) return;
+    if (!lifecycle.markOpen(attemptEpoch)) return;
     if (hasConnectedOnce && disconnectedAt) {
       console.log("[clay] WebSocket reconnected after " + (Date.now() - disconnectedAt) + "ms");
     }
     disconnectedAt = 0;
     setStatus("connected");
-    startHeartbeat(newWs);
-    reconnectDelay = 1000;
-    if (reconnectTimer) { clearTimeout(reconnectTimer); reconnectTimer = null; }
+    startHeartbeat(newWs, attemptEpoch);
+    lifecycle.clearRetry();
 
     // A pane pin is one-shot per WebSocket, not per page lifetime. The server
     // intentionally does not restore pane presence after a daemon restart.
@@ -292,64 +377,97 @@ export function connect() {
   };
 
   newWs.onclose = function (e) {
-    if (getWs() !== newWs) return;
-    if (connectTimeoutId) { clearTimeout(connectTimeoutId); connectTimeoutId = null; }
+    if (getWs() !== newWs || !lifecycle.current(attemptEpoch)) return;
     stopHeartbeat();
+    clearProbe();
     disconnectedAt = Date.now();
-    // Abnormal closes are the ones worth reporting: a clean close is either a
-    // deliberate navigation or a server shutdown the user already knows about.
-    if (e && !e.wasClean) {
-      console.warn("[clay] WebSocket closed abnormally: code=" + e.code +
-        " reason=" + (e.reason || "(none)") + " wasClean=false");
-    }
+    recordConnectionDiagnostic("close", e && e.code, attemptStartedAt ? Date.now() - attemptStartedAt : null);
     closeDmUserPicker();
     store.set({ activeProjectSlug: null, sessionActivatedProjectSlug: null });
     setStatus("disconnected");
     setActivity(null);
-    scheduleReconnect();
+    lifecycle.invalidate(attemptEpoch);
+    scheduleReconnect("close");
   };
 
-  newWs.onerror = function () {};
+  newWs.onerror = function () {
+    if (getWs() !== newWs || !lifecycle.current(attemptEpoch)) return;
+    recordConnectionDiagnostic("error", 0, null);
+    forceReplaceSocket("error", 0, attemptEpoch);
+  };
 
   newWs.onmessage = function (event) {
-    if (getWs() !== newWs) return;
+    if (getWs() !== newWs || !lifecycle.current(attemptEpoch)) return;
     // Backup: if we're receiving messages, we're connected
     if (!store.get('connected')) {
       setStatus("connected");
-      reconnectDelay = 1000;
-      if (reconnectTimer) { clearTimeout(reconnectTimer); reconnectTimer = null; }
+      lifecycle.clearRetry();
     }
 
     blinkIO();
     var msg;
     try { msg = JSON.parse(event.data); } catch (e) { return; }
-    if (msg.type === "pong" && heartbeatDeadlineTimer) {
+    lifecycle.markLive(attemptEpoch);
+    if (msg.type === "pong" && heartbeatDeadlineTimer && heartbeatAwaitingSocket === newWs) {
       clearTimeout(heartbeatDeadlineTimer);
       heartbeatDeadlineTimer = null;
+      heartbeatAwaitingSocket = null;
     }
+    if (msg.type === "pong" && probeSocket === newWs && lifecycle.current(probeEpoch)) clearProbe();
     processMessage(msg);
   };
 }
 
 export function cancelReconnect() {
-  if (reconnectTimer) { clearTimeout(reconnectTimer); reconnectTimer = null; }
+  clearProbe();
+  stopHeartbeat();
+  lifecycle.cancel();
 }
 
-export function scheduleReconnect() {
-  if (reconnectTimer) return;
-  reconnectTimer = setTimeout(function () {
-    reconnectTimer = null;
-    // Check if auth is still valid before reconnecting
-    fetch("/info").then(function (res) {
+function probeReconnect(reason) {
+  if (lifecycle.isOffline() || !lifecycle.current(lifecycle.getEpoch())) return;
+  var socket = getWs();
+  if (socket && socket.readyState === 0) return;
+  if (socket && socket.readyState === 1) {
+    if (probeTimer) return;
+    probeSocket = socket;
+    probeEpoch = lifecycle.getEpoch();
+    probeStartedAt = Date.now();
+    try { socket.send(JSON.stringify({ type: "ping" })); } catch (e) {
+      forceReplaceSocket("probe_error", 0, probeEpoch);
+      return;
+    }
+    probeTimer = setTimeout(function () {
+      probeTimer = null;
+      if (probeSocket === socket && lifecycle.current(probeEpoch) && getWs() === socket && socket.readyState === 1) forceReplaceSocket("probe_timeout", 0, probeEpoch);
+    }, 4000);
+    return;
+  }
+  scheduleReconnect(reason);
+}
+
+export function scheduleReconnect(reason) {
+  lifecycle.schedule(reason || "unknown", function (epoch) {
+    var authEpoch = epoch;
+    var controller = typeof AbortController === "function" ? new AbortController() : null;
+    var authToken = lifecycle.beginAuth(authEpoch, function () {
+      if (controller) controller.abort();
+      scheduleReconnect("auth_timeout");
+    }, function () {
+      if (controller) controller.abort();
+    });
+    if (!authToken) return;
+    fetch("/info", controller ? { signal: controller.signal } : undefined).then(function (res) {
+      if (!lifecycle.finishAuth(authEpoch, authToken)) return;
+      if (!lifecycle.canProceed(authEpoch)) return;
       if (res.status === 401) {
         location.reload();
         return;
       }
       connect();
     }).catch(function () {
-      // Server still down, try connecting anyway
-      connect();
+      var authFinished = lifecycle.finishAuth(authEpoch, authToken);
+      if (authFinished && lifecycle.canProceed(authEpoch)) connect();
     });
-  }, reconnectDelay);
-  reconnectDelay = Math.min(reconnectDelay * 1.5, 10000);
+  });
 }

package/lib/public/modules/app-messages.js

@@ -4,7 +4,8 @@ import { handleIssuesMessageInContext as handleIssuesMessage } from './issues-co
 // All dependencies are direct imports; no context injection needed.
 
 import { store } from './store.js';
-import { acknowledgeMessage, replayPendingMessages } from './message-delivery.js';
+import { acknowledgeMessage, activateDeliverySession, refreshDeliverySessionIdentity } from './message-delivery.js';
+import { initMessageDeliveryUi } from './message-delivery-ui.js';
 import { getWs } from './ws-ref.js';
 
 // --- Leaf module imports ---
@@ -98,6 +99,7 @@ var messagesEl = document.getElementById("messages");
 var headerTitleEl = document.getElementById("header-title");
 var inputEl = document.getElementById("input");
 var connectOverlay = document.getElementById("connect-overlay");
+initMessageDeliveryUi();
 
 export function processMessage(msg) {
   if (handleIssuesMessage(msg)) return;
@@ -839,10 +841,9 @@ export function processMessage(msg) {
         var _effectiveTerminalId = (typeof msg.runtimeTerminalId === "number")
           ? msg.runtimeTerminalId
           : (typeof msg.terminalId === "number" ? msg.terminalId : null);
-        store.set({ activeSessionId: msg.id, cliSessionId: msg.cliSessionId || null, currentModel: msg.model || "", currentEffort: msg.effort || store.get('currentEffort'), vendorCapabilities: msg.capabilities || {}, sessionIsProcessing: !!msg.isProcessing, activeSessionMode: _effectiveMode, activeTerminalId: _effectiveTerminalId, sessionHasHistory: !!msg.hasHistory, sessionVendorBound: !!msg.vendor || !!msg.hasHistory, sessionFullAccess: msg.permissionMode === "bypassPermissions", currentMode: msg.permissionMode || store.get('currentMode'), effectivePermissionMode: msg.effectivePermissionMode || null, permissionCapabilities: msg.permissionCapabilities || { auto: false, mcpOverride: false }, mcpPermissionModeOverrides: msg.mcpPermissionModeOverrides || {} });
         handleScheduledTaskSessionSwitched(msg);
         requestLoopInterviewState();
-        replayPendingMessages(msg.id);
+        activateDeliverySession(msg.id, msg.cliSessionId || null, msg.sessionOriginId || null);
         // TUI sessions swap the chat UI for an embedded xterm running
         // `claude` inside a real PTY. Mount or tear down before the rest of
         // the chat-side bookkeeping runs so we don't waste work on hidden DOM.
@@ -936,6 +937,7 @@ export function processMessage(msg) {
 
       case "session_id":
         store.set({ cliSessionId: msg.cliSessionId });
+        refreshDeliverySessionIdentity(msg.cliSessionId, store.get('sessionOriginId') || null);
         break;
 
       case "message_uuid":

package/lib/public/modules/message-delivery-ui.js

@@ -0,0 +1,63 @@
+// message-delivery-ui.js - receipt recovery notices
+
+import { store } from './store.js';
+import { retryPendingMessage } from './message-delivery.js';
+
+var initialized = false;
+var rendered = {};
+var unsubscribe = null;
+
+function currentContext(receipt) {
+  var currentOriginId = store.get('sessionOriginId') || null;
+  return receipt && receipt.projectSlug === store.get('currentSlug') && String(receipt.sessionId) === String(store.get('activeSessionId')) && receipt.accountId === (store.get('myUserId') || "_default") && (!receipt.sessionOriginId || !currentOriginId || receipt.sessionOriginId === currentOriginId);
+}
+
+function renderReceipt(receipt) {
+  var messages = document.getElementById("messages");
+  if (!messages || !currentContext(receipt) || rendered[receipt.clientMessageId]) return;
+  var notice = document.createElement("div");
+  notice.className = "sys-msg error";
+  notice.dataset.deliveryReceipt = receipt.clientMessageId;
+  var text = document.createElement("span");
+  text.className = "sys-text";
+  text.textContent = "Receipt unconfirmed. Retry this message.";
+  notice.appendChild(text);
+  var retry = document.createElement("button");
+  retry.type = "button";
+  retry.className = "sys-retry";
+  retry.textContent = "Retry";
+  retry.addEventListener("click", function () { retryPendingMessage(receipt.clientMessageId); });
+  notice.appendChild(retry);
+  messages.appendChild(notice);
+  rendered[receipt.clientMessageId] = notice;
+}
+
+function sync(state) {
+  var receipts = state.deliveryReceipts || {};
+  Object.keys(rendered).forEach(function (id) {
+    if (!rendered[id].parentNode || !receipts[id] || !currentContext(receipts[id])) {
+      if (rendered[id] && rendered[id].parentNode) rendered[id].parentNode.removeChild(rendered[id]);
+      delete rendered[id];
+    }
+  });
+  Object.keys(receipts).forEach(function (id) { renderReceipt(receipts[id]); });
+}
+
+export function initMessageDeliveryUi() {
+  if (initialized) return;
+  initialized = true;
+  unsubscribe = store.subscribe(function (state, previous) {
+    if (state.deliveryReceipts !== previous.deliveryReceipts || state.currentSlug !== previous.currentSlug || state.activeSessionId !== previous.activeSessionId || state.sessionOriginId !== previous.sessionOriginId || state.myUserId !== previous.myUserId || state.replayingHistory !== previous.replayingHistory) sync(state);
+  });
+  sync(store.snap());
+}
+
+export function disposeMessageDeliveryUi() {
+  Object.keys(rendered).forEach(function (id) {
+    if (rendered[id] && rendered[id].parentNode) rendered[id].parentNode.removeChild(rendered[id]);
+  });
+  rendered = {};
+  if (unsubscribe) unsubscribe();
+  unsubscribe = null;
+  initialized = false;
+}

package/lib/public/modules/message-delivery.js

@@ -4,7 +4,10 @@ import { store } from './store.js';
 import { getWs } from './ws-ref.js';
 
 var ACK_TIMEOUT_MS = 5000;
+var ACK_RETRY_LIMIT = 3;
 var ackTimers = {};
+var socketRefs = {};
+var activatedContext = null;
 
 function createClientMessageId() {
   if (window.crypto && typeof window.crypto.randomUUID === "function") {
@@ -21,6 +24,39 @@ function replacePending(messages) {
   store.set({ pendingOutboundMessages: messages });
 }
 
+function receipts() {
+  return store.get('deliveryReceipts') || {};
+}
+
+function setReceipt(entry) {
+  var next = Object.assign({}, receipts());
+  next[entry.payload.clientMessageId] = {
+    clientMessageId: entry.payload.clientMessageId,
+    projectSlug: entry.projectSlug,
+    sessionId: entry.sessionId,
+    accountId: entry.accountId,
+    sessionOriginId: entry.sessionOriginId || null,
+    attempts: entry.attempts
+  };
+  store.set({ deliveryReceipts: next });
+}
+
+function clearReceipt(clientMessageId) {
+  var current = receipts();
+  if (!current[clientMessageId]) return;
+  var next = Object.assign({}, current);
+  delete next[clientMessageId];
+  store.set({ deliveryReceipts: next });
+}
+
+function markUnconfirmed(entry) {
+  var unconfirmed = Object.assign({}, entry, { status: "unconfirmed" });
+  replacePending(pendingMessages().map(function (candidate) {
+    return candidate.payload.clientMessageId === entry.payload.clientMessageId ? unconfirmed : candidate;
+  }));
+  setReceipt(unconfirmed);
+}
+
 function clearAckTimer(clientMessageId) {
   if (!ackTimers[clientMessageId]) return;
   clearTimeout(ackTimers[clientMessageId]);
@@ -35,25 +71,92 @@ function isPending(clientMessageId) {
   return false;
 }
 
+function pendingEntry(clientMessageId) {
+  var pending = pendingMessages();
+  for (var i = 0; i < pending.length; i++) {
+    if (pending[i].payload.clientMessageId === clientMessageId) return pending[i];
+  }
+  return null;
+}
+
+function matchesCurrentContext(entry) {
+  return entry && entry.projectSlug === store.get('currentSlug') && String(entry.sessionId) === String(store.get('activeSessionId')) && entry.accountId === (store.get('myUserId') || "_default");
+}
+
+function hasAutomaticReplayIdentity(entry, socket) {
+  if (!activatedContext || activatedContext.socket !== socket) return false;
+  if (entry.sessionOriginId && activatedContext.sessionOriginId && entry.sessionOriginId !== activatedContext.sessionOriginId) return false;
+  if (entry.sessionOriginId && activatedContext.sessionOriginId && entry.sessionOriginId === activatedContext.sessionOriginId) return true;
+  if (entry.cliSessionId && activatedContext.cliSessionId) return entry.cliSessionId === activatedContext.cliSessionId;
+  return socketRefs[entry.payload.clientMessageId] === socket;
+}
+
+function hasKnownCliMismatch(entry) {
+  if (entry.sessionOriginId && activatedContext && activatedContext.sessionOriginId && entry.sessionOriginId === activatedContext.sessionOriginId) return false;
+  return !!entry.cliSessionId && !!activatedContext && !!activatedContext.cliSessionId && entry.cliSessionId !== activatedContext.cliSessionId;
+}
+
+function matchesActivatedContext(entry) {
+  var currentCliSessionId = store.get('cliSessionId') || null;
+  var sameOrigin = !!(entry.sessionOriginId && activatedContext && activatedContext.sessionOriginId && entry.sessionOriginId === activatedContext.sessionOriginId);
+  return !!activatedContext && activatedContext.socket === getWs() && matchesCurrentContext(entry) &&
+    activatedContext.projectSlug === store.get('currentSlug') && String(activatedContext.sessionId) === String(store.get('activeSessionId')) &&
+    activatedContext.accountId === (store.get('myUserId') || "_default") && (activatedContext.sessionOriginId || activatedContext.cliSessionId === currentCliSessionId) &&
+    (!entry.sessionOriginId || !activatedContext.sessionOriginId || entry.sessionOriginId === activatedContext.sessionOriginId) &&
+    (sameOrigin || !entry.cliSessionId || !activatedContext.cliSessionId || entry.cliSessionId === activatedContext.cliSessionId);
+}
+
 function armAckTimer(clientMessageId, socket) {
   clearAckTimer(clientMessageId);
   ackTimers[clientMessageId] = setTimeout(function () {
     delete ackTimers[clientMessageId];
     if (!isPending(clientMessageId) || getWs() !== socket) return;
+    var entry = pendingEntry(clientMessageId);
+    if (!matchesActivatedContext(entry)) return;
     window.dispatchEvent(new CustomEvent("clay-message-delivery-timeout", {
       detail: { socket: socket, clientMessageId: clientMessageId },
     }));
+    var attempts = entry.attempts || 0;
+    if (attempts < ACK_RETRY_LIMIT && entry && socket.readyState === 1) {
+      var nextEntry = Object.assign({}, entry, { attempts: attempts + 1 });
+      replacePending(pendingMessages().map(function (candidate) {
+        return candidate.payload.clientMessageId === clientMessageId ? nextEntry : candidate;
+      }));
+      transmit(nextEntry, false);
+      return;
+    }
+    if (attempts >= ACK_RETRY_LIMIT) {
+      markUnconfirmed(entry);
+      return;
+    }
   }, ACK_TIMEOUT_MS);
 }
 
-function transmit(entry) {
+function transmit(entry, automatic) {
   var socket = getWs();
-  if (!socket || socket.readyState !== 1) return false;
+  if (!matchesCurrentContext(entry) || !socket || socket.readyState !== 1) return false;
+  if (automatic && entry.status === "unconfirmed") return false;
+  if (automatic && !hasAutomaticReplayIdentity(entry, socket)) {
+    markUnconfirmed(entry);
+    return false;
+  }
+  if (automatic) {
+    if ((entry.attempts || 0) >= ACK_RETRY_LIMIT) {
+      markUnconfirmed(entry);
+      return false;
+    }
+    entry = Object.assign({}, entry, { attempts: (entry.attempts || 0) + 1 });
+    replacePending(pendingMessages().map(function (candidate) {
+      return candidate.payload.clientMessageId === entry.payload.clientMessageId ? entry : candidate;
+    }));
+  }
+  socketRefs[entry.payload.clientMessageId] = socket;
   try {
     socket.send(JSON.stringify(entry.payload));
     armAckTimer(entry.payload.clientMessageId, socket);
     return true;
   } catch (e) {
+    markUnconfirmed(entry);
     return false;
   }
 }
@@ -63,10 +166,22 @@ export function sendAcknowledgedMessage(payload) {
   var entry = {
     projectSlug: store.get('currentSlug'),
     sessionId: store.get('activeSessionId'),
+    accountId: store.get('myUserId') || "_default",
+    cliSessionId: store.get('cliSessionId') || null,
+    sessionOriginId: store.get('sessionOriginId') || null,
+    attempts: 0,
+    status: "pending",
     payload: nextPayload,
   };
+  nextPayload.projectSlug = entry.projectSlug;
+  nextPayload.sessionId = entry.sessionId;
+  nextPayload.accountId = entry.accountId;
+  nextPayload.cliSessionId = entry.cliSessionId;
+  nextPayload.sessionOriginId = entry.sessionOriginId;
+  entry.payload = nextPayload;
   replacePending(pendingMessages().concat([entry]));
-  if (!transmit(entry)) {
+  if (!transmit(entry, false)) {
+    if (!getWs() || getWs().readyState !== 1) markUnconfirmed(entry);
     window.dispatchEvent(new CustomEvent("clay-message-delivery-timeout", {
       detail: { socket: getWs(), clientMessageId: nextPayload.clientMessageId },
     }));
@@ -74,6 +189,21 @@ export function sendAcknowledgedMessage(payload) {
   return nextPayload.clientMessageId;
 }
 
+export function retryPendingMessage(clientMessageId) {
+  var entry = pendingEntry(clientMessageId);
+  if (!matchesActivatedContext(entry) || hasKnownCliMismatch(entry)) return false;
+  var retryEntry = Object.assign({}, entry, { attempts: 0, status: "pending" });
+  replacePending(pendingMessages().map(function (candidate) {
+    return candidate.payload.clientMessageId === clientMessageId ? retryEntry : candidate;
+  }));
+  if (transmit(retryEntry, false)) {
+    clearReceipt(clientMessageId);
+    return true;
+  }
+  markUnconfirmed(retryEntry);
+  return false;
+}
+
 export function acknowledgeMessage(clientMessageId) {
   if (typeof clientMessageId !== "string") return null;
   var pending = pendingMessages();
@@ -82,9 +212,14 @@ export function acknowledgeMessage(clientMessageId) {
     if (entry.payload.clientMessageId === clientMessageId) acknowledged = entry;
     return entry.payload.clientMessageId !== clientMessageId;
   });
-  if (next.length === pending.length) return null;
+  if (next.length === pending.length) {
+    clearReceipt(clientMessageId);
+    return null;
+  }
   clearAckTimer(clientMessageId);
   replacePending(next);
+  delete socketRefs[clientMessageId];
+  clearReceipt(clientMessageId);
   return acknowledged;
 }
 
@@ -92,8 +227,30 @@ export function replayPendingMessages(sessionId) {
   var pending = pendingMessages();
   var projectSlug = store.get('currentSlug');
   for (var i = 0; i < pending.length; i++) {
-    if (pending[i].projectSlug === projectSlug && pending[i].sessionId === sessionId) {
-      transmit(pending[i]);
+    if (pending[i].projectSlug === projectSlug && String(pending[i].sessionId) === String(sessionId) && matchesCurrentContext(pending[i])) {
+      transmit(pending[i], true);
     }
   }
 }
+
+export function activateDeliverySession(sessionId, cliSessionId, sessionOriginId) {
+  var socket = getWs();
+  activatedContext = {
+    socket: socket,
+    projectSlug: store.get('currentSlug'),
+    sessionId: sessionId,
+    accountId: store.get('myUserId') || "_default",
+    cliSessionId: cliSessionId || null,
+    sessionOriginId: sessionOriginId || null
+  };
+  replayPendingMessages(sessionId);
+}
+
+export function refreshDeliverySessionIdentity(cliSessionId, sessionOriginId) {
+  if (!activatedContext || activatedContext.socket !== getWs()) return false;
+  if (activatedContext.projectSlug !== store.get('currentSlug') || String(activatedContext.sessionId) !== String(store.get('activeSessionId')) || activatedContext.accountId !== (store.get('myUserId') || "_default")) return false;
+  if (activatedContext.sessionOriginId && sessionOriginId && activatedContext.sessionOriginId !== sessionOriginId) return false;
+  activatedContext.cliSessionId = cliSessionId || null;
+  if (!activatedContext.sessionOriginId && sessionOriginId) activatedContext.sessionOriginId = sessionOriginId;
+  return true;
+}

package/lib/public/modules/websocket-lifecycle.js

@@ -0,0 +1,178 @@
+// websocket-lifecycle.js - bounded connection attempt and retry policy
+
+var DEFAULTS = {
+  handshakeTimeoutMs: 12000,
+  stableConnectionMs: 15000,
+  retryMinMs: 1000,
+  retryMaxMs: 15000,
+  jitterRatio: 0.2,
+  authTimeoutMs: 4000
+};
+
+function createWebSocketLifecycle(options) {
+  var config = Object.assign({}, DEFAULTS, options || {});
+  var epoch = 0;
+  var retryAttempt = 0;
+  var retryTimer = null;
+  var handshakeTimer = null;
+  var stableTimer = null;
+  var authTimer = null;
+  var authInFlight = false;
+  var authCancel = null;
+  var authGeneration = 0;
+  var stableEpoch = 0;
+  var cancelled = false;
+  var offline = false;
+
+  function clearTimer(timer) {
+    if (timer) clearTimeout(timer);
+    return null;
+  }
+
+  function clearTimers() {
+    retryTimer = clearTimer(retryTimer);
+    handshakeTimer = clearTimer(handshakeTimer);
+    stableTimer = clearTimer(stableTimer);
+    authTimer = clearTimer(authTimer);
+    stableEpoch = 0;
+    if (authCancel) authCancel();
+    authCancel = null;
+    authInFlight = false;
+  }
+
+  function current(value) {
+    return value === epoch && !cancelled;
+  }
+
+  function canProceed(value) {
+    return current(value) && !offline;
+  }
+
+  function beginAttempt() {
+    clearTimers();
+    cancelled = false;
+    epoch += 1;
+    var attemptEpoch = epoch;
+    handshakeTimer = setTimeout(function () {
+      handshakeTimer = null;
+      if (current(attemptEpoch) && config.onHandshakeTimeout) config.onHandshakeTimeout(attemptEpoch);
+    }, config.handshakeTimeoutMs);
+    return attemptEpoch;
+  }
+
+  function delayForAttempt() {
+    var base = Math.min(config.retryMaxMs, config.retryMinMs * Math.pow(1.5, retryAttempt));
+    retryAttempt += 1;
+    var jitter = base * config.jitterRatio;
+    var random = config.random || Math.random;
+    return Math.min(config.retryMaxMs, Math.max(0, Math.round(base - jitter + random() * jitter * 2)));
+  }
+
+  function schedule(reason, callback) {
+    if (cancelled || offline || retryTimer) return null;
+    var scheduledEpoch = epoch;
+    var delay = delayForAttempt();
+    retryTimer = setTimeout(function () {
+      retryTimer = null;
+      if (!canProceed(scheduledEpoch)) return;
+      callback(scheduledEpoch, reason, delay);
+    }, delay);
+    return { epoch: scheduledEpoch, delay: delay };
+  }
+
+  function clearRetry() {
+    retryTimer = clearTimer(retryTimer);
+  }
+
+  function beginAuth(authEpoch, onTimeout, onCancel) {
+    if (!canProceed(authEpoch) || authInFlight) return null;
+    authInFlight = true;
+    authGeneration += 1;
+    var authToken = { epoch: authEpoch, generation: authGeneration };
+    authCancel = onCancel || null;
+    authTimer = setTimeout(function () {
+      authTimer = null;
+      authInFlight = false;
+      authCancel = null;
+      if (canProceed(authEpoch) && onTimeout) onTimeout(authEpoch);
+    }, config.authTimeoutMs);
+    return authToken;
+  }
+
+  function finishAuth(authEpoch, authToken) {
+    if (!authInFlight || !current(authEpoch) || !authToken || authToken.epoch !== authEpoch || authToken.generation !== authGeneration) return false;
+    authInFlight = false;
+    authCancel = null;
+    authTimer = clearTimer(authTimer);
+    return true;
+  }
+
+  function markOpen(attemptEpoch) {
+    if (!current(attemptEpoch)) return false;
+    handshakeTimer = clearTimer(handshakeTimer);
+    return true;
+  }
+
+  function markLive(attemptEpoch) {
+    if (!current(attemptEpoch)) return false;
+    handshakeTimer = clearTimer(handshakeTimer);
+    if (stableEpoch === attemptEpoch) return true;
+    stableEpoch = attemptEpoch;
+    stableTimer = clearTimer(stableTimer);
+    stableTimer = setTimeout(function () {
+      stableTimer = null;
+      if (current(attemptEpoch)) retryAttempt = 0;
+    }, config.stableConnectionMs);
+    return true;
+  }
+
+  function invalidate(attemptEpoch) {
+    if (attemptEpoch !== epoch) return false;
+    epoch += 1;
+    clearTimers();
+    return true;
+  }
+
+  function cancel() {
+    cancelled = true;
+    epoch += 1;
+    clearTimers();
+  }
+
+  function setOffline(value) {
+    var nextOffline = value === true;
+    if (nextOffline === offline) return offline;
+    offline = nextOffline;
+    if (offline) {
+      epoch += 1;
+      clearTimers();
+    }
+    return offline;
+  }
+
+  function wake(callback) {
+    offline = false;
+    if (!cancelled && callback) callback();
+  }
+
+  return {
+    beginAttempt: beginAttempt,
+    beginAuth: beginAuth,
+    cancel: cancel,
+    canProceed: canProceed,
+    clearRetry: clearRetry,
+    current: current,
+    finishAuth: finishAuth,
+    invalidate: invalidate,
+    markOpen: markOpen,
+    markLive: markLive,
+    schedule: schedule,
+    setOffline: setOffline,
+    wake: wake,
+    getRetryAttempt: function () { return retryAttempt; },
+    getEpoch: function () { return epoch; },
+    isOffline: function () { return offline; }
+  };
+}
+
+export { createWebSocketLifecycle };

package/lib/sessions.js

@@ -846,7 +846,7 @@ function createSessionManager(opts) {
     var _sessionVendor = session.vendor || defaultVendor || "claude";
     var _vendorCaps = _capsByVendor[_sessionVendor] || {};
     var _permissionState = require("./session-permission-mode").clientState(session, "default", defaultVendor);
-    _send({ type: "session_switched", id: localId, cliSessionId: session.cliSessionId || null, loop: session.loop || null, vendor: session.vendor || null, model: session.model || null, effort: session.effort || null, hasHistory: (session.history && session.history.length > 0), capabilities: _vendorCaps, isProcessing: !!session.isProcessing, mode: session.mode || "gui", terminalId: typeof session.terminalId === "number" ? session.terminalId : null, runtimeMode: session.runtimeMode || null, runtimeTerminalId: typeof session.runtimeTerminalId === "number" ? session.runtimeTerminalId : null, tuiSuspended: !!session.tuiSuspended, dangerouslySkipPermissions: !!session.dangerouslySkipPermissions, permissionMode: _permissionState.requestedPermissionMode, effectivePermissionMode: _permissionState.effectivePermissionMode, permissionCapabilities: _permissionState.permissionCapabilities, mcpPermissionModeOverrides: _permissionState.mcpPermissionModeOverrides, autonomousRun: projectAutonomousRun(session.autonomousRun), loopInterviewBrief: session.loopInterviewBrief || null, loopInterviewHandoff: session.loopInterviewHandoff || null, scheduledTaskDraft: session.scheduledTaskDraft || null });
+    _send({ type: "session_switched", id: localId, sessionOriginId: session.sessionOriginId || null, cliSessionId: session.cliSessionId || null, loop: session.loop || null, vendor: session.vendor || null, model: session.model || null, effort: session.effort || null, hasHistory: (session.history && session.history.length > 0), capabilities: _vendorCaps, isProcessing: !!session.isProcessing, mode: session.mode || "gui", terminalId: typeof session.terminalId === "number" ? session.terminalId : null, runtimeMode: session.runtimeMode || null, runtimeTerminalId: typeof session.runtimeTerminalId === "number" ? session.runtimeTerminalId : null, tuiSuspended: !!session.tuiSuspended, dangerouslySkipPermissions: !!session.dangerouslySkipPermissions, permissionMode: _permissionState.requestedPermissionMode, effectivePermissionMode: _permissionState.effectivePermissionMode, permissionCapabilities: _permissionState.permissionCapabilities, mcpPermissionModeOverrides: _permissionState.mcpPermissionModeOverrides, autonomousRun: projectAutonomousRun(session.autonomousRun), loopInterviewBrief: session.loopInterviewBrief || null, loopInterviewHandoff: session.loopInterviewHandoff || null, scheduledTaskDraft: session.scheduledTaskDraft || null });
     // Send vendor-specific slash commands
     var _vendorCmds = (session.slashCommandsByVendor && session.slashCommandsByVendor[_sessionVendor])
       || session.slashCommands

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clay-server",
-  "version": "4.3.0-beta.1",
+  "version": "4.3.0-beta.2",
   "description": "Self-hosted team workspace for Claude Code and Codex. Multi-user, browser-based, with persistent AI mates.",
   "bin": {
     "clay-server": "./bin/cli.js"